Last updated: February 2026

Your privacy matters. This policy explains what personal data we collect, why we collect it, and how you can control it.

1. Who we are

Fitness&me is a consumer fitness and wellness app. We help individuals track workouts, nutrition, body composition, and general wellness routines. We are not a medical device, diagnostic tool, or clinical service.

2. What data we collect

Account data: email, name, password hash, country.
Body & fitness data: weight, height, body measurements, photos you upload, workout history, steps, walking sessions.
Nutrition data: foods you log, meals, barcodes you scan, food photos, fridge scans.
Wellness data: supplement entries and reminder logs, AI-generated plans.
Payment data: handled entirely by Stripe; we only store subscription status and invoice metadata.
Technical data: IP address (truncated to /24 for rate limiting), device type, app version, crash logs.

3. How we use your data

To provide the tracking, analytics, and reminder features you use.
To generate AI plans, body-fat estimates, and food recognition through our AI providers (see §6).
To send you transactional emails (password reset, payment receipts, wellness reports you request).
To prevent abuse (rate limiting, bot detection via Cloudflare Turnstile).
To improve the app — aggregated, non-identifying analytics only.

We do not sell your data. We do not share it with advertisers.

4. How we protect your data

Encryption in transit: All traffic is encrypted with TLS 1.2+.
Encryption at rest: Sensitive free-text fields (e.g. supplement notes, AI plans) are encrypted with AES-256-GCM. Stored photos sit in access-controlled cloud storage.
Access controls: Your data is scoped by user ID; staff access is logged.
Breach notification: If a breach affects your data, we notify you without undue delay and within 72 hours where legally required (GDPR).

5. Your rights (GDPR & general privacy law)

You can exercise all of these at any time from the Personal tab in the app:

Access: Download a full ZIP export of your data.
Rectification: Edit any entry directly in the app.
Erasure: Delete your account and all associated data (type DELETE MY DATA to confirm).
Portability: The export is provided in open JSON format.
Withdraw consent: Stop using AI features any time via your settings.
Lodge a complaint: You may contact your local data protection authority.

6. Third parties (sub-processors)

We use a small number of trusted providers to run the app. We do not sell your data to any of them.

MongoDB Atlas — primary database hosting.
AWS S3 — secure photo storage.
Stripe — subscription payment processing.
Google (Gemini 3) — AI body-composition and food analysis. Only the image or prompt is sent; your identity is not.
Anthropic (Claude) — AI plan generation.
Resend — transactional email delivery.
Firebase Cloud Messaging — push notifications for reminders.
Cloudflare Turnstile — bot protection.

7. Data retention

We keep your data as long as your account is active. When you delete your account, we erase all your data from our primary systems immediately, and from backups within 90 days. Anonymous aggregate statistics (total users, feature usage counts) may be retained indefinitely.

8. Children

The app is not directed at children under 16. If we learn a child under 16 has created an account, we will delete it. Parents may contact us to request removal.

9. International transfers

Our servers operate in the EU and the US. If you are in the EU, your data may be transferred to providers in the US under Standard Contractual Clauses or equivalent safeguards.

10. Changes to this policy

We update this policy occasionally. Material changes will be announced in the app and by email where required. The "Last updated" date at the top will reflect the change.

11. Contact us

For privacy questions, data requests, or complaints, use the Contact option inside the Personal tab of the app, or email the address shown there.

This policy is provided in good faith and is written for consumer-facing clarity. It is not legal advice. If you sell or operate in a regulated market, consult counsel.