Privacy Policy

What we collect

When you create an account: your email address. If you sign in with Apple (Sign in with Apple) or Google (Google Sign-In), we receive whatever your provider chooses to share — typically just your email, and (with your permission) your name. We do not receive your Apple ID password, Google credentials, or any other profile data.

When you use Maya: we collect the data you share with her, organized as follows:

• Body metrics — weigh-ins, goal, target weight, body-composition inputs
• Nutrition — meals, snacks, water, food photos you upload
• Activity — workouts, walks, steps, and (on iOS) Apple Health data you choose to sync
• Sleep & recovery — sleep duration, HRV, resting heart rate, VO₂ max (when you enable Apple Health)
• Conversations — text messages, voice recordings, and transcripts of your chats with Maya
• Preferences — cuisine, activity level, dietary constraints, and other settings you tell her

We do not collect location, contacts, or any data unrelated to your fitness journey.

How we store it

All user data is stored encrypted in Supabase (Postgres) with Row-Level Security enabled — meaning your data is only readable by your own authenticated session. Photos are stored in Supabase Storage, also encrypted, with EXIF metadata stripped before storage.

What we don't do

• We don't sell your data. Ever.
• We don't share data with advertisers — we have no advertising business model.
• We don't train AI models on your personal logs.
• We don't share data with third parties except: identity providers (Apple, Google — when you choose to sign in with them), Apple (via the App Store) for iOS billing and subscription management, AI infrastructure providers, for processing your conversations with Maya, and Supabase (our hosted database). Each of these processes only what is needed to deliver the specific function you asked for. If we add web-based billing (Stripe or PayPal) later, this list will be updated.

Your rights

• Export: request a full export of your data anytime — every log, every chat, every photo.
• Delete: delete your account anytime — all data goes with it, no zombie copies.
• Correct: edit or delete individual logs at any time via the Maya's Memory tab.
• Restrict: opt out of specific data uses (e.g., disable photo retention) in settings.

Photo handling

Food photos you upload are stored encrypted, retained 90 days by default (extendable in settings to “keep forever” or shortened to “delete after processing”). EXIF metadata is stripped before storage — no GPS coordinates or device fingerprints retained.

Cookies and analytics

We use essential cookies for authentication. We do not use third-party advertising cookies. We may use privacy-respecting analytics (e.g., Plausible) to understand aggregate usage — never personally identifiable.

Contact & data controller

The data controller for FitnessLoop is Rasne Solutions LLP, based in Noida, India.

Privacy questions, data requests, or grievances? Email hi@fitnessloop.app. We respond within 48 hours.