Privacy Policy

1Who we are and what this policy covers

Fitnouriva is an Android app for workouts, nutrition, and body measurements. An individual developer ("we", "us") publishes it. This policy tells you which data the app and its two small servers use. It also tells you why, where the data goes, how long we keep it, and which options you have.

One server verifies subscriptions. The other server operates the food database.

You can read this policy in the app, in Settings, and at https://fitnouriva.com/privacy.html.

This policy does not cover the apps and services of Google, for example Health Connect, Google Play, Google Drive, and Google sign-in. These have their own privacy policies. Those policies apply when you use them through Fitnouriva.

2Summary

• Your workouts, food diary, weigh-ins, and body profile stay on your phone. They never go to our servers.
• The app analyzes food photos for "Detect calories" on your phone. It never uploads them.
• The app reads Health Connect data on your phone to show it to you. It never sends this data to our servers.
• Our servers get only the data that some features must have: food searches, barcodes, shared labels, and subscription data.
• We do not sell your data. We do not show ads. We use no analytics services and no advertising services.
• In Settings, you can export or delete all data on your phone. You can delete your Drive backup separately.

3Data that you enter

You type or record all the data below. The app keeps it in a database on your phone and never sends it to our servers:

• Body profile: weight, height, age, and sex, if you enter them. The app uses a default weight until you enter your weight. The other fields can stay empty.
• Weigh-ins: one weight for each day, with its date and the time that you logged it.
• Workouts: exercises, sets, reps, weight lifted, cardio time and distance, workout names, and notes. Also the time of each set, which the app uses to show your rest times.
• Routines that you save, with their exercises and targets.
• Food diary: the foods that you log, the quantity, the meal, and the time.
• Foods and exercises that you make, your favorite foods, and foods that you save from a search, a barcode, or a label scan.
• Goals and settings: calorie and macro goals, units, and rest timer settings.

4Camera features

The camera is optional and must have your permission. It operates only while one of these screens is open. These features are not for photos of persons. They are for a barcode, a label, or a plate.

• Barcode scan: the app reads the barcode on your phone. The camera image stays on your phone. The app sends only the barcode digits to our food database to find the food (refer to Section 7).
• Label scan: the app reads the text of a nutrition label on your phone. The photo stays on your phone, unless you share the label (refer to Section 7).
• "Detect calories": an AI model in the app calculates an estimate of the calories, macros, portion size, and ingredients of a meal. The app analyzes the photo on your phone and never uploads it. The app discards the photo when you close the screen. Only the food and quantity that you confirm go into your diary.

Barcode and text reading use ML Kit from Google, which operates on your phone. The ML Kit terms say that ML Kit can connect to Google servers to get updates. ML Kit can also send Google data about its performance and use. ML Kit does not send your camera images.

5Health Connect

Health Connect is the shared Android store for health and fitness data. Health Connect is optional, and you select the permissions to give. With your permission, Fitnouriva can do these tasks:

• Read your steps, heart rate, total calories burned, active calories burned, and exercise sessions. The app shows them and uses them to calculate your calorie burn.
• Read food that other apps logged, and show it next to your diary. The app never adds this food to your totals.
• Write the foods that you log in Fitnouriva to Health Connect: name, meal, calories, protein, carbs, fat, fiber, sugar, and sodium. Other apps with your permission can then see them. When you delete the entry in Fitnouriva, the app also deletes it from Health Connect.

The app never sends Health Connect data to our servers. The app keeps a small cache on your phone, so that the home screen opens quickly. The cache holds the step count and calories burned for each day, for a maximum of approximately 13 months.

The cache does not hold heart rate or exercise sessions. Your Drive backup and your exported database do not include the cache. The app deletes the cache when you use "Delete data on this phone" or remove the app.

Health Connect access operates only while your subscription is active. Previous versions of Fitnouriva also wrote finished workouts to Health Connect. The current version does not. If you delete one of those workouts in Fitnouriva, its copy stays in Health Connect. To remove the copy, use "Data and access" in Health Connect.

6Your Google account and Drive backup

Sign-in

Google sign-in is optional. Before you sign in, you must agree to this policy. When you sign in, Google gives the app your account ID, email address, display name, and a link to your profile photo.

The app keeps these only on your phone, and the Android backup does not include them. The app gets your profile photo from the Google servers to show it. The app does not send your account data to our servers. The only exception is when you share a nutrition label (refer to Section 7).

Sign-in does not keep the data of different persons separate. All persons who use Fitnouriva on a phone can see all the Fitnouriva data on that phone. When you sign out, the data stays.

Drive backup

When you select "Back up now", the app copies its database to a private, hidden folder in your Google Drive. Only Fitnouriva can open this folder. The database holds your workouts, routines, food diary, custom foods and exercises, weigh-ins, body profile, goals, and settings.

The file goes directly from your phone to Google Drive. It never goes through our servers. Each backup replaces the previous backup. Your Google account protects the backup. There is no separate password.

The backup does not include Health Connect data, the cached daily totals in Section 5, your Google account data, or your subscription status.

When you restore a backup, the backup replaces all the data on your phone. When you sign out, the backup stays. To delete it, use "Delete Drive backup" in Settings.

7The food database, barcodes, and shared labels

For these features, you must agree to this policy and have an active subscription. Each request includes a record that our server signed when it verified your purchase.

From that record, our server reads a hashed identifier of your subscription. A hashed identifier is a scrambled value. For these features, our server never sees your purchase token.

• Food search: the app sends the text that you type to our server, in the body of the request, not in the web address. Our server keeps no search history.
• Search results come from USDA FoodData Central (public domain, CC0; https://fdc.nal.usda.gov/) and from foods that other users gave. The app saves the foods that you select on your phone for offline use.
• Barcode lookup: the app sends the barcode digits to our server in the web address. As a result, barcodes can show in the request logs of our server (refer to Section 10).
• Label sharing: this is optional and stays off until you set it to on each time. You must have a Google account to share a label.
• When you share, the app sends the label photo (made smaller first) and the name, barcode, serving size, and nutrition facts that you confirmed. It also sends the Android ID of your phone and a Google token that shows which account shares.

From that Google token, our server keeps your Google account ID and email address with the submission. Then the reviewer can see who sent it, and can block an account that sends abuse.

Google also puts your display name and a link to your profile photo in each token of this type. Our server verifies the token but does not keep these two items. A factory reset changes the Android ID. The Android ID is not your name, email, or advertising ID.

A person examines each shared label. If the person approves the label, the app publishes only the name, brand, barcode, serving, and nutrition facts of the food to the food database. All Fitnouriva users can see these.

At that time, we delete your photo, account data, and phone data. No published data identifies you. During the review, the reviewer's computer keeps the photo for a short time. The review tool deletes the photo when it closes.

8Subscriptions and purchases

Fitnouriva is a subscription: weekly, monthly, or annual, with a free trial for new subscribers. Google Play does all the billing. We never see your card number, billing address, or payment data.

• Purchase check: the app sends our server the purchase token from Google Play, the product ID, the app package name, and a random one-time value.
• Our server asks Google Play if the purchase is valid. Then it sends back a signed record of the status, plan, trial offer, end date, and auto-renewal setting. The app keeps this record on your phone.
• The subscription cannot operate without this check. As a result, the check occurs if you agree to the optional features in Section 7 or not.
• Refunds: Google Play tells our server when it refunds a subscription. Then our server keeps a hashed copy of the purchase token permanently.
• With this copy, a refunded purchase cannot open the app again. Our server never keeps the token itself.
• Trial reminder: three days before a free trial changes to a paid subscription, the app shows a reminder. The phone sets the reminder and sends no data.

9Other phone features

• Notifications (optional): trial reminders and the rest timer. The phone makes them. You can set each type to off in the Android settings.
• Screen lock: before you export or delete your data, the app asks you to confirm with your screen lock. Android does this check. Fitnouriva never gets your fingerprint, face, or PIN.
• Policy answer: the app keeps your answer to this policy, and the date of your answer, on your phone.

10Data that we collect automatically

To prevent abuse

• Our servers set a daily limit for the requests from each subscription. They use the hashed subscription identifier from Section 7.
• Our servers also set a limit for label submissions and purchase checks from each IP address. They keep the IP address in a daily counter.
• We keep a list of the hashed subscription identifiers and Google account IDs that we blocked for abuse of the food database, with the reason.

Server logs

Our hosting provider (Google Cloud) records data about each request to our servers. This data includes the IP address, the web address (which can include a barcode), the time, the response status, and the device or software type.

Our servers also log the hashed subscription identifier or Google account ID when they refuse or limit a request, or get a label. They never log email addresses, search text, purchase tokens, or Google tokens.

Google Cloud keeps request logs for 30 days, then deletes them automatically. Only we, and Google as our host, can get access to them. We make no other copies.

Google Cloud also keeps an audit log of changes to our cloud configuration, for example a new server version, for 400 days. This log records our own administrative tasks, not your requests.

Data that we do not collect

• No location. Fitnouriva asks for no GPS permission and no other location permission. (IP addresses are above.)
• No contacts, no microphone, no photos from your gallery, and no files outside the app.
• No motion sensor data. Steps come only from Health Connect, and only with your permission.
• No advertising ID. No advertising, analytics, or crash report services of any type.

11How we use data

• Body profile and weigh-ins: to calculate your calorie burn, set your targets, and show your weight trend.
• Workouts and routines: for your workout log, history, progress charts, and rest time charts.
• Food diary and goals: for your nutrition diary and daily targets.
• Health Connect data: to show your activity and heart rate, calculate your daily calorie burn, and show food from other apps.
• Food searches and barcodes: to find foods in the database.
• Shared labels: to examine them and add the food to the shared database.
• Google account data: to show who is signed in, for Drive backup, and to identify who shared a label so that we can block abuse.
• Purchase data: to verify your subscription and to stop refunded purchases.
• Hashed identifiers, IP addresses, Android IDs, and server logs: to keep the service available, prevent abuse, and repair problems.

We do not use this data for advertising. We make no profiles of you beyond the necessary data for these features. We make no automated decisions that have legal or similarly important effects on you.

Legal bases (EEA, UK, and Switzerland)

• Contract, to supply the app and your subscription: your workouts, diary, profile, and purchase checks.
• Your consent: Health Connect access, the optional features in Section 7, Google sign-in, and Drive backup.
• You can withdraw your consent at any time. This does not change the lawfulness of the processing before you withdrew it.
• Your explicit consent for health data, which you give when you enter it or connect Health Connect.
• Our legitimate interest to keep the service safe and prevent abuse: rate limits, block lists, and server logs.
• Legal obligations, when a law tells us to keep or disclose data.

12Where we keep your data

• On your phone: all data in Sections 3, 6, and 9. Also the Health Connect cache from Section 5, labels that wait to go to our server, and your signed subscription record.
• The Android app sandbox and the encryption of your phone protect this data. When you remove Fitnouriva, Android deletes all of it.
• In Health Connect: the data that you gave permission for. Android keeps and controls this data, not Fitnouriva.
• In your Google Drive: your backup, if you make one.
• On our servers (Google Cloud, United States): shared labels for review, the published food database, daily request counters, the block list, refund records, and server logs.
• Our servers never keep your workouts, food diary, weigh-ins, or body profile.

Automatic Android backup

Fitnouriva stops the automatic Android cloud backup and the phone-to-phone transfer for its database and settings. To move your data, use Drive backup or export your database.

Previous versions of the app possibly left copies in your Android backup. You can remove these copies in the Android settings.

13Who gets your data

We do not sell your data. We do not share it with advertisers or data brokers. We share data only in these conditions:

• Google, for the services that Fitnouriva uses: Health Connect, Google Play, Google sign-in, Google Drive, ML Kit (refer to Section 4), and Google Cloud, our host.
• Other Fitnouriva users: the nutrition facts from a label that you share, after approval, with no data that identifies you.
• Other apps with your permission in Health Connect: the foods that you log in Fitnouriva.
• When the law tells us to, or to protect the rights, safety, or security of our users, the public, or Fitnouriva.
• If a different person or company buys or gets Fitnouriva, the limited data on our servers goes too. This policy continues to apply to it.

14How long we keep data

• Data on your phone: until you delete it in the app, use "Delete data on this phone", or remove Fitnouriva.
• Cached daily step and calorie totals: approximately 13 months. Then the app removes them automatically.
• Shared labels that wait on your phone: a maximum of 30 days. Then the app removes them.
• Your Drive backup: until you replace it or delete it.
• Shared labels that wait for review: the photo, Android ID, Google account ID and email, and hashed subscription identifier.
• Our server deletes these automatically 30 days after you share them. If a reviewer approves the label before then, we delete them immediately.
• After approval, we keep only the nutrition facts. If a reviewer rejects the label, we delete these items 30 days after the rejection.
• Google removes expired records in the background, usually less than one day after the end date.
• Published nutrition facts: we keep them as part of the food database.
• Daily request counters, which include the counters for each IP address: deleted automatically two days after we write them.
• Block list records: until we remove the block.
• Refund records (hashed purchase token): kept permanently, so that a refunded purchase can never open the app again.
• Server request logs: 30 days (refer to Section 10).

15Your options and rights

• Permissions: camera, notification, and Health Connect access are optional. You can change them at any time in the Android settings. The app operates without them.
• Optional features: you can agree to this policy or decline it at any time in Settings. When you decline, the features in Section 7, Google sign-in, and Drive backup stop. No data is deleted.
• Correct your data: you can edit or delete all the data that you entered in the app.
• Export your data: "Export database" in Settings saves a copy of your data as a file. The file contains private health data and has no password. Keep it in a safe location.
• Delete your data: "Delete data on this phone" in Settings deletes your data and the cached Health Connect totals. It also cancels labels that wait to go, resets your settings, and signs you out.
• These controls operate without a subscription, and without your agreement to this policy.
• Other copies: to delete your Drive backup, use "Delete Drive backup". To delete Fitnouriva records in Health Connect, use "Data and access" in Health Connect.
• If you remove the permission or remove the app, those Health Connect records stay.
• When you delete data on your phone, your subscription continues. Cancel it in Google Play. Server records, for example shared labels and anti-abuse records, also stay.
• To ask us to delete server records, send an email to support@fitnouriva.com.

Privacy rights where you live

Where you live, you can possibly have these rights: to know which data we keep about you, get a copy, correct it, and delete it. Also, to limit or object to how we use it, withdraw your consent, and opt out of its sale or use for targeted advertising.

We do not sell personal data and do not use it for advertising. As a result, there is no sale or advertising to opt out of. In the EEA, the UK, and Switzerland, you can also make a complaint to your data protection authority.

To make a request, send an email to support@fitnouriva.com. We must confirm that the request is yours. For server records, this usually means the Google account or subscription of the record. If you use these rights, we do not treat you differently.

16Health data

Workouts, food, weight, and Health Connect data are health data. We treat them as sensitive data in all locations.

• We never sell health data. We never use it for advertising or analytics.
• Your diary, workouts, weigh-ins, body profile, and Health Connect data never go to our servers.
• We do not collect location. We do not use geofences, and we target nothing from visits to health facilities.

17Washington and Nevada

If you live in Washington or Nevada, our Consumer Health Data Privacy Policy also applies to you. It tells you which consumer health data we collect and share.

It also tells you how to see this data, delete it, or withdraw consent. And it tells you how to appeal if we refuse a request. You can read it in Settings, and at https://fitnouriva.com/consumer-health-privacy.html.

18Children and teens

Fitnouriva is for persons who are 13 years old or older. It is not for children younger than 13. The app accepts only ages from 13 to 100.

If the age in a profile is less than 18, the app stops the adult calorie and macro targets.

If you are younger than 18, or younger than the age where the law where you live lets you agree to this policy yourself, a parent or guardian must give you permission to use Fitnouriva.

If you think that a child younger than 13 shared data with us, send an email to support@fitnouriva.com. We will delete the data.

19International transfers

Our servers are in the United States. If you use Fitnouriva outside the US, our servers process the limited data that they get (Section 12) in the US.

When the law tells us to, we use applicable safeguards for these transfers, for example standard contractual clauses.

20Security

The app encrypts all data that it sends, and it refuses connections that are not encrypted. Our database has no direct internet connection. It is available only through our servers.

Each request that reads or adds to the food database must show an active subscription. Shared labels must also come from a verified Google account. The Android app sandbox and phone encryption protect the data on your phone.

No system is fully safe. As a result, we cannot guarantee full security. But we never send your data to locations other than the locations in this policy.

21Changes to this policy

If we change which data Fitnouriva collects or how we use it, we will update this policy, its version, and its effective date, in the app and at https://fitnouriva.com/privacy.html.

When the policy changes, the app asks you to read it and answer again. Until you answer, the optional features in Section 7, Google sign-in, and Drive backup stay off. Settings shows when the policy changed after you agreed.

22Contact us

If you have questions about this policy, send an email to support@fitnouriva.com. Also use this address to ask to see, correct, or delete your data. We reply in 30 days or less, or sooner if the law where you live tells us to.