Privacy Policy

1. Information we collect

• Account: your email address, a securely hashed password, email-verification status, or the identifiers supplied by a sign-in provider you choose.
• Profile & health inputs you provide: age or date of birth, sex, height, current and target weight, activity level, goals, dietary preferences, and any health conditions you choose to share (for example diabetes, hypertension, or joint pain).
• Activity you log: weight and water entries, workout sessions, logged meals, and reminders.
• Meal photos: if you scan a meal, the photo is used to estimate its contents. We keep only a small thumbnail with the log entry.
• Device & notifications: a push-notification token (via Firebase Cloud Messaging) so we can send the reminders you enable, and basic device/OS information.
• Purchases: your subscription/entitlement status. Payments are processed by Google Play — we never receive your card or bank details.
• Technical data: app and server logs (such as timestamps and error diagnostics) needed to operate the service.

2. How we use your information

We use your information to create and adjust your workout and diet plans, filter out exercises that may be unsafe given a health condition, estimate the nutrition in meals you scan, track your progress, send the reminders you turn on, provide customer support, operate and secure the service, and meet legal obligations. We do not sell your personal data, and we do not use your health data for advertising.

3. AI meal analysis

When you scan a meal, the photo is sent to Google's Gemini AI service to estimate the foods and their nutrition. The estimate is approximate and may be wrong — always use your own judgement, especially for medical or allergy-related decisions.

4. Who we share it with

We share data only with service providers who process it on our behalf, under contract, to run the app:

• Google — Gemini (meal-photo analysis), Firebase Cloud Messaging (push notifications), and Google Play Billing (subscription payments).
• Hosting & database providers — to run our servers and store your account data.
• Email provider — to send verification and password-reset emails.
• Meta — the WhatsApp Business Cloud API, to deliver the one-time codes used to verify your phone number and sign you in.

We may also disclose information if required by law or to protect the rights and safety of our users.

5. How long we keep it

We keep your data while your account is active. Meal-photo thumbnails are automatically removed 90 days after logging. When you delete your account, your profile, health inputs, logs, history, photos, reminders, and notification subscriptions are removed immediately, and encrypted backups age out within 30 days.

6. Your rights and choices

• Access & export: export a copy of your data from Settings in the app.
• Correct: edit your profile and preferences at any time in the app.
• Delete: delete your account from Settings, or see our account-deletion page.
• Control notifications:turn reminders on or off in Settings, or in your device's notification settings.

7. Security

We protect your data with encryption in transit, hashed passwords, and access controls. No system is perfectly secure, but we work to keep your information safe and to respond promptly to any issue.

8. Children

Refitt is intended for adults (18+) and is not directed to children. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will remove it.

9. Where your data is processed

Refitt is operated primarily for users in India, and our servers are hosted in the Mumbai region. Some service providers (such as Google) may process data in other countries under appropriate safeguards.

10. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above and, for significant changes, notify you in the app.

11. Contact us

Questions about this policy or your data? Email privacy@refitt.app.