Lose weight without giving up the foods you love

How to request deletion

1. Email [email protected] from the email address on your account.
2. Use the subject line "Account Deletion Request".
3. We'll verify the request and confirm once it's complete — usually within a few days, and always within 30 days as required by GDPR.

What's deleted, and what's retained

Deleted: your food log entries, saved meals, visual-progress data, and profile information. Your account is deactivated immediately and can no longer sign in or be used to access the app.

Retention period: your data is removed from active use immediately upon deletion; underlying records are permanently purged from our systems within 30 days, in line with our GDPR erasure commitment. We do not retain your data for any purpose after that window.

Working draft — not yet finalized

This policy has not yet been reviewed by qualified privacy/data protection counsel. It describes our intended data practices, including for features not yet live in the app. Sections still needing legal input are marked inline. If anything here is unclear, contact [email protected].

Last updated: August 9, 2026 · Effective date: August 9, 2026

1. Who We Are

My Food Diary ("we," "us," "our") provides a nutrition and exercise tracking application available via web and Android (myfooddiary.fit). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have over it.

This Policy applies to all users of My Food Diary, regardless of subscription tier. Where additional or different terms apply to specific features (such as visual progress photo analysis, professional data sharing, or the advertising participation program), those are described in the relevant sections below.

[LEGAL: Insert controller identity, registered business address, and contact details for data protection inquiries before publication.]

2. What Personal Data We Collect

We do not collect data we do not need for the app to function or for the specific opt-in features described in this Policy.

3. How We Use Your Data and Our Legal Basis (EU/EEA/UK Users)

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar requirements, we rely on the following legal bases under the General Data Protection Regulation (GDPR): operating core app features and billing under performance of a contract; security and fraud detection under legitimate interests; behavioral usage analytics, re-engagement messaging, and the advertising participation program under your explicit consent; visual progress photo analysis under your separate, explicit consent as special category data (Section 5); and professional data sharing under your explicit consent.

[LEGAL: This lawful-basis mapping requires confirmation by qualified EU data protection counsel before publication.]

4. Your Choices and Controls

Nearly everything beyond the core logging experience is opt-in, not opt-out:

• Visual progress analysis is off by default and requires a separate, explicit opt-in (Section 5)
• Professional data sharing only happens when you generate a share code and a professional redeems it — nothing is shared automatically
• Smart watch / fitness tracker integration requires you to connect an account; we never access this data without that explicit connection
• Outbound data sharing to external apps (Apple Health, Google Fit, etc.) requires a separate opt-in and an advisory screen explaining that your data, once shared, is subject to that platform's own privacy practices, not ours
• Re-engagement messaging and the advertising participation program are both consent-gated, with consent collected at each stage rather than once for all future stages
• Analytics and A/B testing participation are individually toggleable from onboarding and remain adjustable at any time in Settings

You can review, change, or revoke nearly every consent described in this Policy directly from the app, without contacting us.

5. Visual Progress Photos — Special Handling

If you choose to opt into visual progress analysis: your photos are processed in memory only and are never written to permanent storage — we do not keep a copy of your body photos. What we retain instead is an encrypted, mathematically opaque vector that has no human-readable meaning on its own, cannot be viewed as an image, and cannot be used to identify or evaluate your appearance. This vector calibrates the tone of in-app encouragement messages only, and is never shown to any person, including our own staff. You can opt out at any time — doing so deletes all associated vectors immediately and permanently, with no separate delayed-deletion step.

Depending on where you live, this data may be treated as "special category" or "biometric" data under applicable law, which means we collect it only with your separate, explicit, and informed consent, never as a condition of using the rest of the app.

[LEGAL: Confirm classification of visual progress vectors as biometric/special category data under GDPR Art. 9, Illinois BIPA, Texas CIPA, and Washington My Health My Data Act before this section is finalized. If BIPA applies, a written release and publicly available retention/destruction schedule are required in addition to this Policy.]

6. Data Sharing

We do not sell your personal data. We do not share your data with advertisers for cross-context behavioral advertising. We share data only: with a professional you've linked (only the categories you've authorized, only while the link is active, every access audit-logged); with service providers who help us operate the app (payment processing, push notification delivery, encrypted file storage — bound by data processing agreements, given only the minimum data needed); if you opt into the advertising participation program, only to the extent you've agreed to at that stage; or if required by law.

[LEGAL: Insert subprocessor list (Stripe, Google/Firebase, Cloudflare) with links to their DPAs once executed.]

7. Data Retention and Deletion

Most account data is retained for as long as your account is active. Deleted entries and Saved Meals enter a tiered recovery system: an immediate undo window, a 7-day self-service "Recently Deleted" view, and a further 60-day support-recoverable window, after which the data is permanently and automatically erased. Full account deletion is permanent and immediate — a distinct, deliberate action from entry-level deletion, with no recovery tier (see our account deletion section above). Visual progress vectors are deleted synchronously the moment you opt out, not on a delayed schedule.

8. Your Rights

Depending on your location, you may have the right to access, correct, delete ("right to erasure"), export, object to or restrict processing of, and withdraw consent for your personal data at any time. Most of these rights are available as self-service tools directly in the app. Where a request requires manual handling, you can reach us at [email protected].

California residents: you have the right to know what personal information we collect, to request deletion, and to opt out of the sale or sharing of personal information. We do not sell your personal information.

[LEGAL: "Do Not Sell or Share My Personal Information" link required on the public website.]

9. Children's Privacy

My Food Diary is not currently available to users under the age of 18. We do not knowingly collect personal data from minors. If we learn that a minor has created an account, we will take steps to delete that account and associated data.

10. International Data Transfers

[LEGAL: Insert details of data transfer mechanisms (standard contractual clauses, adequacy decisions, etc.) for any data processed outside the user's home jurisdiction, once hosting/infrastructure architecture is finalized.]

11. Security

We encrypt user-associated data at rest by default and use TLS 1.3 in transit. Professional access to your data is scoped to exactly what you've authorized and is recorded in an immutable audit log. We do not use third-party tracking scripts or advertising SDKs in the app.

12. Changes to This Policy

We will notify you of material changes to this Policy before they take effect, through the app and/or by email. Continued use of My Food Diary after a change takes effect constitutes acceptance of the updated Policy.

13. Contact Us

Questions about this Policy or your data can be sent to [email protected].

[LEGAL: Insert EU/UK representative if applicable, and Data Protection Officer contact if one is appointed.]