Privacy Policy

In short

TheBestOfYou is an account-based fitness and nutrition tracker. To sync your data across devices we store it on our servers in the European Union. We do not sell your data and we do not use it for advertising. You can delete your account and all of its data at any time.

What we collect

We only collect what the app needs in order to work:

• Account — email address, display name and a securely hashed password. If you sign in with Google or Facebook, we receive your name, email address and profile picture from them.
• Profile — age, gender, height, weight, activity level and your goals, used to calculate your calorie and macronutrient targets.
• Health and activity data — the meals and foods you log, water intake, workouts and your weight history.
• Photos — if you use AI photo analysis, the photo of your meal is sent for analysis. It is used to identify the food and is not stored on our servers afterwards.
• Device data — a push token for your device, if you enable notifications.
• Technical data — IP address, browser and device type, and error reports, used for security, abuse prevention and diagnosing faults.

How we use your data

We process your data to provide the service: to run your account and keep you signed in, to calculate your targets and statistics, to sync your data across your devices, to send the emails the service requires (email verification, password reset, sign-in alerts), to send the notifications you have enabled, and to keep the service secure and working.

Under the GDPR we rely on performance of a contract (running your account), your consent (notifications and AI analysis) and our legitimate interest (security and fault diagnosis). Health-related data is processed on the basis of your explicit consent, which you give by entering it.

AI features

When you use the AI assistant, photo analysis or free-text meal logging, the content you provide (your message, the meal description or the photo) is sent to the Google Gemini API for processing. Please do not send information you would not want processed by a third party, or that you consider confidential. To measure our AI calls (response time, token counts, errors) we use Langfuse: the text of your messages and meal descriptions reaches it, but photographs do not — they are removed before sending. These features are optional and the app is fully usable without them.

Who processes your data

We use the providers below. They act as data processors on our behalf and may only use the data to provide their service:

• Microsoft Azure — application hosting (Container Apps, France)
• Supabase — database hosting (EU region)
• Upstash — cache and session storage
• Cloudflare — website hosting and DNS
• Resend — sending service emails
• Google Gemini — AI meal and photo analysis
• Firebase Cloud Messaging — push notifications
• Sentry — error reporting and diagnostics
• Langfuse — logging and measuring AI calls (EU region); photos are removed before sending and never reach it
• Google, Facebook — optional sign-in
• Open Food Facts — food database lookups; it receives only the search term or barcode

Some providers may process data outside the European Economic Area. Where that happens, transfers are covered by the European Commission's standard contractual clauses.

How long we keep it

We keep your data for as long as your account exists. When you delete your account, your data is removed from our systems. Backups are overwritten on a rolling basis and are fully replaced within 30 days.

Your rights

Under the GDPR you have the right to access your data, to correct it, to have it erased, to restrict or object to processing, and to receive a copy in a portable format. Contact us and we will respond within one month. If you believe we handle your data unlawfully, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

Security

Traffic is encrypted with HTTPS. Passwords are stored only as bcrypt hashes and are never readable by us. Sessions use httpOnly cookies, and you can review and revoke your active sessions in the app. Two-factor authentication is available.

Children

The service is not intended for children under 16, and we do not knowingly collect data from them. If you believe a child has provided us with data, contact us and we will delete it.

Changes to this policy

If we make significant changes we will update the date at the top of this page, and where the change is material we will notify you in the app or by email.

Contact

Questions about your data or this policy? Email us at privacy@thebestofyou.app