Privacy Policy

1. Introduction

Burn Fat Up ("we", "us", "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our mobile application ("App").

This policy is designed to comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and — where applicable to you — other privacy laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"). It applies to all users of the App regardless of where you access it from; see Sections 14 and 15 for jurisdiction-specific information.

3. Data We Collect

We collect and process the following categories of personal data:

3.1. Account Data
• Full name
• Email address
• Profile picture (optional)
• Authentication provider (email/password or Google)

3.2. Health & Body Data
• Height and weight
• Gender
• Fitness goal (e.g., lose weight, maintain, gain muscle)
• Daily calorie and protein targets
• Country of residence
• Body measurements you choose to log (e.g., waist, hips, chest, arms)
• Exercise activity you log (type, duration, calories burned, custom MET values)
• Intermittent fasting schedule and history
• Water intake logs

3.3. Photos You Provide
When you use AI food-photo recognition or the AI barcode-estimate fallback, we process the photo you take or select. Photos are uploaded to our backend storage (Convex) and sent to our AI provider (OpenRouter, see Section 6.3) for analysis. We use these photos only to generate the nutritional estimate you requested, and we do not use them to identify you personally.

3.4. Usage Data
• Meal plans and recipes you generate or save
• Progress data (calories consumed, meals tracked)
• Challenge participation and completion data
• Shopping lists
• AI credit balance and how you obtained credits (purchase, free daily quota, or rewarded ad)
• App feature usage and interaction patterns

3.5. Device & Technical Data
• Device type and operating system
• App version
• Push notification token (if notifications enabled)
• Advertising ID, if ads are enabled on your device — used by Google AdMob to serve and measure ads (see Section 6.5)
• Crash reports and error logs

3.6. Payment Data
Payment processing is handled entirely by Google Play (Android) or Apple App Store (iOS). We do not receive or store your payment card information. We only receive confirmation of subscription status from the respective app store.

4. How We Use Your Data

We use your personal data for the following purposes:

Account creation and authentication
Generating personalized AI meal plans and recipes based on your health data
Tracking your nutritional progress and challenge participation
Serving advertisements, including rewarded video ads that grant in-app AI credits upon completion
Sending push notifications (with your consent)
Improving the App's performance and features
Responding to customer support requests
Complying with legal obligations
Detecting and preventing fraud or abuse

5. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 GDPR:

Contractual necessity (Art. 6(1)(b)): Processing required to provide the App's services, including account management, meal plan generation, and progress tracking.

Consent (Art. 6(1)(a)): Processing of health data (weight, height, fitness goals) and push notifications, based on your explicit consent given during registration or in Settings. You may withdraw consent at any time.

Legitimate interests (Art. 6(1)(f)): Processing for fraud prevention, security, and improvement of our services, where these interests are not overridden by your rights.

Legal obligation (Art. 6(1)(c)): Processing required to comply with applicable laws.

For health and body data (special categories under Art. 9 GDPR), we rely on your explicit consent.

Where you are located outside the EEA/UK and GDPR does not directly apply to you, we apply these same legal-basis principles as a matter of policy.

6. Third-Party Processors

We share your data with the following trusted third-party service providers who process data on our behalf:

6.1. Firebase (Google LLC)
• Purpose: User authentication (email/password and Google Sign-In)
• Data: Email, authentication tokens, device information
• Privacy Policy: policies.google.com/privacy
• Data transfer: USA (Standard Contractual Clauses apply)

6.2. Convex Inc.
• Purpose: Backend database and serverless functions
• Data: All user profile data, meal plans, progress data
• Privacy Policy: convex.dev/privacy
• Data transfer: USA (Standard Contractual Clauses apply)

6.3. OpenRouter, Inc.
• Purpose: AI-powered recipe/meal-plan generation and food-photo recognition, routed to underlying third-party AI models (currently Google Gemini)
• Data: Dietary preferences, fitness goals, allergens, and photos you submit for food recognition (no account identifiers are sent)
• Privacy Policy: openrouter.ai/privacy
• Data transfer: USA

6.4. AiGuruLab
• Purpose: AI-generated recipe images
• Data: Text prompts describing the recipe (no personal data)
• Privacy Policy: see aigurulab.tech

6.5. Google AdMob (Google LLC)
• Purpose: Serving in-app advertisements, including rewarded video ads that grant AI credits
• Data: Advertising ID, ad interaction data, approximate location (for ad relevance), device information
• Privacy Policy: policies.google.com/privacy
• Opt-out: You can limit ad personalization via your device settings — Android: Settings → Google → Ads → "Opt out of Ads Personalization" (or "Delete advertising ID" on Android 12+)
• Data transfer: USA (Standard Contractual Clauses apply)

6.6. Open Food Facts
• Purpose: Looking up nutrition information for scanned barcodes
• Data: The scanned barcode number only (no personal data)
• Privacy Policy: world.openfoodfacts.org/privacy

6.7. Google Play / Apple App Store
• Purpose: In-app purchase processing and subscription management
• Data: Transaction information, subscription status

We do not sell your personal data to any third party for money. Where our use of Google AdMob for personalized advertising may be considered a "sale" or "sharing" of personal information under the CCPA/CPRA, you may opt out as described in Section 6.5 or by contacting us (see Section 14).

7. Data Retention

We retain your personal data for as long as your account is active or as necessary to provide the Service.

Account data: Retained for the duration of your account plus 30 days after deletion
Health data: Retained while your account is active; deleted upon account deletion
Usage and progress data: Retained for the duration of your account plus 30 days
Photos submitted for AI recognition: Not retained by us after the estimate is returned, unless you choose to attach the photo to a saved food log entry, in which case it is retained as Usage Data above
Advertising identifiers and ad-interaction data: Retained and processed by Google/AdMob under Google's own retention policy; we do not separately store this data
Payment records: Retained for 7 years to comply with financial and tax regulations
Crash and error logs: Retained for 90 days

After the applicable retention period, your data is securely deleted or anonymized.

8. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

Right of Access (Art. 15): Request a copy of the personal data we hold about you.

Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.

Right to Erasure / "Right to be Forgotten" (Art. 17): Request deletion of your personal data, subject to legal retention obligations.

Right to Restriction of Processing (Art. 18): Request that we limit how we use your data in certain circumstances.

Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.

Right to Object (Art. 21): Object to processing based on legitimate interests.

Right to Withdraw Consent: Withdraw consent for processing at any time (this does not affect the lawfulness of prior processing).

Right to Lodge a Complaint: You have the right to lodge a complaint with your national data protection authority. In Romania, this is ANSPDCP (www.dataprotection.ro).

To exercise any of these rights, contact us at support@burnfatup.app. We will respond within 30 days. If you are located outside the EEA/UK, see Sections 14 and 15 for your rights.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include:

Encrypted data transmission (HTTPS/TLS)
Firebase Authentication for secure account access
Role-based access controls on our backend
Regular security reviews

Despite our best efforts, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your data.

10. Children's Privacy

The App is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. Ads served through the App are not targeted at children, and we do not knowingly serve personalized advertising to users under 16 — we rely on Google AdMob's content-rating and ad-serving controls to help enforce this. If you believe we have inadvertently collected such data, please contact us immediately at support@burnfatup.app and we will delete it promptly.

13. Advertising

The App displays advertisements served by Google AdMob, including rewarded video ads that grant in-app AI credits when watched to completion. Depending on your consent and region, these ads may be personalized based on your Advertising ID and app activity — see Section 6.5 for how to opt out.

We do not control the content of third-party advertisements and are not responsible for the products, services, or claims made in them. Ad networks may collect data directly from your device in accordance with their own privacy policies, which we link to in Section 6.

14. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Right to Know what personal information we collect, use, and disclose
Right to Delete personal information we hold about you
Right to Correct inaccurate personal information
Right to Opt-Out of the "sale" or "sharing" of personal information — our use of Google AdMob for personalized advertising may be considered "sharing" under the CPRA. You can opt out via your device's ad settings (Section 6.5) or by emailing support@burnfatup.app with the subject "CCPA Opt-Out"
Right to Non-Discrimination for exercising any of these rights

We do not sell personal information for money. To exercise any of these rights, contact us at support@burnfatup.app. We will verify your request and respond within 45 days, as required by California law.

15. Users Outside the EEA/UK/California

Regardless of your location, we apply the data-protection principles described in this Policy as our global standard of practice. If the law of your country grants you statutory data protection rights (for example Brazil's LGPD, Canada's PIPEDA, or South Korea's PIPA), we will honor requests to access, correct, or delete your personal data to the extent required by that law. Contact us at support@burnfatup.app to make such a request.

This Policy is intended to give you meaningful information and control over your data everywhere the App is available, but it is not a substitute for independent legal advice about the law of your specific country.