Privacy Policy

1. Data controller

FIT4EAT is operated by Castles Bay, Lda ("we").

• Address: Rua José Valorado, Fração D, 10, 2660-131 Santo Antão do Tojal, Portugal
• Company number (NIPC): 519226860
• Email: info@fit4eat.com

For any question about this policy or your data, contact us at the email above.

2. Data we collect

We collect the following categories of data:

• Account data. Name, email and password (stored in encrypted form). If you sign in with Apple or Google, we receive the identifier and email linked to that account.
• Profile and goals. Age, sex, height, weight, activity level, goals and food preferences you provide.
• Health and fitness data. Workouts, sets, reps, body weight, meals, calories, macros, hydration, sleep and supplements you log in the app. These are special category data under the GDPR.
• Meal photos. Photos you take for food analysis by artificial intelligence.
• Precise location, including in the background. When you start and allow a GPS cardio session (running, walking, cycling), the app records your location to calculate route, distance and pace. Recording continues with the phone locked or the app in the background until you finish the cardio session. Outside a cardio session we do not collect your location.
• Apple Health / Health Connect and wearable data. If you allow it, we read steps, calories, heart rate, sleep and weight from these sources, and workouts recorded on your watch (type, duration, distance, calories and heart rate) to add them to your history. This permission is optional and you can revoke it at any time in your device settings.
• Garmin Connect data. If you connect your Garmin account, we receive your activities and daily health summaries, as described in section 5.
• Social content and messages. Posts, stories, comments, reactions, polls, direct messages (including voice messages) and the list of people you follow, when you use the community features.
• Purchases and subscriptions. The plan you subscribe to and the subscription status, as described in section 13. We do not receive your card details.
• Usage and device data. Device model, operating system, language, app identifiers, IP address, and usage and performance statistics.
• Error reports. Technical diagnostic information when the app crashes, so we can fix problems.

3. What we use data for and on what legal basis

• Providing the Service: creating your account, generating training and nutrition plans, logging meals and workouts, showing leaderboards and running the community (performance of contract).
• Analysing meal photos and answering in the AI assistant, based on your data (performance of contract).
• Processing health data, photos and location, which are sensitive data, based on your explicit consent, which you can withdraw at any time.
• Processing subscriptions, unlocking paid features and supporting you with purchases (performance of contract), and keeping the records required by tax and accounting law (legal obligation).
• Improving the app, preventing abuse and ensuring security (legitimate interest).
• Knowing which Apple advertising campaigns brought new installs, as described in section 6 (legitimate interest).
• Sending notifications and reminders you turn on (consent), and essential communications about the Service (legitimate interest).

4. Artificial intelligence

Some features use artificial intelligence models, for example meal analysis from photos, generating plans and recipes, and the assistant. For this, we share the strictly necessary data (such as the meal photo, or your question and the relevant context) with our AI provider, OpenAI (United States). OpenAI processes this data to return the result to us and is bound not to use it to train its models. We do not use your health data to make automated decisions with legal effects on you.

AI Transparency Statement for Garmin data. The data we receive from Garmin Connect (activities, heart rate, sleep, steps, weight) is not sent to any AI system by default. We only share it with OpenAI, so the assistant can answer about your workouts and to generate or adjust your training and nutrition plans, if you give explicit consent through a dedicated option in the app, separate from connecting Garmin and turned off by default. You can withdraw this consent at any time in the same option, and from then on that data is no longer sent. OpenAI processes it only to return the result to us and does not use it to train models. We never use Garmin data, or anything derived from it, to train, evaluate or improve AI models.

5. Garmin Connect

If you connect your Garmin Connect account in the app, Garmin sends us, each time you sync your watch, the data you authorise on Garmin's authorisation screen:

• Activities: type, date and time, duration, distance, calories, heart rate, pace or speed, GPS route and the device name.
• Daily health summaries: steps, calories, heart rate (including resting), sleep and weight.

We use this data only to provide the Service to you: adding your workouts to your history, marking the matching day of your plan as done, updating your progress (XP and streak), showing you your daily data and adjusting your calorie target. If you turn on workout sending, we send the workouts from your FIT4EAT plan to your Garmin Connect account so you can do them on your watch.

• Who can see it: your Garmin data is visible only to you. It is only shown to other people if you share a workout in the community yourself.
• Where it is stored and who it is shared with: it is stored with Supabase in the European Union (Ireland). We do not sell it, do not use it for advertising and do not share it with third parties for their own use. It only reaches OpenAI under the conditions in section 4.
• Credentials: we store the access credentials Garmin gives us in encrypted form, and use them only to receive your data and send your workouts.
• Disconnecting: you can disconnect Garmin at any time in the app or in the list of connected apps in your Garmin Connect account. When you disconnect, we delete the credentials and stop receiving data. Workouts already imported stay in your history until you delete them or delete your account.
• Your rights: you can view and correct imported workouts in the app, export your data in Account settings, delete it and withdraw any consent, as described in sections 10 and 11.

6. Who we share data with

We do not sell your data and never share it for third-party advertising or marketing. We only share data with providers that help us run the Service, acting as processors and bound by data protection agreements:

• Hosting and database: Supabase, with data hosted in the European Union (Ireland).
• Artificial intelligence: OpenAI (United States), as described in section 4.
• Garmin: if you connect your Garmin Connect account, we receive data from Garmin and send it the workouts from your plan, as described in section 5.
• Error reports: Sentry, for diagnosing and fixing crashes, with data hosted in the European Union (Germany). Reports include technical information about the error, the device model and system, and an internal account identifier. We have configured it to exclude your email and your health data.
• Push notifications: Expo (United States), which forwards the notifications you turn on to Firebase Cloud Messaging (on Android) and the Apple Push Notification service (on iOS). These services receive your device's notification identifier and the text of each notification.
• Subscriptions: RevenueCat (United States), to manage purchases made on the App Store and Google Play, as described in section 13.
• Maps: Google Maps (on Android) and Apple Maps (on iOS), to show the map and route of GPS cardio sessions.
• Ad measurement (iOS only): we use Apple's attribution (AdServices) to know whether you installed the app from an Apple Search Ads ad. The app gets an attribution token from Apple, which we verify with Apple, and we store the campaign data linked to your account. This does not use the device's advertising identifier or track you across other apps.
• Sign-in: if you choose to sign in with Apple or Google, those services handle authentication.
• Nutrition databases: when you search for foods, the query may be sent to providers such as FatSecret, USDA and Open Food Facts.
• Other users: content you publish in the community (public profile, posts, stories, messages) is visible according to the privacy settings you choose in the app.
• Legal obligations: we may disclose data if the law requires it or to protect the rights, safety and integrity of the Service.

Apart from the Apple attribution described above, we do not use third-party analytics or advertising tools in the app. Usage statistics stay on our own servers.

7. International transfers

Some of the providers above, such as OpenAI, RevenueCat and Expo, process data outside the European Economic Area, namely in the United States. In those cases we ensure appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission.

8. How long we keep data

We keep your data while your account is active. If you delete your account, we delete or anonymise your personal data within 30 days, except where the law requires a longer retention period (for example, tax or accounting obligations). Backups are deleted in the normal rotation cycle.

9. Security

We apply technical and organisational measures to protect your data, including encryption in transit (HTTPS/TLS), access control and secure storage of credentials. No system is 100% secure, but we work to reduce the risks.

10. Your rights

Under the GDPR, you have the right to:

• Access your data and get a copy (portability).
• Correct inaccurate data.
• Erase your data ("right to be forgotten").
• Restrict or object to certain processing.
• Withdraw consent at any time, without affecting the lawfulness of earlier processing.

To exercise these rights, contact info@fit4eat.com. You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the supervisory authority in Portugal.

11. Deleting your account and data

You can delete your account and the associated data directly in the app, in Account settings. Alternatively, you can request deletion by email at info@fit4eat.com and we will handle the request. After deletion, your personal data is removed within the period stated in section 8.

12. Children

FIT4EAT is intended for people aged 16 or over and is not directed at children under 16. We do not knowingly collect data from children under 16. If we learn that we have collected data from someone below that age, we delete it. If you are a parent or guardian and believe this has happened, contact us.

13. Payments and subscriptions

FIT4EAT has a free version and paid subscriptions: PRO (monthly or yearly) and the Scan Pack (monthly, only for meal analysis from photos). Current prices are shown in the app before each purchase.

• Purchases are made and paid through the App Store (Apple) or Google Play. The store handles payment; we never receive or store your card details.
• We use RevenueCat (United States) to manage subscriptions. RevenueCat receives your internal account identifier and the purchase data the store sends it, to confirm the subscription is active. We do not send it your name or email.
• We store your subscription status on our servers: the product, the store, the purchase and renewal or end dates, and a record of each event sent by the store (which includes the price, currency and store country). We use this data to unlock paid features, provide support and meet tax and accounting obligations.
• Subscriptions renew automatically until you cancel them in your Apple or Google account settings. You can restore previous purchases in the app.
• New accounts may receive a free PRO period, without us asking for payment details.

14. Device permissions

The app may ask for access to the camera (meal photos and barcode scanning), the microphone (to record voice messages in conversations), location including in the background during GPS cardio, Apple Health or Health Connect, and notifications. You grant these permissions optionally and can revoke them at any time in your device settings.

15. Cookies (website)

The fit4eat.com website uses only strictly necessary cookies and anonymised analytics. The mobile app does not use advertising cookies.

16. Changes to this policy

We may update this policy. When a change is significant, we will let you know in the app or by email. The date at the top shows the last update.

17. Contact

Castles Bay, Lda, Rua José Valorado, Fração D, 10, 2660-131 Santo Antão do Tojal, Portugal. info@fit4eat.com.