This privacy policy applies to the Fitto.ai app for mobile devices, together with any related services operated by Samipan Bandyopadhyay (collectively, the "Application"). Samipan Bandyopadhyay is hereby referred to as the "Service Provider".

Information Collection and Use

The Application collects information when you download and use it. This information may include:

Information automatically collected

Your device's Internet Protocol (IP) address
The pages of the Application you visit, and the time and date of your visit
The time spent on the Application
Your mobile operating system, device platform and app version
Your time zone, so reminders, streaks and daily limits follow your local day
Which features you use, and whether notifications were delivered and opened

Information you provide

Account details: your email address and name. If you sign in with Apple or Google, the account identifier and email address that service provides
Profile details used to estimate your nutritional needs: age, weight, height, gender, activity level, goal, and target weight. Optionally, your country (used for the country leaderboard), how you heard about the Application, and whether and how you have tracked food before
Your food log: the meals you save, their items and nutrition estimates, meal photographs, the text you type to describe a meal, products you scan by barcode, the foods you pick from food search, and your weigh-ins. If you leave food search to type a meal in yourself, the first 40 characters of what you searched for are recorded as a usage event, so the Service Provider can see which foods are missing
Voice recordings, when you choose to log a meal by voice, correct a scan with a voice note, or speak to the Coach. A recording is used only to transcribe and analyze it and is not stored; the resulting text may be stored as the meal's description or as your message to the Coach
Coach data, if you use the Coach: your messages, the preferences you give it (such as diet, allergies, dislikes, cuisines, cooking time, budget, kitchen equipment and household size), the things you ask it to remember, your pantry, and the meal plans and grocery lists it creates
Favourite meals you save, and the lighter-version suggestions you request
Feedback, support messages and survey answers you choose to send
Purchases: a record of the credit packs you buy. Payment is handled by Apple (App Store) or Google (Google Play); the Service Provider never receives your card details
Invites and sharing: your invite code, the code you used to join (if any), and a record that you shared a card or invite. The content of the message you send, and who you send it to, is not collected

Health-related information

Some of this information relates to your health, including your weight and weigh-ins, your food log, and any allergies or dietary requirements you tell the Coach. It is used only to provide the features you use, such as your calorie target, meal analysis, meal plans and the Coach's answers. It is never used for advertising and never sold. You can view and edit your profile in the app, view, edit or delete everything the Coach has stored on its profile screen, and delete individual meals at any time.

How meal photos, voice notes and descriptions are used

When you choose to analyze a meal, the photo, voice recording or text description you provide is sent to Google's Gemini AI service (Google Generative AI, operated by Google LLC) to estimate the food items, calories, and macronutrients. No other personal data is sent to Google for meal analysis, and the Application asks for your explicit consent before your first photo or voice recording is analyzed. Other features, including the Coach, send more than this; each is described in the "Artificial Intelligence and Third-Party AI Processing" section below.

How meal photos are stored

When you save a meal, its photo is stored so that it appears with that meal in your history on any device you sign in to. Photos are hosted by Cloudinary (Cloudinary Ltd.), a third-party image hosting provider acting as a processor for the Service Provider. A stored photo is kept for as long as the meal it belongs to: deleting the meal deletes the photo, and deleting your account deletes all of them. Meals you log by voice, by typing a description, or by scanning a barcode have no photo; for those, the text you provided is stored with the meal instead.

Information other users can see

The Application has leaderboards that rank users by logging activity. Unless you hide yourself, other users can see your first name and the initial of your last name, your country if you set one, your level, your score, and your current streak. Your email address, photo, meals, weight and targets are never shown. You can hide yourself from every leaderboard at any time in your Profile, and the first time you open the leaderboards the Application shows you how you appear and offers the same choice.

When you choose to share a meal card or an invite, the card contains the meal, its photo if it has one, its nutrition estimates, and your invite code. It never contains your name, profile picture, weight or goal. Visits to an invite link on the Service Provider's website are counted per invite code, without recording the visitor's IP address or device.

Notifications

If you allow notifications, the Application stores a push token for your device and uses it to send meal reminders, streak reminders and Coach check-ins. Notifications are delivered through Expo's push service (operated by 650 Industries, Inc.) and Apple's or Google's notification service. You can change how many reminders you receive in your Profile, or turn notifications off in your device settings.

Cookies and tracking technologies

The Application or its third-party SDKs may use cookies, SDKs, pixels, and similar technologies to support functionality, analytics, or service delivery. The Application contains no advertising SDKs and does not track you across other companies' apps or websites. Where required by applicable law, the Service Provider will obtain consent before using non-essential tracking technologies.

Your Rights

You may request access to, correction of, or deletion of your personal data held by the Service Provider. To exercise these rights, or to withdraw consent where processing is based on consent, contact the Service Provider at [email protected].

Many of these controls are also in the app: you can edit your profile, delete any meal and its photo, edit or delete what the Coach has stored, clear your Coach conversation, remove favourite meals, hide yourself from the leaderboards, and delete your account.

Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information is collected, the right to delete personal information, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising these rights. The Service Provider does not sell your personal information and does not share it for cross-context behavioral advertising. To exercise your CCPA/CPRA rights, contact the Service Provider at [email protected].

Artificial Intelligence and Third-Party AI Processing

Several features of the Application use Google's Gemini AI service (Google Generative AI), operated by Google LLC. Data is sent only when you use one of these features, and only what that feature needs:

Meal analysis (photo, voice or text): the meal photo, voice recording or description you provide, and any note you add. If you correct a result with "Not right?", your correction and the previous result are sent too. Purpose: to identify foods and estimate calories and nutrients.
Coach: your message (and your voice recording, if you speak it, so it can be transcribed), together with the context the Coach needs to answer you: your first name, age, gender, height, weight, weigh-ins and weight trend, goal, target weight and calorie and nutrient targets; a summary of your recent meals and the foods you eat most; your streak, level, badges, daily quests and your own leaderboard positions; your active meal plan; the preferences, allergies and pantry you have given it; the things you have asked it to remember; and recent messages in the conversation. Purpose: to answer you and to carry out what you ask, such as building a meal plan. If you send a photo in the Coach, it is analyzed as a meal photo (above) and is not otherwise sent to the Coach.
Meal plans: your calorie and nutrient targets, the plan settings you choose, the preferences, allergies, pantry and remembered notes from your Coach profile, and the names of foods you have logged recently or that appeared in earlier plans. Purpose: to write a plan that fits you and avoids repeating itself.
Matching meals to your plan: the name of a meal you log and the names of the planned meals it might match. Purpose: to tell whether you followed your plan.
Lighter versions and their recipes: the items of the meal you choose, your goal, and the allergies from your Coach profile. Purpose: to suggest similar meals and write their recipes.

What is never sent: your email address, password, account identifiers, payment details, or your device's IP address or location. Requests to Google are made by the Service Provider's servers, not by your device.
Consent: the Application asks for your explicit consent before your first meal photo or voice recording is analyzed. You may decline, and those features will not be used. The Coach, meal plans and lighter versions run only when you use them; you can stop using them at any time, clear your Coach conversation, and delete what the Coach has stored.
Third-party protection: Google processes this data in accordance with the Google APIs Terms of Service, the Gemini API Additional Terms of Service and the Google Privacy Policy, which provide data protection equivalent to that described in this policy.
Estimates, not advice: AI results are estimates for general wellness. They are not medical advice.

Third Party Access

The Service Provider uses the following service providers, each acting on its behalf and receiving only what its role requires:

Google LLC (Gemini AI): AI features, as described in the "Artificial Intelligence and Third-Party AI Processing" section above
Cloudinary Ltd.: storage of photos attached to saved meals, as described under "How meal photos are stored"
RevenueCat, Inc.: processing in-app purchases of credit packs. It receives your account identifier, your purchase records from Apple or Google, and the onboarding answers about how you heard about the Application, your country and your food-tracking history, so purchases can be understood by source. It does not receive your name, email or health information
650 Industries, Inc. (Expo): delivering push notifications, as described under "Notifications"
Apple and Google: Sign in with Apple and Google Sign-In, if you choose them, and payment for purchases through the App Store and Google Play
Open Food Facts: looking up a product when you scan a barcode. Only the barcode number is sent
USDA FoodData Central and Open Food Facts (food data): the foods you can search for come from USDA FoodData Central (U.S. Department of Agriculture), with some dishes, such as Indian dishes, computed from USDA ingredient data. Open Food Facts (© Open Food Facts contributors, ODbL) is used only for barcode lookups: when you scan a barcode, the Service Provider's server sends the barcode number to Open Food Facts to look up the product. The text you type into food search is sent to the Service Provider's own servers (hosted by the providers listed below) to return results. It is not sent to Google Gemini or any other AI provider for search
Cloud hosting and database providers (Render and MongoDB Atlas): storing and serving the Application's data

Aside from this, only aggregated, anonymized data is periodically transmitted to external services to help the Service Provider improve the Application. The Service Provider does not sell your personal data. The Service Provider may share your information with third parties in the ways that are described in this privacy statement.

International Data Transfers

The Service Provider or its third-party service providers may transfer personal data to countries outside your country of residence, including outside the European Economic Area (EEA). Where applicable law requires safeguards for international transfers, the Service Provider will use appropriate mechanisms.

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions or other legally recognized transfer mechanisms
Your consent, where required and legally permitted

Data protection laws in other countries may differ from those in your jurisdiction. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.

The Service Provider may disclose User Provided and Automatically Collected Information:

as required by law, such as to comply with a subpoena, or similar legal process;
when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
with their trusted services providers who work on their behalf, do not have an independent use of the information the Service Provider discloses to them, and have agreed to adhere to the rules set forth in this privacy statement.

Opt-Out Rights

You can stop further collection of information from your mobile device by uninstalling the Application. Uninstalling will stop the Application from collecting data from your device, but it does not automatically delete information that has already been transmitted to the Service Provider or to third parties.

To request deletion of your personal data, to withdraw consent, or to exercise any of your rights, contact the Service Provider at [email protected]. You can also delete your account in the app; see how to delete your account.

Data Retention Policy

The Service Provider retains personal data based on its necessity for the stated purposes:

User Provided Data: Retained for the duration of your use of the Application plus 12 months thereafter, unless longer retention is required by law
Meal photos: Retained for as long as the meal they belong to. Deleting a meal deletes its photo; deleting your account deletes every photo you stored
Voice recordings: Not retained. A recording is discarded once it has been transcribed and analyzed
Coach conversation: Retained until you clear it in the Coach, or until your account is deleted. Coach preferences, memory, pantry, meal plans, grocery lists, favourite meals and lighter-version suggestions are retained until you delete them or your account is deleted
Automatically Collected Data: Retained for up to 24 months from collection, unless longer retention is required for legal compliance
Aggregated and Anonymized Data: Retained indefinitely as it no longer identifies you
Data required for legal compliance: Retained as long as required by applicable law

When you delete your account in the app, it is closed immediately and permanently deleted after 30 days, unless you sign back in before then. Permanent deletion removes your account and profile, meals and their photos, weigh-ins, Coach conversation and profile, meal plans, grocery lists, favourite meals, lighter-version suggestions, and your streak and leaderboard progress, and the text recorded when a food search ended in typing a meal yourself is erased from your usage events. Purchase records and automatically collected data are retained for the periods above.

You may request deletion of your personal data, subject to any legal obligation to retain it. If you want the Service Provider to delete User Provided Data submitted through the Application, please contact them at [email protected]. Please note that some User Provided Data may be required for the Application to function properly.

Children

The Application is not intended for children under 16 years of age, or such higher age as required by applicable law. The Service Provider does not knowingly solicit data from children or market the Application to them.

The Service Provider does not knowingly collect personally identifiable information from children. The Service Provider encourages all children to never submit any personally identifiable information through the Application and/or Services. The Service Provider encourages parents and legal guardians to monitor their children's Internet usage and to help enforce this Policy by instructing their children never to provide personally identifiable information through the Application and/or Services without their permission. If you have reason to believe that a child has provided personally identifiable information to the Service Provider through the Application and/or Services, please contact the Service Provider ([email protected]) so that they will be able to take the necessary actions. If you are under 16 years of age, your parent or guardian must provide consent on your behalf where permitted by law.

Security

The Service Provider is concerned about safeguarding the confidentiality of your information. The Service Provider provides physical, electronic, and procedural safeguards to protect information the Service Provider processes and maintains.

Data Breach Notification

If a data breach occurs that affects your personal data, the Service Provider will notify you in accordance with applicable legal requirements, including, where required, providing information about the nature of the breach and the steps being taken to address it.

Changes

The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.

Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at [email protected].

This privacy policy is effective as of 2026-11-01.

Your Consent

Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases is carried out as described above.

Contact Us

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at [email protected].