Privacy Policy

1. Introduction

Only Fasting ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application ("App").

By using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the App.

2. Data Controller

For any privacy-related questions or to exercise your data rights, please contact us at the email address above.

3. Data We Collect

3.1 Information You Provide

Data Type	Examples	Purpose
Account Information	Email, name, profile photo	Account creation & authentication
Fasting Data	Start/end times, fasting plans, streaks	Core app functionality
Hydration Data	Water intake amounts, timestamps	Hydration tracking feature
Willpower Entries	Resisted cravings, calories avoided	Motivation tracking
Preferences	Language, notification settings, goals	Personalization

3.2 Information Collected Automatically

Data Type	Examples	Purpose
Device Information	Device model, OS version, unique identifiers	App functionality & support
Usage Data	Features used, session duration	App improvement
Crash Reports	Error logs, stack traces	Bug fixing

4. How We Use Your Data

• Provide Services: Track your fasting periods, hydration, and progress
• Sync Data: Keep your data synchronized across devices
• Send Notifications: Remind you about fasting start/end times and hydration
• Process Payments: Handle premium subscription transactions
• Improve App: Analyze usage patterns to enhance features
• Customer Support: Respond to your inquiries and requests
• Legal Compliance: Meet legal obligations and protect our rights

5. Legal Basis for Processing

Under GDPR Article 6 and Article 9

Processing Activity	Legal Basis
Account creation & authentication	Contract performance (Art. 6(1)(b))
Fasting & hydration tracking	Contract performance (Art. 6(1)(b))
Health data processing	Explicit consent (Art. 9(2)(a))
Push notifications	Legitimate interest (Art. 6(1)(f))
Analytics & improvement	Legitimate interest (Art. 6(1)(f))
Subscription processing	Contract performance (Art. 6(1)(b))

6. Third-Party Services

We use the following third-party services to operate our App:

Service	Purpose	Data Shared
RevenueCat	Subscription management	Purchase data, anonymous user ID
Apple (Sign in with Apple)	Authentication	Email (optional), name
Supabase	Database hosting (EU)	All user data (encrypted)
Expo	Push notifications	Device tokens

7. Data Storage & Security

7.1 Where We Store Data

In the current release, fasting and hydration records are stored locally on your device. If optional account sync is enabled in future updates, synced data will be stored on secure servers located in the European Union (Frankfurt, Germany).

7.2 Security Measures

• All data transmitted using TLS 1.3 encryption (HTTPS)
• Passwords hashed using bcrypt with salt
• Database encrypted at rest
• Regular security audits
• Access controls and authentication for all systems
• Rate limiting and brute force protection

8. Data Retention

Data Type	Retention Period
Account data	Until account deletion
Fasting history	Until account deletion
Health tracking data	Until revoked or account deletion
Audit logs	2 years (anonymized after deletion)
Subscription records	7 years (legal requirement)

After account deletion, your personal data is permanently removed within 30 days, except where retention is required by law.

9. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

Right	Description	How to Exercise
Access (Art. 15)	Request a copy of your data	Contact privacy@onlyfasting.com
Rectification (Art. 16)	Correct inaccurate data	Profile > Edit Name
Erasure (Art. 17)	Delete your account and data	In-app Delete Account (Profile > Data) or Delete Account page or privacy@onlyfasting.com
Portability (Art. 20)	Receive data in machine-readable format	Contact privacy@onlyfasting.com
Withdraw Consent	Revoke previously given consent	Settings or contact us
Lodge Complaint	Complain to supervisory authority	Your local DPA

To exercise any of these rights, contact us at privacy@onlyfasting.com. We will respond within 30 days.

10. Children's Privacy

Our App is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you are a parent and believe your child has provided us with personal data, please contact us immediately at privacy@onlyfasting.com and we will delete such information.

10b. California Privacy Rights (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You can request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out: You can opt-out of the sale of your personal information. Note: We do not sell your personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us at privacy@onlyfasting.com or use our Delete Account page.

Categories of Information Collected: Identifiers (email, name), health information (with consent), commercial information (subscription status), internet activity (app usage).

Do Not Track: Our App does not respond to "Do Not Track" signals as there is no industry standard for this.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new policy on this page
• Updating the "Last updated" date
• Sending an in-app notification for significant changes

12. Contact Us