Privacy Policy

1. Introduction

Only Fasting ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application ("App").

By using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the App.

2. Data Controller

For any privacy-related questions or to exercise your data rights, please contact us at the email address above.

3. Data We Collect

3.1 Information You Provide

Data Type	Examples	Purpose
Account Information	Email, name, profile photo	Account creation & authentication
Fasting Data	Start/end times, fasting plans, streaks	Core app functionality
Hydration Data	Water intake amounts, timestamps	Hydration tracking feature
Willpower Entries	Resisted cravings, calories avoided	Motivation tracking
Preferences	Language, notification settings, goals	Personalization
Health & Fitness Data	Weight, height, BMI, body fat percentage, calorie intake, macronutrient data (protein, carbs, fat), meal logs	Nutrition tracking & personalized calorie goals
AI Analysis Data	Food/activity descriptions submitted for AI analysis	AI-powered calorie & nutrition estimation (processed by Google Gemini)

3.2 Information Collected Automatically

Data Type	Examples	Purpose
Device Information	Device model, OS version, unique identifiers	App functionality & support
Usage Data	Features used, session duration	App improvement
Crash Reports	Error logs, stack traces	Bug fixing

4. How We Use Your Data

• Provide Services: Track your fasting periods, hydration, and progress
• Sync Data: Keep your data synchronized across devices when you create an account
• Send Notifications: Remind you about fasting start/end times and hydration
• Process Payments: Handle premium subscription transactions
• Improve App: Analyze usage patterns to enhance features
• Customer Support: Respond to your inquiries and requests
• Legal Compliance: Meet legal obligations and protect our rights

5. Legal Basis for Processing

Under GDPR Article 6 and Article 9

Processing Activity	Legal Basis
Account creation & authentication	Contract performance (Art. 6(1)(b))
Fasting & hydration tracking	Contract performance (Art. 6(1)(b))
Health data processing	Explicit consent (Art. 9(2)(a))
Push notifications	Legitimate interest (Art. 6(1)(f))
Analytics & improvement	Consent (Art. 6(1)(a))
Subscription processing	Contract performance (Art. 6(1)(b))

6. Third-Party Services

We use the following third-party services to operate our App:

Service	Purpose	Data Shared	Location
RevenueCat	Subscription management	Purchase data, anonymous user ID	USA
Apple (Sign in with Apple)	Authentication	Email (optional), name	USA
Supabase	Database hosting	All user data (encrypted)	EU (Frankfurt, Germany)
Firebase / APNs	Push notifications	Device tokens only	USA
Google Gemini	AI food & activity analysis	Food/activity descriptions & photos (no personal identifiers sent)	USA
PostHog	Product analytics (with consent)	Anonymous usage events, device type, app version	EU (Germany)
Sentry	Error monitoring (with consent)	Crash reports, error logs (anonymized)	USA
Google (Sign in with Google)	Authentication	Email, name, profile photo	USA

6.1 AI Data Processing Disclosure

Data sent to AI: Only the food/activity description text (max 150 characters) or photo you submit. No personal identifiers (email, name, user ID, health data, fasting history) are included in AI requests.

AI model training: Your data is not used for training Google Gemini models (per Google Gemini API Terms of Service).

Automated decision-making: AI calorie estimation is an automated decision-making process. Results are estimates only and not medical advice. You can always edit results manually or opt out of AI analysis entirely via Privacy Settings.

Consent required: AI analysis requires your explicit consent, which you can withdraw at any time from the app's Privacy Settings.

6.2 Cross-Border Data Transfers

Some of your data is transferred outside the European Economic Area (EEA) to the United States. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs): Agreements with US-based processors that provide EU-equivalent data protection
• Data Processing Agreements (DPAs): Signed with all third-party data processors
• Data minimization: Only necessary data is transferred; personal identifiers are excluded where possible
• Encryption: All transfers use TLS 1.3 encryption

For Turkish users, cross-border transfers are conducted under KVKK Article 9 with explicit consent. See our KVKK Illumination Text for details.

7. Data Storage & Security

7.1 Where We Store Data

Your fasting, hydration, and nutrition data is stored locally on your device by default. When you create an account and sign in, your data is synced to secure servers located in the European Union (Frankfurt, Germany). You can use the App without creating an account; in that case, all data remains on your device only.

7.2 Security Measures

• All data transmitted using TLS 1.3 encryption (HTTPS)
• Passwords hashed using bcrypt with salt
• Database encrypted at rest
• Regular security audits
• Access controls and authentication for all systems
• Rate limiting and brute force protection

8. Data Retention

Data Type	Retention Period
Account data	Until account deletion
Fasting history	Until account deletion
Health tracking data	Until revoked or account deletion
Analytics data (PostHog)	12 months (anonymized)
AI analysis inputs	Not stored (processed in real-time, discarded)
Audit logs	2 years (anonymized after deletion)
Subscription records	7 years (legal requirement)

After account deletion, your personal data is permanently removed within 30 days, except where retention is required by law.

9. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

Right	Description	How to Exercise
Access (Art. 15)	Request a copy of your data	Contact privacy@onlyfasting.com
Rectification (Art. 16)	Correct inaccurate data	Profile > Edit Name
Erasure (Art. 17)	Delete your account and data	In-app Delete Account (Profile > Data) or Delete Account page or privacy@onlyfasting.com
Portability (Art. 20)	Receive data in machine-readable format	Contact privacy@onlyfasting.com
Withdraw Consent	Revoke previously given consent	Settings or contact us
Lodge Complaint	Complain to supervisory authority	Your local DPA

To exercise any of these rights, contact us at privacy@onlyfasting.com. We will respond within 30 days.

10. Children's Privacy

Our App is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you are a parent and believe your child has provided us with personal data, please contact us immediately at privacy@onlyfasting.com and we will delete such information.

10b. California Privacy Rights (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You can request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out: You can opt-out of the sale of your personal information. Note: We do not sell your personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us at privacy@onlyfasting.com or use our Delete Account page.

Categories of Information Collected: Identifiers (email, name), health information (with consent), commercial information (subscription status), internet activity (app usage).

Do Not Track: Our App does not respond to "Do Not Track" signals as there is no industry standard for this.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new policy on this page
• Updating the "Last updated" date
• Sending an in-app notification for significant changes

12. Contact Us