Privacy Policy

This policy describes Flabsolutely’s food logging, nutrition estimates, workout planning and tracking, progress tools, AI coach, and connected account features. Flabsolutely is a general wellness service. Information you provide can still be sensitive health data even when it is not part of a medical record. The separate Consumer Health Data Privacy Policy gives more detail about that information.

Account information includes your email, account identifier, authentication information, and, if you use Google sign-in, the identity information Google provides, such as your name and profile image. Email signup does not require a profile display name. Our authentication provider handles password authentication.

You may provide your birthday, gender, height, weight, target weight, activity level, goals, available exercise equipment, food descriptions, portions, saved nutrition estimates, workout plans, exercises, sets, repetitions, loads, and completion history. We also process derived calorie targets, progress summaries, and other estimates based on those records.

AI features process your prompts, food photos, relevant account context, generated answers, and requested actions. Coach conversations and tool activity can be saved to support conversation history. Avoid including unnecessary medical records, information about other people, or unrelated sensitive details in prompts and photos.

Operational information can include request times, IP addresses, browser and device information, service errors, usage counts, subscription identifiers and status, and notification endpoints when you enable reminders. Theme and time-zone preferences support the interface and daily logs. We do not request fingerprints, face-recognition templates, or other biometric identifiers for identifying you; body measurements and health-related inferences may nevertheless receive special protection under applicable law.

We use this information to create and secure accounts, store records you choose to save, estimate nutrition, calculate goals and trends, generate and run workouts, answer coach questions using relevant history, deliver requested reminders, manage subscriptions and usage limits, troubleshoot errors, and prevent abuse. We do not use food or fitness records to make insurance, employment, credit, or medical eligibility decisions.

Where EU or UK data protection law applies, account administration and requested services may rely on performance of a contract; security and service reliability may rely on legitimate interests; and required financial or legal records may rely on legal obligations. Processing that requires consent, including applicable special-category health-data processing, requires a separate valid consent or another legally available condition. Reading this policy or accepting general terms is not itself explicit health-data consent.

When you request photo recognition, the app prepares a reduced-size image and sends it through our server to OpenAI to estimate the visible food and nutrition. The web preview stays temporarily in memory. Flabsolutely does not attach the photo to the saved food record or place it in a photo library. Saved entries contain food names, portions, nutrition values, and the date.

This does not mean the photo never leaves your device or that all service-provider copies are immediately erased. AI providers process requests under their applicable service terms, security controls, and retention arrangements. Coach requests may include your relevant profile, food, and workout history. Verify generated estimates and suggestions before relying on them.

Supabase provides account authentication and application data storage. OpenAI processes requests for food recognition, nutrition estimation, and AI coaching. Stripe handles checkout, payment details, recurring subscriptions, and billing management; Flabsolutely stores billing identifiers and subscription status rather than full payment-card details. Hosting and infrastructure providers deliver the service and process operational requests. Google participates when you choose Google sign-in. Browser and push-service providers deliver notifications when you enable them.

If you authorize an external assistant or connected application, it may access or act on account information within the permissions you approve. Review that application’s permissions and privacy terms. Such access is distinct from our service providers processing data for us.

We may disclose information when required by law or to address fraud, security incidents, or legal claims, subject to applicable protections. The current application does not include third-party advertising integrations or sell personal information. See the separate Do Not Sell or Share page for details about advertising-related sharing.

Saved account, food, workout, weight, and conversation records remain associated with your account until you delete them or your account, subject to necessary legal, billing, fraud-prevention, and security retention. Account deletion removes application records linked to your profile and attempts to cancel an active Stripe subscription. Payment-provider records and backup or security copies may follow separate retention schedules; account deletion is not a promise of immediate erasure from every provider system.

Access controls and account-scoped database permissions help protect your records. No internet service can guarantee absolute security. Protect your sign-in credentials and review any connected applications.

Providers may process information in countries other than your own. Where applicable, international transfers require an appropriate legal transfer mechanism and safeguards. Contact us for information about the arrangements relevant to your account.

You can review and edit profile information, food entries, workouts, and saved records through the app. Manage subscription billing, reminders, theme preferences, and account deletion from Profile. You can disable notifications in your browser or device settings and remove local preferences through browser storage settings.

Depending on where you live, you may have rights to access, correct, delete, obtain a portable copy, restrict or object to processing, withdraw consent, and appeal a denied request. Submit a request using the contact information below and identify the account concerned; do not send passwords, payment-card numbers, or unnecessary health details. We may need proportionate identity verification for access or deletion, but do not require an account or identity verification merely to opt out of advertising-related sale or sharing.

Withdrawal does not change the lawfulness of earlier processing. Health-data features that require the withdrawn permission may no longer be available. You may complain to your local data protection authority; Washington residents may also contact the Washington Attorney General. We do not penalize you for exercising rights protected by law.

Flabsolutely is intended for adults aged 18 and older. Do not create an account or submit information about a child. If you believe a child has provided personal information, contact us so we can investigate and address it.

We update this policy as practices change and identify the revision date above. Material changes may require additional notice or renewed consent before new processing begins.