Privacy Policy

Effective April 25, 2026 · Last updated July 2, 2026 · v2.0

FitGlass is an iOS calorie and macronutrient tracking app built and operated by Nisarg Chaudhary as an independent developer. This page explains, in plain English, what data FitGlass collects, where it goes, who can see it, and how you remove it. If something here is unclear or inaccurate, email fitglass.app@gmail.com and it will be corrected.

The short version. FitGlass stores your account, profile, and food log in Firebase under your own user ID. Food descriptions and photos you send to the AI logger are passed through to Anthropic for analysis; Anthropic deletes them within 30 days and never uses them to train models. Your Apple Health data stays on your device. We don’t sell your data, don’t track you across apps or websites, and don’t run advertising. You can export or delete everything from inside the app at any time.

Washington and Nevada residents: FitGlass also maintains a separate Consumer Health Data Privacy Policy as required by those states’ health-data laws.

Who we are

FitGlass is developed and operated by Nisarg Chaudhary, an individual independent developer. For the purposes of data-protection law (including the GDPR), Nisarg Chaudhary is the data controller for the personal data described in this policy. Contact: fitglass.app@gmail.com.

Information we collect

Account information

You can sign in three ways. What we receive depends on the method:

• Sign in with Apple / Google. Your email address, your name (Apple provides it only on first sign-in; Google on every sign-in), and an opaque provider identifier that lets you sign back in. FitGlass never sees your Apple ID or Google account password.
• Email and password. Your email address, a display name you choose, and a password. The password is transmitted directly to Firebase Authentication and stored by Google in hashed form — our servers and the app never store your plain-text password. Password resets are handled by a Firebase-generated email link.

Firebase Authentication also logs IP addresses and user-agent strings for security purposes and keeps them for a few weeks (see Firebase’s privacy documentation).

Profile and goal information

During onboarding you provide (some fields optional):

• Sex, age, weight, height, and activity level
• Your motivation (e.g., lose fat, build muscle, eat mindfully, maintain) and, where applicable, a target weight and pace
• Dietary preferences (e.g., vegetarian, vegan) and a typical meal schedule, if you choose to set them
• Daily calorie, protein, carbohydrate, fat, and fiber targets — calculated from the above using the Mifflin–St Jeor equation, or set manually
• Display preferences: which macro bars appear on your dashboard, and your chosen dashboard theme

This information is used solely to compute your daily targets and render your dashboard. It is never sold or shared for marketing.

Food and nutrition data

Every food you log is stored as a structured record:

• Food name (free text, AI-identified, or matched USDA entry)
• Macros (calories, protein, carbohydrates, fat, fiber) and — for AI- and database-logged foods — label-set micronutrients (sugar, saturated fat, sodium, cholesterol, potassium, calcium, iron, vitamins A/C/D)
• Meal type (breakfast / lunch / dinner / snack), serving details, and timestamp
• The logging path (manual, USDA search, quick-add, or AI chat)

Our backend also maintains derived daily and monthly nutrition totals (aggregates of the entries above) to power charts efficiently. These are projections of your food log, not additional data.

AI conversation content

When you use the AI food-logging chat (text, photo, or both):

• The text you type and any photo you attach (resized and compressed on your device first) are sent to our backend — a Firebase Cloud Function — which forwards them to Anthropic’s Claude API.
• Each request also includes context so the AI can respond sensibly: your daily targets, a compact summary of up to 12 of today’s logged entries (name, meal type, calories), and your frequently repeated meals from the past 14 days (so “my usual breakfast” resolves to your actual foods). This context is recomputed from your food log on each request — nothing extra is stored to support it.
• The AI returns structured food suggestions which the app shows you before anything is logged. You always confirm the food cards before they become entries.
• When you save foods from an AI proposal, we keep a small correction record: what the AI proposed versus what you actually saved (food names, calories, meal type). We use these records to measure and improve the AI’s accuracy. They are stored under your account and deleted with it.

Feedback you send us

If you use Profile → Send Feedback, the app pre-fills an email containing the app version and build number, your device model and iOS version, your Firebase user ID, and the IDs (not names) of your last three logged entries — so we can correlate your report with server logs. The body contains no food names, nutrition data, or chat content, and you can edit it before sending. Feedback goes to a Gmail inbox operated by the developer.

Operational metadata

To run the service safely, the backend records:

• A daily counter of your AI requests (rate limiting — currently 20 per UTC day).
• Daily AI token-usage totals per account (cost monitoring, not a user-facing feature).
• A short-lived record of each AI response (kept for about 10 minutes) so that if your app retries a request — for example after a network drop — you get the same answer back instead of being charged a second request. These records expire automatically.
• Structured server logs containing your user ID, latency, and event names. These logs do not include your food names, photos, or message contents.

What we do not collect

• Your location (no location services usage)
• Your contacts
• Your advertising identifier (IDFA) — we never request tracking permission
• Your browsing history, or any cross-app / cross-website activity

How we use your information

We use the data described above only to:

1. Authenticate you and route you to your own data.
2. Compute your nutrition targets and render your dashboard, weekly chart, and Home Screen widget.
3. Resolve your AI chat messages into food suggestions you can review and log.
4. Measure and improve the AI logger’s accuracy using correction records (proposed vs. saved).
5. Enforce daily rate limits and monitor operating costs so the service cannot be abused.
6. Diagnose crashes and operational errors.
7. Respond to feedback and honor your requests to export or delete your data.

We do not use your data for advertising, marketing profiling, or sale, and we do not use it to train AI models — neither ours (we have none) nor Anthropic’s (see “AI logging” below).

How we share your information

FitGlass shares your data only with the service providers (processors) required to run the app, and only to the extent each needs to perform its function:

We do not sell your personal information, and we do not share it with advertisers, data brokers, or marketing networks. We have no affiliates or subsidiaries.

If we are ever legally compelled to disclose your data (subpoena, court order, regulatory requirement), we will comply only as required by law and notify you where lawfully permitted.

Data storage and security

Where your data lives

• Account, profile, food entries, derived totals, correction records, operational metadata: Google Cloud Firestore, nam5 multi-region (United States). Stored under your unique user ID.
• AI conversation transcripts: not persisted on our servers. The transcript is held in memory on your device and discarded when you close the AI chat. Our backend briefly retains the structured response to each request (~10 minutes, for retry protection) and Anthropic retains request content for up to 30 days (see “AI logging” below).
• Apple Health data: on your device only. See “Apple Health (HealthKit)” below.
• Widget data and reminder settings: on your device only, in an App Group container shared between the app and the Home Screen widget. Meal reminders are local notifications; their schedule never leaves your device.
• USDA food database: bundled with the app as read-only public reference data — not user data. It involves no network requests.

Account isolation

Firestore security rules scope all data to your authenticated user ID; no other user — and no unauthenticated request — can read or write your namespace. Sensitive operational records (rate-limit counters, usage metrics, retry-protection records) are server-write-only and cannot be modified from a client, even by you.

Transit and at-rest encryption

All network traffic between the app and our backend uses HTTPS/TLS. Firestore and Firebase Authentication encrypt data at rest using Google Cloud’s standard infrastructure encryption. The Anthropic API key used by our backend is stored in Google Secret Manager and never embedded in the app binary.

Abuse prevention

AI requests are capped server-side (currently 20 per user per UTC day), authenticated end-to-end, and user-provided text is sanitized before being embedded in AI prompts. These limits cannot be bypassed by a modified app.

How long we keep your data

Apple Health (HealthKit)

If you grant HealthKit access, FitGlass:

• Reads your active energy, resting energy, step count, exercise minutes, and workout history — to display your daily burn and activity alongside calories consumed. This data is displayed on your device only. It is never uploaded to our servers, never sent to Anthropic, and never included in AI prompts.
• Writes dietary calories, protein, carbohydrates, fat, and fiber for foods you log, so your nutrition appears in Apple’s Health app alongside other sources.

You choose exactly which types to allow when iOS shows the permission sheet, and you can revoke access at any time from Settings → Privacy & Security → Health → FitGlass.

Consistent with Apple’s App Review Guidelines (§5.1.3), we never use HealthKit data for advertising, marketing, or data mining, never sell it or disclose it to third parties, and never store it in iCloud.

Important: per Apple’s design, uninstalling the app or deleting your FitGlass account does NOT remove the dietary entries FitGlass wrote to the Health app. If you want those gone too, delete them from the Health app yourself (Browse → Nutrition → data source FitGlass). The in-app account-deletion flow reminds you of this.

AI logging (Anthropic)

Food descriptions and photos you send through the AI chat go to Anthropic’s Claude API via our Firebase Cloud Function. Specifically:

• The current chat session’s messages — including any photos, compressed and base64-encoded — are sent. Once you save a photo-based proposal, later messages in that session reference the identified foods by name instead of re-sending the photo.
• Your daily targets, up to 12 of today’s logged entries (name, meal type, calories), and your repeated meals from the past 14 days are included so the AI can respond in context.
• Your identity is not sent: no user ID, email, or name goes to Anthropic. Only our Cloud Function knows which request belongs to which account.

Per Anthropic’s commercial terms and data-retention policy: API inputs and outputs are not used to train Anthropic’s models, and Anthropic automatically deletes them from its backend within 30 days. If content is flagged as violating Anthropic’s usage policy, Anthropic may retain that content for up to 2 years per its trust-and-safety terms.

On our side, the structured response (identified foods and their nutrition — not your raw message or photo) is retained for about 10 minutes for retry protection, then expires automatically. When you commit an AI proposal, the proposed-vs-saved delta is kept as a correction record (see “Information we collect”) to improve accuracy.

Analytics and crash reporting

FitGlass uses two Firebase products for operational telemetry. Both are disabled in development builds and active only in TestFlight / App Store builds.

• Firebase Crashlytics — when the app crashes, a stack trace and basic device metadata (model, iOS version, build number) are sent to Firebase on next launch. Your Firebase user ID is attached so we can correlate a crash with your account if you report a problem. Crash reports never include food entries, profile data, or AI messages. Google retains crash data for 90 days.
• Firebase Analytics — collects usage events (app opens, sessions, and a food_logged event carrying only the logging method, meal type, and a rounded calorie number) plus standard device metadata. Your Firebase user ID is attached to these events so we can understand real usage per account during the beta — this is app-internal measurement, not advertising. Food names, chat text, photos, and any content you author are never sent to Analytics.

No data is used to track you across other companies’ apps or websites (NSPrivacyTracking is false in our privacy manifest), nothing is shared with ad networks or data brokers, and the app never requests the iOS tracking permission.

Your rights and how to exercise them

You can act on your data at any time, from inside the app, without contacting us:

• Access / export. Profile → Export my data produces a JSON file containing your profile and your food entries from the past 365 days. Share it anywhere via the iOS share sheet. For a complete copy including anything older, email us.
• Correction. Edit your profile from Profile → Edit profile; edit or delete any logged entry from the Dashboard.
• Deletion. Profile → Delete account (with re-authentication) immediately deletes your food entries, profile, and authentication account. Residual server-side records (derived totals, correction records, rate-limit counters, usage metrics) are removed by a server-side cleanup within 30 days, and Google purges authentication data from backups within 180 days. Deletion is permanent — signing in again later creates a fresh, empty account.

HealthKit data must be deleted by you from the Health app — Apple does not let third-party apps remove HealthKit entries on your behalf.

For anything else — a full export, a deletion you can’t perform in-app, or any question — email fitglass.app@gmail.com from the address on your account (that’s how we verify it’s you). We respond within 7 days and honor requests within the timeframe your local law requires.

US state privacy rights

If you live in California or another US state with a comprehensive privacy law (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others), you have rights to know, access, correct, delete, and obtain a portable copy of your personal information — all of which the in-app tools above already provide, to everyone, regardless of state.

• We do not sell your personal information, and we do not share it for cross-context behavioral advertising. There is nothing to opt out of.
• We do not use sensitive personal information for anything beyond providing the service you asked for.
• We will never discriminate against you for exercising a privacy right.
• You may use an authorized agent to submit requests by email; we will verify the request with you directly.
• If we decline a request, you may appeal by replying to our response; we will answer the appeal within the period your state’s law requires.

Consumer health data (Washington & Nevada)

Nutrition, body-measurement, and fitness information is “consumer health data” under Washington’s My Health My Data Act and Nevada’s SB 370. Residents of those states: see our separate Consumer Health Data Privacy Policy for the required disclosures — categories collected, sources, purposes, sharing, and how to exercise your rights to access, withdraw consent, and delete. In short: we collect health data only to run the app for you, we share it only with the processors listed above, and we never sell it.

Users in the EEA, UK, and Switzerland

Lawful bases

International transfers

FitGlass data is processed in the United States (Firestore nam5; Cloud Functions in us-central1; Anthropic in the US). Transfers from the EEA, UK, and Switzerland are protected by our processors’ safeguards — Google and Anthropic each rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses in their data-processing terms.

Your rights

You have the rights of access, rectification, erasure, restriction, portability, and objection (GDPR Arts. 15–21), and the right to withdraw consent at any time without affecting prior processing. Exercise them via the in-app tools or by email. You also have the right to lodge a complaint with your local supervisory authority.

Children’s privacy

FitGlass is not directed to children and is not intended for anyone under 13 (or the higher minimum age your jurisdiction sets for consenting to data processing — e.g., up to 16 in parts of the EEA). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has created an account, contact fitglass.app@gmail.com and the account and its data will be deleted.

Changes to this policy

If this policy materially changes — a new processor, a new category of data, or a new use of existing data — the “Last updated” date at the top will be revised and the change summarized in the change log below. For significant changes, an in-app notice will appear before the change takes effect. Continuing to use FitGlass after the effective date of a revised policy means you accept it; if you don’t, you can delete your account from the Profile screen.

Contact

For privacy questions, data requests, or anything else covered by this policy, email fitglass.app@gmail.com. Responses within seven days.

Change log

• v2.0 — July 2, 2026.
  • Email/password sign-in is now available (v1 said it was disabled). Added a description of how passwords are handled.
  • Corrected the analytics description: Firebase Analytics events carry your Firebase user ID and a food_logged event (method, meal type, rounded calories) — v1 described analytics as anonymous. No content (food names, messages, photos) is sent, as before.
  • Disclosed that the structured AI response is retained server-side for ~10 minutes for retry protection (v1 said requests were dropped immediately; the raw request still is).
  • Disclosed AI correction records (proposed-vs-saved food names and calories, used to improve accuracy).
  • Expanded the HealthKit section: reads now cover active energy, resting energy, steps, exercise minutes, and workouts (display-only, on-device); writes now include fiber.
  • Added: server-maintained daily/monthly nutrition totals, the feedback-email contents, precise Anthropic retention terms (30-day deletion, no training), a full retention schedule, US state rights, EEA/UK lawful bases and transfer safeguards, and a separate Consumer Health Data Privacy Policy for Washington and Nevada residents.
• v1.0 — April 25, 2026. Initial policy.