Privacy Policy

Last Updated: November 1, 2026

FitDine Inc., a corporation organized under the laws of the State of Wyoming, USA (“we,” “us”), operates the FitDine mobile application, the website at fitdine.app and related services (the “Services”). This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices and rights you have. The Services are available to users worldwide. Where the laws of your region require it, additional information and rights are described in this Policy.

1. Age Restriction; Children’s Privacy (COPPA)

The Services are intended only for individuals aged eighteen (18) and over. We do not knowingly collect personal information from anyone under 18, and the Services are not directed to children, including children under 13 within the meaning of the U.S. Children’s Online Privacy Protection Act (COPPA), or minors under the applicable age of digital consent in any other country. If we learn that we have collected personal information from a person under 18, we will delete it promptly and may terminate the account. If you believe a minor has provided us with personal information, contact support@fitdine.app.

2. Information We Collect

Information you provide:

- Account and profile information: email address, name, age.

- Health and wellness information (“Sensitive Health Data”): height, weight, target weight, activity level, dietary goals, food allergens and dietary preferences, and meal logs and notes.

- Location information: your ZIP code or, if you allow it, your device location, which we use to find restaurants near you. We use precise location only to answer that request and do not store it on our servers.

- Images and menus: menu content and food images that you submit for analysis (“scan photos”). Scan photos are stored securely in your private account on our servers until they are deleted automatically 7 days after the scan (see Section 7), and are not shared publicly by us, unless you explicitly choose to share them using the app’s external sharing features.

- Profile photo (optional): if you choose to add a profile photo, the image you upload. You are not required to provide one. Your profile photo is stored securely in your private account on our servers and is visible only to you; it is not shared with other users or publicly by us, unless you explicitly choose to share it externally. We do not use facial recognition and do not create biometric templates from your photo.

- Communications: messages you send us, such as support requests.

Information from Apple Health (iOS only): If you grant permission, the app reads your step count from Apple HealthKit. You control this permission and can change or revoke it at any time in your iOS Settings (Health > Data Access & Devices).

Information collected automatically: basic technical and usage information, such as device model, operating system and version, app version, language, IP address (and the approximate location derived from it), the screens you open and the features you use (for example adding meals, scanning and subscribing), diagnostic and log data, and subscription status.

Information from third parties: purchase and subscription status from Apple, Google, Stripe and Adapty (we do not receive your full payment card details), and marketing attribution information, such as the ad that led you to install the app, from AppsFlyer.

3. Sensitive Health Data and Your Explicit Consent

Your Sensitive Health Data (including information you provide about your body metrics, goals, dietary needs and allergies, and your step count from Apple Health) is considered sensitive personal information or “consumer health data” under various laws, including U.S. state privacy laws and, where applicable, the EU and UK General Data Protection Regulations (GDPR).

We collect and process Sensitive Health Data only with your explicit consent, which we request separately at registration (through an affirmative action, such as an unticked checkbox) before you provide that data. The Apple Health permission is a separate consent that you grant through the iOS permission prompt. We use Sensitive Health Data only to provide, personalize, secure and improve the Services you request. You can withdraw consent at any time by deleting the relevant data or your account in the app, revoking the Apple Health permission in iOS Settings, or emailing support@fitdine.app. Withdrawal does not affect prior lawful processing, and some features may stop working.

If you are located in the European Economic Area (EEA), the United Kingdom or Switzerland, this explicit consent is the legal basis for our processing of special category data under Article 9(2)(a) of the GDPR and the UK GDPR.

Apple HealthKit Data

Data collected from Apple HealthKit is used solely to provide the app’s core tracking functionality. We will never use Apple HealthKit data for marketing or advertising, and we will never sell it, or disclose it to data brokers, advertising platforms or information resellers. We do not disclose HealthKit data to third parties other than the service providers that host and process it on our behalf under contract (see Section 5), and we do not store it in iCloud. HealthKit data is not transmitted to our AI providers. We also do not send HealthKit data to our analytics or marketing attribution partners.

4. How We Use Information

We use personal information to:

- provide, operate and personalize the Services, including calculating goals and generating nutrition and meal suggestions;

- create and manage your account, display your optional profile photo within your account, and authenticate you;

- analyze menus and food images you submit using AI Features;

- process subscriptions and manage access to paid features;

- provide customer support and send service-related communications;

- send you marketing and promotional communications, where permitted by law (using your email address only, and never using Apple HealthKit data);

- maintain security, prevent fraud and abuse, and debug and improve the Services;

- understand how the Services are used, and measure and improve the effectiveness of our marketing campaigns;

- comply with legal obligations and enforce our Terms; and

- create aggregated or de-identified data that cannot reasonably identify you, which we may use for lawful business purposes.

We do not use Sensitive Health Data for advertising or for any purpose materially unrelated to those above without your consent.

Legal bases (EEA, UK and Switzerland). If you are located in the EEA, the UK or Switzerland, we process your personal data on the following legal bases:

- Provide, operate and personalize the Services, including the optional profile photo: Contract (Art. 6(1)(b)); explicit consent for Sensitive Health Data (Art. 9(2)(a))

- Create and manage your account; customer support: Contract

- Process subscriptions and payments: Contract; legal obligation

- Security, fraud prevention, debugging and improving the Services: Legitimate interests

- Analytics and marketing attribution: Consent, where required by law (including in the EEA and the UK); otherwise legitimate interests

- Marketing communications and non-essential cookies: Consent, where required by law; you may withdraw it at any time

- Legal compliance and defending legal claims: Legal obligation; legitimate interests

5. How We Share Information

We do not sell your personal information for money. Our use of the marketing attribution partner described below may be considered “sharing” of personal information for cross-context behavioral advertising or “targeted advertising” under some U.S. state laws, and you can opt out as described in Section 9. We disclose information only as follows:

- Infrastructure: Supabase provides our database and backend. Data is hosted on Amazon Web Services (AWS) in the us-east-1 region (Virginia, USA).

- AI providers: OpenAI and Anthropic process menu content, food images and related inputs through their APIs to power our AI Features. Data sent to these providers through their APIs is not used by them to train their foundational models. These providers may retain API inputs for a limited period solely for safety, abuse-prevention and legal-compliance purposes under their applicable API terms. We send only the information reasonably necessary for the requested feature, and we do not send your profile photo to these providers. We ask for your permission in the app before your first scan is sent to an AI provider.

- Analytics: We use Amplitude to understand how people use the Services and to improve them. Amplitude receives the screens you open and the features you use (for example adding meals, scanning and subscribing); your device model, operating system and app version; your language; and your IP address and the approximate location derived from it.

- Marketing attribution: We use AppsFlyer to measure which ads lead to installs, registrations and subscription purchases. AppsFlyer receives which ad you came from; your install, registration and subscription purchase events; your device identifier, IP address, device model and operating system; and, on iOS, your advertising identifier (IDFA) only if you allow tracking in the iOS permission prompt.

- What we do not send to these partners: We do not send Amplitude or AppsFlyer your name or email address; your weight, height, age or sex; your food allergens, dietary goals or meal logs; Apple HealthKit data (including step counts); your precise location; or your messages or photos.

- Communication Providers: We use third-party email service providers (such as Resend) to send authentication codes, service updates, and marketing emails. They process your contact information strictly on our behalf.

- Payments and subscriptions: Purchases are processed exclusively through the Apple App Store, Google Play and, for web purchases, Stripe. In-app subscriptions are managed using the Adapty SDK, which processes subscription and transaction status and device identifiers on our behalf. We do not process or store raw credit card data.

- Legal and safety: to comply with law, subpoenas or legal process, enforce our Terms, or protect the rights, safety and security of the Company, our users or others.

- Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to protections consistent with this Policy.

- With your consent or at your direction (for example, if you choose to use our sharing features to post your progress, photos, or meal logs to your social media networks, the information you select will be shared with those third-party platforms).

These service providers may use your information only to perform services for us and are bound by contractual confidentiality and data-protection obligations.

6. Cookies and Similar Technologies

Our website uses cookies and similar technologies as described in our Cookie Policy. The mobile app does not use browser cookies, but may use device storage and the SDKs described above to operate. Our Services do not respond to “Do Not Track” browser signals because there is no uniform standard, but we honor Global Privacy Control signals where required by law. The analytics and marketing partners described in Section 5 may collect information about your use of the Services over time.

7. Data Retention

We keep personal information only as long as necessary for the purposes described in this Policy. Unless a longer period is required or permitted by law: account data (including any profile photo) and health data are retained while your account is active and deleted or de-identified within thirty (30) days after account deletion; transaction records are retained for seven (7) years for tax and accounting purposes; and backups are overwritten on a cycle of up to thirty (30) days. We may retain information longer to resolve disputes, enforce agreements or comply with law. Scan photos (meal and menu photos you submit to AI Features) are deleted automatically 7 days after the scan.

8. Security

We use reasonable administrative, technical and organizational safeguards, including encryption in transit and access controls, to protect personal information. No system is completely secure, and we cannot guarantee absolute security. We will notify you of a data breach as required by applicable law.

9. Your Rights and Choices

All users. You can review and update most account, profile and dietary information in the app, delete your account, and manage Apple Health and device permissions in your device settings.

Marketing communications. We may send you marketing and promotional communications. You can opt out of these emails at any time by using the unsubscribe link provided in the emails. Where required by law (including in the EEA and the UK), we send marketing communications only with your consent.

U.S. state privacy rights. Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and similar state laws, residents of certain states have privacy rights. As a best practice, we extend the following rights to all U.S. users, subject to legal exceptions:

- Access/Know: the categories and specific pieces of personal information we collect, use and disclose;

- Deletion: request deletion of your personal information;

- Correction: request correction of inaccurate information;

- Portability: obtain a copy of your information in a portable format;

- Opt out of sharing and targeted advertising: you can opt out of sharing your data with our marketing attribution partner through the privacy controls in the app or by emailing support@fitdine.app, and on iOS you can decline or revoke tracking in your device settings; we also honor Global Privacy Control signals where required by law;

- Limit use of sensitive personal information: we use sensitive personal information only for the purposes described above;

- Withdraw consent to the processing of Sensitive Health Data;

- Appeal a denied request; and

- Non-discrimination for exercising your rights.

Categories collected in the past 12 months: identifiers (name, email, device identifiers and, on iOS, your advertising identifier if you allow tracking); characteristics (age); commercial information (subscription status); internet and device activity (such as screens viewed and features used); geolocation (ZIP code, approximate location derived from your IP address and, if you allow it, precise device location); visual information (optional profile photo); and sensitive personal information (health and wellness information and, if you allow it, precise geolocation). We collect these for the purposes in Section 4 and disclose them to the categories of service providers in Section 5.

To exercise your rights, email support@fitdine.app from your account email or use the in-app account controls. We may verify your identity and will respond within 45 days (with a possible extension as permitted by law). Authorized agents may submit requests with proof of authorization. We honor Global Privacy Control opt-out signals where required by law.

EEA, UK and Switzerland (GDPR). If you are located in the EEA, the UK or Switzerland, you also have the right to: access your personal data; have inaccurate data rectified; request erasure (the “right to be forgotten”); restrict or object to processing, including processing based on legitimate interests and direct marketing; receive your data in a portable format; and withdraw your consent at any time without affecting prior lawful processing. You may also lodge a complaint with your local data protection supervisory authority. To exercise these rights, contact us as described above.

Other countries. If you live in another country whose privacy laws give you additional rights (for example Canada, Brazil or Australia), you may exercise those rights by contacting support@fitdine.app, and we will respond as required by applicable law.

10. Third-Party Services

The Services may link to or rely on third-party services. This Policy does not apply to information processed by third parties independently of us. We encourage you to review their privacy policies.

11. International Transfers

We are based in the United States, and your information is stored and processed in the United States (including on servers hosted in Virginia, USA). If you use the Services from outside the United States, your information will be transferred to, and processed in, the United States, whose data protection laws may differ from those of your country. For transfers of personal data from the EEA, the UK or Switzerland, we rely on appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission (together with the UK addendum or international data transfer agreement, where applicable) or the EU–U.S. Data Privacy Framework where the recipient is certified. You may request a copy of the relevant safeguards by contacting us.

12. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new “Last Updated” date and, for material changes, notify you through the Services or by email and, where required by law, obtain renewed consent before using previously collected information for a materially different purpose.

13. Contact

FitDine Inc. | support@fitdine.app