MyProgressFit Logo
MyProgressFit
ES EN
Back to MyProgressFit
Official Documentation

Privacy Policy

At MyProgressFit, we take the security and privacy of your personal and health data very seriously.

Last updated: October 18, 2026

This Privacy Policy describes how Sergio ("the Controller", "we", "us", or "our") collects, uses, protects, and processes personal data from users ("user", "you", or "your") across the MyProgressFit mobile application (the "App") and our informational website (together, the "Services").

MyProgressFit is a nutritional tracking and fitness mobile application for personal use. We are firmly committed to protecting your privacy and complying with the European Union General Data Protection Regulation (GDPR - Regulation EU 2016/679), Spanish Organic Law 3/2018 (LOPDGDD), and other applicable privacy regulations in Spain and the European Union.

We encourage you to read this document carefully. If you do not agree with the processing of your data under these terms, please do not use the App. For any questions or inquiries, contact us at support@myprogressfit.com.

Request Account Deletion

  • From the App: Profile > Account > Delete account.
  • Without the App installed: email support@myprogressfit.com from the address linked to your account stating you want it deleted; we may ask you to confirm your identity.
  • What is deleted, what may be kept, and retention periods: see Section 8.

Executive Summary

Who is the Controller? Sergio , contactable via support@myprogressfit.com.

Minimum Age (18+): Use of the App is strictly restricted to adults aged 18 and over. We do not collect data from minors.

What data do we process? Account data (email, password protected with cryptographic hash or Google Sign-In identifier), initial profile (date of birth, biological sex, height, current weight, activity level, fitness goals), dietary preferences and food allergies, meal and macronutrient logs, custom foods, weight history, body measurements, optional progress photos, and minimal technical diagnostic logs.

Health Data, Body Measurements & Progress Photos (Special Category): Certain data you enter (food allergies, weight logs, body measurements, calorie intake, and optional progress photos) constitute health-related data under Article 9 of the GDPR (not biometric identification data). We process them based on your explicit consent obtained via a clear affirmative action (unselected interactive checkbox), recording authorization timestamps internally.

Artificial Intelligence (AI) Features: AI features operate through commercial Google Gemini APIs, transmitting only the parameters strictly required for the requested feature. We never include account details such as your name, email, password, or session tokens. Photos are only processed when you expressly trigger an image analysis feature.

No Ads, No Selling of Data: We do not display third-party advertisements, we do not sell or monetize your personal data, and there is no public social network within the App.

Your Rights: You can access, rectify, erase, restrict, object to, and port your data at any time via the in-app account deletion tool or by emailing us.

1. Data Controller

The controller responsible for processing your personal data under the GDPR and Spanish LOPDGDD is:

2. Age of Majority Requirement (18+)

The App is strictly intended for individuals aged 18 and older. During registration, your birth date is requested to verify age and calculate metabolic requirements. We do not knowingly collect data from minors under 18. If an account created by a minor is identified, we will immediately close the account and permanently delete all associated data.

3. Information and Data We Collect

We collect data directly provided by you in the App, as well as minimal technical logs generated by standard service operation:

A. Account and Authentication Data

  • Email and Password: For direct registration, we store your email address and your password protected using irreversible salted cryptographic hashing (bcrypt).
  • Social Sign-In (Google Sign-In): If you log in via Google Sign-In, we receive your verified email address, Google unique user ID, and name if available. We never access your Google password.

B. Profile and Goal Data

  • Date of birth (for basal metabolic rate calculation and age verification).
  • Biological sex, height, and current weight.
  • Daily activity level and nutritional goal (e.g., fat loss, muscle gain, maintenance).

C. Health, Nutrition, Measurements & Progress Photos (Special Category)

  • Dietary Preferences and Restrictions: Diet style, declared allergies/intolerances, and excluded foods.
  • Meal Plans and Food Logs: Logged meals, foods consumed, macronutrient and calorie targets, and meal timing.
  • User-Created Custom Foods: Nutritional sheets for custom ingredients, recipes, or foods created privately in your account.
  • Weight History and Body Measurements: Periodic weight and body circumference records entered voluntarily (treated as health and fitness tracking data, not biometric identification data).
  • Body Progress Photos (Optional): Progress photos you choose to upload voluntarily. They are private and stored encrypted; they are transmitted over secure connections and only you can view them, through authenticated access. To show them to you, our systems decrypt them in a controlled way (this is not end-to-end encryption). They are not biometric data for unique identification. They are only processed by AI if you explicitly request an image analysis; in that case, the image is sent to the AI provider to perform that analysis. To load them faster, the App keeps a copy in your device's local cache, which may persist between sessions and which the App does not encrypt itself (it relies on your device's protection); you can remove it by uninstalling the App or clearing its data from your device settings.

D. Technical and Diagnostic App Data

  • Server Technical Logs: IP addresses (processed transiently for network perimeter security and abuse mitigation), API request timestamps, and operating system versions.

E. Launch Waitlist (Website)

  • Email and preferences: If you join the waitlist on our website, we process your email, chosen platform (iOS and/or Android), the date and version of your consent, and your subscription status (pending, confirmed or unsubscribed). We use them only to confirm your sign-up and to notify you once when MyProgressFit is available on your chosen platform; we do not subscribe you to newsletters or other marketing. Legal basis: your consent (Art. 6.1.a GDPR), confirmed through an email link. You can unsubscribe at any time from the link in each email or by writing to support@myprogressfit.com. We use Cloudflare Turnstile to prevent form abuse (see section 6).

4. Legal Bases for Processing (GDPR)

We process your personal data under the following legal bases pursuant to Articles 6 and 9 of the GDPR:

  • Contract Performance (Art. 6.1.b GDPR): Necessary to deliver the App service, manage your account, calculate calorie targets, and store your nutritional plans.
  • Explicit Consent (Art. 6.1.a & Art. 9.2.a GDPR): For processing health-related data, body measurements, nutrition logs, and optional progress photos. We collect your explicit consent via a free, informed affirmative action (unselected interactive checkbox) during onboarding or when recording new health data. You may withdraw this consent at any time by deleting your account or contacting us.
  • Legitimate Interest (Art. 6.1.f GDPR): To maintain backend security, prevent unauthorized access, and fix technical bugs.
  • Compliance with Legal Obligations (Art. 6.1.c GDPR): To satisfy judicial or regulatory requirements when legally mandated.

5. Processing in Artificial Intelligence Features

AI features operate through commercial Google Gemini APIs, transmitting only the parameters strictly required for the requested feature. We never include account details such as your name, email, password, or session tokens. Photos are only processed when you expressly trigger an image analysis feature.

  • Data sent to AI: When requesting a recipe recommendation, diet adjustment, or photo analysis, only the technical parameters strictly required for the feature are transmitted (such as calorie goals, macro distribution, dietary restrictions, and where applicable, the specific photo).
  • No account data: Personal account identifiers like name, email, password, or session tokens are never passed to AI endpoints.
  • Provider terms: Processing occurs via commercial Google Gemini APIs under the terms of service governing commercial enterprise API usage.
  • Human supervision: AI suggestions are automated guidelines. Users must always verify ingredients, portions, and nutritional values before preparation and consumption.

6. Third Parties and Service Providers

We rely on trusted technical providers for authentication, transactional emails, secure cloud storage, and AI processing:

  • Google LLC / Google Ireland Limited: Google Sign-In authentication and Artificial Intelligence services (Google Gemini API under commercial terms).
  • Resend, Inc.: Transactional email service provider, used exclusively for sending verification and password reset codes and, if you join the waitlist, the confirmation email and the launch notification. Only the recipient email and the message content are transmitted.
  • Cloud Infrastructure & Storage Providers: Managed database services and private, encrypted storage for progress photos.
  • Sentry (Functional Software, Inc.): Error and stability diagnostics for the App and the server. It may receive technical information about failures (error type, App version, device and operating system, and other technical data the service may record, such as the IP address). We have configured it not to deliberately send request contents, cookies or personal data and to filter sensitive information, but we cannot guarantee that an error report will never incidentally include some personal data.
  • Cloudflare, Inc.: Private, encrypted storage of photos and other images (Cloudflare R2). Also protection against automated sign-ups and abuse through Cloudflare Turnstile on sign-in/registration and on the waitlist form. Turnstile may process technical browser or device data and the IP address to tell people from bots.
  • Open Food Facts: Open food database used for product searches and nutrition lookups under the Open Database License (ODbL).

We never sell, rent, or trade your personal data to third parties for commercial or advertising purposes.

7. International Data Transfers

Where service providers are located outside the European Economic Area (EEA), we ensure international data transfers comply with Chapter V of the GDPR (utilizing European Commission Standard Contractual Clauses or applicable adequacy decisions).

8. Data Retention and Account Deletion

We retain personal data only for as long as necessary to fulfill the stated purposes:

  • Active Account Data: Profile details, weight logs, foods, photos, and plans are stored while your account remains active.
  • Account Deletion: You can request it from the App (Profile > Account > Delete account) or, without the App installed, by emailing support@myprogressfit.com. When your account is deleted we remove: your account and credentials, your profile and personal data, diets, meals and nutrition logs, workout history, weight, measurements and body composition, Proppy and FitCoins data, AI operation records, and the images you uploaded (progress photos, avatar and cover). Images are deleted first from private file storage and, only once that deletion is confirmed, the account is deleted; if image deletion fails the account remains and you can retry. You can delete individual photos at any time from the App.
  • Data that may be kept after deletion: (a) database provider backups, which may temporarily retain already-deleted data until they expire under their own cycle, and we cannot guarantee instant deletion; (b) technical error reports already sent to Sentry, which are not deleted when you delete your account and expire under that service's retention; and (c) data we are legally required to keep. As of this policy we cannot state specific periods for (a), (b) and (c).
  • Waitlist: We keep your email and preferences until you unsubscribe or the app is released on your platform and we notify you; sign-ups you do not confirm by email are automatically deleted after 30 days. After unsubscribing we keep only the minimum record needed not to contact you again.

9. Your Data Protection Rights

Under European and Spanish data protection laws, you hold the following rights which you may exercise free of charge at any time:

  • Right of Access (Art. 15 GDPR): Obtain confirmation on whether we process your data and receive a copy.
  • Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete information.
  • Right to Erasure ("Right to be Forgotten" - Art. 17 GDPR): Request deletion of your personal data when no longer necessary.
  • Right to Restriction of Processing (Art. 18 GDPR): Request temporary freezing or limitation of data processing under statutory conditions.
  • Right to Data Portability (Art. 20 GDPR): Receive your personal data in a structured, commonly used, machine-readable format.
  • Right to Object (Art. 21 GDPR): Object to data processing based on legitimate interests.
  • Right to Withdraw Consent (Art. 7.3 GDPR): Withdraw consent for processing health, nutrition, or progress photo data at any time without affecting previous lawful processing.
  • Right to Lodge a Complaint: You have the right to file a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan, 6, 28001 - Madrid, www.aepd.es).

To exercise any of these rights, email us at support@myprogressfit.com specifying the right you wish to exercise.

10. Security Measures

We apply appropriate technical and organizational measures: communications are encrypted in transit (HTTPS/TLS), progress photos are stored encrypted and privately, passwords are protected with cryptographic hashing (bcrypt), and administrative access is restricted. No system is infallible, so we cannot promise absolute security.

11. Changes to this Privacy Policy

We may update this Privacy Policy to reflect legal, technical, or service enhancements. The last updated date will always be indicated at the top. For material modifications, we will notify you through the App or by email prior to changes taking effect.

12. Contact

For any questions regarding our Privacy Policy or data processing practices, contact: