Privacy Policy

Section 1

Information We Collect

1.1 Information you provide directly

• Account information: name, email address, and password when you create an account.
• Profile & health details: age, gender, height, current weight, goal weight, and activity level entered during onboarding or updated in settings.
• Food logs: meals, food items, portion sizes, and nutrition data you enter manually or via barcode scan.
• Weight logs: weigh-in entries and body measurements you record over time.
• Progress photos: images you voluntarily upload to track your physical transformation.
• Water intake logs: daily water consumption entries.
• AI coach conversations: messages, goals, questions, and coaching threads you exchange with the AI nutrition coach.

1.2 Information collected automatically

• Device information: device type, operating system, OS version, and unique device identifiers.
• Usage analytics: feature interactions, session length, screen views, and in-app navigation patterns.
• IP address and approximate location: used to determine your country for content localization and legal compliance.
• Crash reports and performance data: diagnostic information to identify and fix bugs.
• Marketing attribution data: UTM parameters and referral sources when you arrive via an advertisement or referral link.

1.3 Information from third parties

• If you sign in using Apple Sign In or Google Sign In, we receive your name and email address from those providers.
• Subscription status and purchase history from RevenueCat (see Section 8).

Section 2

How We Use Your Information

• To create and manage your account and authenticate your identity.
• To calculate your Total Daily Energy Expenditure (TDEE), calorie targets, and macronutrient goals.
• To power the AI nutrition coach, personalized meal plan generator, and weight loss roadmap features.
• To display your food logs, weight trends, progress photos, and other tracked data back to you.
• To process and fulfill subscription purchases and manage billing.
• To send transactional emails (account confirmation, password reset, subscription receipts).
• To send product updates, tips, and marketing communications — only with your consent, and you may opt out at any time.
• To analyze aggregate usage patterns and improve the app’s features and user experience.
• To detect, investigate, and prevent fraud, abuse, and violations of our Terms of Service.
• To comply with applicable legal obligations and respond to lawful requests from authorities.

Section 3

AI Features Disclosure

UrbanFit AI uses artificial intelligence to power several core features, including the AI nutrition coach, AI meal plan generator, and personalized weight loss roadmap. These features process your profile data, health metrics, food logs, and conversation history to generate personalized recommendations.

AI-generated content — including meal suggestions, calorie advice, and motivational coaching — is produced by large language models and may not always be accurate, complete, or appropriate for your individual circumstances. This content is not a substitute for professional medical, dietary, or clinical advice.

You should critically evaluate AI-generated recommendations and consult a registered dietitian, physician, or other qualified healthcare provider before acting on them. We do not guarantee the accuracy or suitability of any AI-generated output.

AI features are powered by OpenAI. See Section 7 for details on how your data is processed by OpenAI.

Section 4

Food Photo Processing

The UrbanFit AI food photo scanner allows you to photograph meals to estimate their nutritional content. When you use this feature:

• The image is transmitted securely to OpenAI’s API, which analyzes the photo to identify foods and estimate calories, macros, and portion sizes.
• The estimated nutritional data is returned to the app and associated with your food log.
• Images submitted to the food scanner are processed transiently and are not stored by UrbanFit AI on our servers beyond the immediate analysis request.
• OpenAI’s data handling for API inputs is governed by their API data usage policy (see Section 7).

Food photo estimates are approximations and may not be accurate. We recommend verifying nutritional data using the manual entry or barcode scanner for precision.

Section 5

Subscription and Payment Information

UrbanFit AI offers a freemium model with optional paid subscriptions. Subscription purchases are processed through the Apple App Store or Google Play Store directly — we never collect or store your credit card number, bank details, or full payment credentials.

We use RevenueCat to manage subscription entitlements, restore purchases, and track subscription status across devices. RevenueCat receives your App Store or Play Store receipt data and subscription state. See Section 8 for more details.

Financial transaction records associated with your subscription may be retained for up to 7 years as required by applicable tax and accounting laws, even after account deletion.

Section 6

Firebase Usage

UrbanFit AI uses Google Firebase as its core backend infrastructure. Firebase services we use include:

• Firebase Authentication: manages user sign-in, account creation, and session tokens.
• Cloud Firestore / Realtime Database: stores your profile data, food logs, weight logs, AI conversation history, and app preferences.
• Firebase Storage: stores progress photos you upload.
• Firebase Cloud Functions: runs server-side logic including AI request processing and subscription webhooks.
• Firebase Analytics / Crashlytics: collects aggregated usage analytics and crash reports to improve app stability.

Data stored in Firebase is encrypted at rest (AES-256) and in transit (TLS). Google processes this data as a data processor on our behalf under a Data Processing Agreement.

Section 7

OpenAI Usage

AI-powered features in UrbanFit AI — including the nutrition coach, meal plan generator, food photo scanner, and weight loss roadmap — are powered by the OpenAI API.

When you interact with an AI feature, relevant data is sent to OpenAI for processing. This may include:

• Your profile details (age, height, weight, goal, activity level) to generate personalized advice.
• Your recent food and weight logs to provide context-aware coaching.
• The text of your messages to the AI coach.
• Food photos submitted to the food scanner feature.

As of the effective date of this policy, OpenAI does not use data submitted via the API to train its models by default. Data sent via the API may be retained by OpenAI for up to 30 days for abuse monitoring, after which it is deleted. Please review OpenAI’s current API data usage policy for the most up-to-date information.

We do not send sensitive financial data, passwords, or payment information to OpenAI.

Section 8

RevenueCat Usage

We use RevenueCat to manage in-app subscriptions, validate purchases, and synchronize subscription entitlements across your devices.

RevenueCat receives and processes the following data:

• A pseudonymous user ID generated by UrbanFit AI to identify your account.
• App Store or Google Play receipt data to verify and validate purchases.
• Device and platform information to support cross-device entitlement sync.
• Subscription lifecycle events (purchase, renewal, cancellation, expiration).

RevenueCat does not receive your name, email address, health data, food logs, or any other personal health information.

Section 9

Data Sharing

We do not sell your personal data to third parties. We share data only in the following limited circumstances:

• Service providers: We share data with third-party vendors who process it on our behalf to operate the Service — including Firebase (infrastructure), OpenAI (AI processing), and RevenueCat (subscription management). These vendors are contractually bound to use your data only to provide services to us.
• Apple and Google: In-app purchase transactions flow through Apple’s App Store and Google Play. Their respective privacy policies govern that data.
• Analytics providers: Aggregated, non-identifiable usage data is shared with analytics tools to help us improve the app.
• Legal compliance: We may disclose personal data if required to do so by law, court order, or governmental authority, or to protect the rights, property, or safety of UrbanFit AI, our users, or the public.
• Business transfers: If UrbanFit AI is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email or in-app notice before your data is transferred and becomes subject to a different privacy policy.

Section 10

Data Security

We take the security of your data seriously and implement industry-standard technical and organizational measures to protect it:

• All data is transmitted using TLS (Transport Layer Security) encryption.
• Data stored in Firebase is encrypted at rest using AES-256.
• Progress photos stored in Firebase Storage are protected by security rules that allow access only to the authenticated user who uploaded them.
• Access to production systems and personal data is restricted to authorized personnel on a need-to-know basis.
• We do not store your payment credentials — all payment processing occurs through Apple, Google, and RevenueCat.

No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your rights and freedoms, we will notify you as required by applicable law.

Section 11

Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service.

• Active accounts: All data categories listed in Section 1 are retained for the duration of your account.
• After account deletion: Health data (food logs, weight logs, progress photos, AI conversations) and profile information are permanently deleted within 30 days of a confirmed deletion request.
• Financial records: Subscription transaction records are retained for up to 7 years as required by applicable accounting and tax laws.
• Fraud/abuse records: If your account was suspended for fraud or Terms of Service violations, minimal records necessary to prevent re-registration may be retained.
• Anonymized analytics: Aggregated, non-identifiable usage data may be retained indefinitely as it cannot be linked to you.

To request deletion of your account and data, see our Delete Account page.

Section 12

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data. Most data can be updated directly in the app.
• Deletion: Request permanent deletion of your account and all associated personal data.
• Data portability: Request your data in a structured, machine-readable format.
• Restriction: Request that we restrict certain processing of your data while a dispute is being resolved.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Withdraw consent for marketing communications at any time via the unsubscribe link in any email or by contacting us.

To exercise any of these rights, email us at esarlawschool@gmail.com. We will respond within 30 days. We may ask you to verify your identity before fulfilling a request.

Section 13

Children’s Privacy

UrbanFit AI is not directed at children under the age of 13 (or under 16 in the European Economic Area and United Kingdom). We do not knowingly collect personal data from children under these ages.

If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us at esarlawschool@gmail.com. We will promptly delete the data upon verification.

Section 14

International Data Transfers

UrbanFit AI operates globally. Your personal data may be transferred to and processed in countries other than your country of residence, including the United States, where our third-party service providers (Firebase, OpenAI, RevenueCat) are primarily located.

These countries may have different data protection laws than your own. When we transfer data internationally, we rely on appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EEA to third countries.
• Data Processing Agreements with our sub-processors that incorporate appropriate transfer mechanisms.
• Reliance on adequacy decisions where applicable.

By using UrbanFit AI, you acknowledge that your data may be transferred to and processed in the United States and other countries.

Section 15

California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional rights:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for which we use it, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out is required, but you may contact us to confirm.
• Right to Limit Use of Sensitive Personal Information: We use sensitive personal information (health data) only for the purpose of providing the Service.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise your California rights, contact us at esarlawschool@gmail.com with the subject line “California Privacy Request.” We will respond within 45 days, extendable by an additional 45 days when reasonably necessary.

Categories of personal information collected in the past 12 months: identifiers (name, email, device ID); personal information (health and fitness data, food logs, weight logs, progress photos); internet or network activity (usage analytics, session data); and geolocation data (approximate country from IP address).

Section 16

GDPR Rights (EEA & UK Residents)

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), the General Data Protection Regulation (GDPR) and/or the UK GDPR apply to our processing of your personal data.

Legal bases for processing: We process your data on the following legal bases:

• Contract performance (Art. 6(1)(b)): processing necessary to deliver the Service you signed up for.
• Legitimate interests (Art. 6(1)(f)): analytics, security, fraud prevention, and product improvement, balanced against your privacy rights.
• Consent (Art. 6(1)(a)): marketing communications. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): retention of financial records as required by law.
• Special category data (Art. 9(2)(a)): health data (food logs, weight logs, progress photos) is processed based on your explicit consent provided when you enter this data into the app.

Your GDPR rights include:access (Art. 15), rectification (Art. 16), erasure / “right to be forgotten” (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object (Art. 21). You also have the right to lodge a complaint with your local supervisory authority.

To exercise your GDPR rights, contact us at esarlawschool@gmail.com. We will respond within 30 days.

Section 17

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make changes, we will update the effective date at the top of this page.

For material changes — those that significantly affect your rights or how we use your data — we will provide prominent notice via email (sent to the address on your account) or via an in-app notification at least 7 days before the changes take effect.

Your continued use of UrbanFit AI after the effective date of a revised policy constitutes your acceptance of the updated terms. If you do not agree to the changes, you may delete your account before they take effect.

Section 18

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We aim to respond to all privacy inquiries within 30 days.