Privacy Policy

1. Who we are

Leanify (“the app”, “we”, “us”) is operated by Tri Nguyen, based in San Antonio, TX, United States. For privacy questions, contact tringuyen7379@gmail.com.

2. What this policy covers

How we collect, use, store, and share information when you use Leanify at leanify-liard.vercel.app. It does not cover third-party sites we link to.

3. Information we collect

You provide directly:

• Account information: email address, and name and profile image if you sign in with Google
• Health and body data: sex, date of birth, height, weight, body fat percentage, activity level
• Goals and preferences: target weight, rate of change, calorie and macronutrient targets, carb-cycling schedule
• Food logs: foods, quantities, meals, dates, custom foods, recipes, and notes
• If you turn on reminders: a push subscription for your browser (an address and encryption keys issued by your browser’s push service)
• A cookie that remembers your light/dark display preference on this device

Collected automatically:

• Authentication data: session tokens, sign-in timestamps
• Technical data: IP address (stored only as a salted hash for abuse prevention), browser and device type, timezone
• Aggregate usage analytics: page views and feature usage, collected without cookies and not tied to your identity

We do not collect: payment information (the app is free), precise geolocation, contacts, photos, or health data from any device or third-party service.

4. Sensitive data and your consent

Body weight, body composition, and dietary intake are sensitive personal data. We process them only with your explicit consent, given at signup, and only to provide the app’s core function: calculating your targets and tracking your intake.

You may withdraw consent at any time by deleting your account (§9). Withdrawal doesn’t affect processing that already happened.

5. How we use your information

We do not use your data to train machine learning models, to profile you for advertising, or to make automated decisions with legal or similarly significant effects.

6. What we never do

• We do not sell your personal information, and never have.
• We do not share your personal information for cross-context behavioral advertising.
• We do not show advertising in the app.
• We do not share your health data with insurers, employers, data brokers, or marketers.

7. Who we share data with

Only the service providers needed to run the app, each acting on our instructions under a data processing agreement:

When you search foods, we send your search query or scanned barcode — never your identity, logs, or body data — to the USDA FoodData Central and Open Food Facts APIs.

We may also disclose information where legally required by valid legal process, or to protect the rights and safety of users or the public. We will notify you of any such request unless legally prohibited.

8. Data retention

Inactive accounts: after 24 months with no sign-in, we email you and delete the account 30 days later if there’s no response.

Push subscriptions are deleted when you turn reminders off, when your browser revokes them, or when you delete your account.

9. Your rights

Regardless of where you live, you can:

• Access and export everything, as JSON or CSV, from Settings → Data
• Correct any of your information from Settings
• Delete your account and all associated data from Settings → Data
• Withdraw consent to health-data processing (this deletes the account, since the app cannot function without it)
• Object or restrict — email us

Deletion is real deletion. Account deletion soft-deletes immediately (you lose access at once) and hard-deletes within 30 days, including from backups within 90 days as backups age out. We keep only the anonymized consent record described above.

Depending on where you live you may have additional rights — including under GDPR/UK GDPR, the Texas Data Privacy and Security Act, the California CPRA, and Washington’s My Health My Data Act — such as the right to non-discrimination for exercising your rights and the right to appeal a refused request. To appeal, email tringuyen7379@gmail.com with “Appeal” in the subject; we will respond within 45 days. EU/UK users may complain to their local supervisory authority.

Self-serve requests complete instantly. Emailed requests get a response within 30 days, and we verify identity through your registered email address.

10. Security

Encryption in transit (TLS 1.2+) and at rest. Authentication uses secure HTTP-only session cookies; if password login is offered, passwords are hashed with a memory-hard algorithm. Access is scoped per user at the application layer and enforced at the database layer with row-level security. Backups are encrypted. Dependencies are monitored for known vulnerabilities.

No system is perfectly secure. If a breach affects your personal data, we will notify affected users and the relevant authorities as required by law, without undue delay.

11. Children

Leanify is for users 18 and older. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete it promptly. Contact tringuyen7379@gmail.com if you believe a minor has created an account.

12. International transfers

We are based in the United States and our providers store data in the US. If you access the app from outside the US, your data will be transferred there. Where required, transfers from the EEA/UK rely on Standard Contractual Clauses.

13. Not medical advice

Leanify provides estimates generated by published formulas. It is not a medical device and does not provide medical, nutritional, or health advice, diagnosis, or treatment. Calorie and macronutrient estimates carry meaningful error and are not tailored to any medical condition. Consult a physician or registered dietitian before changing your diet, especially if you have any health condition, are pregnant or nursing, or have a history of disordered eating.

14. Changes to this policy

We’ll post the updated policy here with a new version and effective date. Material changes get an email at least 14 days before they take effect, and continued use after that constitutes acceptance. Where required, we’ll ask for fresh consent.