Privacy Policy

Collection and use

Your voluntarily saved weight, waist, diet, exercise, sleep, goals and meals support your records and statistics. FIT imports retain sampled ride summaries, routes and telemetry, not original files. Routes may include precise locations. Photos are reencoded without EXIF and stored in a private server directory, with no public upload URL. Sign-in accounts, cookies and optional billing data are managed separately from health records.

Every health API checks your session and ownership. Admin settings do not grant a page for reading other users' health records. Health pages do not load the template's marketing analytics, ads or support scripts. Exports contain sensitive health, photo and location data; keep them on trusted devices.

External services

Each meal AI request requires explicit consent. It sends only the consented meal text, takeout flag and photos, not weight, account or other health records. The operator configures an OpenAI-compatible service. Advice is not a medical diagnosis. Before enabling it, the operator must disclose the actual provider, processing locations, retention and deletion channels. This application cannot recall data already sent.

Weather requests send your explicitly selected city's coordinates to Caiyun, without requesting precise location or sending health records. Ride parsing and route drawing use this application without third-party maps by default. No platform OAuth connections are currently stored. Future connections must disclose permissions, credential handling and revocation before use.

Export and deletion

The data and privacy page exports complete JSON with field descriptions, units, timezones, your records, derived reports and photo content. Direct restore is not supported.

Single-record deletion revokes access and recalculates statistics. Clearing all health data requires a second confirmation and deletes your health profile, records, goal history, reports, AI/import jobs, deduplication receipts and ride details. Photo access is revoked first; failed file cleanup retains only necessary receipts and offers retry. Your sign-in account, billing, subscriptions, admin settings and shared city weather remain. Account deletion needs a separate operator-managed process; database cascading alone can leave media files behind.

Retention, backups and deployment

Health facts remain until you delete them. Unconfirmed import previews expire after 24 hours and are cleared on subsequent access. Completed jobs do not retain raw input payloads. Failed or expired analysis clears input snapshots; job status and consent remain until deletion. Necessary rate controls, hashed confirmation tokens and short access leases contain no health content.

Online deletion does not immediately erase backups. Before opening the service, the operator must publish a definite backup retention period, provider policies and a contact channel, and reapply effective deletions after restoring backups. Until those details are configured, keep the deployment for personal testing or disable external features; this template is not a completed public-operation privacy promise.

Production requires HTTPS, stable authentication secrets, a transactional database and persistent private storage. Restrict and encrypt database and backup access. No system can guarantee absolute security; health pages support retries and outcome checks after failures.