Privacy Policy

This Privacy Policy explains what information DDDEV LTD — the company behind Sweatmeal ("Sweatmeal," "we," "us") — collects when you use the Sweatmeal app and website, why we collect it, who we share it with, and the choices you have — including how to access, export, or delete your data. We've tried to write it in plain English rather than pure legal boilerplate, because we think you should actually be able to read it.

Information we collect

Sweatmeal is a training-aware nutrition coach, so the data it needs to work is health-adjacent by nature: your body, your training, and what you eat. Here's exactly what we collect and where it comes from.

Account information

When you create an account, we collect your email address and authentication details. Account creation and sign-in are handled by our own backend (built on Better Auth) running on our self-hosted infrastructure at Hetzner in Germany (EU), which stores your credentials and account record.

Profile and body stats

To calculate your targets, we collect the profile information you enter: weight, height, sex, body-fat percentage (if you choose to provide it), and your goals (e.g. lose, maintain, gain weight, training focus).

Food logs

When you log a meal, we store what you enter — plain-text descriptions and, if you use photo logging, the meal photos you submit — along with the macro estimates generated for that entry.

Wearable and health data

If you connect a wearable, Sweatmeal receives training and recovery data — things like workouts, heart rate, sleep, and recovery scores — from that provider. Supported wearables (Whoop, Strava, Oura, and Ultrahuman) connect through Open Wearables, our self-hosted OAuth integration layer (running on our own Hetzner infrastructure); you authorize the connection and can disconnect it at any time from the wearable provider's own account settings as well as from within Sweatmeal.

Apple Health (iOS) and Android Health Connect are handled differently: that data is read on-device, with your explicit operating-system permission, and is not routed through a third-party OAuth provider the way the wearables above are.

Subscription status

Sweatmeal's paid subscription is billed through the Apple App Store (and, once available, Google Play). Subscription status and entitlement are managed viaRevenueCat. Sweatmeal never sees or stores your card number — payment details are handled entirely by Apple/Google and RevenueCat.

AI processing of food and coach content

When you log a meal by text or photo, or message the AI coach, that content (the text, and any photo you submit) is sent through the Vercel AI Gatewayto Google Gemini solely to estimate macros or generate a coaching response for you. Meal logging is confirm-gated — nothing is saved to your log until you approve the estimate.

We route these requests with zero data retention and prompt-training turned off, and Google processes them under its paid API terms, under which your content is not used to train Google's models. Your content is not used to train any Sweatmeal model, and is never used for advertising.

Analytics

On our website, we use Vercel Web Analytics, which is cookieless — it does not use advertising cookies or cross-site tracking, and does not build an individual profile of you across other sites.

In the app, we use PostHog (EU Cloud — data is stored in the European Union) to understand how features are used and to fix problems. This records product-usage events (for example, screens opened or a subscription started) linked to your account identifier — we do not send your food, body, or health data to PostHog, and it is never used for advertising or sold. You can turn this off at any time in the app under Profile, and we don't run advertising pixels or third-party ad trackers.

How we use your information

• Create and maintain your account and authenticate you.
• Calculate your daily calorie and macro targets from your body stats, goals, and training.
• Estimate macros from meal text/photos and power the AI coach.
• Sync and display your training, recovery, and burn data from connected wearables.
• Process and manage your subscription and entitlement.
• Operate, secure, debug, and improve the app (including aggregate, cookieless analytics).
• Respond to support requests sent to hi@sweatmeal.app.
• Meet legal obligations where applicable.

We do not use your food, body, or health data to serve you advertising, andwe do not sell your personal data.

De-identified and aggregated data

We may create de-identified and aggregated data — statistics and insights that do not identify you (for example, the average protein intake across many users) — and use it to operate, understand, and improve the Service. We may also share such aggregated, anonymized data with third parties, including for research, provided it cannot reasonably be used to identify you.

We will only share data that could identify you — even with names removed — for research or any other third-party purpose with your explicit, opt-in consent, which you can withdraw at any time. Data we receive from connected wearables is not redistributed to third parties, in line with those providers' terms. None of this data is ever used for advertising or sold.

Who we share data with

We share data only with the service providers ("processors") that help us run Sweatmeal — never for advertising, and never sold to data brokers. The processors involved, and what each one handles:

We may also disclose information if required by law, or to protect the rights, safety, and security of Sweatmeal, our users, or the public.

Apple Health and Health Connect

Data read from Apple Health (HealthKit) or Android Health Connect is used only to provide Sweatmeal's features to you — calculating your burn, your targets, and your coaching. It is never used for advertising or marketing, is never sold, and is not disclosed to third parties except to provide the Service to you, or — for medical or health research — only with your explicit consent. You can revoke this access at any time in your device settings.

Data retention

We keep your account and application data — your profile, meal logs, workouts, weight history, and targets — for as long as your account is active, so the app keeps working the way you'd expect. Specifically:

• If your account is inactive for 24 months, we may notify you and then delete or anonymize your data.
• When you delete your account, we remove your personal data from our active systems within 30 days, and from encrypted backups within a further 90 days as those backups cycle out.
• Subscription and billing records may be kept for up to 6 years where we're required to for tax, accounting, or other legal obligations (Apple and Google hold the payment details themselves).
• Support emails are kept for up to 24 months, so we have context if you write to us again.

We don't keep personal data for longer than we need it for the purpose it was collected, or than the law requires.

Your rights and choices

You can, at any time:

• Access the personal data we hold about you.
• Export your data by requesting a copy via email.
• Delete your account and data — in the app, go to Profile → Delete account, which immediately and permanently removes your profile, meals, workouts, weight history, and settings. You can also emailhi@sweatmeal.app and ask us to delete it for you.
• Correct inaccurate data by editing your profile in the app.
• Disconnect any wearable at any time, from the app or the provider's own settings.
• Withdraw consent for optional data uses (e.g. disconnecting a wearable, revoking Health/Health Connect access via your device settings).

To exercise any of these rights, email hi@sweatmeal.app.

Your data-protection rights (UK & EU)

Sweatmeal is operated from the United Kingdom. If you are in the UK, we act as a controller of your personal data under the UK GDPR and the Data Protection Act 2018; if you are in the EU/EEA, we process it under the EU GDPR. Our legal bases are: performance of a contract (running the app and the subscription you signed up for); your consent (for example, connecting a wearable, enabling Apple Health / Health Connect, or sharing identifiable data for research) — and, because your body, food, and health data are a special category, that is your explicit consent to process it; and our legitimate interests (such as security and product improvement), balanced against your rights.

You have the rights described above. If you're in the UK you can complain to theInformation Commissioner's Office (ICO); if you're in the EU/EEA, to your local data protection authority. The data controller is DDDEV LTD (company no.16374016), registered office C/O Schoolgate Accounting Services, 46–50 Coombe Road, New Malden, London, England, KT3 4QF.

CCPA — for California residents

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. California residents have the right to know what personal information we collect, request its deletion, and request correction, as described above — contacthi@sweatmeal.app to exercise these rights.

Children's privacy

Sweatmeal is not directed at, and is not intended for use by, children under 13 (or under 16 where a higher age applies under local law). We do not knowingly collect personal information from children below that age. If you believe a child has provided us with personal data, contacthi@sweatmeal.app and we will delete it.

International data transfers

Your core account and app data are hosted in the European Union (Germany), and our app analytics (PostHog) are EU-hosted. Some of our service providers — such as the AI Gateway, Google, RevenueCat, and the app stores — may process data in other countries, including the United States. Where personal data is transferred out of the UK or EU/EEA, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses — for those transfers.

Security

We rely on our processors' security practices (our Hetzner-hosted infrastructure, Vercel, PostHog, RevenueCat, and the wearable providers) and use reasonable technical and organizational measures to protect your data. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you in the app.

Contact us

Questions about this policy or your data? Emailhi@sweatmeal.app.

Sweatmeal is a product of DDDEV LTD (company no.16374016), a company registered in England and Wales. Registered office: C/O Schoolgate Accounting Services, 46–50 Coombe Road, New Malden, London, England, KT3 4QF.