FitFriz

Privacy Policy

Last updated: October 6, 2026

This Privacy Policy explains how FitFriz ("FitFriz", "we", "us", or "our") collects, uses, stores, and shares information when you use the FitFriz Android and iOS (iPhone and iPad) applications and related backend services.

1. Who we are

FitFriz is operated by MIC Software.

• Contact email: fitfrizadmin@gmail.com
• Account deletion page

2. Scope

This Privacy Policy applies to:

• the FitFriz Android and iOS apps, including use on iPad;
• the FitFriz backend and APIs used by the app; and
• related account emails such as email verification and password reset messages.

3. Information we collect

A. Information you provide directly

When you create and use an account, we may collect:

• email address;
• password;
• optional account name;
• profile information you enter, including sex, age, height, weight, goal, activity level, and any calorie target override;
• food and planning preferences, including daily or weekly budget targets, preferred store, avoided ingredients, and avoided categories;
• pantry information, including pantry items, ingredient keys, variant keys, and display names;
• planner and grocery interactions derived from your accepted meal plans and grocery selections.

B. Information created or stored as you use the app

When you use FitFriz, we may create or store:

• account status data, such as whether your email has been verified;
• authentication session data, including access tokens, refresh tokens, session identifiers, and token expiry times;
• meal-planning records, including weekly plans, day proposals, accepted proposals, calorie targets, budget targets, pantry-aware grocery lists, and quote results;
• password reset and email verification token records; and
• support and operational messages generated by account actions, such as password reset or verification requests.

C. Information stored locally on your device

The Android and iOS apps store some information locally to keep you signed in and preserve app state. This may include:

• encrypted authentication tokens;
• account metadata such as user ID, email address, display name, verification state, and onboarding completion state;
• grocery checklist progress for selected weeks;
• app recovery state, such as last-opened area, selected planner or grocery week, and planner proposal mode choices.

On iOS and iPadOS, authentication tokens are stored in Apple Keychain. Account metadata, app recovery state, and grocery checklist progress are stored in local app preferences (UserDefaults). Android uses encrypted local storage for authentication tokens.

D. Analytics and crash data

The Android app integrates Firebase Analytics and Firebase Crashlytics. These services may process information such as:

• app instance or device-related identifiers;
• app activity and usage events;
• crash logs, diagnostics, stack traces, and technical error context; and
• custom diagnostic keys attached to non-fatal errors in the app.

Depending on Google's and Firebase's current SDK behavior and your device settings, Google services may also process technical signals such as coarse location derived from IP and advertising-related identifiers.

The current iOS app does not include Firebase Analytics or Firebase Crashlytics SDKs and does not send analytics or crash reports to Firebase. Requests to our backend may still generate technical service logs used to operate and secure the service. The iOS app does not access the advertising identifier or track you across other companies’ apps and websites.

E. Information we do not request directly through app permissions

The FitFriz Android app does not request access to contacts, microphone, camera, call logs, SMS, or precise location through runtime Android permissions in the current release build.

The current iOS app does not request access to contacts, microphone, camera, photos, or precise location, and does not read or write Apple Health or HealthKit data. Profile and nutrition information is entered by you and processed by our backend to provide meal planning.

4. How we use your information

We use the information above to:

• create and manage your account;
• authenticate you and maintain secure sessions;
• send email verification and password reset messages;
• generate calorie-aware and budget-aware meal planning suggestions;
• build pantry-aware grocery lists and pricing or quote results;
• save your profile, pantry, and preferences across sessions;
• troubleshoot bugs, monitor performance, and improve reliability;
• understand product usage and improve app features;
• protect the service against abuse, unauthorized access, and fraud; and
• comply with legal obligations and enforce our terms or policies.

5. How we share information

We do not sell your personal information.

We may share or allow processing of information with the following categories of service providers:

• hosting and infrastructure providers that run the FitFriz backend and database;
• Google Firebase, including Firebase Analytics and Firebase Crashlytics, for the Android app;
• email delivery providers used for account emails, such as Resend when enabled in production; and
• security, logging, and operational providers as needed to run the service.

We may also disclose information:

• if required by law, regulation, legal process, or valid government request;
• to protect the rights, safety, and security of our users, our services, or others; and
• in connection with a merger, acquisition, financing, or sale of assets, subject to applicable law.

6. Data retention

We retain personal information for as long as needed to provide the service, maintain your account, and meet legal, security, or operational requirements.

In the current implementation:

• refresh-token-backed authentication sessions are configured to expire after 30 days unless revoked earlier;
• email verification tokens are configured to expire after 24 hours;
• password reset tokens are configured to expire after 60 minutes; and
• access tokens are configured to expire after 15 minutes.

Account-related data such as your profile, preferences, pantry, and planner records are generally retained until you delete your account or we no longer need the data for the purposes described in this policy.

Locally stored app data may remain on your device until you log out, delete your account, clear app storage, or uninstall the app.

Analytics and crash data may be retained according to the configuration and policies of our third-party providers, including Google Firebase.

On iOS, signing out or successfully deleting your account removes sign-in tokens and cached account metadata. Grocery checklist progress can remain locally until you delete the app. Deleting or offloading an app alone does not delete your server account; Keychain items may survive an uninstall.

7. Account deletion and your choices

If you created a FitFriz account, you can request deletion of your account from within the app.

On Android, use the delete-account action in Settings. On iPhone or iPad, open Profil, select Obriši nalog, and confirm with Trajno obriši. When deletion succeeds, the backend deletes the user record and related profile, preferences, pantry items, authentication sessions, authentication action tokens, and weekly plan records that are linked through the current data model.

You may also request account deletion outside the app using this web resource:

• https://milicak93.github.io/fitfriz/account-deletion.html

You may also contact us at fitfrizadmin@gmail.com to:

• request access to your information;
• request correction of inaccurate information;
• request deletion of your account and associated personal data; or
• ask questions about this policy.

We may retain limited information where necessary to comply with legal obligations, resolve disputes, detect abuse, or enforce our agreements.

8. Security

We use reasonable technical and organizational measures designed to protect personal information.

Examples from the current implementation include:

• encrypted local storage for authentication tokens on Android using EncryptedSharedPreferences;
• Apple Keychain storage for authentication tokens on iOS and iPadOS;
• server-side password hashing rather than storing plaintext passwords;
• hashed storage of refresh tokens and action tokens on the backend; and
• authenticated API access for account-specific resources.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Children's privacy

FitFriz is not intended for children under 13. The current backend validation also restricts age values below 12 for stored profile data. We do not knowingly collect personal information from children in violation of applicable law.

If you believe a child has provided personal information to us, contact us at fitfrizadmin@gmail.com and we will investigate.

10. International data transfers

Your information may be processed in countries other than your own, depending on where our hosting, infrastructure, analytics, crash reporting, or email service providers operate.

By using FitFriz, you understand that your information may be transferred to and processed in Serbia and other countries where our service providers operate, subject to applicable safeguards and law.

11. Third-party services

FitFriz may rely on third-party services, including:

• Google Firebase Analytics (Android);
• Google Firebase Crashlytics (Android); and
• Resend or another transactional email provider used for account emails.

Those third parties may process information under their own privacy terms and policies. We encourage you to review their policies as well.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice inside the app or through other reasonable means.

13. Contact us

For app help, visit our support page.