Privacy Policy

1The short version

2Who we are

BarbellBites is run by BARBELLBITES LTD, a company registered in England and Wales (company number 17042421), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are the controller of your personal data, which means we decide how and why it’s used and we’re responsible for protecting it. We’re registered with the Information Commissioner’s Office (ICO), registration number ZC096081.

This policy covers the BarbellBites app: the website at barbellbitesapp.com and our iPhone and Android apps (together, “the app”). Our shop and blog at barbellbites.com have their own privacy policy.

For anything about your data, email [email protected].

3What we collect

3.1 Information you give us

• Account details: your email address, password (we only ever store a scrambled, one-way “hash” of it), first and last name and username.
• Profile: your profile photo, goals, units and the settings you choose.
• Food and nutrition: meals and foods you log, calories, macros and other nutrients, custom foods, recipes, saved meals, meal plans and the supplements you log (and any meal photos added in an earlier version of the app).
• Training: workouts, exercises, sets, reps, weights, durations, personal records and saved programmes.
• Body and progress: your body weight, calorie and macro targets, goals and, if you have Premium, your weekly coach check-ins.
• Social activity: friend requests, friends, people you block, groups, challenges, points, streaks, achievements and profile items you unlock.
• Purchases: your plan, subscription status, trial and renewal dates, and reference numbers from Stripe, Apple or Google Play. We never see or store your full card details. With a Google Play purchase, the app gives Google a coded reference for your account (never your name or email address), so the purchase can be matched to your account.
• Messages to us: anything you send when you contact support or report a problem or another user.

The TDEE calculator asks for your age, sex, height and activity level. Those answers stay on your device. We only save the targets you choose to keep.

3.2 Information from your device

• Apple Health or Health Connect: only if you connect them. See section 6.
• Notifications: if you allow them, a notification token for your device or browser so we can send you reminders.
• Time zone: so reminders, streaks and daily totals happen at the right local time.
• Technical information: your IP address, browser or device type and the pages you request. We use this to keep the app running and secure, for example to stop people flooding our sign-up forms. It also appears briefly in our hosting provider’s logs. If a screen in the app goes wrong, the app sends us a short error report (what went wrong and on which page, with your account ID but not your name or email) so we can fix it. It’s kept in the same logs.
• Camera and photos: the barcode scanner uses your camera on your device, and we don’t keep any images from it. If you use meal photo estimates, the photo you choose is sent for analysis and not kept (section 4.1). We only store a photo if you choose to add one to your profile. If you remove it or replace it, we delete the old one.

3.3 Information from other people and services

• Sign in with Apple or Google: your name, email address (or Apple’s private relay address if you choose to hide yours), an account ID and the sign-in tokens that keep you logged in.
• Other users: for example when someone sends you a friend request, or adds you to a group or challenge.
• Payment providers: Stripe, Apple and Google tell us whether a payment or subscription went through.

You don’t have to give us anything beyond what’s needed for an account (an email address, or an Apple or Google sign-in, and a username). Everything else is optional, but the app can’t track what you don’t log.

4How we use it and why

Data protection law says we must have a lawful basis for each thing we do with your information. Here’s what we do and the basis we rely on.

Where we rely on legitimate interests, we’ve weighed them against your rights and you can object (see section 13). Where we rely on consent, you can withdraw it at any time. That doesn’t affect anything we did before you withdrew it.

4.1 Automated suggestions and meal photos

The coach, the TDEE calculator, meal plans and the workout planner work out suggestions automatically from what you log, such as an estimate of how much energy you burn or a new calorie target. They run on our own software.

Meal photo estimates (Premium) work differently. If you choose to use them, and only once you’ve given your permission, the photo you take or pick goes to our AI provider, along with anything you type about the meal, so it can estimate what’s on the plate. Your device removes the location and other hidden details from the photo first, and we never send your name or account details with it. We don’t keep the photo. Our AI provider only uses it to give us the estimate, doesn’t use it to train its models, and deletes it within 30 days (longer only if it’s needed to investigate misuse of its service). You can turn meal photo estimates off at any time in Settings.

None of these suggestions make decisions that have legal or similarly significant effects on you, and you decide whether to use them. A photo estimate is only logged once you’ve checked it and chosen to log it.

5Your health and fitness information

Information about your body weight, food, supplements, training and activity can count as health data, which the law treats as a special category of personal data. We only use it with your explicit consent, which you give when you create your account, and only to provide the app to you: tracking, stats, personal targets, the coach, meal plans, programmes, meal photo estimates (with your separate permission, section 4.1) and the social features you choose to use.

We never use your health and fitness information for advertising, never sell it, and never use it to judge things like insurance, credit or employment. Tracking is what the app does, so we can’t run it without this consent. You can withdraw your consent at any time by deleting the information or your account (see section 14).

6Apple Health and Health Connect

Connecting Apple Health (iPhone) or Health Connect (Android) is optional, and you choose what to allow on your phone.

• iPhone: the app asks to read your steps, distance and active energy from Apple Health, and to save the estimated calories from workouts you log to Apple Health. If you connected an earlier version of the app, it may also have asked for your weight, heart rate and workouts; it never used them, and you can turn them off in the Health app.
• Android: the app asks Health Connect for your steps, distance and active calories.
• We store your daily step totals so they appear on your dashboard, in step challenges and on leaderboards. Distance and active energy are only shown in the app.

Data from Apple Health and Health Connect is never used for advertising or marketing, never sold, and never shared with anyone except the providers that host the app for us (section 8) and the friends you share your steps with (section 7). We don’t store it in iCloud.

You can turn access off at any time in the Health app on iPhone, or in Health Connect on Android. Turning it off stops new data coming in. Steps we’ve already saved stay in your account until you delete your account.

7What other people can see

• Anyone using BarbellBites can find you by your username or name and see your username, name and profile photo. Nobody can find you by email, and other users never see your email address.
• Your friends (people whose friend request you accept, or who accept yours) can see your profile and the activity you choose in Settings > Privacy: workouts, meals, streaks, personal records, weekly macros, body composition and daily steps. Body composition (your weight) and weekly macros are hidden unless you switch them on.
• Step challenges: if you connect Apple Health or Health Connect, your friends see your weekly step total in the weekly step challenge, unless you turn off Daily Steps in Settings > Privacy.
• Groups and challenges: people in a group or challenge with you can see your name, photo and your progress in it.

You can remove friends, leave groups and block people at any time.

8Who we share it with

We don’t sell your information, we don’t work with advertising networks or data brokers, and we don’t show ads. We share it only with the service providers that help us run the app, and only what each one needs:

These providers may only use your information to provide their service to us, and they must protect it to at least the standard described in this policy. Stripe, Apple and Google also handle your payment details under their own privacy policies. If you’d like to know which companies we use for hosting, email and AI, ask us.

We look up foods and barcodes in the Open Food Facts database. Those lookups come from our servers and don’t include anything that identifies you.

We may also share information:

• if the law requires it, for example a court order, or to report illegal content to the authorities;
• to protect the safety of our users or others, or to defend our legal rights;
• with professional advisers such as accountants and lawyers, who must keep it confidential;
• with a buyer if BarbellBites is ever sold or merged. They would have to keep using it as this policy describes, and we would tell you first.

9Transfers outside the UK

Some of our providers are based in, or reach your information from, outside the UK, mainly in the USA and the European Union. When your information leaves the UK, we make sure it’s protected by one of the safeguards UK law allows:

• the country has UK “adequacy” status (for example, countries in the EU);
• the US company is certified under the UK extension to the EU-US Data Privacy Framework (the “UK-US data bridge”); or
• we have a contract approved for UK transfers in place, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

Email us if you’d like more detail about these safeguards.

10Cookies and analytics

Cookies are small files a website saves in your browser. We also keep a few settings in your browser’s local storage. Here’s what we use:

• Essential: sign-in cookies that keep you logged in and protect your account, and stored settings such as your cookie choice and data the app keeps for offline use. The app can’t work without these, so they don’t need your consent.
• Analytics (only if you say yes): Google Analytics cookies (named _ga) that tell us how people use our website, such as which pages are visited. Google Analytics only loads after you accept, and never in our iPhone or Android apps.

You can change your choice at any time with the Cookie settings link at the bottom of our home page and these policy pages, or by clearing this site’s data in your browser.

11Emails and notifications

• Service emails: we send emails you need, such as your welcome email, password resets, a link to confirm a new email address (and a note to your old one once it changes) and a reminder the day before a free trial you started on our website ends.
• Marketing emails: we only send tips, news and offers if you’ve agreed, for example by joining our email list and confirming your address. Every marketing email has an unsubscribe link.
• Notifications: reminders and updates (such as meal and workout reminders, streaks, friend activity and challenges) only arrive if you allow notifications. You can choose which ones you get in Settings, or turn them off in your phone or browser settings.

12How long we keep it

13Your rights

Under UK data protection law you have the right to:

• Access your information and get a copy of it
• Correct information that’s wrong or incomplete
• Delete your information (sometimes called the right to be forgotten)
• Restrict how we use it, for example while we check a complaint
• Object to us using it based on our legitimate interests, and to direct marketing at any time
• Data portability: get the information you gave us in a format you can move to another service
• Withdraw consent at any time, where we rely on it
• Not be subject to decisions made only by automated means that have legal or similarly significant effects on you (we don’t make any)

You can see and change most of your information yourself in the app, and choose what friends see in Settings > Privacy. For anything else, including a copy of your data, email [email protected] from the address on your account. We may ask you to confirm who you are. It’s free, and we’ll reply within one month (we’ll tell you if we need longer for a complicated request).

14Deleting your account

You can delete your BarbellBites account at any time, from the app or the website:

• Go to Settings, scroll to the bottom and tap Delete Account. Type DELETE (and your password, if you have one) to confirm.
• Or email [email protected] from the address on your account and ask us to delete it. We’ll do it within one month and let you know when it’s done.

Deleting your account removes your profile, photos, logs, progress, settings, friendships and the groups and challenges you created. It can’t be undone.

• Premium on our website or Android app: your subscription is cancelled automatically when you delete your account.
• Premium through the App Store: Apple bills you, so cancel first in your iPhone’s Settings > your name > Subscriptions. Otherwise Apple will keep charging you.
• We keep payment records for as long as tax law requires (section 12). Our email list is separate: use the unsubscribe link in any email to leave it.

15Keeping your information safe

• Everything between your device and our servers is encrypted in transit (HTTPS).
• Passwords are stored as one-way hashes, never as plain text.
• Card payments are handled by Stripe, Apple or Google, so your full card details never reach us.
• Your account is protected by your password or your Apple or Google sign-in.
• Only the people who need it to run BarbellBites can get to your information, and they must keep it confidential.

No system is perfectly secure, but we work hard to protect your information. If something goes wrong that puts you at risk, we’ll tell you and the regulator as the law requires.

16Children and teenagers

You must be at least 16 to use BarbellBites. We don’t knowingly collect information from anyone under 16. If you think someone under 16 has an account, email us and we’ll delete it.

If you’re under 18, please talk to a parent, guardian or doctor before changing what you eat or how you train. We never send marketing to anyone we know is under 18.

17Complaints

If you’re unhappy with how we’ve used your information, please tell us first at [email protected]. We’ll acknowledge your complaint within 30 days, look into it without undue delay, keep you updated and tell you the outcome.

You can also complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the EU, you can also contact the data protection authority where you live.

18Changes to this policy

We’ll update this policy when the app or the law changes. The date at the top shows when it last changed. If we make an important change, such as using your information in a new way, we’ll tell you in the app or by email before it takes effect, and ask for your consent again where the law requires it.

19Contact us

Company

BARBELLBITES LTD

Company number

17042421 (registered in England and Wales)

Registered office

71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

ICO registration

ZC096081

Email

[email protected]

Terms of Service

barbellbitesapp.com/terms