Privacy policy

Last updated November 3, 2026

GunnarFit is a workout and food log run by one independent developer. This page explains, in plain words, what the app collects, who helps run it and what they see, how long things are kept, and how you can get a copy of your data or delete it. We don't sell your data, we don't show ads, and we don't share your data with anyone except the services listed below that are needed to run the app.

What we collect

Only what you give the app, plus what it needs to work:

Account: your email address and password (stored scrambled by Supabase, never readable), or your Google email, name and picture if you sign in with Google. That you confirmed you are 13 or older. Your display name and friend code if you set them.
Workouts: exercises, sets, reps, weights, times and distances, rest days, workout programs, saved workouts and exercise goals.
Food: what you eat, calories and macros, water, My Foods and recipes, and barcodes you scan.
Body and health: body weight, steps and sleep, and goals such as calories, protein and target weight. This includes anything you import from Apple Health, Fitbit, Garmin, Strava or other files, or sync from Fitbit.
Photos and videos: progress photos, photos and videos attached to entries, pictures sent in chats, and bug report screenshots. A meal photo you log from is sent to the AI to read, then thrown away; it is not stored.
Friends and chats: your friends list, friend requests, chats and their messages, what you share, and blocks and reports you make.
App activity: coins, badges, shop items, your pet, themes, settings, notification settings and your time zone, and counts of how often you log (to keep the AI from being overused).
Reports you send: bug reports and feature requests, with your name, email, user id, page and browser.
Technical data: your IP address and browser in server logs, crash reports, and anonymous page-visit counts.

The app does not use your location, contacts or advertising ids. The camera and microphone are only used while you are scanning a barcode, taking a photo or speaking a log.

How we use it

To run the app: show your log, progress, streaks, coins and recaps, and sync your devices.
To turn what you type, say or photograph into log entries, and to look up nutrition for foods.
To send the reminders and chat notifications you turn on, and account emails (confirm your email, reset password).
To keep the app safe: stop bots and abuse, enforce limits, and review reports of chats and shares.
To fix bugs and crashes, and to see which pages get used.

We don't sell or rent your data, use it for ads, or build profiles of you for anyone else. We don't use your data to train AI models.

What other people can see

Your log is private. Friends only see what you choose to share (a workout, streak, badge, photo, weight or week in review) and your messages in chats you are in.
Friends and people in your chats see your display name. If you haven't set one, they see the part of your email before the @.
A food or recipe you share as a link (gunnarfit.com/f/…) can be opened by anyone who has the link, without an account.
If someone reports a message or share, the app's owner can see what was reported in order to review it, and can remove it or suspend an account.

Services that process your data

GunnarFit uses these services to run. Each one only gets what it needs for its job, and handles it under its own privacy policy and terms. Your data is stored in the United States (Ohio).

Supabase
Database, sign-in and file storage
Everything you save in GunnarFit: your account, logs, photos, videos, chats and settings.
Vercel
Runs the website and app
Every request to gunnarfit.com passes through it, including what you type to log. It keeps short-lived server logs (errors, IP address, page).
Vercel Web Analytics
Counts page visits
Which pages are visited, the referring site, browser, device type and country. It uses no cookies and doesn't identify you.
Anthropic (Claude)
Turns what you type into logged workouts and food
The text you send to the log box, the date and time on your device, your weight unit, the names and numbers of your saved foods, and a meal photo if you send one. Not your name or email.
Each time you log by typing, speaking or sending a meal photo.
USDA FoodData Central and Open Food Facts
Calories and macros for foods
Food names you log or search for and barcodes you scan. Not who you are.
When a food isn't already in your My Foods or the app's food catalog.
Cloudflare Turnstile
Checks that a sign-up or sign-in is a person, not a bot
Signals from your browser and your IP address while the check runs.
Email sign-up, sign-in and forgot password.
Resend
Sends account emails
Your email address and the email's content (confirm your address, reset your password).
When an account email is sent to you.
Have I Been Pwned
Warns about passwords that have leaked elsewhere
The first 5 characters of a scrambled (SHA-1) copy of your new password. Never the password itself or your email.
When you create an account or set a new password.
Google
Google sign-in, and Fitbit sync through the Google Health API
If you sign in with Google, Google tells us your email, name and profile picture. If you connect Fitbit, we ask Google for your steps, sleep, weight and workouts and keep a sign-in token so we can fetch new days.
Only if you choose Google sign-in or connect Fitbit.
Your browser's push service (Apple, Google or Mozilla)
Delivers notifications
The notification text (a reminder, a new chat message or share) and an anonymous address for your device.
Only if you turn on notifications.
Your browser's speech recognition
Turns your voice into text
What you say while the microphone is on. Your browser (for example Chrome or Safari) may send the audio to Google or Apple to recognise it.
Only when you tap the microphone.
GitHub
Where bug reports, feature requests and crash reports are kept (a private repository)
For a bug report or feature request: what you wrote, your screenshot, your name, user id, email, the page and your browser. For a crash: the error, the page, your user id and browser, with emails and tokens removed. For a reported chat or share: only that a report was made.
When you send a report, or when the app crashes.

How long we keep it

Your account and everything you log	Until you delete it, or delete your account.
Photos, videos and chat pictures	Until you delete them, or delete your account.
Chat messages you sent	Until the chat is deleted or you delete your account. People in the chat may have already seen them.
Database backups	Encrypted nightly backups are kept for 30 days, so deleted data is gone from backups within 30 days.
Server logs at Vercel	A short time (hours to days, set by Vercel).
Bug reports, feature requests and crash reports	Until they are dealt with and deleted from GitHub. Deleting your account removes your screenshots but not the text of a report.
Foods looked up online	Their nutrition numbers are saved in a shared food catalog so the next lookup is faster. The catalog holds food names and numbers only, never who logged them.

Export or delete your data

Export: open the gear menu and choose Export your data > Everything (.zip). You get a spreadsheet (CSV) for each kind of data plus your photos and videos. Single CSVs of workouts, food and weight are there too. Chat messages aren't in the export because they belong to everyone in the chat.
Delete one thing: any entry, photo, video, saved food, recipe or goal can be deleted from where it is shown.
Disconnect Fitbit: Settings > Import > Disconnect. We delete the saved sign-in token.
Delete your account: Settings > Account > Delete my account. This deletes your account and everything in it straight away: logs, photos and videos, friends, the chat messages you sent, settings and notifications. It can't be undone. Copies in backups are gone within 30 days.

If you can't sign in any more and want your data deleted, email privacy@gunnarfit.com.

Cookies and your device

GunnarFit only uses cookies that keep you signed in and remember a couple of display choices. There are no advertising or tracking cookies. To work offline, the app keeps pages and logs you typed while offline on your device (browser storage) until they are sent. Signing out removes the saved pages, and deleting your account also clears the rest from that browser.

Your choices and rights

You can see, correct, export and delete your data yourself in the app, as described above. You can turn off notifications, disconnect Fitbit, and hide features you don't use in Settings. Depending on where you live (for example the EU, UK or California), you may have extra rights, such as asking what we hold about you or objecting to how it is used. To use them, contact us and we'll answer within 30 days.

Children

GunnarFit is for people 13 and older, and everyone confirms their age when they sign up. If you think a child under 13 has an account, contact us and we'll delete it.

Changes and contact

If this policy changes, we'll update the date at the top, and tell you in the app for any important change. For questions or requests about your data, use privacy@gunnarfit.com.