Privacy Policy

Data Controller

The data controller responsible for your personal data is Ruslan Lysenko, an individual developer based in Finland, operating the Formveo service. For any privacy-related request you can reach the controller at privacy@formveo.com.

1. Information We Collect

We collect information you provide directly and information generated as you use the app:

• Account data — email address and password hash when you create an account.
• Fitness profile — age, height, weight, biological sex, fitness goals, activity level, and dietary preferences you enter at onboarding or update later.
• Food photos — images you take or upload for AI-powered macro analysis. Photos are sent to Google Gemini API for processing and are not permanently stored after analysis completes.
• Workout logs — exercises performed, sets, reps, weights, duration, and perceived exertion ratings you log in the app.
• Nutrition logs — meals, food items, portion sizes, and macro totals you track over time.
• Device data — device type, OS version, app version, and crash logs for debugging purposes.

2. How We Use Your Information

Your data is used to provide and improve the service:

• AI personalization — your fitness profile, workout history, and nutrition logs are used by our AI engine to generate personalized workout plans and nutritional recommendations tailored to your exact goals and progress.
• Progress tracking — historical data is used to visualize trends, compute streaks, and show you how your body metrics change over time.
• Product improvement — aggregated and anonymized usage patterns help us understand which features are most valuable and where to focus development.
• Service communications — your email is used to send account-related notifications (password resets, important changes). We do not send marketing emails without explicit consent.

3. Third-Party Services

We use a limited set of third-party services to operate the app:

• Google Gemini API — food photos and nutritional queries are processed by Google's Gemini AI model. Data sent to Gemini is governed by Google's Privacy Policy.
• Google Cloud — our backend infrastructure (databases, compute, storage) runs on Google Cloud Platform in the EU and US. Data is encrypted in transit and at rest.

Where personal data of EU users is transferred to or processed in the United States (for example by Google Gemini or Google Cloud), the transfer is covered by the EU Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework.

We do not sell your personal data to any third party. We do not use your data for advertising.

4. Data Retention

We retain your account data and fitness logs for as long as your account is active. If you delete your account, we permanently delete all associated personal data within 30 days, except where retention is required by law. Anonymized, aggregated statistics derived from your data may be retained indefinitely.

5. Your Rights

You have the following rights regarding your personal data:

• Access — request a copy of all personal data we hold about you.
• Export— download your complete fitness history (workouts, nutrition logs, body metrics) in JSON or CSV format from the app's Settings page.
• Correction — update or correct inaccurate personal information at any time from your profile settings.
• Deletion — delete your account and all associated data from Settings → Account → Delete Account. Deletion is permanent and irreversible.
• Restriction — request that we stop using your data for product improvement purposes by contacting us at the address below.

6. Security

All data is encrypted in transit using TLS 1.3. Passwords are hashed using bcrypt. We conduct periodic security reviews and follow industry best practices. Despite these measures, no system is completely secure, and we cannot guarantee absolute security.

7. Contact for Privacy Questions

For privacy-related requests or questions, email us at privacy@formveo.com. We respond to all requests within 30 days.