Who we are
Eat & Lift is made by Nedeveon EOOD, a company registered in Bulgaria. We decide how and why the data in this policy is used. That makes us the controller under the EU and UK General Data Protection Regulation (GDPR).
This policy covers the Eat & Lift apps for iPhone, Apple Watch and Android, the website eatnlift.com, and the emails you send us. It applies to version 2 of the apps and later.
You can reach us at [email protected], and our data protection officer at [email protected].
What stays on your phone
Everything you log is kept on your phone first: meals, foods and recipes, workouts and routines, weight, water, activity, sleep, goals, plans, progress photos, and your chat and notes with the AI coach. You can keep and use your diary offline and without an account. The AI coach, searching for more foods, backups and sharing need an internet connection.
Nothing in your diary reaches us unless you use one of the features below. Each section says what that feature sends and why.
Your account
An account is optional. You need one for the AI coach, backups and private links with friends. If you create one, we need the details below to run it. You can sign in with Apple, Google or an email address:
- Apple: your name and email address (or Apple's private relay address) and a token that proves the sign-in.
- Google: your name, email address and the tokens Google gives the app to prove the sign-in.
- Email: your name, email address and password. The app hashes the password before it leaves your phone, and our server hashes it again, so we never see it.
Your account holds an id, your email address and your name. The emails that confirm your address or reset your password are sent through Resend.
Encrypted backups
Backups and sync between your devices come with Premium. When you're signed in with Premium, your diary backs up on its own from your first entry, and the app makes your backup password for you. You can turn backups off in Settings → Backups → Backup and sync, and delete your backup from our servers there too. Restoring a backup you already have is free.
Without Premium, or with backups off, your diary lives only on your phone. You can export it at any time in Settings → Local Data → Export diary, as a .eatnlift file (a zip archive of your records and photos) to keep wherever you like. The file isn't encrypted: anyone who gets it can read it, so keep it somewhere safe.
When backups are on, your phone makes a key and encrypts your diary and photos (AES-256-GCM) before uploading anything. The key lives in your phone's keychain and moves between your devices through it (iCloud Keychain on iPhone). We also store a copy of the key locked with your backup password, so you can get it back on a new phone. The password never leaves your devices.
- What we can see: metadata only. That's your account, the ids, times and sizes of your encrypted records and photos, which of them you deleted, how much space they take, and a hashed code that checks the key is right without revealing the key itself.
- What we can't see: any of your data or photos.
Photos are uploaded without their location or camera details. If you lose your keychain and your backup password, nobody can open the backup, including us.
The AI coach
The AI features are the coach's chat (on iPhone and Apple Watch), meal and label scans, Quick Add from text, voice or photos, describing and refining entries, workout calorie estimates, reactions, weekly reviews, plans, and the coach's notes and journal. They're part of Premium, need an account, and start only after you agree to the AI terms in the app.
Before you agree, the app shows "What your coach can see": your name, age, sex, height, weight, activity level, goals, meals, workouts, water, activity, sleep and recovery, foods, routines, plans and photos. Each starts switched on, and you can switch any of them off, then or later in Settings → AI Coach.
- What's sent: your messages and recent chat, the photos and voice recordings (up to a minute) you add, the coach's notes, files and journal, and the parts of your diary you allow. That can include data from Apple Health or Health Connect, such as sleep, weight or activity. Progress photos are never sent.
- When: when you use an AI feature, and, while the AI is on, in the background: reactions to what you log, including what arrives from Apple Health or Health Connect, your weekly review, and keeping the coach's notes tidy. These happen without you opening the chat.
- Where it goes: through our server to OpenRouter, Inc., which passes it to the company running the AI model, with an id that's scrambled so it doesn't identify you. Our server doesn't store requests, and we use only AI providers that keep nothing (zero data retention) and never train on your data. Requests are processed only to answer you. The models and the companies running them can change; these rules don't.
- What we keep: for each request, which model and provider answered, how long it took and what it cost, so we can track your weekly allowance. Never what was said. We also keep a record of your agreement: when you agreed, which version of the AI terms, the provider and permissions you chose, and your platform, app version and language.
Your chat with the coach, and its notes and journal, stay on your phone and are in your encrypted backup when backups are on. The coach keeps notes on its own as you talk, so it remembers what matters; you can read and delete them in Settings → AI Coach → Journal.
If you use your own OpenRouter key instead, the key stays in your phone's keychain and requests go straight from your phone to OpenRouter under OpenRouter's terms, never through us. When you paste a link for the coach to read, your phone fetches that page itself, so that website sees the request and your IP address.
Apple Health and Health Connect
Connecting Apple Health (iPhone) or Health Connect (Android) is optional, and you choose what the app may read and write in your phone's own settings.
- What it can read: weight, height, sex, date of birth, steps, active energy, workouts, nutrition, water, sleep, resting heart rate and heart rate variability.
- What it can write: the meals you check off with their nutrients, water, weigh-ins and finished workouts.
We use this data to fill your diary, set your goals and show your history. Imported meals, water, weight, workouts and daily activity become diary records, so they're in your encrypted backups and your exports. Raw sleep, resting heart rate and heart rate variability readings stay on your phone only. With the AI on, the coach sees the health data you allow, as described above.
Taking away the app's access in your phone's settings stops any further reading and writing. It doesn't delete what's already in your diary, and it doesn't change what the AI can see: manage that in Settings → AI Coach.
Health data is never used for advertising or marketing, never sold, and never shared for those purposes. Our use of Health Connect follows Google Play's rules for health apps and the Health Connect permissions policy, including its limited use requirements. Our use of Apple Health follows Apple's rules.
The Apple Watch app records your workouts with Apple Health and works through your iPhone. It never contacts our servers itself; the workouts it records and what you say to the coach on it are handled like anything else in this policy.
Friends and links
Sharing with friends is free and optional.
- Private links are end-to-end encrypted. What you share with a friend is encrypted on your phone, and the key travels only inside the link, never to us. We store the encrypted feed. Both of you need an account, and an unused invite expires after 7 days.
- Public links (such as eatnlift.com/u/your-handle) aren't encrypted. Anyone with the link can see what you share through it, and so can we. They don't expire: they stay up until you stop them or delete your account. When you stop one, it's deleted immediately, along with the data that was shared publicly.
- What you can share: your streak is always included when you share. Everything else you can fine tune: daily calories and macros, activity, steps, workout summaries, weight, water and sleep. Friends always see your name; a public link shows it only if you switch it on. You can change all of this for each friend and link at any time.
- Share links send a meal, a day, a workout, a recipe, a plan, a food or a routine. Making one needs Premium; opening one is free and needs no account. They're encrypted on your phone, and the key is in the part of the link after "#", which never reaches our server, so anyone with the whole link can open it. We keep the encrypted copy until you stop the link or delete your account.
- Share cards are pictures made on your phone. They go wherever you send them.
Removing a friend deletes what each of you shared with the other. Stopping a link removes it from our servers, but it can't take back copies or screenshots someone already made.
Food search and barcodes
The food library and recipes are built into the app. When you search for more foods, what you type (up to 100 characters) goes to our server. When you scan a barcode, the code goes to our server too, and our server may look it up with Open Food Facts, sending only the code. Our server uses them only to find the food and never logs them.
Subscriptions
Premium is bought through the App Store or Google Play, which handle the payment; we never see your card. RevenueCat, Inc. keeps track of your subscription. Apple or Google tell it about your purchases in Eat & Lift, and it links them to an id (your account's, or an anonymous one when you're not signed in). The app only starts RevenueCat after you accept this policy. We keep purchase records for as long as accounting law requires.
Notifications and diagnostics
Notifications, including the coach's reactions and reminders, are made on your phone. We don't run a server that sends them.
The app has no analytics or crash reporting of its own. If you choose to share diagnostics with app developers in your phone's settings, Apple or Google sends us crash reports and basic statistics about Eat & Lift that don't identify you. We read them in App Store Connect and Google Play Console to fix problems.
The website
eatnlift.com uses no cookies, analytics or trackers. Our server logs each request (your IP address, browser and the page) to keep the service secure, and Cloudflare, Inc. routes and protects the traffic.
When you write to us
When you email us, we use your address, your message and anything you attach to answer you and keep track of your request. Our email runs on Google Workspace.
Who processes data for us
These companies process data for us, each only for what's listed:
| Company | Where | What for |
|---|---|---|
| Hetzner Online GmbH | Germany | Our servers and encrypted database backups |
| Backblaze, Inc. | Netherlands (EU region) | Encrypted database backups |
| Cloudflare, Inc. | USA | Routing and protecting traffic |
| OpenRouter, Inc. | USA | AI requests, passed to the AI model companies |
| RevenueCat, Inc. | USA | Subscriptions |
| Resend | USA | Sign-in emails |
| Google (Workspace) | USA | Our email |
Apple and Google also provide sign-in, the app stores, payments and the health platforms, under their own privacy policies.
Where your data is kept
Our servers and their backups are in the EU. Some of the companies above work outside the European Economic Area, mainly in the USA, and OpenRouter passes AI requests to AI model companies that may be outside it too. These transfers rely on the safeguards in those companies' own terms, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
How long we keep it
| Data | Kept |
|---|---|
| Your account | Until you delete it |
| Encrypted backups | Until you delete them or your account |
| Friends' feeds, public links and share links | Until you remove or stop them, or delete your account |
| Unused friend invites | 7 days |
| AI requests, on our server and with AI providers | Not kept |
| AI usage and agreement records | With your account, then only in a form that doesn't identify you |
| Purchase records | 10 years, as Bulgarian accounting law requires |
| Logs of the emails we send | 90 days |
| Server request logs | 30 days |
| Your emails to us | As long as we need them to help you and keep track of your request |
| Encrypted backups of our database | 30 days |
How we protect it
Backups, private links and share links are encrypted on your phone before they're uploaded, so even we can't read them. Public links and AI requests are protected as their sections describe. Everything travels over encrypted connections and is stored on encrypted disks. Only the people who run our servers can access them, and their access is protected with two-factor authentication. We keep our systems updated and watch for misuse.
Why we're allowed to
- To run the app and your account, including backups, links, food search and subscriptions: because it's needed to provide the service you asked for (GDPR article 6(1)(b)).
- For health data: what you log stays on your phone or is encrypted so we can't read it. Where we do process it, for the AI features or a public link you publish, we rely on your explicit consent (articles 6(1)(a) and 9(2)(a)), which you give by switching those features on. Access to Apple Health or Health Connect is your explicit consent too, given in your phone's settings, and it doesn't on its own let the AI or anyone else see your data.
- For the AI features: your consent (article 6(1)(a)).
- To keep the service secure and stop abuse, including request logs: our legitimate interest in a safe service (article 6(1)(f)).
- To answer your emails: our legitimate interest in helping you (article 6(1)(f)).
- For purchase records: our legal obligation (article 6(1)(c)).
Withdrawing consent stops further processing, but doesn't make what happened before unlawful. You don't have to give us anything: without an account, the features that need one don't work. We don't use automated decisions that have a legal or similarly significant effect on you.
Your rights
You can ask us to show you your data, correct it, delete it or hand it over. You can also ask us to restrict how we use it, object to what we do based on our legitimate interests, and withdraw any consent you gave. Most of it you can do in the app:
- Delete your account: Settings → Profile → Delete account.
- Take your data with you: Settings → Local Data → Export diary.
- Change what the AI sees, or turn it off: Settings → AI Coach.
- Turn off or delete backups: Settings → Backups.
Deleting your account removes your backups, share links, public links, friends and friends' feeds, and your subscription details from our servers. Your diary stays on your phone. Purchase records stay for the 10 years accounting law requires, and AI usage and agreement records are kept only in a form that doesn't identify you. Logs expire as the table above says, and anything deleted is gone from our database backups within 30 days. Deleting your account doesn't cancel a subscription: cancel it in your App Store or Google Play account.
You can also ask us to delete your account without the app, or exercise any other right, by emailing [email protected]. Use your account's email address if you can; if you can't, we'll ask for what we need to confirm the account is yours. We answer within a month.
You can also complain to a data protection authority. Ours is Bulgaria's Commission for Personal Data Protection (cpdp.bg), at 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia.
If you live in the USA: we don't sell your personal information or share it for advertising. You can ask us what we hold, ask us to correct it or ask us to delete it, and we won't treat you differently for asking.
Age
Eat & Lift is for people aged 18 and over. We don't knowingly hold data about anyone younger, and we delete it if we learn we do.
Changes
When this policy changes, we update it here with a new date, and we tell you in the app before a significant change applies.
Contact
Nedeveon EOOD, Bulgaria. Email [email protected], or our data protection officer at [email protected].