Privacy Policy

Data we collect

We only collect the data strictly necessary to provide the weight-tracking service. All of it is provided by you, stored under your account, and synchronized between your own devices.

We do not collect location data, contacts, advertising identifiers or behavioral analytics, and we do not use any advertising or tracking SDK.

• Account data — username, e-mail address and password. The password is stored as a one-way hash (bcrypt) and can never be read back. Your e-mail address is verified at registration.
• Profile data — name, birth date, gender, height, measurement unit, display theme and, if you set them, target weight, target date and desired weekly change.
• Measurement data — weight entries: date, weight, body mass index (BMI, computed from your entries), mood, notes and, if you record it, your menstrual period.
• Photos — the photos attached to your measurements, their thumbnails, and your profile photo.
• Technical data — internal identifiers, version numbers and timestamps used to synchronize your data between your devices and to keep your account secure.

How we use your data

Your data is used solely to operate the service: store your measurements, compute your BMI and your goal progress, synchronize your data between your devices, secure your account and send you service e-mails (account verification, password recovery, notice before the deletion of an inactive account).

We never use your data for advertising, profiling, or any purpose other than providing and securing the service.

How we share your data

We do not sell, rent or trade your personal data, and we do not share it with advertising or analytics companies.

Your data is synchronized between your own devices through your account. When you request a password reset, your e-mail address is transmitted to our e-mail service provider solely to deliver the reset message to you.

We may disclose your data only when required by law or by a binding request from a public authority.

Data retention

Your data is kept for as long as your account is active. Deleted entries and photos are kept as tombstones for up to 90 days so that the deletion reaches your offline devices, then permanently purged.

Accounts that are inactive for six months are notified by e-mail one month before their deletion, then permanently deleted. Any activity (opening the application and signing in) cancels the deletion.

Password-recovery tokens are destroyed 30 minutes after their creation. Expired sessions are regularly purged.

When you delete your account, your data is deleted immediately and permanently (see the account deletion page).

Data security

Data is transmitted over encrypted connections (TLS). Passwords are stored as one-way bcrypt hashes, session tokens only as fingerprints (SHA-256), and cached server responses are encrypted at rest (AES-256-GCM) in production deployments.

Access to your data requires your password and is limited to your account.

Your rights

You can access and correct your data at any time from the application. You can delete your account and all your data permanently, from the application or from the account deletion page.

If you have any question or request about your data, contact us (see the Contact section).

Children's privacy

AGVP is not intended for children under 16, and we do not knowingly collect data from them. If you believe a child has provided us personal data, contact us so we can delete it.

Changes to this policy

We may update this policy from time to time. The date at the top of this page indicates the latest update; significant changes will be announced in the application.

Contact

For any question about this policy or about your personal data, use the contact form below: