JST Fitness — Privacy Policy

Last updated: 17 October 2026

What changed on 17 October 2026. On Android, the app now scans barcodes with its own camera screen, the same one that reads a nutrition label or a restaurant menu, instead of a scanning screen of Google's, so it asks for the camera the first time you scan a barcode too. While it looks for a barcode, it reads a few small pictures a second on your phone with Google's barcode reader, drops each one at once, and keeps only the code it finds; a food's barcode number goes to Open Food Facts as before. Google's barcode reader reports the same kinds of technical diagnostics about itself that its scanning screen did. Earlier the same day, this policy was rewritten as one launch edition naming JST Fitness LLC as the company responsible for your data. Earlier versions are kept on file; email [email protected] for a copy of any of them.

JST Fitness is a workout, nutrition and body-weight tracker for Android. Until an iPhone app exists, the same app also runs in a phone's browser at jst-fitness.vercel.app, and this policy covers that web version too. It explains exactly what the app stores, what leaves your device, and what it never touches. It also covers what our website, jstfitness.com, keeps if you join the waiting list for the app's launch: your email address, and when and where you joined.

Your health data also has its own policy. Everything you record about your body — your weight, your measurements, your food and your workouts — is covered by the Consumer Health Data Privacy Policy as well as by this one. That document was written for Washington's My Health My Data Act and Nevada's SB 370, and everything it promises is true for everyone, wherever you live.

At a glance

• You need an account to use JST Fitness: an email address and a password, or Google sign-in. Your account holds your email address, your name, an account id, your sign-in sessions, the record of what you agreed to, and your plan ("What leaves your device", section 1).
• Cloud sync is separate, and stays off unless you agree to it. Without it, what you log stays on your phone. With it, most of what you log is stored with Supabase, our database provider, so it follows you between devices. Your step counts, your meditation log, your profile photo and the routes you record are never uploaded, whether or not sync is on.
• No advertising, no trackers, and no advertising or analytics software in the app, and nothing is sold. Nothing we hold about you is passed to a third party, with two exceptions, neither yet under a business agreement: the words of a feedback message you send, and the error message of a crash report, can be read by Anthropic's AI tools, which help us sort and fix them (sections 4 and 5 below); and email you send to our jstfitness.com addresses is kept in a Gmail inbox at Google, where we read it ("Who processes your data"). The services your phone contacts directly when you use a feature — a barcode lookup, a recipe import, signing in with Google — are listed below too.
• Two things come close to analytics, so they are named here. Two pieces of Google's software in the app — its barcode reader, and the text reader that reads a nutrition label or a restaurant menu, each reading what you point the app's camera at — report their own technical diagnostics to Google when you use them ("Barcode scanning and the camera" below); and we count how many accounts are still syncing and how much room everything synced takes, and how many sign-ins and active accounts come from each country, across everyone at once and never as a record about you ("The legal bases" below, and section 1).
• One thing can be shown to other users of the app, and only if you choose it, food by food: a food you added yourself — the product's label facts, never your log and never your name (section 6 below).
• Your choices: export everything, switch sync off and remove your synced copy, or delete your account, all from inside the app ("Your data and your choices"). A few records outlive a deleted account by design — the record that your address had its free trial, our host's server logs, what our AI tools already read, email you sent us, reports and blocks — and that section names each.
• JST Fitness is for adults: you need to be 18 or older to use it.
• Questions: [email protected].

Everything that leaves your device is listed in full below. And beyond the request logs any website's host keeps, our website keeps something only if you join its waiting list: your email address, with when and where you joined, kept only to email you once, when the app launches, and never shared or sold ("The waiting list on our website" below).

Who is responsible for your data

JST Fitness is run by JST Fitness LLC, a Florida limited liability company ("we", "us"). It was founded by two people, its founder and a co-founder, who run it. JST Fitness LLC is the "data controller" in GDPR terms — the party responsible for what happens to your data — and its founder is the person to write to about it:

Tristan Allard Email: [email protected]

His co-founder helps run the app and signs in to the same internal support page he uses. That page shows each account's email address, when the account was created, when it last signed in and last synced, and whether it is on a trial or a plan; which accounts are being closed under the age rule; the feedback messages and crash reports we receive, and our support tickets about them; reports about shared foods, and the block list; and the sign-in records behind the country counts in section 1. It does not open the fitness, body or food data you sync.

We have no data protection officer (none is required at this size), and no EU representative.

What is stored on your device

By default, everything the app records stays in local storage on your phone and is never uploaded (in the web version, "your phone" is your browser's storage on that device; "What leaves your device" below says what cloud sync uploads if you agree to it, and what stays here even then):

• Workouts, routines, any training program you run from them, and workout history (sets, reps, weights, any set you mark to failure, the distance of a run, walk, ride, row, swim or other cardio set, if you enter one, the weight of a vest or pack you carry on a cardio set, if you enter one, the 1-10 effort rating you give a session, notes)
• Work in progress, kept only so it survives the app closing: a workout you are in the middle of, as it stands (the sets logged so far, when you last logged one, the longest gap between two, and whether any set was filled in from the plan), and a food card you have started but not yet added, including a dish opened from a menu read. Neither is ever uploaded, synced or put in your backup file. The workout's record is deleted when the workout is saved or thrown away; the food card's when you add or cancel it, or when you next open the food list (after the app closed unexpectedly, it is offered back to you then instead, for up to six hours).
• Body-weight log, body measurements (including a body-fat percentage, if you enter one) and BMI history
• Meals, calorie and macro targets (and any different targets you set for days of the week), saved foods, saved meals, water intake, and any names you give the four meal sections
• The fasting timer, if you switch it on in Preferences: how many hours of the day you chose to fast, whether to tell you when a fast ends, when your latest fast started, and whether the timer is on. It keeps that one start time and no record of any fast before it: starting a new fast replaces it, End fast, Clear or switching the timer off removes it, and the app removes it the first time it is open, and you are signed in, a day or more after the fast ended. It is never uploaded or synced, and it is not in your backup file.
• Goals, achievements, XP and streaks, and the dates of any streak pause you set
• Your profile (name, height, sex, activity level, birth date if you entered one, and your goal — with the weekly pace you chose, if it is to lose or gain weight) and app settings (theme, units, timezone, date format, the day your week starts on, the plates and bar you have told the plate calculator you own, and whether calorie numbers are hidden)
• Meditation sessions you record with the timer
• Your profile photo, if you set one
• Your daily step totals, if you let the app read your steps from Health Connect ("Health Connect" below)
• Weekly report summaries — the averages and totals the app writes for itself when a week ends, keeping the 56 most recent (the weekly report is on unless you switch it off)
• Yearly report summaries — once a year ends, one summary of that year (built from the weekly summaries above and your workout, weight and achievement records), kept so you can look back at any year
• Membership cards you save — the name you give each card, and the text of its barcode or QR code and what type of code it is (never a photo of the card). They are never uploaded or synced, they are included in your backup file, and deleting your account removes them from this phone.
• On the Android app, a copy of what its home-screen widget shows: how many days in a row you have opened the app (the streak on the Home screen), how many workouts you have logged this week, and the name of the routine your weekly schedule plans for each day. With them it keeps the dates of any streak pause you have on or booked, your timezone setting, and the day the copy was made and the days its figures stay true until, so the widget shows the right thing on each day. The app keeps it in its own storage on this phone, whether or not you have added the widget, so that a widget can show it while the app is closed. It is never uploaded or synced and is not in your backup file. Signing out removes it, and so does deleting your account from this phone; if "Stay signed in" is off, it stays after the app closes until you next open it. The widget never shows a weight, a calorie or a weigh-in streak, and it is never shown on the lock screen.
• If you use Track route on the Android app: the location points of a set while it records, the routes you record (each a simplified drawing with its first and last 200 m left off and no latitude or longitude in it), and Track route's own notes of your answers. None of these is ever uploaded or synced; "Route tracking and your location" below says what each is, how long it is kept, and what goes in your backup file.
• If a date of birth under 18 is confirmed on this phone — in the setup questions or in your profile — that date, kept so that the question cannot simply be answered again on this phone. It is never uploaded, synced or put in your backup file. Deleting an account, or a different account signing in, removes that account's records from this phone but not this date, because it belongs to the phone rather than to an account; signing out leaves it too, as it leaves everything else here. The app deletes it the first time it opens after that date is 18 years ago, and uninstalling the app removes it.

Uninstalling the app removes all of this from your device. (In the web version, clearing the site's data in your browser does.)

What leaves your device

There are nine. Your account is the one you cannot do without: the app needs one to sign in. Cloud sync and five more happen only when you choose them; one is automatic — a short diagnostic report sent when the app hits an error, so it can be fixed. The ninth is neither optional nor numbered below: the demonstration clips your phone streams while you use the workout library. It is described at the end of section 1, with the rest of the library. Separately, Google's own software in the app reports technical diagnostics about itself to Google when you use it — its barcode reader when you scan a barcode (section 2), and its text reader when you have the app read a nutrition label or a restaurant menu ("Barcode scanning and the camera" below); none of it comes to us.

1. Your account, and cloud sync only if you switch it on

Your account

You need an account to use JST Fitness: an email address and a password, or Google sign-in. Giving one is what makes the agreement our Terms describe, so without one there is no account and the app cannot be used. JST Fitness uses Supabase as its authentication and database provider, and your account is kept there:

• your email address and an account identifier;
• the name you give when you sign up, or the one your Google account gives if you sign in with Google;
• your sign-in sessions, with the IP address each one carries (below);
• Your consent record — which versions of our Terms and this policy you accepted and when, and, if you agree to cloud sync, which version of the sync-consent wording you agreed to and when. Stored with your account as the legal proof the consent was given (GDPR Article 7(1)).
• Your plan — whether your account is a beta founder, when your free trial started and ends, and — once subscriptions launch — whether a subscription is active and which tier. This record lives on our server and the app can only read it; writes from the app are refused, which is what makes founder status and trial dates unforgeable. The app keeps a small copy on your device so your plan still shows when you're offline. This record is about your account, not your body: it holds no health data.

Passwords are handled and hashed by Supabase; the app never stores your password. Our server also keeps a one-way scrambled record that your email address has had its free trial ("How long data is kept" says what it is and how long it stays).

If you sign in with Google instead, Google returns your email address, your name and a link to your Google account picture to create the account, and Supabase keeps them with it. Unless you set your own photo, Profile shows that picture, and your phone loads it from Google each time, which shows Google your IP address as any picture on the internet does.

Two-step sign-in, once the app offers it. The app does not offer it yet; before an update offers it, this policy will say what it keeps.

Signing in carries your IP address, the way every request over the internet does, and Supabase records it against your session. That is what keeps you signed in, and what lets a stolen sign-in be told from a normal one. We also do two things with those addresses, both on our internal support page (the one "Who is responsible for your data" describes), and both only ever by country.

The first counts how many sign-ins came from each country, so we can see where the app is being used. The second counts how many accounts on a trial or a paid plan last signed in from each country, so we can see where the people actually using it are. That second one means that, for the moment the page is drawn, an account is matched to the country its last sign-in came from.

Both counts are worked out as the page is drawn and nothing is written down: no city, no coordinates, no map of any one person, and no stored record of where any account signed in from. Neither is ever attached to your weight, your food, your workouts or anything else in this policy, and neither leaves that page. Deleting your account deletes your sessions, and those addresses with them. (Every request also passes through our hosting provider's routine server logs, which keep what "How long data is kept" describes.)

Cloud sync — only if you switch it on

Cloud sync is separate from your account, and nothing syncs until you agree to it. The app asks when you create your account, and you can switch it on or off at any time at Profile → Preferences → "Sync my data to the cloud". If you agree, most of what the app records is synced to the cloud so it follows you between your phone and your computer. That covers:

• Body — your weight log, your body measurements (and, if you enter one, your body-fat percentage), your saved BMI/BMR/TDEE figures and the height/age/sex you entered to calculate them. The ids of weigh-ins you delete sync too, so a delete on one device stays a delete on every other, and so does a record of each body measurement you delete or correct: the reading's own id when it has one, and one to three short fingerprints worked out from its body part, its day and its number (the number as stored, and as the app's own spreadsheet would bring it back in inches and in centimetres). The fingerprints are not the number written out, but they are not a secret either: someone holding the list could work the deleted reading back from them. It is kept so a delete stays a delete on every device, and in a spreadsheet you import again. A reading we delete because you asked us to by email leaves only its id (see "Erasure" under "Your rights"). A weigh-in imported from your scale through Health Connect syncs with two extra things attached, and they are named here rather than left implied: a mark saying it came from Health Connect instead of from you typing it, and the id Health Connect gave that reading, kept so the same reading is never imported twice. Neither is anything about your body, and a weigh-in you typed has neither.
• Training — your workout history (every exercise, set, rep and weight you log — and, for timed intervals, the seconds you worked, and for a run, walk, ride, row, swim or other cardio set the distance you enter, if you enter one — typed, or measured by your phone's GPS on an outdoor set with Track route on; only the distance leaves your phone, never the points it was measured from or the drawing of the route ("Route tracking and your location" below) — and it works out the pace from your time and distance each time it shows it, without storing it), the weight you carry on a cardio set logged in minutes — a weighted vest or a pack — if you enter one (the app's own swims have no box for it; it is kept in the weight every set already has, shown with that set, and counted in no lifting total, volume or record), the optional 1-10 effort rating you can give a session — tapped from a row of ten on the set-by-set logging screen, or picked from three choices when a follow-along circuit finishes, which records on that same 1-10 scale — any set you mark to failure (your own note that you could not do another rep, stored with that set; you can set it before or after the set, and the app never marks a set for you), your saved routines (and the ids of workouts you delete and routines you delete, so a delete on one device stays a delete on every other), any custom exercises you create (and, for exercises you delete, the exercise's id and a short code made from the muscle and equipment it was tagged with, which can be matched back to those tags — never the name itself, though an exercise that came from a spreadsheet, or that was given a new id, has an id worked out from its name, so a guessed name could be checked against it — so a delete stays a delete on every device that has this update; one deleted before it, or on a device still on an older version of the app, left no marker, so it can keep coming back from a device that still holds it until that device has the update; deleting it again on an updated device keeps it gone. Where two exercises made on older versions of the app shared an id, the one given a new id keeps a note of the id it had, and the app tells you, because its older sessions may show under the other exercise's name), your weekly training schedule, and any training program you run (the name you give it, which of your saved routines it uses, in what order, the day it started and how many weeks it runs — the app writes no weights, sets or reps into it; the name is free text you type, and it syncs with the program). If you fill in the optional "Following" line on a session — a class, a channel, a video title or a link you paste — that text is part of the session and syncs with it. The app only stores and shows it: it never loads the page, never fetches a thumbnail, and never tells anyone you watched anything. The distance earns no records. It counts toward one achievement, Marathon, which unlocks when a single workout logs at least 42.195 km or 26.2 miles of running or walking, and earns that achievement's XP.
• Food — your meal and water log (each drink with the date and time you logged it), your daily water goal, your saved foods, any homemade recipes you build (their names, ingredients and yield — and the ids of recipes you delete, so a delete on one device stays a delete on every other), your saved meals (a name and a copy of the foods in it — and the ids of meals you delete, so a delete on one device stays a delete on every other), and your calorie and macro targets (your everyday target: any different targets you set for days of the week stay on your phone, below). Each food in your log and your saved foods carries its calories and macros and, when you type them in or a barcode scan finds them, its fibre, sugars, sodium and alcohol; a food you pick from the community list brings the fibre and sugars the person who shared it typed, if they typed them; a restaurant food from the app's own catalogue brings the fibre, sugars and sodium its chain publishes, where the app has them; and an everyday food from the app's own catalogue — one with no restaurant or brand, such as a banana or a hard-boiled egg — brings the fibre, sugars and sodium that USDA FoodData Central, the United States Department of Agriculture's public food database, gives for it, where the app has them. Each of those boxes on the add-food card is optional, and one you leave blank is kept as not known, never as zero. You type a drink's alcohol as the % on its label, and the app keeps it in grams, worked out from the % and the drink's size in ml (without a size in ml it keeps none), and uses it to check that the calories you typed add up. These figures are in your backup file too, but not in the food-log spreadsheet, which keeps calories and the three macros.
• Progress — your goals (and the ids of goals you delete), unlocked achievements and when you unlocked them, your XP and level, and the list of days you opened the app (which is what your streak counts).
• Profile — the name you entered, your date of birth, your goal (Cut, Bulk, Maintain and the rest) and, if it is to lose or gain weight, the weekly pace you chose for it, and display preferences: your step goal, which graph the home screen shows, whether the rest timer is switched on, and your measurement units (kilograms or pounds), how your body weight reads (pounds, kilograms or stones) and whether food energy reads in calories or kilojoules. (The rest timer's sound, vibration and notification switches stay on the device — see below.) Profile basics — sex, date of birth, height, weight, activity level — are asked for by the setup quiz because the calorie and macro maths cannot run without them; they stay on your device unless you agree to sync.
• Appearance — the theme and colour scheme you chose, so the app looks the same on every device you sign in to.

These stay on your device and are never uploaded: your step counts from Health Connect, your meditation log, your profile photo, the dates of any streak pause you set, the copy of your streak, this week's workout count and your routine names that the Android app keeps for its home-screen widget, the weekly report summaries listed above, and your device settings — timezone, date format, the day your week starts on, accessibility mode, the rest-timer sound, vibration and notification switches, the meal, hydration and weigh-in reminder switches and the times you set for them, the Health Connect switch for reading your scale's weigh-ins, the follow-along runner's countdown sound and buzz, the plate sizes and the bar you have told the plate calculator you own, whether a new set's boxes start pre-filled with what you lifted last time, whether your steps add to a day's calorie target, and whether you have asked the app to hide calorie numbers and show protein instead (it is in your backup file, and it changes only what the app shows you — your food log and targets are stored as before). So does everything Track route keeps on your phone — the location points of a set while it records, the drawings of the routes you record, and its notes of your answers ("Route tracking and your location" below); only the distance they measure leaves this phone, with your workouts. So do any names you give the four meal sections: they are in your backup file, and your food log keeps only which section each food is in, never the name you gave it. So do any different calorie targets you set for days of the week, under "Different days" — which days, and how many calories more or fewer than your everyday target: they are in your backup file, and of your targets, only the everyday one is synced. A second copy of the daily hydration goal you last typed in on this phone stays here too: a mark one achievement reads to tell a goal you chose from the one the app starts everyone on. The goal itself is listed under "What leaves your device"; the mark is not in your backup file. The fasting timer stays here too, if you switch it on: the hours of the day you chose to fast, whether to tell you when a fast ends, when your latest fast started, and whether the timer is on. It keeps that one fast only, never a record of the ones before it, and it is not in your backup file. Two marks the app keeps about its own walkthrough stay here too: whether it has already offered the walkthrough to you, and which of its chapters you have ticked off. They record what has been read on this phone, and they are not in your backup file either, so a new phone simply offers the walkthrough again. A date of birth under 18, if one is confirmed on this phone, stays here too ("What is stored on your device" above says why, and why it stays when an account goes).

The meditation log deserves its own sentence, because it is the one thing here we decided to keep off our servers rather than merely happening not to send. Every meditation you record — its length and the day you sat — stays on the phone it happened on, even if you have agreed to sync. It is in your backup file, so it is still yours to keep and move. Nothing is asked about how you felt, and there is nowhere in the app to say. Nothing derived from it leaves your device either: no achievement is earned from it, and nothing about your practice reaches us — not a session, not its length, and not which days you sat.

One small side effect, named rather than hidden. Sitting earns XP like everything else in the app, so the number of days you have sat is part of your level — and your level is one of the counts attached to a feedback message. That only happens if you tick the "include usage" box, which is off unless you turn it on, and the app shows you every number before you send it. Your level is a single figure that adds workouts, active days, completed goals, unlocked achievements and days sat together; it is not a record of your practice, and one number that several things went into cannot be unpicked back into any of them.

Switching sync off removes your copy from our servers, unless you keep it. When you switch off Profile → Preferences → "Sync my data to the cloud", the sync stops at once, and the app then asks what to do with your synced copy on our servers, and leads with removing it. "Remove my copy" removes everything the list above says is synced. Your account record stays (your plan, and your consent record, which then shows which wording you agreed to and when, that you withdrew it, and which versions of our Terms and this policy you accepted). That record is how we can show all of that, and how your other devices learn to stop syncing too. "Keep my copy on the server" leaves your copy where it is. Your account stays, and everything on your phone stays: before anything is removed, the app first syncs your copy down to your phone, the same way it does when you sign in, and switching sync back on uploads what your phone holds again. If the removal cannot finish — the app cannot reach our servers, or cannot check that your phone has all of your copy, say — the app tells you, and your copy stays where it is; it also stays if the app closes before you answer. Either way, while sync is off you can remove it later with "Remove my copy from our server", under the same switch. Another device of yours that still has sync on stops when it next connects, and anything it sends before then stays on our servers.

If you do not agree to sync, none of the data described above is sent to Supabase: only your account itself is there (your email address, its id, your name, your sign-in sessions, your consent record and your plan), and your fitness data stays on the device.

Two other things leave it whether or not you sync, and both are described in full below: the demonstration-clip requests in the next paragraph, and the automatic error diagnostics in section 4. Neither carries your fitness data. The diagnostics are on by default, and you can switch them off.

The first of those: exercise demonstration videos are streamed from our hosting (Supabase) when you open an exercise in the workout library, show the demo during a workout, or run a follow-along circuit — which streams the clip for each station in turn, and fetches the next one a few seconds early so it is ready when that interval starts. Like any video stream, each request necessarily carries your IP address. It is not linked to an account, and we build no record of which demos you watch. Like every request, they appear in our hosting provider's routine server logs, which Supabase keeps on its own schedule, not ours. Those logs also hold the app's signed-in requests, which carry your account's id, so for as long as they are kept they could link the clips fetched from your connection to your account, and because a circuit fetches its clips in order, they would reflect the shape of a session. We never use them to work out who watched what: we copy nothing from them, and look at them only to fix a fault, to investigate a security problem, or to check what they hold.

2. Barcode lookups — only when you scan a product

When you scan a food barcode, the barcode number is sent to Open Food Facts (openfoodfacts.org), a free public food database, to retrieve that product's name and nutrition information. The request carries nothing that identifies you or this app — just the barcode.

The request carries no account information or other app data — but like any request your device makes over the internet, it does reveal your IP address to Open Food Facts, along with the barcodes you choose to look up. Open Food Facts is a French non-profit and its own privacy policy applies to what it receives.

Nutrition data returned by Open Food Facts is contributed by its community and is used under the Open Database License (ODbL).

The barcode reader also reports to Google. The app reads a barcode with Google's barcode reader, on your phone, and whenever you scan — a food, or a membership card, which otherwise sends nothing anywhere — Google's software sends Google some technical information about the phone and the scan. "Barcode scanning and the camera" below says exactly what. It is not the code you scanned, and it does not happen if you never scan.

3. Password safety check — only when you choose a password

When you create or change a password, the app checks whether it appears in known public breach datasets using Have I Been Pwned.

This uses the k-anonymity range API: the app computes a SHA-1 hash of your password locally and sends only the first five characters of that hash. Your password, your full password hash, your email address and your identity are never sent. The service cannot determine which password was checked.

If you sign in with Google you choose no password, and this never runs.

4. Error diagnostics — automatically, when the app hits an error

If the app hits an error, it sends a short diagnostic report to our own Supabase database so we can find and fix the problem — including for people we can't otherwise reach, like someone using the web version. Unlike the three above, this one is not something you trigger; it runs automatically whenever something goes wrong.

A report contains:

• the error message and its technical stack trace
• which screen it happened on, the app version, and whether it was the web or Android build
• your browser's user-agent string (device/OS context)
• a randomly-generated diagnostic id, used to tell one device's errors apart from another's

It is not designed to include your name, email, or anything from your weight, workout, meal, or goal data — none of those are ever attached on purpose. One honest caveat: a stack trace is whatever text the failing code produced, and in rare cases an error message can embed a fragment of something you typed (for example, a value that failed to save). That is a side effect, not a collection channel: reports exist solely to fix bugs — never for advertising, profiling, or sale — and they age out quickly (below).

A word about that id, because "anonymous" would be too strong a word for it. The id is a random string that contains no name, no email and nothing about you — but it is stored on your device and reused, which makes it pseudonymous, not anonymous. If you later send feedback with your email attached, the same id rides along with it, and the account-deletion sweep uses exactly that link to find and delete your crash reports. Data that can be connected to you is personal data, and it is treated as such.

You can turn this off. Profile → Preferences → "Send crash reports" stops the app sending any error report from that device. Reports age out and are deleted after 30 days.

When we work on a report, its error message can be read by the AI tools we use to help find and fix problems, which are provided by Anthropic — see "Who processes your data", below. The report's diagnostic id is not sent.

5. Feedback you send us — only when you use "Send Feedback"

Profile → Send Feedback sends us what you type and the kind of message you picked (a bug, an idea or something else), plus the app version, whether you're on web or Android, your browser's user-agent string (the same device/OS line section 4 describes), and the same diagnostic id described above. Nothing is sent unless you write a message and press Send.

Before you send, the form says what goes with every message — your app version, your device type and this phone's diagnostic id — and that AI tools from Anthropic may help us read it. It also shows the two extras, and you can remove either with one tap:

• Your email address, so we can reply to you. This one is attached by default — a bug report we can't reply to helps nobody. The form carries a "Send without my email address" tick box, left unticked, and tells you underneath exactly which address is going with the message. Tick it and no email address is attached, and we won't be able to reply.
• How you use the app — off by default, attached only if you tick the box: counts and settings only — number of workouts logged, routines, custom exercises, scheduled days, your level, your units/theme choices, and whether accessibility mode is on.

The usage option never includes your weight, measurements, meals, goals, or the contents of any workout — counts only, never what you logged.

Feedback is kept until your message has been dealt with, and for at most 12 months; once a message is marked handled, an automatic purge deletes it 90 days after it was sent. A copy in our encrypted backups is gone within 14 days of that (see "How long data is kept"). When the message is purged, the same step blanks our own notes on it, any restatement of it our tools wrote on the support ticket, and the fix note that described it — so no paraphrase of your words outlives the message. What stays is ours by construction: the ticket's status, its labels and the code change that fixed it.

When we work on your message, the words you wrote can be read by the AI tools we use to help sort and fix what people report, which are provided by Anthropic — see "Who processes your data", below. Your email address, your diagnostic id and the usage counts are not sent with it.

6. Foods you choose to share — only when you switch sharing on

A food you add to the food list yourself can be shared with every other user of JST Fitness. Sharing is off for every food unless you switch it on, one food at a time, and only a packaged food with a barcode can be shared. Nothing happens for a food you never switched on. A food you looked up from Open Food Facts cannot be shared this way — it already lives there, under its own licence.

What is published — the product, and only the product: its name, brand, serving size, barcode, and the calorie, macro, fibre and sugar figures you entered from its label (a fibre or sugar figure above the shared list's own limit is left out). Its sodium and a drink's alcohol, if you entered them, are not published; they stay with the food in your own list. Other users see the product in their food list marked "Community", the way they see the app's own catalogue rows, and they can log it and report it. What they do with it never comes back to you.

What is never published: your name, your email address, your account, the fact that you were the one who shared it, whether you have ever eaten it, or anything from your food log — no dates, no quantities, no meals. There is no profile, no contributor name and no "shared by" line anywhere in the app.

What we keep privately, and why. Beside each shared entry our database keeps an internal reference to the account that shared it — not your email address and not your account id, but a scrambled value derived from it. It exists so that we can act on a report, correct a pattern of bad entries, and block an account that keeps submitting them (sections 5 and 10 of the Terms). It is never shown to anyone, inside or outside the app, and it is cut when you delete your account: the entry stays in the list, because other people's logs may already use it, and nothing on our servers connects it to you any more. The same happens if you switch sharing off again for a food you already shared. Because we could trace a scrambled reference back to you while your account exists, it is personal data, and it is treated as such — the same footing as the diagnostic id in section 4. Earlier versions of an entry are kept when it is corrected, so that what changed can be seen; they carry the same reference and lose it the same way.

What you agree to when you switch sharing on is set out in section 9 of the Terms: you dedicate the entry to the public, so it can be used by anyone, corrected, passed on to public food databases such as Open Food Facts, and kept after your account is gone.

Reports. Any user can report a shared entry from the food list. A report sends us the entry's identifier, the reason you picked, any note you typed, the app version and the same diagnostic id a feedback message carries. If you are signed in, our server adds the same kind of scrambled reference to your account described above, so that an entry is hidden automatically only once three different accounts have reported it; it is cut when you delete your account. Your email address goes with it only if you type it in: leaving it lets us tell you what we did; leaving it blank means you will not hear back. Reports are deleted 180 days after they are made, whether or not we have acted on them — a fixed period of their own, not the feedback schedule below.

7. Recipe imports — only when you import from a web page

In the Android app you can fill a recipe from a recipe web page. When you do, your phone fetches that page directly from the website and reads the recipe's name, its number of servings and its ingredient list, the way your browser would open it. The website receives the page address, your IP address, and the identifying line every browser sends — here it names your phone's Android version and browser engine (and often your phone's model) and says the request comes from JST Fitness. If the address forwards to another site, as a shortened link often does, that site receives the same. Nothing you have logged and no account information goes with it. No cookies are sent, and any cookie the website sets is cleared as soon as the import finishes, so no cookie links one import to the next — though, like any website, it can tell when requests come from the same IP address.

The request never passes through our servers, and the app does not record the page address. The import fills in the recipe's name, its number of servings and its ingredients, all of which you can change; what you then save is stored, and synced if you sync, like any recipe you build by hand. Nothing else from the page is kept — not the address, the instructions or the pictures. The website is an independent site you chose, and its own privacy policy applies to what it receives.

Pasting a recipe sends nothing anywhere: the text you paste is read on your phone, and only what you save is kept.

The waiting list on our website

Our website, jstfitness.com, is not the app. Like any website, the pages you open reach Cloudflare, which serves them, with your IP address ("Who processes your data"); beyond that, we keep nothing about you from it unless you join its waiting list. If you type your email address into the form there and press the button, we keep your email address, the date and time you joined, and which page you joined from (the holding page or the home page). Nothing else goes on the list: not your IP address, not your browser's details, and nothing that links it to an account in the app. Pressing the button does carry your IP address and your browser's identifying line to Supabase, as every request over the internet does; they appear in its routine server logs, which it keeps on its own schedule, and they are never added to the list. The form sets no cookie and stores nothing in your browser.

We keep it only to email you once, when the app launches. We will not send you anything else, it is not added to any other list, it is not shared with anyone, and it is not sold. It is kept in our Supabase database ("Who processes your data"), where only the people who run the app can read it; the form itself can add an address and do nothing else. The launch email will be sent through Resend, the service that sends the app's account emails, and it will carry a way to unsubscribe.

How long it is kept. We delete the whole list within 30 days after the launch email has gone out. And whatever happens, every address is deleted automatically 12 months after it was added.

Being removed. Email [email protected] from the address you joined with, or naming it, and we delete it; you do not need to give a reason. Your address on the list is separate from any account you have in the app: deleting your account does not remove it, and removing it does not touch your account.

The form gives the same answer whether or not an address is already on the list.

Health Connect: step counts and weigh-ins

Android's Health Connect is where your phone, your watch, your smart scale and your other health apps share their data (Samsung Health among them). JST Fitness can read two things from it, each behind a permission of its own that you grant separately: your daily step count, and your weigh-ins. It reads nothing else, and it writes nothing back.

Before the app asks Android for either permission, it shows you a screen setting out exactly what follows, and you can decline it. The two answers are independent: allowing one never allows the other, and you can withdraw either at any time in Health Connect's settings.

Step counts

Switched on by tapping the step ring on the home screen.

• What is read — this permission covers your step counts and nothing else: not your heart rate, sleep or workouts. For earlier days this is the daily total. For TODAY, while the hourly breakdown is open, the app also reads the individual step entries your phone or watch recorded, so it can show you which hours you moved in. Those hourly entries are read while you are looking at them and are not saved — only the daily totals are kept.
• How far back — today and the previous 29 days, read in one go rather than repeatedly.
• What it is for — showing you your own steps inside this app: the step ring and daily total on the home screen, the last-7-days chart, today's hour-by-hour breakdown when you tap the ring, and the daily numbers in your history calendar. The distance and calorie figures the app can show beside them are rough estimates derived from the step count. If you turn on Add calories from steps in Today's Breakdown (it is off until you do), the app also adds part of the estimated calories from that day's steps to the calorie target your calorie ring counts towards. That figure is worked out on your phone each time the ring is shown and is never saved or uploaded.
• How long it is kept — each day's TOTAL is saved in the app's own storage on your device and is not trimmed. The hour-by-hour detail is never saved at all: it is read from Health Connect while you have that view open and is gone when you close it. That is deliberate: Health Connect only keeps about 30 days, so after that our copy is the only record of your history. It stays until you uninstall the app or clear its data, and it is included if you export your own backup file.
• Never uploaded, never shared — your step data is never sent to our servers. It is excluded from cloud sync even when sync is on, it is never shared with anyone, and it is never used for advertising or sold.

Weigh-ins from your scale

Switched on at Profile → Health Connect → Weigh-ins from my scale, and off by default. It exists so that a weigh-in on a smart scale is a weigh-in in the app without you typing it.

• What is read — this permission covers body-weight readings and nothing else: not your heart rate, sleep or workouts. The app also sees which app or device recorded each reading, which is how it ignores its own.
• How far back — today and the previous 29 days, which is about all Health Connect keeps. The app reads when you open it or return to it, never in the background.
• What is kept — one reading a day, the earliest of that day, added to your own weight log. Any day you have already logged a weigh-in yourself is left exactly as it is, and a reading outside a plausible body weight is ignored. An imported weigh-in is shown, graphed, edited and deleted exactly like one you typed. It is stored with two things a typed weigh-in does not have: a mark saying it came from Health Connect, and the id Health Connect gave the reading, kept so the same reading is never imported twice. Both sync with the weigh-in itself.
• ⚠ Where it goes — this one is NOT device-only. Unlike your step counts, an imported weigh-in joins your weight log, so if you have agreed to cloud sync it is stored on our servers and syncs to your other devices along with the rest of that log. Without sync it stays on the phone. Either way it is never used for advertising and never sold.

Nothing is written back. JST Fitness holds no permission to write to Health Connect — not your workouts, not your weigh-ins — so nothing this app records is added to it. Health Connect's own settings show you what JST Fitness may read and let you withdraw it at any time; the app carries on working without either permission.

Barcode scanning and the camera

Scanning a barcode, and reading a nutrition label or a restaurant menu, are all the app uses the camera for. On Android, the first time you do any of them the app asks Android for the camera — Android's own question — and the camera is on only while its screen is open. You can take the permission back at any time in Android's settings; the rest of the app does not need it.

Scanning a barcode. The camera button beside the food list's search box, and the one beside LOG MEAL on Home, open the camera with a switch at the bottom of the frame between Barcode and Menu; the recipe builder's barcode button and "Scan a card" under Membership Cards open it for barcodes alone. While the camera is open on Barcode, the app reads a few small pictures a second of what the frame on your screen shows, on your phone, with Google's barcode reader, and stops at the first barcode it finds. Each of those pictures is dropped as soon as it has been read: none is saved to your phone's gallery or anywhere in the app, uploaded, or sent to us or to anyone else. What the app keeps is only the code it found — the barcode's number, or a QR code's text. A food scan sends that number to Open Food Facts (section 2); a membership card scan sends it nowhere, and it stays on your phone only if you save the card.

Reading a nutrition label. When you add a food of your own and tap "Read the label", the app asks Android for the camera — Android's own question, the first time — and shows it on the screen. When you tap "Read the label" under the picture, it takes one picture of what the frame on your screen shows, reads the words and numbers on the label on your phone with Google's on-device text recognition, and fills in the food's figures for you to check and change before you add it. The picture is never kept: it is not saved to your phone's gallery or anywhere in the app, not uploaded, and not sent to us or to anyone else, and it is gone once the label has been read. The food you then add is the same record you would make by typing the figures yourself. The camera is on only while that screen is open, and you can take the permission back at any time in Android's settings; the rest of the app does not need it.

A restaurant menu is read the same way. On Android, the food list's camera button opens the same camera screen; with the switch at the bottom of the frame on Menu, when you tap "Read the menu", it takes one picture of what the frame on your screen shows, reads the menu's words and numbers on your phone the same way, and looks the dishes it names up in the app's own restaurant list, on your phone. The dishes it finds are shown in the food list for you to pick from, like any search; a dish the list has no match for, or holds at a figure far from the one the menu printed, can be opened as a food of your own — its name, the restaurant's name, and only the calorie figure the menu printed — for you to check before you add it. That picture is never kept either, and neither is what was read from the menu: none of it is saved anywhere in the app, uploaded, or sent to us or to anyone else, and it is gone once you close the food list or move on. Only a dish you then pick, or open as a food of your own, goes any further, and it is kept exactly as it would be had you searched for it or typed it yourself.

Because both are Google's software, Google's barcode reader and text reader also report some technical information to Google whenever you use them: your phone's make, model and Android version, which machine-learning hardware it has, this app's name and version, an identifier for your phone, and a random identifier for the installation (Google says this one is not meant to identify you or your phone), and how the reader performed — how long it took, how it was set up, what happened, and any error. Google says it uses this for diagnostics, to see how its software is used, to keep it working and improve it, and to detect misuse, that it sends it encrypted, and that it does not pass it on to anyone else. The list Google publishes does not include the code you scanned, the pictures or anything read from a label or a menu, your account or anything you log, and none of it comes to us. If you never scan, or read a label or a menu, it never happens.

The one picture the app keeps is the profile photo you choose yourself, if you set one. It comes from Android's own picker (your gallery or files — not the camera), it is stored only on your phone, it is never uploaded or synced, and it is included in your backup file so a restore brings it back. Removing it in Profile deletes it. (If you signed in with Google and set no photo, the app keeps only the link to your Google picture, as section 1 says.)

Route tracking and your location

On an outdoor walk, run, hike, ride or ruck logged with the stopwatch, the Android app can measure how far you went with your phone's GPS. Nothing is read until you agree to it on the route screen, which the app shows the first time you press START on such a set with Track route on. Once you agree, Track route is on for every such set — every outdoor set: switch it off under the stopwatch, before you press START, and that exercise records no route until you switch it back on. On a cardio exercise you made yourself, Track route starts off, and records a route only once you switch it on under its stopwatch. The app cannot tell a treadmill or an indoor bike from the road, so switch it off that way for an exercise you do indoors. If you tap Not now on the route screen, Android's location question is answered no, or you turn Track route off in Profile → Preferences, Track route stays off on every set until you turn it back on. The web version of the app, which iPhone testers use, does not have it.

• What is read, and when. Your phone's precise location, about once a second, from when you press START on a set with Track route on until you press DONE — including while the screen is off or you are in another app — and at no other time. The app shows a notification card for as long as it lasts (if notifications for JST Fitness are on), and newer Android phones also show their own location indicator. Recording also stops if you tap Stop route on that card, two minutes after you leave that set for another one or for Quick Log, if you turn Track route off in Profile → Preferences, and by itself 4 hours after it started. The app holds no "all the time" (background) location permission.
• What it is for. Working out the distance of that one set, so the distance box fills itself. You can change the number or type your own, and the number you type is the one kept. While the set records, the app also draws the route under the stopwatch as you go — a plain line, with no map behind it — from the same points, on this phone. Nothing is drawn until you are 200 m from where the set started, and no part within 200 m of that place is drawn after; the drawing goes when the recording stops. It is shown only on your screen, and is never stored, synced, sent or shared.
• What is kept, and where it goes. The distance, and, on this phone only, a drawing of the route (the next point). The distance is saved with the set in your workout history and, if you agree to sync, it syncs, backs up and exports with that workout exactly like a distance you type ("What leaves your device" above). The location points it was measured from are kept in a private file on this phone while the set records, are never sent anywhere — not to us, not into your backup file, not to Android's own backup — and are deleted once the set is logged, or if you start the set over, discard the workout or sign out. If the app is closed in the middle of a set, the points stay on the phone until that set is logged or discarded, and never more than a day after recording stopped — except after a Force stop in Android's settings, which stops the app's own clean-up too; they then go the next time you open the app. One location is kept a little longer: where the drawing of the workout's first saved route begins (its first kept point, never where that set started), so that the drawings of the workout's later sets can be placed beside it. It stays in a private file of its own on this phone until you save or discard the workout or sign out, and never more than a day after that route's recording stopped (after a Force stop, until you next open the app); no drawing keeps it.
• The route you see afterwards. When you press DONE, the app keeps a simplified drawing of the route on this phone, in a file of its own: the line you went along, measured in metres from its own first point, with every part of it within 200 m of where the set started or finished left off — wherever the route passes those places, not only at its two ends. A route that never gets more than 200 m from both ends keeps no drawing, only its distance; the distance and the splits still count the whole route. The file holds no latitude or longitude: it places the drawing in metres from where the workout's first drawing begins, so one exercise's sets are drawn each in its place. The drawing is shown on the workout's summary and on its card in History. It is never uploaded or synced, never sent to us or anyone, and not in Android's own backup, and if the set is not logged — you start it over, or discard the workout — it goes too. Your backup file includes your saved routes, with the first and last 200 m left off as on screen, as drawings in metres with no latitude or longitude in them; keep it somewhere private.
• Keeping and deleting a route. A saved route is kept until you delete it, on its own from its card in History, or with its workout. A saved route cannot be edited; you can delete it on its own or with its workout, and correct the distance it shows. Routes are only on your phone, and on any phone you restore your backup file onto: we cannot see or delete them, so delete them in the app, or uninstall. Signing out keeps them; deleting your account, or a different account signing in on this phone, removes them.
• Before the first route. The app shows a short screen saying all of this the first time your account presses START on an outdoor set with Track route on, before anything is read, and keeps a note on this phone of which wording you agreed to and when. It shows the screen again, at a START with Track route on, if that wording changes, if the note is missing — a different account signing in on this phone, say — or if you have since removed the app's location permission, or turned Track route off in Profile → Preferences and back on. It also remembers, on this phone, when you last said no to Track route (on the route screen, to Android's location question, or in Preferences), the exercises you switched it off for and the exercises of your own you switched it on for, so you are not asked at every set. None of this leaves this phone, and none of it is in your backup file.
• How to stop. Press DONE, or Stop route on the card, to stop a route that is recording; switch Track route off under the stopwatch, before START, and that exercise records none until you switch it back on; turn Track route off in Profile → Preferences, and no set records a route — one that is recording stops — until you turn it back on and agree on the route screen again; or remove JST Fitness's location permission in Android Settings → Apps → JST Fitness → Permissions, and the app shows its route screen again the next time you press START on an outdoor set with Track route on, where Not now keeps Track route off on every set. The rest of the app keeps working, and you can always type a distance instead. Routes already saved stay on this phone until you delete them.

Your location is never sold, shared, or used for advertising, and the app sets no geofence around any place.

Who processes your data, and where

These are the companies that handle data for this app, or that receive requests directly from your device — and, last, the one group of people who can see something you chose to share:

• Supabase (a US company) — runs the database and sign-in system that hold your account and everything you sync. Supabase is our processor: it stores and serves your data so the app works, on our instructions and not for its own purposes. The formal contract that belongs underneath that — Supabase's standard data processing agreement — is not signed yet, and this entry will name the date once it is. The transfer paragraph below says the same thing about the same gap. Supabase also holds our website's waiting list ("The waiting list on our website" above).

• Vercel (a US company) — hosts jst-fitness.vercel.app: the web version of the app that iPhone testers use, the page our password-reset and invite emails open, and a copy of these pages. It receives your IP address and standard request logs; what you log in the web version goes to Supabase, not to Vercel.

• Cloudflare (a US company) — serves jstfitness.com, where these policy pages live and which the app opens when you tap one of them, and passes email sent to [email protected], or to our other jstfitness.com addresses, on to the inbox we read it in (Google, below). When you open one of our pages it receives your IP address and the standard details of the request, like any web host; when you email us, your message and your address pass through it on the way.

• Resend (a US company) — delivers the emails the app sends about your account: the invitation, if we invite you to create one; the code that confirms your address when you create one; the password-reset link; and short notices about your sign-in, such as that your password was changed. It receives your email address and the contents of those messages, and nothing else for those emails. It is never sent your weight, your food log, your workouts, or anything else the app holds. Resend is our processor: it sends on our instructions and not for its own purposes. It will also send the one email announcing the app's launch to the addresses on our website's waiting list, and receive those addresses to do it.

• Anthropic (a US company) — we use its Claude AI tools, run from our own computers, to help read, sort and fix the bug reports and feedback we receive. When we work on one, the words of a feedback message you sent, or the error message from a crash report, go to Anthropic together with our own notes about it. Your email address, your diagnostic id, your account and the data you sync are not sent. This is not yet under a business agreement that stops Anthropic keeping or learning from what it is sent; this entry will say so, and name the date, once it is.

• Google — if you sign in with Google, Google processes that sign-in and returns your email address, your name and a link to your Google account picture to the app; if you set no photo of your own, your phone loads that picture from Google (section 1). On Android, Google also provides the on-device barcode reader, the on-device text reader that reads a nutrition label or a restaurant menu, and Health Connect, all described elsewhere in this policy; the barcode reader and the text reader report their own technical diagnostics to Google when you use them ("Barcode scanning and the camera"). And email you send to [email protected], or to our other jstfitness.com addresses, arrives through Cloudflare in a Gmail inbox, so Google holds the messages we receive there. That inbox is an ordinary Gmail account, not under a business agreement with Google; this entry will say so, and name the date, once it is.
• Open Food Facts (a French non-profit) — receives the barcode you scan and, as with any web request, your IP address. It is an independent service you choose to query, not a processor working for this app.
• The website a recipe comes from — when you import a recipe from a web page, your phone requests that page from the website directly. It receives the page address, your IP address and the identifying line your phone's browser sends, which names this app; a site the address forwards to receives the same. It is an independent site you chose, not a processor working for this app, and the request never passes through us (section 7).
• Have I Been Pwned — receives the first five characters of a hash of your candidate password, and nothing else.
• Other users of JST Fitness — not a company and not a processor, but the one place data goes because you chose to send it there: a food you added and switched sharing on for is shown to every other user of the app, as the product's label facts and nothing about you (section 6). Nobody outside the app receives it from us; if we ever pass shared entries on to a public food database, it will be under the public-domain dedication the Terms describe, still with nothing about you attached.

International transfers. Supabase, Vercel, Cloudflare and Resend are US companies, so data they handle may be stored in, or accessible from, the United States. The mechanism for that transfer is the standard contractual clauses in each provider's data processing agreement, and the EU-US Data Privacy Framework where the provider is certified. Those agreements are not yet in place; this paragraph will name the date once they are. Anthropic, also a US company, handles the report text described in its entry above, and that is not yet under such an agreement either; nor is the Gmail inbox, at Google, also a US company, where the email you send us is kept. The encrypted backups described under "How long data is kept" are kept on our founder's own computer.

How we protect your data

Everything the app sends travels encrypted (HTTPS). On our servers each synced record is locked to its own account: the database refuses any request to read or change another account's records, and the app holds no key that gets round that. That lock binds every request the app makes. Whoever administers our Supabase project can reach the database through Supabase's own console, which the lock does not bind; we use it to run and repair the database, not to read your records. Only the two people who run JST Fitness can open our internal support page, each with a second sign-in step, and it does not show the fitness, body or food data you sync. Android's own backup is switched off for this app, so nothing it stores is copied to Google Drive; the backups we keep are encrypted and described under "How long data is kept". If a breach ever reached your data, we would tell you, and the authorities the law names, as the law requires.

The legal bases, if you're in the EU or UK

The GDPR requires a stated legal basis for each thing done with your data. Here they are, purpose by purpose:

• Cloud sync of your fitness and health data — everything the sync list above names, including your weight, measurements and meals — rests on your explicit consent, given when you agree to sync. Health data gets the strictest treatment the GDPR has (Article 9), which is why nothing syncs unless you agree to it. You can withdraw the consent at any time: Profile → Preferences → "Sync my data to the cloud" stops the sync at once, and then removes your synced copy from our servers unless you choose to keep it (section 1 says what stays) — crash reports, feedback you send and foods you choose to share are not part of the sync, and each is covered in its own section above — and deleting your account withdraws it permanently. If you choose to keep your copy, it stays because you asked us to keep it. So that we can prove the consent was given (Article 7(1)), your account keeps a small consent record — which wording you agreed to and when.
• Creating and running your account — your email address, your name, password handling, sign-in, your consent record and your plan — rests on performance of a contract: it is the thing you asked for by signing up.
• Error diagnostics rest on our legitimate interest in finding and fixing bugs. The reports are minimal, deleted after 30 days, and Profile → Preferences → "Send crash reports" turns them off.
• Counting how much is synced, and how many accounts are still syncing — how many accounts have synced in the last 7, 30 and 90 days, and how much room the sync mirror takes altogether — rests on your explicit consent: the same Article 9(2)(a) consent that lets us hold that data at all. Knowing how much of it we are holding, and how many accounts are still adding to it, is part of holding it: it is what tells us the storage is sized right and what the deletion schedule below will actually reach. If you have switched sync off, or never switched it on, you are not counted in those figures. This consent does not cover everything that page counts: accounts, subscriptions, crash reports, support messages and sign-in countries rest on the other bases in this list. And one count about the community food list sits outside it: how many foods have been shared, and how many of those are hidden. That one is not gated on your sync consent, and that is a decision rather than an impossibility. A shared entry carries no account id — only a keyed hash of the account that shared it — and we could match that hash to a consent record if we kept a map from one to the other. We deliberately do not keep one, because that map would be the very link the sharing feature is built to avoid, and we are not going to create it in order to filter a count of entries. It rests on our legitimate interest in knowing how the shared list is being used, which is available here precisely because the fact that a food was shared is not health data about anybody. The sharing entry below says what that consent does cover. Nothing is stored in order to produce any of these figures. Each one is worked out fresh at the moment the page is drawn, from whatever the accounts it may count hold right then. One chart groups accounts by the day each last synced, so its bars carry dates — the date on a bar is the day somebody last synced, not the day we counted. The figures in this entry are totals across accounts, never a row about one person; no third party receives them, and nothing extra is recorded to produce them. (One per-account row does exist on that page, for support rather than for counting — an account list showing when each account last signed in and last synced. It is described in What the app does not do below.) We do not claim that counting makes your data anonymous — with a user base this size it plainly would not, and a policy that said otherwise would be wrong. Your data stays your data, subject to every right listed below, whether or not it has been counted.
• Counting sign-ins by country — the two counts described in section 1 — rests on our legitimate interest in knowing where the app is being used and where the people using it are. It is worked out from the address your sign-in already carries, only ever by country, as the page is drawn, and nothing about where you are is written down.
• Feedback you send, and a report you make about a shared food, rest on your consent, given by pressing Send. Sections 5 and 6 list everything that goes with each, and the feedback form says it beside its Send button, with who may read it.
• Sharing a food you added with other users rests on your consent, given by switching sharing on for that food after the app has told you, beside the switch, what is published and what is not. You can withdraw it by switching sharing off again or by deleting your account; either cuts the link between you and the entry, which is the only part of it that is about you. The entry itself — a product's label facts, dedicated to the public under the Terms — carries nothing about you once that link is cut, and stays. This consent covers publishing the entry. It is not what the internal page's count of shared foods rests on, and saying that it was would be stretching it: agreeing to put a label in a public list is not agreeing to be counted. That count — how many entries the shared list holds, and how many are hidden — rests on our legitimate interest in knowing how the list is being used, which is a basis we can use here only because the fact that a food was shared says nothing about anyone's health. It is not filtered by anyone's sync consent, deliberately: doing that would mean keeping a map from account to entry, and not keeping one is the point of the hash. Switching sharing off, or deleting your account, cuts the link between you and the entry either way.
• Barcode lookups and the password safety check rest on performing what you asked for: each runs only when you trigger it, sends the minimum described above, and stores nothing about you.
• Recipe imports from a web page rest on performing what you asked for too: the request runs only when you import, sends what section 7 describes, and the recipe it fills in is kept only if you save it — on the same footing as any recipe you build by hand.
• Recording a route with GPS rests on your explicit consent (Article 9(2)(a), with Article 6(1)(a)), given on the route screen the app shows before anything is read, and recorded on this phone with the wording's version and time. You can withdraw it at any time by turning Track route off in Profile → Preferences, or by removing the app's location permission ("Route tracking and your location" says what each does).
• Keeping a date of birth under 18 on the phone it was confirmed on rests on our legitimate interest in keeping the app to adults, as the Terms require: it is one date, that copy never leaves the phone, and the app deletes it once that date is 18 years ago.
• Keeping the service running and safe — the encrypted backups, the record that an address has had its free trial, the block list, the record that an account is closing under the age rule, our support tickets, and the routine request logs our hosts keep — rests on our legitimate interest in restoring accounts after a failure, one trial per person, stopping abuse, keeping the app to adults as the Terms require, and fixing what people report.
• Email you send us rests on our legitimate interest in answering it, and, for a request to use one of your rights, on the legal obligation to answer it.
• The waiting list on our website rests on your consent, given by typing your address and pressing the button beside a line that says what the list is for. You can withdraw it at any time by emailing us, and we delete the address.

What the app does not do

• No advertising and no ad identifiers

• No analytics of our own about you, and no tracking of you as a person — no profile, no behavioural record, and nothing about you sold or used for advertising. The one outside diagnostics in the app are Google's own, about its barcode reader and its text reader, which reads a label or a menu ("Barcode scanning and the camera" above).

  Almost every usage figure we can see is a count across all accounts together, described in the legal bases above and in section 1. There is one exception, and it is a row rather than a count: the internal page carries an account list for support, with one row per account showing the email address, when the account was created, when it last signed in, whether it is on a trial or a plan, and when it last synced. Nothing about what you have logged is on that row — no size, no store count, nothing from inside your data — and the row exists so that a support message can be answered, which rests on our contract with you rather than on your health-data consent.

• No tracking across other apps or websites. Google receives each Google sign-in and, if you set no photo of your own, each load of your Google account picture (section 1), as it does from any app or site that uses them, under its own privacy policy. Apart from that, no one — not us, and no other company through the app or our website — collects information about what you do over time across other apps or websites. So the app and the site do not change what they do for a Do Not Track or Global Privacy Control signal: there is nothing for one to switch off.
• No location tracking outside a route you start. The app reads your phone's precise location only between START and DONE on an outdoor cardio set with Track route on, and holds no "all the time" (background) location permission ("Route tracking and your location" above). The one other near neighbour is the sign-in country count described in section 1; it is worked out from the address your sign-in already carries, and nothing about where you are is stored.
• No selling of personal information, and no sharing of it with a third party apart from the two exceptions "At a glance" at the top names: the words of a feedback message you send, and the error message of a crash report, can be read by Anthropic's AI tools, and email you send to our jstfitness.com addresses is kept in a Gmail inbox at Google ("Who processes your data"). A food you choose to share carries none (section 6).
• No contact list, SMS, or call log access

No training of AI models on your data. We do not use your personal data to train large language models or other AI models.

The one decision the app makes about you on its own

If you confirm a date of birth under 18, the app closes your account ("Children and under-18s" below). Under 13, the account and its data are removed within minutes, and that cannot be undone. From 13 to 17 you get at least 30 days' notice first; during that time you can email us, and a person will look at it and can stop the closing. The decision rests only on the date you entered. Nothing else the app works out decides anything about you with legal or similarly significant effect.

Your data and your choices

• Export — the app can export a full backup file of your data, and spreadsheet (CSV) copies of your workouts, weigh-ins, body measurements and food log that open in any spreadsheet app. Those spreadsheets can be brought back in at Profile → Backup & Restore → Import from Spreadsheet: the file is read on your phone, only what is missing is added, and the added rows join your logs and sync with them like anything you log. An exercise the app does not know is added to your own exercises, unless you match it to one of the app's on the import screen, and if an imported weigh-in is the newest in your weight log, your current weight follows it, as it does when you log one. Each added row carries a mark saying it was imported. A workout or a weigh-in also carries a short fingerprint worked out from everything the file said about it — its date, its numbers and any words it carried, such as a workout's name and notes or a weigh-in's note — and an imported food's own id is made the same way from its day, meal and food; they are kept so the same row is never imported twice, and a weight goal's history names an imported weigh-in by its fingerprint, as it names any other weigh-in by its id, so that deleting the weigh-in takes it off the goal ("Rectification", under "Your rights", says what can stay). A fingerprint says nothing the file did not. It stays with a workout if you later edit it; editing an imported weigh-in makes a new entry, and the old one's fingerprint joins the list of deleted items, as a delete's does. If you delete an imported workout or weigh-in, its fingerprint joins the list of deleted items the app already keeps and syncs, so importing the same file again does not bring it back.
• Share an image — you can share a picture of your weekly report, of your training report, of a single workout from your history, or of one of your saved routines, through Android's own share sheet; it is made on your phone and goes only where you send it. A workout's picture carries its name and date, how long it lasted, how many sets you logged, a cardio set's distance (typed in, or measured by GPS when you tracked the route — never the route itself), and its exercises with the sets and reps, seconds, or time, distance and pace you logged; a routine's picture carries its name, how many exercises and sets it plans — or, for a circuit, how many rounds — and its exercises with their planned sets and reps, seconds or minutes; neither carries a weight you lifted, planned or carried, or a record; on every picture, names you gave your routines and exercises appear as you typed them. The weekly report's picture carries the week's dates, a one-line headline (which may name one of your goals as you named it, your average steps a day, how many records you set or how many days you showed up), the days you showed up, how many workouts and active days you had, your step total, how many records you set, and how many badges you earned with up to three of them by name, and it is one of the two that can carry a weight: the total you lifted that week, up to three of the records you set, each with its weight and reps, and the badges you earned by lifting a stated weight or total (such as "Three-Plate Bench" or "Half-Million Club"). Before you share it, the app lists every part with what it would show: those three start unticked each time the list opens and go on the picture only if you tick them, the rest start ticked unless you unticked them earlier while the app was open, and anything you untick stays off the picture. The training report's picture carries the window's dates, a one-line headline (how many records you set, or how many times you trained and how often), how many times you trained in each week of the window (each month, over a long stretch), how many sessions, how many a week, your total training time, how many records you set, and your most-trained lifts with how many sessions each, and, when you started training partway through the window, the day you started, from which those figures count; it is the other one that can carry a weight: the total you lifted in the window and up to three of the records you set, each with the day you set it, its weight and its reps. Before you share it, the app lists every part with what it would show: those two start unticked each time the list opens and go on the picture only if you tick them, the rest start ticked unless you unticked them earlier while the app was open, and anything you untick stays off the picture. No picture carries your body weight, your calories or your meditation.
• Keep every device you use JST Fitness on up to date. A phone, or a browser with the web version open, that is still running an older version of the app can bring back something you deleted or corrected on another device, until it is updated.
• Delete local data — uninstalling removes everything stored on the device.
• Remove your synced copy but keep your account — switch sync off and choose "Remove my copy" (section 1 says what stays).

• Delete your account and your data — from inside the app at Profile → scroll to the bottom → Delete Account. You are asked to type DELETE to confirm. This immediately and permanently removes your account and sign-in credentials; all synced data on our servers (weights, workouts, routines, custom exercises, measurements, meals, goals, achievements, streaks and profile details); any feedback you sent with your email address attached, including that address; and crash diagnostics linked to the devices that feedback came from. The app also erases its copy on the device you delete from.

  The limits on that, stated plainly:

• Feedback sent "without my email address" is deleted when we can find it — and we usually can. Every feedback message carries the device's diagnostic id even when your email doesn't. If any other message from that device did carry your email, the deletion sweep uses that link to find and delete the email-less messages too. A message from a device that never sent identified feedback stays in our feedback list as unattributed text: nothing in the message ties it to your account; while our host keeps its request logs, the request that sent it carries your account's id if you were signed in, and we never use them to connect messages to people. Email us a description if you want a specific one removed.
• Words our AI tools have already read. If we worked on a message or crash report you sent with Anthropic's tools, deleting your account cannot recall what was sent; Anthropic's own terms decide how long it keeps it.
• Your requests in our host's server logs. Every request the app makes, a sign-in included, passes through our hosting provider's routine server logs, which record your IP address and, once you are signed in, your account's id; a sign-in also records your email address. Deleting your account cannot remove them; Supabase deletes them on its own schedule, not ours.
• Your other devices are not wiped remotely. We have no way to reach out to a phone or laptop and erase it. Once the account is gone, those devices simply stop syncing — but whatever was already downloaded stays on them until you uninstall the app or use your system's "clear app data". Signing out alone does not remove it: sign-out ends the session and deliberately leaves the data on the phone, because it can include entries that never synced anywhere else and exist nowhere else. A route you recorded with Track route was never downloaded anywhere: it lives only on the phone that recorded it, and on any phone you restore your backup file onto, which a deletion by email cannot reach, so delete your account from inside the app on that phone, or uninstall the app there, to remove it.
• A food you chose to share stays shared. The entry — the product's name, brand, serving, barcode and its calorie, macro, fibre and sugar figures — stays in every user's food list, because their logs may already use it and because you dedicated it to the public when you shared it. What deletion removes is the private link between the entry and your account, so nothing on our servers connects it to you.
• Some records outlive the account by design, and "How long data is kept" below describes each: a report you made about a shared food stays until it is deleted 180 days after you made it, with any private link to your account cut; a block, if one was ever placed on your account, device or network, stays so that deleting the account cannot lift it; and the one-way scrambled record that your email address has had a free trial stays for 400 days.
• One date can stay on the phone you delete from. If a date of birth under 18 was confirmed on that phone, the app keeps a copy of that date there, so that the age question cannot simply be answered again ("What is stored on your device" above). It never reaches our servers, and the app deletes it once that date is 18 years ago.
• An address on our website's waiting list stays on it. The list is separate from the app and is not linked to your account, so deleting your account does not remove it; ask us by email and we delete it ("The waiting list on our website" above).
• Email you sent us stays in our support inbox, an email asking us to delete your account included, for as long as "How long data is kept" below says.

There is no grace period, and a deleted account cannot be restored. For up to 14 days, copies of your account record — your sign-in email address, name, profile-photo link and sign-in details, and your plan record — and of any support ticket made from something you sent can remain in the encrypted backups described under "How long data is kept", and are then deleted. Nothing you logged or synced is in those backups, except a food you chose to share, which is part of the shared list. If you want to keep your data, use Profile → Backup & Restore → Back Up Data first.

Crash diagnostics that were never linked to any feedback of yours contain no name or email, and nothing in them ties them to your account; while our host keeps its request logs, the request that sent one carries your account's id if you were signed in, and we never use them to connect reports to people. They may be kept for stability analysis until they age out at 30 days.

• Anything else — contact the email below to request deletion of the account and any synced data.
• Revoke permissions — Health Connect access can be withdrawn at any time in Android's settings. So can camera access, which the app asks for only when you scan a barcode or have it read a nutrition label or a restaurant menu; everything else works without it (see "Barcode scanning and the camera" above). So can location, which only Track route uses ("Route tracking and your location" above).

Your rights

You have the rights below wherever you live: the GDPR gives them to people in the EU/EEA and the UK, and we honour them for everyone. To use any of them, email the address at the bottom of this page. Requests are answered within 30 days, and using them costs you nothing and changes nothing about how the app works for you.

If we refuse a request, we will tell you why, and you can appeal by replying. We answer an appeal within 45 days, and if we turn it down we will tell you how to complain to your state's Attorney General or, in the EU and UK, your data protection authority.

• Access — ask for a copy of everything held about you. The in-app backup export covers the fitness data you synced; your consent record, your plan record (founder / trial / subscription status), feedback and crash reports held on the server, the list of foods you have shared, and an address on our website's waiting list, can be requested by email.
• Rectification — correct anything that is wrong. Everything you enter that the app syncs can be corrected in the app, one body measurement at a time included: the pencil beside a day's measurements in the Weight tab's history lets you change or delete each reading. For anything you cannot reach in the app, email us: we will correct it where our copy can be corrected, or record your correction beside it. A few things cannot be changed in the app, and "What the app cannot correct for you", just below, names each one.
• Erasure — delete your account and its data, from inside the app or by email, as described above (a shared food's link to you is cut — section 6). To remove your synced data but keep your account, switch sync off and choose "Remove my copy" (section 1 says what stays). If you ask us by email to delete some body-measurement readings and keep your account, we keep only each reading's id (a stamp of when it was written, which says nothing of the body part or the number) until your account goes, so the delete holds on every device; a spreadsheet you import again can bring the reading back. A reading from before 24 September 2026 has no id, so nothing is kept for it ("If you used JST Fitness before launch", below, says what that means). An address on our website's waiting list is deleted when you ask us by email.
• Restriction — ask for your data to be held but not used while a dispute or correction is being sorted out.
• Objection — object to processing based on legitimate interest. In this app that means the error diagnostics, the sign-in country counts, the count of shared foods, the date of birth kept on a phone, and the records listed under "Keeping the service running and safe" in the legal bases above.
• Portability — receive your data in a machine-readable format. The backup export is a plain JSON file you can take anywhere.
• Withdraw consent — at any time, without affecting the lawfulness of what was done before. Switching sync off withdraws the sync consent, and deleting your account withdraws it entirely. Switching sharing off for a food withdraws that consent. Turning Track route off withdraws the route consent. Emailing us withdraws your consent to our website's waiting list, and we delete the address.
• Complain to a supervisory authority — you can lodge a complaint with your local data protection authority. That right is yours no matter what this page says — though writing to the address below first will usually get things fixed faster.

What the app cannot correct for you

These are the exceptions to "everything you enter can be corrected in the app". For any of them, email us, as above.

• A BMI/BMR/TDEE result you saved keeps the figures it was saved with; saving again replaces that day's result, not an earlier one, and every saved result goes when you delete your account.
• A workout whose card in your history has no Edit button — a follow-along session, for one — can be deleted but not edited.
• What the app records for itself (your achievements, XP and the days you opened the app) is not edited in the app, and an achievement stays earned if you later correct or delete what earned it.
• Deleting a weigh-in, or correcting its weight, also takes it off your weight goals' history, on every day a goal recorded it, and on your other devices once they sync with this version of the app — a phone, or the web version open in a browser; a device still running an older version keeps those points, and can send them back, until a device with this version syncs again. If another weigh-in on the same date has the same weight, the point can stay, as that weigh-in's; it can also go, for one when a device that had not yet caught up with the delete sends the goal back. If you delete every weigh-in, a weight goal that follows them shows its Start as where you are now.
• A point a weight goal recorded before your device was updated to this version of the app, or on a device still running an older version, can stay. It goes only if the goal records a new point on the day the point is dated, since a goal keeps one point a day, or if the goal still follows your weigh-ins, the point is dated on the deleted weigh-in's own date or on the day it was logged, and no other weigh-in at that weight is dated or logged that day; a copy dated on another day can stay.
• A goal's Start, the weight it began from, is a setting of the goal, and so is the Current of a goal you keep by hand: deleting a weigh-in does not change them, and you can change them in the goal's editor. A goal you have marked complete keeps its Start and the weight it finished at as they stood, because a finished goal cannot be edited in the app.
• While you have told the app you are under 18, or your height and latest weight put you below a BMI of 18.5, a goal's editor does not show you the date a weight goal, or a goal that counts weigh-ins, was to be reached by; the target, Start or type of a weight-loss goal, or of a goal that counts weigh-ins; the finish line of a goal that counts weigh-ins; or the name of a weight-loss goal you have not marked complete, which its card and its editor show as "Weight Goal" instead. They stay as they are: delete the goal to remove them, or email us.
• Where a goal's editor shows you the target, it will not save a weight goal whose target is below a BMI of 18.5 at the height you entered (or, if you have not entered your height, at 4 feet 10 inches (147 cm), the height the app assumes for this check alone when it does not know yours: a target of about 88 lb (40 kg) or less) while it keeps that target — not even a new name, Start or Current — unless the goal began below the target and you are still below it, as a goal to gain up to it: to change the rest, move the target or delete the goal, or email us.
• A shared food is corrected by us when you ask, by email; earlier versions are kept as a record.

How long data is kept

• Everything stored on your device — until you uninstall the app or clear its data. It is your copy, on your hardware. One exception: your food log and water log keep the last 90 days. Older days are removed from your phone when the app starts, and from your synced copy the next time it syncs. A backup file or spreadsheet holds only what is still there, so export regularly if you want a longer record. A second exception: what Track route keeps — the location points of a set, which go once that set is logged and never more than a day after recording stopped, and your saved routes, which stay until you delete them or their workout, or until your account is deleted or a different account signs in on this phone ("Route tracking and your location" has every case).
• Your account and synced data — until you delete your account (your food and water logs keep 90 days, as above). Your synced data goes sooner if you switch sync off and let the app remove it (section 1). Deletion from our database is immediate and permanent; the encrypted backup copies of your account record described below are gone within 14 days, and your synced data is never in them. The one exception is an account being wound down (see "Children and under-18s" and section 10 of the Terms): during that notice period the data is kept, and only so that you can still export it.
• Your sign-in sessions, and the IP address recorded against each one — kept for as long as the session itself lives: until you sign out on that device, or until the session stops being renewed and expires on its own. Deleting your account deletes your sessions and those addresses with them. We keep no separate archive of them, but every sign-in, like every request the app makes, also passes through our hosting provider's routine server logs. Those logs record the IP address, the rough place it points to and your device's identifying line; once you are signed in, your account's id; and, for a sign-in, your email address. Supabase keeps those logs on its own schedule, not ours, and deleting your account cannot remove them sooner. We copy nothing from them, and look at them only to fix a fault, to investigate a security problem, or to check what they hold. The country counts described in section 1 are worked out from your sessions' addresses as the internal page is drawn, and store nothing.
• Backups — encrypted, and kept 14 days. So that a server failure or a mistake cannot wipe out everyone's account, we keep a daily copy of the records nothing else could restore: sign-in email addresses, names, profile-photo links and sign-in details; plan and founder records; the free-trial and block records described below; the record that an account is being closed under the age rule; the foods people have shared; and our own support tickets — which can hold a copy of a feedback message or of a crash report's error message, and our notes about it. Reports about a shared food are not in them. Each copy is encrypted before it is written, kept on our founder's own computer rather than in the database, used only to put those records back if they are lost, and deleted automatically once it is 14 days old (if that computer is switched off that day, the next time it is on). Your synced fitness, body and food data is never in them — if the database lost it, it would come back from your own devices. Deleting your account removes your account record from every backup made after that; the copies made before it are gone within 14 days. Anything deleted on a schedule below (feedback, crash reports) likewise leaves the backups within 14 days of its own deletion. If we ever have to restore records from a backup, we first delete again every account we know was deleted after that copy was made — from the later backups and from the deletion requests we received — so a restore is never used to bring back an account someone closed.

• The record that your email address has had its free trial outlives your account. Every new account gets one 10-day free trial. To make "one" mean one, when an account is created we keep a record that the email address it signed up with has had its trial — otherwise deleting an account and signing up again would hand out an endless supply of free trials. The one exception is an account removed because its owner is under 13: that removal deletes this record too.

  We do not keep your email address to do this. What is stored is a one-way keyed hash of it: a scrambled value that cannot be turned back into your address, produced with a secret key that never leaves the database. It can answer exactly one question — "has this address had a trial before?" — and nothing else. It is not linked to your name, your account, or anything you recorded in the app, and none of your fitness data survives with it. Each record is deleted 400 days after the address was last used to sign up.

  We considered doing this by IP address instead and decided against it: an IP is shared by everyone in a house, an office or on public wifi, so it would wrongly refuse trials to people who had never had one — and an IP tells us far more about you than the hash does.

• A block outlives a deleted account too — but only where a block was placed. An account, a device or a network can be blocked for attacking or abusing the service, which is the case section 10 of the Terms describes. The block list keeps the identifier that was blocked and a short note about why. It has to outlive the account, or deleting the account and signing up again would lift the block. It holds no name, no email and nothing you recorded in the app, and if you were never blocked there is no record of you in it at all.
• The record that an account is closing under the age rule — no date of birth, age or email; it goes with the account at the end of the notice period (at least 30 days), or within minutes for an account under 13.
• A food you chose to share outlives it too — without the link to you. Shared entries stay in the community food list for as long as that list exists, after the account that shared them is deleted, with the internal reference to that account removed. They are product facts, and they carry no name, no email and nothing from your log. Reports about a shared entry are deleted 180 days after they are made, whether or not we have acted on them.
• Error diagnostics — deleted automatically after 30 days.
• Feedback — kept until your message has been dealt with, and for at most 12 months. Both limits are enforced automatically in the database, not by hand: a nightly job deletes handled messages 90 days after they were sent, and deletes anything at all once it is 12 months old.
• Email you send us — kept in our support inbox while we need it to answer you; a rights request and our answer are kept for 24 months as the record that we answered. Deleting your account does not delete email you sent us, an email asking for the deletion included.
• A sign-up that is never confirmed — the email address and name it was made with stay until we remove them; email [email protected] to have one removed.
• The waiting list on our website — deleted by us within 30 days after the launch email has gone out; whatever happens, a nightly job in the database deletes each address 12 months after it was added; and one address at once if you ask ("The waiting list on our website" above).

California residents (CCPA)

JST Fitness is free to use while it is in beta, and it is run by two people. The rights the CCPA grants to California residents are honoured here:

• Nothing is sold or shared, as the CCPA defines those words. The app carries no advertising, no ad identifiers, no data brokers and no cross-context behavioural advertising, so there is no "Do Not Sell or Share" link — there is nothing for it to switch off. That describes the app as it stands on this page's date; it is not a promise about every version that will ever exist. If it stops being true, this page will say so before it takes effect, the link will appear, and you will be asked to agree again first.
• Choosing to share a food you added is not a sale or a share in the CCPA's sense either: no money or other value changes hands, nothing is used for advertising, and what other users see is a product's label facts, not information about you.
• What is collected is exactly what this policy lists. There is no second, longer list.
• Know, delete, correct — the access, deletion and correction routes described above are open to everyone, California included.
• No discrimination — exercising any of these rights costs you nothing and changes nothing about how the app works for you.

Requests: the email at the bottom of this page.

Children and under-18s

JST Fitness is for adults: you need to be 18 or older to use it. The app is not directed at children or teenagers and does not knowingly collect information from anyone under 18.

The reason is what the app does. It sets calorie and macro targets and can be pointed at losing weight, and those are not things it can do safely for someone who is still growing.

If we learn that an account belongs to someone under 18, it is closed. What happens to the data depends on their age, because the two situations are governed by different rules:

• Under 13 — the account and its data are removed promptly and without notice, as required by the US Children's Online Privacy Protection Act (COPPA). COPPA obliges us either to obtain verifiable parental consent or to delete promptly; we are not set up to verify a parent, so we delete. The law does not offer a grace period and does not let us keep the data in the meantime. Encrypted backup copies of the account record (see "How long data is kept") are deleted within 14 days of the removal, and are never used to bring the account back.
• 13 to 17 — this is not COPPA. They are simply not eligible under our Terms, so the account is wound down rather than deleted on the spot: they are told, and they get at least 30 days to export their data before it is removed, exactly as section 10 of the Terms of Service promises everyone. Their data is retained for that window for the sole purpose of letting them take a copy of it.

When someone confirms a date of birth under 18, the app also keeps a copy of that date on the phone it was entered on, so that starting again on that phone does not simply get past the question. That copy is not part of any account and never reaches our servers, and the app deletes it once that date is 18 years ago.

If you believe a child or teenager has an account, email the address at the bottom of this page and we will remove it. The same goes for our website's waiting list: if we learn that an address on it belongs to someone under 18, we delete it.

If you used JST Fitness before launch

JST Fitness was tested by a small group before it launched, and a few things from that time can still be true of a tester's data. If any of these is yours, email us and we will help you correct or remove it:

• A synced copy left by switching sync off. If you switched sync off in a version of the app that did not ask what to do with your synced copy, that copy is still on our servers; "Remove my copy from our server", under the sync switch, removes it.
• Two days of counting that reached too far. From 4 to 6 September 2026 our internal page counted, for each kind of data — weigh-ins, meals, workouts, goals and the rest — how many accounts held it, how much they held and how long accounts had gone without syncing, and how many separate people had shared a food. It chose whom to count from the policy stamp alone, so it counted accounts that had switched sync off or never switched it on. Those figures were totals, never a record about one person, and that counting stopped on 6 September 2026.
• Effort ratings the app filled in. A version of the app saved a 7 as the effort rating of every follow-along circuit, and of a set-by-set session whose rating row you never touched. Sessions saved then keep that 7, because working out which sevens were yours would mean rewriting your training log on a guess.
• Body measurements with no id. A reading logged on a version of the app that gave readings no id, or brought back from a backup file such a version made, has none, so a deletion we make by email keeps nothing for it, and a phone that still holds it puts it back at its next sync unless it is also deleted in the app there.
• Weigh-ins with no logged time. A weigh-in logged by a version of the app older than the first one to record when each weigh-in was logged, from 29 July 2026, or brought back from a backup file such a version made, carries no such record, and this version of the app records no goal point from it.
• A weight goal turned into a count of training days. A goal's Start is a setting of the goal, which you can change in its editor. The exception is a weight goal you turned into a count of training days after its date passed, which an earlier version of the app offered: it keeps its Start and the weight it showed when it turned, which its editor does not show; delete the goal while it is running to remove them, or email us.
• Accounts that lived only on one device. Some early accounts were created before the app required sign-in, and exist only on the device that made them. None of what they log is sent to our servers, deleting one erases it immediately, and the app no longer offers a way to create one.

Contact

Questions about this policy or requests about your data: [email protected]

Changes to this policy

The "Last updated" date at the top is the day this version took effect. When a change matters — something new leaves your phone, someone new receives it, it is kept longer or used for a new purpose, or your rights change — that date moves, the note at the top of this page says in a few lines what changed, and the app shows you the policy and asks you to agree before you carry on. We will not start sending a new kind of data off your phone, or use or share what we hold for a new purpose, until we have told you in the app and, where the law asks, you have agreed; you can always switch sync off or delete your account instead. Data you gave us before a change is never used or shared in a new way unless you have agreed to it. Other edits — describing something new that stays on your phone, a clearer sentence, a typo, a fixed link — do not move the date. Earlier versions are kept on file; email [email protected] for a copy.