Privacy policy
Howfen Fitness is a free gym and food tracker. It is owned and run by Howfen Studio (“we”, “us”), the data controller for the personal data described here. Contact us at [email protected] or via www.howfen.studio.
In short: we collect what the app needs to work, we keep your health data private, we never sell your data, and you can export or delete everything from Settings at any time.
1. What we collect
Account
Your name, email address, a hashed password, an optional profile photo, your invite code and the mates you add.
Body stats
Sex, age, height, weight and body measurements you enter (such as body fat or waist), your goal, training days, experience and the calorie and protein targets we calculate from them.
Progress photos
Photos you choose to upload to track your progress. These are stored privately and are only visible to you.
Workouts
Routines, exercises, sets, weights, reps, rest times, how a session felt, and sessions you train with a mate.
Food logs
Meals and foods you log, their calories and macros, foods you like or create, and barcodes you scan.
Health app data
If you choose to connect one, we read the following from Apple Health (iPhone), Health Connect (Android) or Fitbit via the Google Health API: daily steps, active calories, weight and body fat, and workouts recorded by other apps. If you allow it, we may write your Howfen weigh-ins back to Apple Health or Health Connect. We only read what you grant permission for on your device or Google account.
Technical data
Basic server logs (IP address, browser or device type, time of request) kept for security and to fix faults, and a session cookie that keeps you logged in. If, and only if, you turn on anonymous usage stats, we record which screens and features are used, without your name or email attached.
2. Why we use it and our lawful basis
Under the UK GDPR and the Data Protection Act 2018 we rely on these lawful bases:
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, logging workouts and food, syncing across devices, training with mates | Contract: providing the service you signed up for |
| Body stats, progress photos and health app data (special category data concerning health) | Your explicit consent, given during setup and when connecting a health app (Article 9(2)(a) UK GDPR) |
| Anonymous usage stats | Your consent, which is optional and off unless you turn it on |
| Keeping the service secure, preventing abuse, fixing faults | Our legitimate interests |
| Responding to legal requests | Legal obligation |
You can withdraw consent at any time: switch off usage stats in Settings, disconnect a health app in Settings → Connected apps, or delete your account. Withdrawing consent does not affect processing that happened before.
3. Who we share it with
We do not sell your personal data, and we do not share it with advertisers or data brokers. We use a small number of service providers (processors) who act only on our instructions:
- Hosting provider: stores the app’s database and files.
- Anthropic: when you snap a meal photo, the photo is sent to Anthropic’s Claude API to estimate the food and its nutrition. The photo is used only for that request; we do not store the photo beyond the request, and Anthropic does not use API data to train its models.
- Open Food Facts: when you scan a barcode, the barcode number is sent to the Open Food Facts database to look up the product. No personal details are sent with it.
- Google: if you connect Fitbit, we exchange data with Google’s Health API under the terms below.
Your mates can see your first name, profile photo, whether you are training now and your most recent workout name, and, while you train together, your set count and total volume for that session. They never see your body stats, weight, photos or food logs.
Where a provider processes data outside the UK, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Addendum or an adequacy decision.
4. Google Health and Fitbit data
Howfen Fitness’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We use Google Health data only to show your steps, activity, weight and workouts inside Howfen Fitness. We do not use it for advertising, we do not sell it, we do not transfer it to others except as needed to provide the app, comply with the law or with your consent, and no person reads it unless you ask us to for support, it is needed for security, or the law requires it.
5. How long we keep it
- Account, workouts, food logs, body stats and progress photos: for as long as you have an account.
- Health app data: while the app is connected. Disconnecting stops new syncing; deleting your account removes it all.
- Meal photos sent for analysis: not stored by us after the analysis request finishes.
- Server logs: up to 30 days.
- When you delete your account we delete your data straight away. Encrypted backups roll off within 30 days.
6. How we keep it safe
Data is sent over HTTPS, passwords are hashed, progress photos are stored privately and only served to you after you log in, and access to our systems is limited to the people who run Howfen Studio.
7. Your rights
Under UK data protection law you have the right to:
- Access your data: use Settings → Export my data to download a copy at any time, or email us.
- Correct it: edit your details in Settings or in the app.
- Delete it: use Settings → Delete my account. This removes everything we hold about you.
- Data portability: the export is a CSV you can take elsewhere.
- Withdraw consent, object to or restrict processing.
Email [email protected] for anything else. We will reply within one month. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk, though we would appreciate the chance to put things right first.
8. Children
Howfen Fitness is for people aged 16 and over. We do not knowingly collect data from anyone under 16. If you think a child has signed up, tell us and we will delete the account.
9. Cookies
We use only essential cookies: one to keep you logged in and one to protect forms against cross-site request forgery. We do not use advertising or tracking cookies.
10. Changes
If we make a meaningful change to this policy we will update the date above and tell you in the app before it takes effect.
11. Contact
Howfen Studio
Email [email protected]
Web www.howfen.studio