Privacy policy

At FittyFlow, your privacy is not a detail: the service relies on personal information, sometimes sensitive, and we treat it with the seriousness it deserves. This page simply describes what we collect, why, and your rights.

1. Data controller

The data collected on FittyFlow is processed by Bastien Devaux, sole trader (registration in progress), reachable at bdprofessionnal@outlook.com.

2. Data collected

• Waitlist: your email address and, if you answer the quiz, your answers (goal, blocker, pace) in order to personalize our launch communications.
• Account: email and password (stored only in hashed form — we cannot read it).
• Coaching data: profile (first name, age, height, weight, goal, food preferences and allergies), measurements, exchanges with the AI coach and photos of meals you choose to analyze. Weight and body goals are health data: they benefit from enhanced protection and are processed only with your explicit consent, collected when you create your profile. You can withdraw it at any time by deleting your data.
• Payment: handled by Stripe; we never see or store your card number.
• Audience measurement: anonymous events (page view, quiz step…) without any cookie or advertising identifier, not linked to your identity.

3. Purposes and legal bases

Your data is used exclusively to provide the service (performance of the contract), to personalize coaching (explicit consent for health data), to inform you of the launch (consent) and to improve the product (legitimate interest, anonymized data). No data is sold or shared for advertising purposes.

4. Sub-processors

We rely on recognized providers:

• Vercel (site hosting);
• Neon (database, hosted in the European Union — Frankfurt);
• Anthropic (AI processing: the content of your messages to the coach and the photos to analyze are sent to it to generate responses; they are not used to train its models);
• Stripe (secure payment);
• Brevo (email sending, French company).

5. Retention periods

• Waitlist: until launch + 12 months max.
• Account and coaching data: as long as the account is active, then deleted within 30 days after account deletion.
• Meal photos: processed on the fly, not kept.
• Anonymous audience measurement: 13 months max.

6. Your rights

In accordance with the GDPR, you have the right of access, rectification, erasure, portability, objection and withdrawal of consent. From the app: « My account » lets you erase your data in one click. Otherwise, write to bdprofessionnal@outlook.com — reply within 30 days. You can also refer the matter to the French CNIL (www.cnil.fr).

7. Cookies

FittyFlowuses a single strictly necessary cookie (login session, httpOnly). No advertising cookie or third-party tracker. Our audience measurement works without a cookie and without identifying people — that's why no banner is required. If we ever add trackers subject to consent (e.g. an advertising pixel), a consent banner will be shown beforehand.

8. Security

Encrypted connections (HTTPS), hashed passwords (scrypt), signed sessions, database encrypted at rest at our host. In the event of a data breach likely to affect you, you will be notified in accordance with the law.