Privacy policy

Draft. We will complete this page and have it reviewed by a lawyer before the app launches.

Forma is an iPhone and Apple Watch app for logging food and training. This page describes what data we process, why and for how long.

1. Controller

The controller's identification and contact details will be added before the app launches.

2. Data we process

Account: an anonymous identifier, Sign in with Apple data if used, time zone.

Health data (special category under Art. 9 GDPR): weight, food logs, workouts, Apple Health data you allow. Processed only with your explicit consent during onboarding.

Food photos: sent through our server to an AI model and never stored permanently. For a follow-up question the server keeps them for 30 minutes at most. Body photos never leave your phone.

Website waitlist: email, language, sign-up and confirmation time, version and time of consent (proof of consent). Unconfirmed addresses are deleted after 30 days, unsubscribing deletes the address right away.

Analytics: anonymous events and counts only, no health values and no food content.

A full list of data categories and the legal basis for each will be added before the app launches.

3. Purpose and legal basis

Providing the service, explicit consent for health data (Art. 9(2)(a) GDPR), legitimate interest for security. Details will be added before the app launches.

4. Where data lives

Servers run in the EU (Railway, EU West, Amsterdam). Processors: Railway, RevenueCat, TelemetryDeck, the AI model provider, Apple Push Notification service. The full list of processors and information on transfers outside the EU will be added before the app launches.

5. Retention

We keep data while you have an account. Deleting your account in the app deletes server data too. Retention periods for backups and logs will be added before the app launches.

6. Your rights

Access, rectification, erasure, restriction, portability (CSV and JSON export in the app), objection, withdrawing consent anytime (in app settings) and a complaint to the supervisory authority.

7. Cookies

This website uses no cookies and no third-party tracking scripts. Fonts are self-hosted.

8. Changes

The effective date and how we handle changes will be added before the app launches.