Privacy Statement

Last updated 25 October 2026

This statement covers the Fyvit Nutrition app and the fyvit.com website. Do you use Fyvit Pro as a dietitian, coach or other professional? Then also read the Fyvit Pro privacy notice. This statement is available in English, Dutch and German. If the versions differ, the Dutch version applies.

The short version

Your diary is stored in the EU. Your diary, profile and photos are stored by Google in the Netherlands, and Google processes AI requests in the EU. Signing in also uses Google servers in the United States.
Health data only with your explicit consent. Your weight, body measurements, dietary needs and food diary count as health data. We only process them with your explicit consent, which you can withdraw in the app.
AI meal recognition by Google, only when you use it. To recognise a meal, we send your photo or description to Google's Gemini AI, which runs in the EU. Google does not use it to train or improve its models.
No ads, no trackers in the app, no selling. We do not sell or rent your data, and the app contains no analytics or advertising software.
Under 16 only with a parent's permission. A parent or guardian has to agree before we store a child's health data.
You are in control. You can delete your account and everything in it from the app.
Questions or complaints? Email contact@fyvit.com. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Who we are

Fyvit is made by AlleyApp V.O.F., a general partnership registered in the Netherlands.

Address: Cabralstraat 16-1, 1057 CG Amsterdam, the Netherlands
Chamber of Commerce: KvK 75853663
Email: contact@fyvit.com

AlleyApp is the controller under the General Data Protection Regulation (GDPR) for the personal data in this statement. That means we decide why and how it is processed, and we are responsible for it. We have not appointed a data protection officer. Please send all privacy questions to contact@fyvit.com.

What we collect

What you give us

Account: your email address, name, profile photo (optional) and how you sign in: with Apple, with Google, with email and password, or as a guest. If you sign in with Apple or Google, we receive your name, email address (or Apple's private relay address) and profile photo from them.
Profile: your date of birth, sex, height, weight, activity level, goal, dietary preferences, and your country and supermarket preferences. We use these to calculate your personal targets.
Diary: the meals, products and portions you log and when you log them, meal photos, weight entries, custom products and recipes, and your ratings of AI results.
Messages: what you type or dictate to describe a meal, and your conversations with the Ask Fyvit assistant.
Suggestions: feedback you send us from the app, together with your user ID and email address.
A parent's email address, if you are younger than 16 (see Children under 16).

What we collect automatically

Technical data: your user ID, device type, operating system, app version, IP address, and error logs on our servers.
App integrity: a check from Apple (App Attest) or Google (Play Integrity) that requests really come from the Fyvit app.
Subscription: whether you have Fyvit Unlimited, which plan and store, and when it renews or ends. We never see your payment details.

Health data

Your weight, height, the measurements we derive from them, your dietary needs, and your diary and meal photos can say something about your health. The GDPR calls this a special category of personal data (Article 9). We treat all of it as health data.

Why we use it, and on what legal basis

We only use your data for the purposes below. Each purpose has a legal basis under Article 6 GDPR and, for health data, an exception under Article 9 GDPR.

Purpose	Data	Legal basis	How long
Your account and signing in	Account data	Contract (Art. 6(1)(b))	Until you delete your account
Your diary, targets and progress	Profile, diary, photos, weight	Contract (Art. 6(1)(b)) and your explicit consent for health data (Art. 9(2)(a))	Until you delete the item or your account
Recognising meals with AI and answering Ask Fyvit questions	Photos, text, and the diary and profile details the answer needs	Contract (Art. 6(1)(b)) and your explicit consent for health data, which covers the AI features (Art. 9(2)(a))	Not kept by us after the answer (see AI in Fyvit)
Sharing your diary with a professional you choose	Your diary and name, plus the photos and personal details you choose	Explicit consent (Art. 9(2)(a))	Until you stop sharing (see Sharing with a professional)
Adding your own products to the shared product database	Product name, brand, barcode, nutrients, photo, your user ID	Consent (Art. 6(1)(a))	Until you remove the product from the shared database or delete your account
Your Fyvit Unlimited subscription	Subscription data	Contract (Art. 6(1)(b))	Until you delete your account
Statistics to improve Fyvit: totals by age group, sex, BMI range, activity level, goal, diets, country and supermarket preference, never per person. Groups of fewer than 5 people are hidden.	Profile	Explicit consent (Art. 9(2)(a))	Calculated from current profiles; nothing is stored per person
Counting sign-ups and how many people use Fyvit each day	Your email address, sign-in method and sign-up date; per day, whether and how often you logged something (not what)	Legitimate interest in knowing how Fyvit is used (Art. 6(1)(f))	Until you delete your account
Answering your suggestions and emails	Your message, email address, user ID	Legitimate interest in helping you and improving Fyvit (Art. 6(1)(f))	12 months after we have handled it
Security, preventing abuse and fixing errors	Technical data. When someone asks for a link at fyvit.com/parent-consent: a hash of the email address (a code calculated from it), so we send at most 3 emails a day to one address	Legitimate interest in a secure, working service (Art. 6(1)(f))	Server logs: 30 days. The hash: at most 2 days
Recording each time a professional opens or exports the diary you share	Which professional, when, what they opened, and their IP address and browser; your user ID	Legitimate interest in protecting your health data and being able to show who accessed it (Art. 6(1)(f))	5 years
Website statistics	See Website and cookies	Consent (Art. 6(1)(a))	2 months
Asking a parent for permission if you are younger than 16, and proving it	Your date of birth and first name; your parent's email address and their decision	Legal obligation (Art. 6(1)(c) with Art. 8(2) GDPR)	As long as your account exists, plus 1 year
Legal obligations and disputes	What the obligation or dispute requires	Legal obligation (Art. 6(1)(c)) or legitimate interest (Art. 6(1)(f))	As long as the obligation or dispute requires

Where we rely on legitimate interest, you can object to it. See Your rights.

What you have to provide. No law requires you to give us data. To use the app you need an account, which can also be a guest account without an email address. Your date of birth is required, so we can tell whether a parent has to agree. Your profile details are needed to calculate your targets. Without your consent for health data you cannot use the diary or the AI features. Everything else is optional.

Before you enter your first health details, the app asks for your explicit consent (Article 9(2)(a) GDPR). The box is not ticked for you. Your consent covers:

Your health data: storing and using it to keep your diary and calculate your targets, and counting your profile in the anonymous totals described above.
The AI features, only when you use them: sending your meal photo or description and, for Ask Fyvit, the diary and profile details needed to our AI provider (see AI in Fyvit).

Withdrawing consent. You can withdraw your consent at any time under Profile → Your Data in the app. We then delete your health data (diary, daily summaries, weight entries, body measurements, goals and targets, diets, meal photos, recently logged products, recent searches, "my diet" selections and feedback on AI meals), your Ask Fyvit chat history on that phone, and end any sharing with a professional. The AI features stop too. Your account stays. Withdrawing does not make what we did before it unlawful.

We keep a record of when you gave or withdrew consent and which version of the text you saw, so that we can prove it.

AI in Fyvit

Fyvit uses AI when you log a meal by photo, scan a nutrition label or receipt, describe a meal by text or voice, or chat with the Ask Fyvit assistant.

What we send: the photo or text you submit, including any details your phone stored in the photo file, such as the location where it was taken. With a meal photo we also send your caption, the diets you ticked (for example vegetarian or gluten-free) and your app language. For Ask Fyvit, we also send the parts of your targets, diary, recent products and profile (age, sex, height, weight, activity level, goal and dietary preferences) that the assistant needs to answer you, and product search results for your countries and supermarkets. We do not send your name, email address or user ID.
Who processes it: Google, through Vertex AI (Google Cloud), with its Gemini models. Requests go from our own servers in the EU to Google's EU locations, and Google processes them within the EU.
How Google uses it: Google acts as our processor, under the Google Cloud data processing terms. Google does not use your photos, texts or the answers to improve its products or train its models. To answer faster, Google can keep a temporary copy of a request for at most 24 hours, only for our service and within the EU. Google may also keep requests for a limited period, only to detect abuse.
What we keep: our servers do not store the request. Technical logs (30 days) can contain part of a request or answer when something goes wrong. Results you save become part of your diary. Your Ask Fyvit conversations are stored only on your phone, encrypted, and are deleted after 90 days without use. You can switch this history off in the app.

AI can be wrong. Nutrition values from AI are estimates, so check them. Fyvit does not give medical advice. Ask Fyvit is an AI assistant, not a person. We do not make decisions about you by automated means that have legal or similarly significant effects (Article 22 GDPR).

Sharing with a professional (Fyvit Pro)

You can share your diary with a dietitian, coach or other professional who uses Fyvit Pro. This is optional and off until you switch it on.

You start sharing by entering the invite code the professional gives you.
Your diary is always shared: what you ate and when, meal names and types, products and brands, portions and nutrients. The professional also always sees the name of your account, or your email address if your account has no name.
You choose whether to add your meal photos and your personal details (age, sex, height, weight, activity level, goal and profile photo). Your date of birth is never shared.
Sharing is one-way. The professional can view what you share, but can never change anything in your app.
The professional can export what they can see, for example as a PDF, for their own records. From then on, the professional is responsible for that copy.
You can change what you share or stop sharing at any time in the app. When you stop, we delete the shared copies of your diary, photos and personal details at once, and the professional loses access to them. The professional still sees that you were connected, with your name or email address. If you delete your account, sharing stops, the copies are deleted and your name is removed from the professional's list.
Each time the professional opens or exports your diary, we record who did it and when, in a separate log stored in the Netherlands. You can ask us for this record at any time. We keep it for 5 years, the period Dutch rules set for records of access to health data, also after you stop sharing or delete your account.

Read more in the Fyvit Pro privacy notice.

Who receives your data

We use the following companies to run Fyvit. They process data only on our instructions, under a data processing agreement.

Company	What for	Where	Safeguard
Google (Firebase and Google Cloud)	Database, file storage, our servers, sign-in, app integrity checks, app settings, hosting of fyvit.com, barcode scanning (ML Kit runs on your phone and sends Google usage statistics)	Netherlands (database and files) and Belgium (servers). Sign-in (Firebase Authentication), two account processes and server logs are also handled outside the EU, including in the United States.	Google's data processing terms with Standard Contractual Clauses; EU-US Data Privacy Framework
Google (Vertex AI, part of Google Cloud)	Meal recognition and Ask Fyvit	EU	Google's data processing terms with Standard Contractual Clauses; EU-US Data Privacy Framework
Amazon Web Services (Amazon SES)	Sending the emails we send to parents (permission for children under 16)	Frankfurt, Germany	AWS data processing addendum with Standard Contractual Clauses; EU-US Data Privacy Framework
Supabase	Our product database, including products you choose to share	Frankfurt, Germany	Data processing agreement with Standard Contractual Clauses
RevenueCat	Keeping your subscription status in sync across devices	United States	Data processing agreement with Standard Contractual Clauses
Google Analytics	Website statistics, only if you accept (see Website and cookies)	United States	Google's data processing terms; EU-US Data Privacy Framework

These parties decide for themselves how they use data, under their own privacy policies:

Apple and Google for the App Store and Google Play, in-app payments, Sign in with Apple and Google Sign-In, the speech recognition of your phone when you dictate, and the App Attest and Play Integrity checks.
Google Fonts, which fyvit.com and the app load fonts from. Google sees your IP address (United States).
Discord, our team chat, which receives the suggestions you send from the app, with your user ID and email address (United States).
Websites that host product photos, such as supermarkets and Open Food Facts. The app loads those photos directly, so those websites see your IP address and which product you look at.
Professionals you choose to share your diary with.
Authorities, only when the law requires us to provide data.

We do not sell or rent your data, and we do not share it with advertisers or data brokers.

Transfers outside the EU

Some of the companies above are based in the United States or may process data there: Google (sign-in, server logs, Fonts and Analytics), RevenueCat and Discord. Supabase stores our database in Frankfurt but is a US company. For these transfers we use the EU-US Data Privacy Framework where the company is certified under it, and the Standard Contractual Clauses approved by the European Commission. We do not rely on your consent for these transfers. You can ask us for a copy of the safeguards.

How long we keep your data

Data	How long
Account and profile	Until you delete your account. Deletion happens straight away.
Diary, weight entries, own products, ratings	Until you delete them or your account
Own products you shared to the shared product database	Until you remove them from the shared database (an option when you delete the product) or delete your account
Meal photos	Until you delete the diary entry or your account. Photos from scans you do not save: 30 days.
Ask Fyvit conversations	Only on your phone; deleted after 90 days without use
Copies shared with a professional	Deleted as soon as you stop sharing. The professional keeps seeing that you were connected, with your name or email address, until you delete your account.
Record of when a professional opened or exported your diary	5 years from each time, also after you stop sharing or delete your account. You can ask us for it.
Record of your consent (what, when, which text version)	As long as your account exists, plus 1 year
Parent's email address and their decision (under 16)	As long as the child's account exists, plus 1 year. The emails we send to parents are deleted from our sending system within 2 days.
Subscription status	Until you delete your account. Apple and Google keep their own purchase records.
Sign-up record and daily usage counts	Until you delete your account
Suggestions and emails	12 months after we have handled them
Backups	Backups of our database are kept for 14 days, and deleted photos can be recovered for 7 days. After that, deleted data is gone from them too.
Server logs	30 days
Website statistics (Google Analytics)	2 months

Security

Your diary, profile and photos are stored in the Netherlands and encrypted in transit and at rest.
Access rules make sure only you, and a professional you choose, can read your diary.
Only the founders have administrative access. Our admin dashboard shows totals. It also lists the email addresses of people who signed up recently and of the most active users, with how many entries they logged. It never shows what you logged, your photos or your health details.
If a data breach is likely to put you at risk, we will tell you and the Autoriteit Persoonsgegevens, as the law requires.

Your rights

Under the GDPR you have the right to:

access your data and get a copy of it;
correct it. You can change most of it in the app yourself;
delete it. Use Profile → Delete Account in the app, or email us from the address linked to your account;
restrict how we use it;
object to uses based on our legitimate interest;
receive your data in a common, machine-readable format, or have it sent to another service;
withdraw your consent at any time, under Profile → Your Data in the app.

To use a right, email contact@fyvit.com. It is free. We reply within one month. If your request is complex, we may need up to two more months, and we will tell you why. We may ask you to confirm that the request comes from you.

Complaints. We would like to hear from you first. You also have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the data protection authority where you live or work.

Children under 16

In the Netherlands, someone younger than 16 cannot give consent on their own. A parent or guardian has to give it instead (Article 8 GDPR and Article 5 of the Dutch GDPR Implementation Act). That is why the app asks for your date of birth first.

Asking a parent. If you are younger than 16, you enter the email address of a parent or guardian. We email them a link to a page where they read what Fyvit does and give or refuse permission. Until they agree, we store no health data.
What the parent decides. The parent agrees to the use of health data, which the diary and the AI features need, and decides separately on sharing with a dietitian or coach. Sharing stays off unless the parent allows it.
Changing or withdrawing. The parent can change or withdraw permission at any time at fyvit.com/parent-consent. The parent enters their email address there and gets a link that works for 24 hours. With it, the parent turns sharing with a dietitian or coach on or off, or withdraws permission. After a withdrawal we delete the child's health data and end any sharing with a professional. The account stays.
Rights. For a child younger than 16, the parent uses the child's privacy rights, such as access and deletion.
Turning 16. From your 16th birthday the parent's permission no longer applies, and the app asks for your own consent.

Data about the parent. We use the parent's email address only to ask for permission and to be able to prove it. We keep it with the record of their decision for as long as the child's account exists, plus 1 year. The law requires us to make reasonable efforts to check that a parent gave permission and to be able to prove consent (Art. 6(1)(c) with Art. 7(1) and 8(2) GDPR).

Website and cookies

Hosting. fyvit.com is hosted by Google (Firebase Hosting). To deliver the pages, Google processes your IP address and browser details. We need this to run the website (legitimate interest, Art. 6(1)(f)).
Fonts. The website loads its fonts from Google Fonts, so your browser sends your IP address to Google.
Google Analytics, only if you accept. We would like to see how visitors use the website, and we only do so if you click Accept in the cookie banner. Google Analytics then places the cookies _ga and _ga_<ID>, which last up to 2 years unless you change your choice or clear them. Google Signals and advertising features are off, and the data is deleted after 2 months. If you click Reject, no analytics cookies are placed and nothing is sent to Google Analytics.
Your choice. We remember your choice in your browser's local storage (fyvit-consent). This is necessary and needs no consent. You can change your choice at any time with Cookie settings at the bottom of the main pages.
Partner menu pages (fyvit.com/r) remember your language in your browser's local storage. They load a script from cdnjs (Cloudflare) and dish photos from the restaurant's image service (imgix), which see your IP address.
Emails. If you email us, we use your email address and message to reply (legitimate interest), and keep them for 12 months after we have handled them.

This privacy page and the Fyvit Pro pages do not use analytics.

Changes

When we change what we do with your data, we update this page first, with a new date. Earlier versions are available on request. For important changes, such as a new purpose or a new kind of recipient, we tell you in the app before the change takes effect, and we ask for your consent again where that is needed.

Contact

Email: contact@fyvit.com
Post: AlleyApp V.O.F., Cabralstraat 16-1, 1057 CG Amsterdam, the Netherlands