Last updated: October 24, 2026

This policy explains what FitInFlow (“we”, “us”) collects when you read fitinflow.space and when you use our food and health tracker at /tracker/ (“the tracker”), how we use it, and the choices you have. In short: your data is yours, it is used only to run your diary, it is never sold, and there are no ads and no tracking.

1. Reading the website

You can read our articles without an account. Like every website, our server receives your IP address, browser type and the page you asked for; our web host keeps these in short-term logs for security. If you leave a comment, WordPress stores your name, email and comment. The tracker itself uses no analytics or advertising cookies.

2. Your tracker account

  • Account: your email address, first name and a password. Passwords are stored only as a one-way hash, so nobody, including us, can read them.
  • Sign in with Google: if you choose it, Google tells us your email address and name and confirms they belong to you. We don’t receive your Google password or anything else from your Google account.
  • Login cookies: WordPress sets cookies that keep you logged in. They are needed for the tracker to work and are not used for tracking.

3. What you choose to log

The tracker stores only what you enter or import:

  • Your food diary, your own foods, recipes, saved meals and repeat items, and favorites.
  • Photos you add to meals or foods.
  • Your body profile (height, weight, age, the female or male calorie formula, activity level, goal) and your goals.
  • Weight, water, exercise and steps, intermittent fasting times, vitamins and supplements you take, and alcohol you log.
  • If you turn on cycle tracking: period days and flow, symptoms, mood, notes, medicines, basal body temperature, cervical mucus, ovulation and pregnancy tests, sexual activity (protected or unprotected), blood pressure, pregnancy due date and your cycle settings.
  • App settings such as language, theme, units and diary layout.

Much of this is health information. We treat all of it as sensitive: it is private to your account, it is used only to show you your diary, totals, charts and predictions, and it is never sold, rented, shared for advertising or used to profile you. Other members can’t see it.

4. How we protect it

  • The tracker only works over an encrypted connection (HTTPS), and every request checks that you are the logged-in owner of the data.
  • Your cycle log is additionally encrypted on our server with a key kept outside the database, so a copy of the database alone can’t be read. You can also set a passcode for it.
  • Photos are stored with random names in a private folder, are not listed in the site’s media library, search engines or public feeds, and can only be opened through their unguessable link.
  • Login, sign-up and password reset are rate-limited against guessing attacks.
  • Only the site owner can administer the server. We don’t look at your diary unless you ask us for help with it.

No system is perfectly secure. If a breach ever affected your personal data, we would tell you without undue delay and as the law requires.

5. Services the tracker uses

To look up foods we send only the words you search for or the barcode you scan, never your name, email or diary:

  • USDA FoodData Central (U.S. Department of Agriculture), for generic foods.
  • Open Food Facts, for packaged products and barcodes. Product pictures are loaded from Open Food Facts, so their server sees your IP address.
  • NIH Dietary Supplement Label Database (U.S. National Institutes of Health), for vitamins and supplements.
  • jsDelivr, a public code network, delivers the barcode scanner and the label-reading tool to your phone when you use them; it sees your IP address. Photos you read for text are processed on your own device and are not uploaded for that.
  • Google, only if you choose Sign in with Google.
  • Our web host stores the website and its database, and our email provider sends password-reset emails. They process data only to provide those services to us.

The tracker doesn’t use advertising networks, analytics, tracking pixels or data brokers, and we don’t sell or “share” personal information as those words are used in California law.

6. Data on your device

The tracker keeps small conveniences in your browser’s storage: unsaved recipe drafts, your theme and language, and which sections you collapsed. When you unlock the cycle log with a passcode, a temporary unlock key stays in that browser tab until you close it. You can clear all of this in your browser settings.

7. How long we keep it

We keep your tracker data for as long as you have an account. When you delete data or your account, it is removed from the live site right away, and from our backups as they are replaced (normally within 30 days). Short-term server logs are kept by our host for a limited time.

8. Your choices and rights

  • See and download everything: Settings, Import and export (full backup and reports).
  • Correct anything by editing it in the app, or your account under Settings, Account.
  • Delete your tracker data, only your cycle log, or your whole account: Settings, Delete my data or account, or Cycle settings.
  • Turn off optional features such as cycle tracking at any time.
  • Ask us for a copy, a correction or deletion, or with any question, at FitInFlow@gmail.com. We answer within 30 days and never charge for it.

Depending on where you live (for example California, Washington, other U.S. states, the EU or the UK), you may have further rights, such as to know what we hold, to withdraw consent, to object, or to complain to your data protection authority. We give these rights to everyone, wherever they live. We don’t make automated decisions with legal or similar effects about you.

9. Consumer health data (Washington, Nevada and similar laws)

We collect the health data listed in section 3 only with your consent, which you give by creating an account and choosing to log it, and only to provide the tracker to you. We don’t share it with anyone except the service providers in section 5 that process it on our behalf, and we never sell it. You can withdraw consent by deleting the data or your account at any time, and you can ask which data we hold and who it was shared with by emailing us.

10. Not medical advice

Calories, scores, predictions (including period, fertility and ovulation estimates) and other figures are general estimates for information only. They are not medical advice and must not be used as birth control. Talk to a doctor or dietitian about your health.

11. Children

The tracker is meant for adults 18 and over. Please don’t create an account if you are younger. If we learn that a child has given us personal data, we will delete it.

12. Changes

If we change this policy, we will update the date above, and for important changes we will tell you in the tracker before they take effect.

13. Contact

FitInFlow · FitInFlow@gmail.com

Scroll to Top