Privacy notice

Who is responsible?

LivuFit is a trading name of DevOps with a Smile.

Dutch Chamber of Commerce number: 93875428. Business address: Dr. Ir. Vondelingpark 35, 6716 EL Ede, Netherlands.

Contact: info@livufit.nl or +31 6 16422630 (WhatsApp).

Data used by LivuFit

Your email and account details are used for sign-in. Your profile may include your first name (if you enter it; the app only uses it to address you), goals, target weight, sex, date of birth or age, height, weight, experience, what you can already do (for example how many push-ups or pull-ups you can do in a row), equipment and available time. If you enter them, information about injuries (body region and side), pregnancy, recovery after a pregnancy or breastfeeding is also processed, as well as your answers to safety questions: whether a doctor has advised you not to exercise, and for calisthenics and yoga whether you have high blood pressure that is not well controlled, raised eye pressure or glaucoma, a recent eye treatment, a recent concussion or unexplained dizziness, and for yoga whether a doctor has diagnosed osteoporosis or a vertebral fracture. The app only uses those answers to match your training and sports to your situation, for example by leaving out exercises or sports. From sex, experience, weight and age the app estimates a starting weight for an exercise you have not done before; that estimate is calculated on your device and not stored separately. Your date of birth is used only to calculate your age. That age is part of your estimated energy needs and therefore, from age 18, your calorie target (Mifflin–St Jeor equation) and the safety limits of your training plan, and it moves on automatically on your birthday. If you entered only your age, the app adds the years from the day you entered it until you fill in your date of birth.

Your logbook includes the workouts, food, water, measurements, check-ins and preferences you record. These support your plan, nutrition calculations, calendar, insights and rewards.

You can separately consent to pseudonymous usage statistics to help improve the app. Sharing starts only after your yes; details are below.

Recipe ratings: after cooking you can give a recipe 1 to 5 stars. Your rating is kept in your logbook. When "Include my ratings in the average" is on (Settings → Food & recipes), our database also keeps your stars per LivuFit recipe with your account, so LivuFit can show an average. Other users only see the average and the number of ratings, from five ratings on, and never who rated. Ratings of your own recipes never leave your logbook. When you switch this off or delete your account, your ratings are removed from the server; they are part of your privacy export. The legal basis is the performance of the service (Article 6(1)(b) GDPR). You can share a LivuFit recipe with your phone's share button: the link (livufit.nl/recept/…) contains only that recipe and no data about you, and you choose who receives it. Your own recipes cannot be shared.

Subscription: if you take LivuFit Premium, we keep your subscription status, any launch code and your refund requests. Your payment details stay with Apple or Google (see LivuFit Premium and payment).

Minimum age

LivuFit is intended for people aged 16 and over. In the Netherlands you can give your own consent to an online service from the age of 16 (Article 8 GDPR and Article 5 of the Dutch GDPR Implementation Act); the processing of your health data in LivuFit rests on that consent. When you fill in your profile, the app checks your age or date of birth; under 16 you cannot create a profile.

Are you 16 or 17? Then you can use LivuFit and you get a training plan with lighter rules: technique comes before weight, you keep reps in reserve in every set and you make no maximal attempts. The app does not calculate an automatic calorie or weight-loss target; that is for adults aged 18 and over. Discuss nutrition with your GP or a dietitian.

If an account turns out to belong to someone under 16, we delete the account and its data. Parents or guardians can email info@livufit.nl for this.

On your device and in the cloud

Your device keeps a local copy for app use. Supabase provides sign-in and personal-logbook synchronisation; the database is located in Frankfurt (EU). Netlify serves the website and web-app files and handles product searches. Account emails (such as your invitation and password reset) are sent through Resend and contain no health data; replies and questions to info@livufit.nl arrive in a Microsoft 365 mailbox. Measurement reminders are designed for a separate Supabase function which receives no weight values or full logbooks. Providers may process technical data such as IP addresses and browser information when you connect.

Online product search sends your query or barcode to a server function and Open Food Facts. Camera access reads barcodes on your device; the scanner itself does not upload camera images (a label photo is only sent when you choose to, see Features that use AI). Optional notifications use a device registration and, for web push, a push service. Notifications in the Android and iPhone apps, such as the end of your rest time, your cooking timer, training reminders and the evening nudge for your steps, are scheduled on your phone itself and do not go through our server. In the web app a cooking-timer notification does go through our server: we then keep the name and text of the notification and the end time, and delete them no later than one day after the timer ends.

Health data and legal basis

We ask separately for your explicit consent to store and use health data. This applies for example to weight, target weight, injuries and training restrictions, your answers to the safety questions, pregnancy and recovery, data from Health Connect or Apple Health, and the related personal suggestions and overviews. The legal basis is consent (GDPR Articles 6(1)(a) and 9(2)(a)). Consent is never pre-ticked and is recorded in the database with version and time; your consent for sleep, steps and the scale is recorded with the date on your phone only. A backup file does not count as new consent. Since 19 October 2026 the consent text also names the AI features that send health data to Anthropic (the week review and the sport choice helper); anyone who consented earlier confirms the new text once at the next start. Until then our server refuses those features; your logbook stays as it is.

Without this consent you can browse recipes, save favourites, plan meals and create your own recipes. Account data and these requested functions are processed to provide the service. You choose notifications separately. Technical security processing must be limited to what is needed for safe operation.

Withdraw consent in Settings → Privacy & data. After confirmation, we remove your profile, logbook, measurements and training planning from the active database. Only your recipe data is kept: favourites, recipe preferences, your meal planning and shopping list, your own recipes, ratings and regular dishes. This deletes data; it is not a temporary module pause. You can download your data first. Withdrawal applies from then on: what happened earlier with your consent remains lawful.

Other purposes and legal bases

Your account and sign-in, your subscription and refund requests, syncing your logbook, recipe favourites, product search and the features you start yourself: performance of the contract (Article 6(1)(b) GDPR). Your email address is required for an account; you can skip other profile questions, but then the app cannot match your plan or calorie target to you, or less well.

Notifications: your consent (Article 6(1)(a) GDPR), which you switch on and off per kind of notification. Recording your consents (version, choice and time): needed to show that we have your consent (Article 6(1)(c) GDPR, the accountability obligation). Recording when you open the app (only your account, a random number and the time, 30 days) and the delivery status of account emails: our legitimate interest (Article 6(1)(f) GDPR) in seeing whether the service and the emails work. Keeping refunds for the accounts: a legal obligation (Article 6(1)(c) GDPR). The delivery status of account emails is separate from your choice about usage statistics.

A question through the contact form or by email: our legitimate interest in answering your question, or performance of the contract when it concerns your account. Signing up for one message at launch or when new invitations open: your consent (Article 6(1)(a) GDPR), which you withdraw by emailing info@livufit.nl.

LivuFit Premium and payment

You take LivuFit Premium with an in-app purchase through the App Store or Google Play. Apple and Google process the payment and your payment details themselves, as independent controllers and under their own privacy policies. LivuFit does not see payment details, such as your payment method or card number.

RevenueCat, Inc. (United States) processes your purchase data as a processor for LivuFit: your LivuFit account ID (a random code, not your email address, name or health data), the product you bought, the dates of purchase, trial and expiry, your country and currency, and the store’s transaction IDs and receipt. RevenueCat uses these to check with Apple or Google that your purchase is valid and to pass your subscription status on to LivuFit. Like any online service, RevenueCat also sees technical data when you connect, such as your IP address, the app version and your phone’s operating system. RevenueCat receives no logbook, health data or other content from the app. LivuFit does not use this data for advertising or tracking.

In our database at Supabase (Frankfurt, EU) we keep with your account: your subscription status (the product, the store, whether the subscription is active, whether you are in the trial, the expiry date and the number of renewals), a launch code if you received one, and your refund requests (the date, the subscription, the store, the amount and how it was handled). This data is part of your privacy export. If LivuFit transfers an amount itself, we ask for your account number (IBAN) and the name of the account holder by e-mail; these are not stored in the app or the database, only in that e-mail and in our accounts.

If you request a refund in the app, our server function sends your request as an email through Resend to LivuFit: the number of your request, your account ID, the subscription, the store, the dates and the amount. Your email address and health data are not included.

Legal basis: performance of the contract (Article 6(1)(b) GDPR), to give you Premium, manage your subscription and handle a refund. Keeping refunds for the accounts is a legal obligation (Article 6(1)(c) GDPR).

Retention: LivuFit and RevenueCat keep your subscription data as long as your account exists. If you delete your account, LivuFit erases your subscription status from our database and a launch code is no longer linked to you. Within a day we ask RevenueCat to delete you there as well; for that we keep your account ID in a queue for at most 30 days. We keep refund requests for 7 years for the accounts (the statutory retention period), without a link to your account, and remove them automatically after that. Deleting your account does not cancel your subscription; you do that in the App Store or Google Play.

RevenueCat processes the data in the United States under a data processing agreement. The transfer relies on the European Commission’s standard contractual clauses and, insofar as RevenueCat is covered by it, the EU-US Data Privacy Framework. You can request a copy of the safeguards via info@livufit.nl.

Signing in with Apple, Google or Microsoft

You can sign in with your e-mail address and password, or with Apple (on iPhone), Google or a personal Microsoft account (Outlook.com, Hotmail, Live). This only works for an account you were invited to; such a sign-in never creates a new account. If you choose one of these providers, it sends us, with your permission, your e-mail address and a fixed user ID unique to LivuFit. Supabase Auth stores these with your account so you can sign in without a password next time. We do not ask for your name, photo, contacts or calendar and get no access to your mail.

The purpose is signing in and securing your account; the legal basis is performance of the contract (GDPR Article 6(1)(b)). The provider sees that you use LivuFit; its own privacy policy applies to that. In Settings → Sync & backup you can see which sign-in methods belong to your account and link another one. If you delete your account, LivuFit first asks you to sign in once more and the linked sign-in methods are removed too; for Apple we also revoke LivuFit's sign-in access through Apple. You can also withdraw access at the provider itself (Apple: Settings → your name → Sign in with Apple).

Health Connect and Apple Health

You can connect LivuFit to Health Connect (Android) or Apple Health (iPhone), where your watch, scale and other apps (such as Garmin Connect, Strava, Samsung Health or Apple Watch) keep your data. In the "Choose what you share" sheet (in the intake or under Settings → Health & connections) you tick what LivuFit may read: workouts, sleep, steps, weight and, only together with weight, body fat. With one explicit consent in that sheet you consent to exactly what you tick; your phone then asks for access itself, and there you can still leave parts out. LivuFit only reads what you tick and what your phone gives access to. LivuFit does not read heart rate, calories burned, routes, location or lean body mass, and writes nothing back to Health Connect or Apple Health. We do not sell data from Health Connect or Apple Health and do not use it for advertising or marketing. Workouts and weigh-ins you keep are stored in your logbook at Supabase; if you use the weekly review with AI, Anthropic receives the summary described under Features that use AI. Sleep and steps never go to Supabase or Anthropic. We never store data from Apple Health in iCloud.

Workouts: for each workout LivuFit reads the type of workout, its start and end time, duration, distance covered (for walking, running, cycling, rowing and swimming), which app it came from, whether it was recorded manually or automatically, and an identifier of the workout in Health Connect or Apple Health. The purpose is to complete your planned sessions without entering everything yourself, to copy duration and distance and to avoid counting a workout twice, also when you use LivuFit on two phones. On the first connection LivuFit looks back 7 days, after that only at new workouts, each time you open the app. Workouts you have not decided on yet stay on your phone and disappear from it after 14 days. Only a workout you keep (or that LivuFit links or keeps separately by itself, if you choose that) goes into your personal logbook in our database at Supabase: the sport, date, start and end time, duration, distance and the name of the source app. For each decision (kept, linked or ignored) we keep the workout's identifier and the date in your logbook, for at most 60 days, so a workout does not appear again. Your consent for workouts is stored with version and date in your logbook; your consent for sleep, steps and the scale is stored with the date on your phone only. In the weekly review with AI, kept workouts only count as a number and minutes; times, distances and source apps are not sent to the AI.

The legal basis is your explicit consent (GDPR Articles 6(1)(a) and 9(2)(a)), separate from the permission your phone asks for. In Settings → Health & connections, "Disconnect on this phone" stops reading on that phone: LivuFit deletes your sleep, steps and pending workouts and weigh-ins there, and on Android also withdraws its access in Health Connect. "Withdraw consent on all your phones" does the same and also deletes your consent for workouts and your workout decisions from your logbook. Your other phones follow at their next start or sync: there too LivuFit stops reading workouts, sleep, steps and weigh-ins, deletes your sleep, steps and pending workouts and weigh-ins, and on Android withdraws its access in Health Connect. Otherwise you switch sleep, steps and the scale on or off per phone. Workouts you already kept stay in your logbook, under your consent for your health logbook (see Health data and legal basis), unless you choose "Delete activities from Health Connect" (on an iPhone: "Delete activities from Apple Health"); that removes them from LivuFit, not from Health Connect or Apple Health. You can also manage access per data type in Health Connect itself or in the Health app (your profile → Apps → LivuFit).

Sleep: only with your consent and access on your phone does LivuFit read the start and end of your sleep, your sleep stages and which app the data came from in Health Connect or Apple Health. LivuFit turns this into a summary per night on your phone (how long you slept) and keeps it encrypted and only on that phone, for at most 28 nights; the individual sleep stages are not kept. Your sleep is not sent to LivuFit's servers, to AI providers or to other external services, and it does not go into your logbook, the weekly review with AI, the usage statistics or the error logging. The purpose is to suggest a lighter session or a calm day after a short night; you decide. The legal basis is your explicit consent (GDPR Articles 6(1)(a) and 9(2)(a)). Turn it off in Settings → Health & connections → Turn sleep off; the summaries are then deleted from your phone, as they are when you log out, disconnect or withdraw your consent on all your phones. Withdraw the access itself in Health Connect or in the Health app (your profile → Apps → LivuFit).

Steps: only with your consent and access on your phone does LivuFit read the total number of steps per day from Health Connect or Apple Health, as your phone adds them up itself; no times per step, no routes and no location. LivuFit keeps these day totals encrypted and only on that phone, for at most 35 days, together with your step goal and the time of your evening nudge. Your steps are not sent to LivuFit's servers, to AI providers or to other external services, and they do not go into your logbook, the weekly review with AI or the usage statistics. Your step goal applies on that phone only. The purpose is to show today's steps on Home and in Progress and, if you choose, your goal and an evening nudge. For that nudge the app also keeps, in its own settings on your phone, your goal, the time, an estimated stride length (from your height and sex) and the last step count it read today. Your Android phone reads today's steps at the chosen time while LivuFit is closed (only if you allow that in Health Connect); on an iPhone, Apple Health may wake LivuFit in the background when there are new steps. Such a notification is made on your phone and is not sent through a server. The legal basis is your explicit consent (GDPR Articles 6(1)(a) and 9(2)(a)). Turn it off in Settings → Health & connections → Turn steps off; your steps, your goal and the nudge are then deleted from your phone, as they are when you log out, delete your account or withdraw your consent on all your phones. Withdraw the access itself in Health Connect or in the Health app (your profile → Apps → LivuFit).

Smart scale: only with your consent for weight and access on your phone does LivuFit read your weigh-ins (the weight, the time and which app the weigh-in came from) from Health Connect or Apple Health, and only weigh-ins from the moment you switch it on. LivuFit reads body fat only if you tick it separately. Weigh-ins you have not decided on yet stay encrypted on your phone, together with your decisions, for at most 60 days. A weigh-in you save (or that LivuFit saves automatically, if you choose that) goes into your personal logbook as a weight with its date, just like one you enter yourself, and counts for your weight trend, your progress and your calorie target; the body fat goes with that day's measurement, and never over a value you entered yourself. The purpose is to keep track of your weigh-ins without entering them yourself. The legal basis is your explicit consent (GDPR Articles 6(1)(a) and 9(2)(a)). Withdraw it with Turn the scale off, or on all your phones at once with "Withdraw consent on all your phones"; pending weigh-ins are then deleted from your phone, and weigh-ins you already saved stay in your logbook until you delete them.

Pseudonymous usage statistics

At first launch we ask whether you want to share usage statistics: you can choose yes or no. Sharing starts only after your yes; the legal basis is your consent (Article 6(1)(a) GDPR). You can change this in Settings → App & data → Share usage statistics. Your choice, including a refusal, is stored separately to respect it and show totals of permissions, opt-outs and accounts without a choice. Your choice applies to your entire account on web, Android and iOS. Consent for your personal logbook is separate. All features work without usage statistics.

With your consent, we count features you use and actions such as completing a workout, opening a recipe or using the sport choice helper. Events include the platform, app version, time rounded to the hour and sometimes a fixed code, such as whether a suggestion came from the AI or from the app itself. We do not include names, email addresses, exact health values, recipe names, search terms or free text.

We replace your account ID with a code (a SHA-256 hash with a secret key held in the database). This recognises repeat use. The data is pseudonymous, not fully anonymous: within our protected database it can be looked up through your account, for example for your data export or to delete it. We use no advertising ID or location. The admin portal and Grafana receive only aggregate product counts, not individual logbooks.

You can withdraw consent at any time using the same switch. New usage measurements then stop for your account, pending events on this device are discarded and all your previous counts are deleted from our database at once. If that deletion does not succeed straight away, the app tries again at the next start until it does. While your consent is on, the daily cleanup job deletes counts after 400 days. Your consent choice and history are included in your data export and erased when your account is deleted. Technical errors are processed separately as described below.

For account emails sent through Resend, such as your invitation and password reset, LivuFit receives the delivery status through a webhook: sent, delivered, bounced or complained. Your email address is immediately replaced by the same kind of keyed hash; only the status, subject and time are stored. Open and click tracking is off at Resend and stays off. These statuses are also deleted after 400 days.

Technical error logging

When something goes wrong technically in the app, for example a failed sign-in, a database error, a failed sync or a notification that cannot be scheduled, the app sends an error report to Grafana Cloud (Grafana Labs), an error-tracking service set up in the EU region. This applies to the web app, the Android app and the iPhone app. Only errors are sent, never ordinary use.

An error report contains: the technical error description and stack trace, the kind of error, the route in the app without search terms or ids, an HTTP status or error code, the app version, the platform, browser or operating-system information, a random session number per device per day and the time, and sometimes technical context, such as the exercise of a 3D demo that did not load and the type of graphics chip. Your account is included only as a SHA-256 hash of your user ID so that errors from the same user can be grouped; that hash is only included when you have enabled usage statistics for your account. Email addresses, tokens, UUIDs and long keys are replaced before sending. Health data and the contents of your logbook are never sent. A connection that drops for a moment is not reported.

The legal basis is our legitimate interest in a working, secure service (Article 6(1)(f) GDPR). Grafana Cloud keeps the reports for 30 days; anything that cannot be sent immediately waits briefly on your device (at most 50 reports) and is then deleted.

Features that use AI

Some features use an AI language model from Anthropic (Claude): the food estimate, the weekly review, the plan note, reading your own recipes, reading a label photo, your whole day at once, screenshots of your food diary and the sport choice helper. They always run through LivuFit's own server function at Supabase; the app never talks to Anthropic directly and the API key is not in the app. We do not add your name, email address or account ID to an AI request; Anthropic only receives what is described per feature below. What you type yourself or show on a photo or screenshot can still contain personal data. The plan note and the weekly review (if you switch it on) are written automatically; you start the other features yourself, and you check what the AI suggests before it goes into your logbook. You can also enter food, workouts and recipes yourself without AI; only the explanation of your plan is always written with AI (with a fixed text when that fails). For each feature our database keeps only a daily counter per account (and, for a refused request, a counter per kind of refusal, never the text); these counters are deleted after 7 days. Our server functions do not store or log your text, photos or screenshots.

Food estimate: in the food diary you can describe in your own words what you ate or cooked, for example "chicken sandwich, half a roll with mayonnaise". Only when you choose to, LivuFit sends that description (and, on a correction, the earlier proposal and your remark) to Anthropic. No health values or diary history are sent, only the text you type; so do not type names or medical details. The model proposes ingredients and amounts; the nutrition values come from the Dutch food composition table (NEVO) in the app wherever possible. Every estimate is marked "AI estimate" and remains an estimate you can adjust yourself. The accepted proposal is saved as your own product in your logbook. Each account can request at most 30 estimates per day.

Weekly review: at the start of each week LivuFit can write a short review of your previous week. The weekly review is off by default; you switch it on or off in Settings → Features & display, or off with the button under the card. For that the app sends only numbers and fixed codes about that week to Anthropic: your goal, which features are on, per sport the sessions planned and done, minutes, sets and skipped sessions, how often you reported little sleep or low energy in a check-in, your strength index, how many days you logged food and water, your calorie target (and roughly how much your workouts add to it), your average calories, protein and water, on how many days you were close to your target, how often you cooked from the app, your weigh-ins that week (the number, your first and last weight and the average of this week and last week), your target weight, the number of body measurements, rewards earned and whether an injury or training pause is active. If you are under 18, the goal of losing weight is sent as living healthier. No names, age, notes, dishes, exercises, sleep or steps from Health Connect or Apple Health and no other free text are sent; our server function refuses anything that is not a number or a fixed code. Because this includes health data, it only happens with your explicit consent for your health logbook; without that consent nothing is sent or stored. The text is kept in your logbook and included in export and deletion. Each account can use this up to 12 times a day.

Plan note: when you fill in or change your training profile, LivuFit writes two short sentences about your new schedule under "Why this plan". By default this happens automatically, and again if you open that explanation later while your week has changed; you can switch it off under Settings → Features & display → Plan note, after which you see a fixed explanation and nothing is sent. For that the app sends only the facts of your plan to Anthropic: your language, your goal (getting fitter, getting stronger, building muscle or losing weight), the number of sessions per week, the number of strength sessions and their length, your other sports with count and minutes, gym or home, your experience level, fixed or flexible planning, the sport, day, length and number of exercises of your first session, your diet (everything, vegetarian or plant-based) and which features are on. The app also sends how many ingredients you avoid (only the number), but our server function does not pass that on to Anthropic. Anthropic receives no name, email address, account ID, date of birth, age, sex, weight or target weight, notes, or answers about pain, injuries, pregnancy, recovery or the safety questions. Each account can have the note written at most 6 times per day. If it fails, the app shows a fixed text. The note is kept in your logbook and included in export and deletion; without consent for your health logbook there is no schedule and nothing is sent.

Own recipes: you can have one of your own recipes read by taking a photo of it or pasting its text. Only when you choose to, LivuFit sends that photo (at most two, first reduced on your device) or text, and any answers to a few follow-up questions, to Anthropic. The model turns the recipe into ingredients, amounts and cooking steps; you check and edit everything before saving. The recipe you save is kept in your personal logbook (also without consent for health data, as it is recipe data) and is included in export and deletion. Each account can have recipes read at most 5 times per day. Do not photograph people or other personal details.

Label photo in the scanner: if a scanned product is not in the product database yet, you can take or choose a photo of the nutrition table. Only if you choose to, LivuFit sends that one photo (downscaled on your device first) to Anthropic. The model reads the nutrition values per 100 g or ml; you check them and name the product before you save. LivuFit keeps no copy of the photo, neither on our server nor in the app (a photo you picked from your gallery simply stays there); only the product you save goes into your logbook. Each account can have up to 10 labels read per day.

Your whole day at once: in the diary you can tell at the end of the day, in your own words, what you ate and drank. Only if you choose to, LivuFit sends that text (and, on a correction, your remark) to Anthropic. The model proposes the lines per meal with ingredients and an estimate of your drinks; you check, move or leave out lines before they go into your diary. Each account can use this up to 5 times a day.

Screenshots with your whole day at once: if you already logged your food in another app, you can add 1 to 6 screenshots of that food diary, with a short text if you like. Only if you choose to, LivuFit sends those screenshots (downscaled and re-saved on your device first, without file name, location or other metadata; a long screenshot in at most four parts) to Anthropic. The model reads the lines with the calories and nutrition as shown on the screenshot; LivuFit takes those values over and only estimates what is not shown. You check, move or leave out lines before they go into your diary. LivuFit keeps no copy of the screenshots or the text, neither on our server nor in the app; the screenshots in your gallery simply stay there. Note: everything on your screenshots is sent, including details about other people; crop out other information first. Each account can use this up to 10 times a day.

Sport choice helper: if you are not sure which sport suits you, you can answer four short questions in the intake or under Training (how you like to exercise, where you can train, how often and how long each time, and at most three sports you already enjoy) and optionally type one short remark. Without a remark the app makes a suggestion itself, without AI. If you type a remark or reply to the suggestion, LivuFit sends your answers, your text and a coarse profile to Anthropic: your age group (for example 30-44), your goal, on how many days you can exercise, your experience level, which sports are suitable for you and three yes/no markers the app derives itself (start calmly, no jumping sports, beginner). That list of sports and the first two markers also follow from your answers about pain, injuries, pregnancy, recovery and the safety questions, but those answers themselves are not sent. Our server function also receives only the names of groups of sports that are ruled out for you (for example jumping sports, contact sports or water sports), without the reason, and uses them only to check the suggestion; they are not sent to Anthropic. Your name, email address, date of birth and weight are not sent. What you type yourself is sent, also if you write about an injury or pregnancy; so only mention what you want to share. From your remark and your replies (at most five, each at most 200 characters) the app removes links, email addresses and phone numbers; text that is not about sports or that is about medical treatment or medication is not sent. The model only suggests sports and a number of times per week; the app checks that suggestion against your situation and you choose whether to use it. Each account can use this up to 5 times a day, with at most five replies each time. Without internet or when something fails, the app makes a suggestion itself.

Legal basis: for the features you start yourself, the performance of the service you ask for (Article 6(1)(b) GDPR); the plan note is part of your personal plan. The weekly review and the sport choice helper also involve health data: for the weekly review your weight, target weight and an active injury or pause, for the sport choice helper the markers "start calmly" and "no jumping sports" and the list of sports that suits your situation, which are partly based on your health answers. That requires your explicit consent (Article 9(2)(a) GDPR): you give it with your consent for your health logbook, and on top of that you choose yourself whether to switch on the weekly review and whether to type a remark in the sport choice helper. You can always leave both out. Your answers about pregnancy, recovery and the safety questions themselves are never sent to Anthropic.

Anthropic processes this data as a processor under a data processing agreement (DPA) and does not use API input to train models. Processing takes place in the United States; the transfer relies on the European Commission's standard contractual clauses in that agreement and, insofar as Anthropic is covered by it, on the EU-US Data Privacy Framework. You can request a copy of the safeguards at info@livufit.nl. According to Anthropic's privacy terms, at the time of writing API input and output are deleted within 30 days; where a breach of Anthropic's usage policy is suspected it can be longer (up to two years, and safety scores up to seven years). Deleting your LivuFit account does not affect what Anthropic already keeps under those periods; LivuFit sends Anthropic no account ID, so nothing there is filed under your account. What you accept is kept in your personal logbook and included in export, import and account deletion.

Retention and deletion

You can edit and delete logbook entries. Privacy & data lets you download your local logbook and account data, sign out and clear local account data, or permanently delete your account. Account deletion also removes linked active logbook, consent and push records and your subscription status; you cancel your store subscription yourself.

Simply signing out or uninstalling does not delete your cloud account. Erase downloaded files and copies on other offline devices yourself. An offline device receives changes made elsewhere only after reconnecting. A notification already sent may still arrive.

Account data is kept while needed to provide your account service. The configured cleanup job runs daily and deletes app-open records older than 30 days and pseudonymous usage statistics and email delivery statuses older than 400 days. If you withdraw consent for usage statistics or delete your account, your counts are deleted straight away. Your usage-statistics choice and its change history are deleted with your account. Supabase keeps daily database backups and technical logs for 7 days. Resend keeps email data and delivery logs for 30 days and backups for 7 days. Deleting from the active database therefore means copies in backups disappear within those periods, not immediately. Contact info@livufit.nl about these copies.

On your phone: your sleep (at most 28 nights), your steps (at most 35 days) and pending weigh-ins (at most 60 days) are kept encrypted and only on that phone, and are deleted when you switch them off, disconnect or log out. Workouts from Health Connect or Apple Health you have not decided on yet disappear from your phone after 14 days. Counters for the features that use AI are deleted after 7 days.

We keep subscription data as long as your account exists; we keep refund requests for 7 years for the accounts, after your account is deleted without a link to your account (see LivuFit Premium and payment).

Your rights

Where applicable, you may request access, correction, deletion, restriction or portability and object to processing. You may withdraw consent at any time where processing relies on it; this applies from then on and does not make earlier use unlawful. You may also complain to the Dutch Data Protection Authority. Email your request to info@livufit.nl.

Storage and preferences

The app stores your sign-in details, logbook, language and preferences on your device. It also saves files for offline use. The current app has no advertising trackers. Netlify does not publish a fixed retention period for technical access logs; we are requesting it from Netlify and will add it here once known.

Without your yes we do not share usage statistics. Your choice at first launch or under Settings → App & data applies to your entire account across devices.

Optional situation details and training pause

Pregnancy & recovery asks separately for your explicit consent to store and use the details you provide there. These may include pregnancy, recovery, breastfeeding, a due date or the date a pregnancy ended. The purpose is your preferences, relevant information and the profile prompt you choose. Consent is recorded with the date and setup version. Choosing a notification is separate from this consent.

Recovery after a pregnancy: within the same consent you can tell how your recovery feels, whether you currently notice symptoms (leaking urine, a heavy or dragging feeling in your pelvic floor, pain around your pelvis, pubic bone or lower back, difficulty holding in wind or stools, a bulge or ridge in the middle of your belly, or pain around a caesarean scar), whether a pelvic physiotherapist is guiding you and whether running and jumping already work without symptoms. Every question is optional and you can also choose "Prefer not to say". We use these answers to adapt your training, for example building up more gently, leaving out certain exercises or not planning running and jumping, and to ask you about your recovery again every six weeks while you recover. We do not send your answers about pregnancy and recovery to Anthropic. If you use the sport choice helper with a remark, we do send suitable sports and markers such as "start calmly"; these are partly based on your answers (see Features that use AI).

These details are part of your personal account logbook and the local copy on this device, and are included in exports and imports. In the same screen, you can remove these situation details, including your answers about your recovery, and withdraw consent for this feature. This also removes the corresponding fields from your training profile. The change is applied to your current cloud logbook on the next successful sync. After removal we pause your training plan: an empty answer does not mean an exercise suits you again.

Your own exports and free-text notes are not automatically erased. Remove your own copies and contact info@livufit.nl about deletion and backup retention. Pausing training keeps your logbook; it is not a deletion request. Optional return notifications use neutral text without pregnancy or breastfeeding details on the lock screen.

Providers and international processing

An EU database region determines where primary project data is stored. It does not automatically keep all support, logs, email, CDN or push processing within the EU. Actual project region, processor agreements, subprocessors and transfer safeguards are checked before new participants are admitted. We therefore make no unverified promise that all processing is EU-only.

Pseudonymous usage statistics and email delivery statuses are stored in the same Supabase database in Frankfurt (EU). Grafana can read only aggregate product counts for the admin dashboard. Technical error reports are stored with Grafana Labs (Grafana Cloud, EU region) and deleted there after 30 days. Resend sends the delivery status of account emails through a webhook to a Supabase function, which replaces the email address with a keyed hash before anything is stored.

For the features that use AI (the food estimate, the weekly review, the plan note, reading your own recipes, reading a label photo, your whole day at once, screenshots of your food diary and the sport choice helper) our server function sends data to Anthropic (United States, processor under a data processing agreement, transfers based on standard contractual clauses and, where applicable, the EU-US Data Privacy Framework): only your description, the numbers of your week, the facts of your plan, your recipe photo or recipe text, your label photo, the story of your day, your food diary screenshots and your answers to the sport choice helper with the coarse profile, as described per feature above. The API key lives only in the server function, never in the app. If you sign in with Apple, our server function withdraws LivuFit's sign-in access through Apple when you delete your account. Health Connect (Google) and Apple Health are only a source on your phone: LivuFit does not send their data to Google or Apple.

The website contact form uses Netlify Forms. Do not share medical details, passwords or logbooks there. Messages are used to handle your enquiry and are deleted no later than 6 months after handling, unless there is a follow-up relationship or a concrete need. Deleted mail remains technically present at Microsoft for up to 30 more days. On the website you can also leave your email address to receive one message when LivuFit goes live or new invitations are available. That sign-up (email address and chosen language) also goes through Netlify Forms, is used for that one message only and is deleted no later than 6 months after that message. Want off the list sooner? Email info@livufit.nl.

For LivuFit Premium, RevenueCat, Inc. (United States, processor under a data processing agreement, transfers based on standard contractual clauses and, insofar as RevenueCat is covered by it, the EU-US Data Privacy Framework) processes your purchase data: your account ID, the product, the purchase and expiry dates, country and currency and the store’s transaction IDs. Apple and Google are themselves responsible for the payment and your payment details.

Official information

Privacy rights — Dutch Data Protection Authority ↗