Privacy Policy — Lean: Weight Loss Tracker

Effective date: 7 October 2026 (app version 2.10.0)
Developer: Justinas Kristopaitis
Contact: justinas.kristopaitis@gmail.com

Lean has no accounts and no sign-in. We never ask for your email address, and we do not sell, rent or share your data with advertisers or data brokers.

This policy describes what actually leaves your device, where it goes and why.

1. Your identifier

Lean does not create a user account. Instead, the app generates a random identifier the first time you launch it and stores it in the device Keychain. A second, separate anonymous identifier is issued by Firebase Authentication. Neither is derived from your name, email, phone number or the Apple advertising identifier (IDFA), and neither is shared with any other app.

These identifiers are what allow us to restore your history when you reinstall the app or move to a new device. Because your data is stored against them, it is "linked to you" in Apple's terms, even though we have no way to work out who you are.

2. What stays on your device

• Progress photos. Saved to the app's sandboxed Documents folder. They are never uploaded, never synced and never sent to an AI service. They are deleted when you delete the app.
• Your complete local database. SwiftData on your device is the source of truth for everything in the app. Everything described below is a copy.
• GLP-1 companion. If you turn it on: your medication, shot day, dose, the shots you log and your day-after check-ins (appetite, nausea, digestion, energy). These records are not backed up to the cloud and are never sent to analytics. The short summary described in §5 is sent to the AI coach only if you allow Lean's AI, and because AI coach conversations are backed up (§3), a coach question or reply that mentions your medication is stored with them. The doctor report PDF is created on the device and shared only where you choose to send it.
• Reminder settings and other app preferences.

3. What is backed up to the cloud

To protect you against losing your weight history — the single thing users tell us they care most about — the app keeps an encrypted-in-transit backup in Google Cloud Firestore, stored against the anonymous identifier in §1:

• Profile: first name, age, height, starting and goal weight, activity level, target pace, preferred units
• Weight entries, including any note you type
• Body measurements, including any note you type
• Daily check-ins: mood, stress level, hydration, whether you worked out
• Meal entries: name, meal type, calories and, where known, protein, carbs, fat, the barcode and how the meal was logged
• Fasting sessions
• Lifestyle answers from onboarding (diet style, sleep, stress, exercise habits, allergies, disliked and favourite foods)
• AI coach messages: the questions you typed and the coach's replies (which may mention anything you shared with the coach, including the GLP-1 summary)

This backup exists only so the app can restore it to you. It is not used for advertising and it is not shared with third parties beyond Google, which hosts it on our behalf.

4. Apple Health

With your permission, Lean reads steps, active calories, workout minutes, sleep hours, resting heart rate and body mass from Apple Health, and writes the weights you log back to Health so other apps can use them.

Health data read from Apple Health is used on-device for your charts and insights. A daily summary of it (steps, active calories, workout minutes, sleep hours) is included in cloud AI coaching requests — see §5. It is never sold and never used for advertising.

5. AI coaching — only with your permission

Lean asks before it sends anything to its AI provider. The first time you use a cloud AI feature (a meal photo, a meal description, or a coach question when on-device AI is unavailable), the app shows "Allow Lean's AI?" with what will be sent. You can choose "Not now", and you can change your answer at any time in Profile → Privacy → Lean's AI. Without it, barcode scanning, manual logging and on-device features keep working.

Where your device supports it, coaching runs entirely on-device using Apple Intelligence (Foundation Models). Nothing is transmitted in that case.

Otherwise, if you have allowed it, the request goes to our Google Cloud Function, which forwards it to OpenAI for processing. The request contains:

• your first name, age, height, calorie target and activity level
• your recent weight trend and current/goal weight
• the Apple Health day summary described in §4
• your onboarding lifestyle answers
• the question you typed, if you asked the coach something
• if the GLP-1 companion is on: a one-line summary (medication, shot day, prescribed dose, days since the last shot and the latest check-in scores)

Because the function is called over an authenticated connection, it carries the anonymous identifier from §1. Requests are not stored beyond what is needed to serve them and OpenAI's API terms prohibit using them to train its models.

6. Meal photos and meal descriptions

When you photograph a meal or describe one in words ("2 eggs and toast"), and you have allowed Lean's AI (§5), the photo or text is sent to our Cloud Function and forwarded to OpenAI for recognition, then discarded. The photo is never written to Firestore, never written to Cloud Storage and is not retained by us. OpenAI may retain API inputs for a limited period for abuse monitoring under its own terms.

6a. Barcode lookups

When you scan a product barcode, the app asks the public Open Food Facts database for that product (world.openfoodfacts.org). The request contains only the barcode number; no identifier or personal data is attached, although, as with any web request, their server sees your IP address. The camera image used to read the barcode is processed on the device and never uploaded.

7. Analytics and crash reporting

Lean uses two analytics SDKs and one crash reporter. Each receives data against its own anonymous identifier:

If you installed Lean from an Apple Search Ads ad, Apple's AdServices framework tells the app which campaign, ad group and keyword it came from. Those IDs (no personal data, no IDFA) are stored with the analytics above so we can see which ads bring people who find the app useful.

For the GLP-1 companion, analytics records only that the feature is used (turned on or off, a shot or check-in logged, the report opened) — never the medication, dose or symptoms.

We use these to see which parts of the app help people and which do not. We do not use them for advertising, and the app requests no tracking permission and contains no advertising SDK.

Feedback text is optional and free-form. Please do not include anything in it that you would not want stored in an analytics tool.

8. Subscriptions and payments

In-app purchases are processed entirely by Apple. We never receive or store your payment details. Subscription status is verified on-device via StoreKit 2; only the fact of a purchase, the product and its price are logged to analytics.

9. What we do not collect

• Email address, phone number or postal address
• Precise or coarse location (the app requests no location permission)
• Advertising identifiers (IDFA) — no tracking prompt is ever shown
• Contacts, calendar, microphone or your photo library beyond the single image you choose to scan
• Camera images other than a meal photo you choose to take (barcode reading happens on the device)

10. Children

Lean is not directed at children under 16 and we do not knowingly collect data from them.

11. Retention and deletion

Local data is deleted when you delete the app.

The cloud backup in §3 persists so that reinstalling restores your history. To have it erased, email justinas.kristopaitis@gmail.com — deletion requests are honoured within 30 days. Analytics and crash records are deleted on the same request, subject to each provider's own deletion window.

12. Processors we rely on

13. Changes to this policy

We will update the effective date above and show an in-app notice if we make a material change.

14. Contact

Questions, access requests or deletion requests: justinas.kristopaitis@gmail.com