FitFoodz app privacy policy
What the FitFoodz app holds about you, including health and body data, and how to delete it.
This policy covers the FitFoodz mobile app for iPhone and Android. Our website is covered separately, by our privacy policy.
We are SA FITFOODZ (Pty) Ltd, trading as FitFoodz, registration number 2018/559835/07, VAT number 4050298597, of 77 Walter Sisulu Lane, Miederpark, Potchefstroom, 2531, South Africa.
We are the responsible party for the personal information described here, under the Protection of Personal Information Act, 2013 (POPIA). Our Information Officer is Willem Christiaan Reynders and we are registered with the Information Regulator under 2026-064957.
For anything about your personal information, write to [email protected] and put "privacy" in the subject line.
The short version
- We do not ask for a password, and we never see your card number.
- The app holds health and body information, which the law treats as more sensitive than the rest. We say exactly what we hold and why below.
- You can delete your account and your health data from inside the app, in about three taps.
- We do not sell your personal information to anybody.
1. How you sign in
The app has two ways in and neither one asks you for a password.
- Sign in with Apple. Apple tells us a unique identifier for you, and your name and email address if you choose to share them. If you use Apple's Hide My Email, we only ever see the relay address and that is fine.
- Sign in with FitFoodz. This opens Shopify's own hosted sign-in page, which emails you a code. You type it on their page, not in our app.
We store your email address, your name if we have it, and the identifiers that let us recognise you next time.
2. What the app holds about your body and your food
This is the sensitive part and we would rather over-explain it. Under POPIA, health information is special personal information and we may only process it with your consent, which you give by entering it.
Only what you put in, or what you connect:
- Your body: weight, body fat percentage and waist measurement, each dated
- Progress photos, if you take them
- What you eat: every item you log, with its serving and its calories, protein, carbohydrate and fat, plus any meals you save
- Your plan: the answers to the setup questions, which are your sex, age, height, weight, body fat, activity level, goal and goal weight, and the daily targets we work out from them
- Your training: programmes, sessions, exercises, and the weight and repetitions you log
- Steps and workouts, read from Apple Health or Health Connect if you connect them
We do not track your water, and we do not store your sleep. The app can show sleep read from your phone, but that reading stays on your phone and never reaches our servers.
We only ever READ from Apple Health and Health Connect. We never write to them, and we never change your health data.
Sharing with a Diet Buddy or a group is yours to choose. Your weight trend is only visible to a buddy if you switch it on, and every time you do or undo that we record it, so there is a record of what you agreed to.
3. What your phone asks permission for
We only ask when you use the thing that needs it, and you can refuse any of these and still use the app.
| Permission | What it is for |
|---|---|
| Camera | Scanning meal QR codes and barcodes, photographing nutrition labels, and progress photos |
| Photo library | Choosing a profile picture, or adding a progress photo you already have |
| Microphone and speech | Logging a meal by speaking instead of typing |
| Apple Health or Health Connect | Reading your steps, sleep and workouts to show beside your meals |
| Face ID or fingerprint | Unlocking the app so you stay signed in securely |
| Location | Filling in your delivery address when you tap the button. Foreground only, never in the background, and we keep the address rather than the coordinates |
| Notifications | Order updates and reminders you have asked for |
| Tracking (iPhone) | Measuring which advert brought you to us, and showing you relevant ones. See section 6 |
4. What we collect automatically
Which screens you open, what you search for, which products you view, what you add to your basket, and whether the app crashed. We use it to see what is broken and what is worth building.
We also keep a device identifier so we can send you a notification, and we read Google Play's install referrer once on Android so we know which advert brought you.
5. Payments: we never see your card
FitFoodz does not receive, process or store card numbers, security codes or expiry dates.
- Shop orders are paid on Shopify's own checkout page. We get back an order number.
- FitFoodz+ membership is billed through PayFast. What we hold is a token, which is a reference PayFast gives us. The card itself lives in PayFast's vault and updating it happens on their page, not ours.
We do keep a record of what you were charged, when, and whether it went through.
6. Who else sees your information
We do not sell your personal information. These are the companies that necessarily see some of it so the app can work.
| Who | What reaches them |
|---|---|
| Shopify | Your account, your orders and your payment, on their checkout |
| PayFast | Membership billing and your card, which we never see |
| Meta (Facebook and Instagram) | That you viewed a product or added one to your basket, with your email address and our customer number encrypted into an unreadable code before they are sent, plus your IP address and device type. This is for advertising. On iPhone we ask first, and if you say no we do not send it |
| Anthropic | A photograph of a nutrition label, when you use the label scanner, so it can read the numbers off it for you. The picture is sent to be read and is not used to identify you |
| Apple | What you say, when you log a meal by speaking, for their speech recognition |
| Address suggestions when you type a delivery address, and the notification service | |
| Expo | The token that lets us send you a notification |
| Sentry | Crash reports, so we can fix what broke |
| FatSecret, Open Food Facts, USDA | A barcode or a food name you searched for. Not who you are |
| Judge.me | Product reviews you choose to write |
Some of these are outside South Africa. POPIA allows that where the other country's law or the company's own commitments give your information comparable protection, and we rely on that.
7. Marketing, and how to stop it
We may send you email, WhatsApp messages and app notifications about orders, and about offers if you have agreed to them.
Every marketing message has a way out, and it always works. You can also turn notifications off in your phone's settings, and manage what we send from our marketing preferences page. Stopping marketing never stops the messages you need, such as telling you where your order is.
8. How long we keep it
We keep what is in your account until you delete it. That is the honest answer, and we would rather give it than quote a number we do not enforce.
Two exceptions, and both are the law rather than our preference:
- Order, invoice and tax records are kept for five years, because SARS requires it. These stay even if you delete your account.
- Anything we need to keep to deal with a dispute stays until the dispute is finished.
9. Deleting your account
In the app: Account, then Delete account. It asks you to confirm, and then it removes your FitFoodz account and, with it, your weight history, your progress photos, your food diary, your saved meals, your training programmes and sessions, your steps and workouts, and your buddy and group connections.
If you would rather keep your account and start over, Start fresh clears your plan and, if you ask it to, your weight history, food diary and photos.
What survives, so that you know before you press it: your past orders and their invoices, for the five year tax reason above.
You can also ask us to delete you by writing to [email protected]. There is a fuller description on our account and data deletion page.
10. Your rights
Under POPIA you may ask us to:
- Tell you what we hold about you, and where we got it
- Correct or delete anything that is wrong, misleading, out of date, or that we should no longer have
- Stop processing your information, or object to us using it for direct marketing
- Give you a copy of what you gave us
Write to [email protected]. We answer within a reasonable time and we do not charge for a straightforward request.
If we have not put something right, you may complain to the Information Regulator (South Africa), at [email protected], JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Our full access procedure is in our PAIA manual.
11. Children
The app is not meant for anyone under 18 and we do not knowingly collect information from children. A child's personal information is specially protected under POPIA. If you believe a child has given us information, tell us and we will delete it.
12. Keeping it safe
Your session is held in your phone's secure storage, which is the same place your phone keeps its own credentials. Everything travels encrypted. Access to our systems is limited to the people who need it.
No system is perfectly secure, and anybody who tells you otherwise is selling something. If personal information is ever compromised in a way that could harm you, POPIA requires us to notify you and the Information Regulator, and we will.
13. Changes
If we change this policy we will update the date below, and if the change is significant we will tell you in the app.
Last updated 2026-09-17. Questions: [email protected] or WhatsApp 072 522 7099, Monday to Friday, 08:00 to 17:00 South African Standard Time.