Fibrea Privacy Policy
Version: 1.0 · Effective date: 21 October 2026 · Website: https://fibrea.fit
This policy explains what the Fibrea app does with information about you: what it collects, why, where it is kept, who else sees it, how long it stays, and how you control it. We tried to write it so that every sentence is true for this app, in plain words.
Which sections apply to you
| You live in | Read |
|---|---|
| Any country | Sections 1–14 |
| European Union, EEA, United Kingdom, Switzerland, Montenegro | Sections 1–14 (they are written to the GDPR standard) and section 15 |
| United States | Sections 1–14 and section 16 (and our separate Consumer Health Data Privacy Policy) |
| Russia | The app is not offered in Russia |
| Elsewhere (Brazil, Canada, Australia, Türkiye and others) | Sections 1–14 and section 17 |
1. Who is responsible
Fibrea is developed and run by Sergey Karaev, a private individual resident in Montenegro ("we", "us"). We decide how your personal data is used, which makes us the data controller.
- Country: Montenegro
- Privacy questions and requests: privacy@fibrea.fit
- General support: support@fibrea.fit
2. The short version
- Your data lives on your phone first. Without an account, your entries stay on your device and we cannot see them.
- An account is optional. It keeps a copy of your entries on our server in the European Union (Frankfurt, Germany) so you can use several devices and not lose data. We ask for your explicit consent before the first copy is made.
- Sensitive data needs its own yes. Menstrual cycle data, data imported from Apple Health or Health Connect, and progress photos go to your account only if you switch each one on separately.
- AI features are opt-in. The AI coach and the plate photo send data to an AI provider (Anthropic, USA) only after you agree. We do not keep the photo.
- No advertising, no tracking, no data sales. The app contains no ad networks, no analytics tools and no cross-app tracking.
- You stay in control. You can export everything, delete individual entries, withdraw any consent, and delete your account in the app or on our website.
3. What we collect and why
3.1 Data you enter
| Data | What we use it for |
|---|---|
| Questionnaire: sex, age, height, weight, goal, experience, training place and equipment, training schedule, health limitations (for example blood pressure, heart conditions, asthma, pregnancy, recent injury, a doctor's restriction), diet and allergens | To calculate your calorie and nutrient targets, build a training plan, and leave out exercises and breath-holding that may not suit you |
| Daily check-ins (sleep, stress) | Tips on the Today screen |
| Food diary, favourite foods, your own products | Nutrition tracking |
| Workouts, exercise progress, breathing sessions, calm tests, your own exercises and workouts | Your training history, weight progression and statistics |
| Weight and body measurements | Progress tracking |
| Menstrual cycle dates, settings and how you feel | Cycle calendar and, if you choose, adjusting training to your cycle phase |
| Plans, calendar items and reminders | Your schedule. Reminders are created on your phone; we do not use push servers |
| Ratings of recipes and exercises | Your own ratings, and an anonymous average shown to all users |
| Progress photos and avatar | Comparing your progress; your profile picture |
Some of this is health data, which the law treats as a special category. We treat all of it with the same care whether or not a particular law classes it as health data.
3.2 Data collected while you use features
| Data | When | What we use it for |
|---|---|---|
| Precise location (GPS route, distance, pace) | Only while you record a run, ride or walk, from Start to Finish, including with the screen off. Never outside a recording | Map and results of the activity |
| Heart rate from a Bluetooth sensor or watch | Only during a session you started | Average, maximum, start and end heart rate for that session |
| Barcode number | When you scan a product | Looking the product up in Open Food Facts |
| Camera image | Only when you take a progress photo or a plate photo | See 3.4 and 3.5 |
Privacy zones you set (for example around your home) stay on your phone and hide the start and end of a route on images you share.
3.3 Apple Health and Health Connect
Only if you connect them in Settings → Connections and allow access in your phone's settings.
- We read: workouts (including the route, if you allow it), heart rate during workouts, steps, sleep and weight, to show them in your history and on the Today screen.
- We write: your workouts, weight, meals (calories, protein, fat, carbohydrates) and mindful minutes from breathing practices.
Data read from Apple Health or Health Connect is never used for advertising or marketing, is never sold, and is not shared with third parties except as needed to run the features you asked for. It is copied to your account only if you separately switch on "Keep Health data in my account".
3.4 AI coach (PRO, 18+)
When you write to the coach, your message (up to 500 characters) and your last few messages go to our server. To give an answer that fits you, the server adds information from your account: your questionnaire (including health limitations, diet and allergens), recent workouts, daily nutrition totals, recent weights and breathing sessions. This goes to our AI provider, Anthropic, which generates the reply. Your chat history is kept on your phone only; our server does not store it.
You are talking to an AI, not to a person, a doctor or a certified trainer. Its replies are general suggestions, not a diagnosis or medical advice.
3.5 Plate photo (PRO)
The photo of your meal goes through our server to Anthropic, which estimates the food and its nutrients. We do not save the photo in the app or on our server.
3.6 Account
If you create an account we store your e-mail address or your Apple or Google sign-in identifier. If you sign in with Apple, we keep a token issued by Apple so that we can revoke Apple sign-in when you delete your account (Apple requires this).
3.7 Subscription
Purchases are processed by Apple (App Store) or Google (Google Play). We never see your card or bank details. Our subscription service, RevenueCat, receives an app user identifier and your purchase records so the app knows whether PRO is active. After you sign in, that identifier is your account ID.
3.8 Messages to us
If you send feedback, your e-mail app sends us your message, your e-mail address and, if you leave it on, the app version, operating system and language. We do not attach your profile, entries or health data.
3.9 Records we keep to protect you and us
- A log of the consents you gave or withdrew (type, text version, yes/no, time).
- Daily counters for AI requests, to apply fair-use limits. To stop limits being bypassed with a new account, one counter is tied to a one-way code (hash) of the purchase rather than to you; it is kept for a few days only.
3.10 What we do not do
We do not show ads, use advertising identifiers, track you across other apps and websites, use analytics or crash-reporting tools, sell or rent personal data, or build profiles of you for marketing.
4. Legal bases (GDPR and similar laws)
| Purpose | Legal basis |
|---|---|
| Storing and syncing your entries in your account | Your explicit consent (GDPR art. 6(1)(a) and 9(2)(a)), because the entries include health data |
| Syncing cycle data, Health imports, progress photos | Separate explicit consent for each |
| AI coach and plate photo | Separate explicit consent |
| Providing your account, subscription and the features you request | Performance of our contract with you (art. 6(1)(b)) |
| Records of consent, Apple sign-in revocation, answering legal requests, keeping records required by law | Legal obligation (art. 6(1)(c)) |
| Security, abuse prevention, fair-use limits for AI, anonymous rating averages, answering your messages | Our legitimate interests (art. 6(1)(f)), balanced against your rights |
Without an account, the app processes your data only on your device, under your control.
5. Your consents and how to withdraw them
| Consent | Asked when | Withdraw | What happens when you withdraw |
|---|---|---|---|
| Sync with account | Turning on sync | Settings → Account → Turn off sync | The server copy of all your entries and photos is deleted; everything stays on your phone. Your account remains and you are signed out on all devices; sign in again to turn sync back on |
| Cycle data in account | Account setup or Settings → Account | Same place | The server copy of cycle data is erased; data stays on your phone |
| Health data in account | Same | Same | Imported workouts and weight are erased from the server; they stay on your phone |
| Progress photos in account | Same | Same | Photos and avatar are erased from the server; they stay on your phone |
| AI data | First use of the AI coach or plate photo | Settings → Account | AI features switch off. Requests already sent cannot be recalled from the provider but are deleted on its schedule (section 8) |
| Phone permissions (location, camera, Bluetooth, Health, notifications) | When a feature first needs them | Your phone's settings | The feature stops working; everything else continues |
Withdrawing consent does not affect processing that already took place.
6. Who receives your data
We do not sell or share your data for advertising. We use a small number of service providers who process data only on our instructions and under data processing agreements:
| Provider | What it does | Data | Location |
|---|---|---|---|
| Supabase Inc. | Database, sign-in, file storage, server functions | Your account and synced data | Servers in Frankfurt, Germany (Amazon Web Services); company in the USA |
| Anthropic PBC | AI models for the coach and plate photo | The AI request described in 3.4–3.5 | USA |
| RevenueCat Inc. | Subscription status | App user ID, purchases | USA |
| Google LLC (Gmail), Cloudflare Inc. | Our e-mail, sending sign-in codes, website | Messages you send us; your e-mail address for sign-in codes | USA / global |
Some companies act on their own behalf under their own privacy policies:
- Apple and Google — app stores, payments, Sign in with Apple / Google, Apple Health and Health Connect, and the maps in the app (Apple Maps on iPhone, Google Maps on Android load map tiles for the area you view).
- Open Food Facts (France) — receives the barcode number you scan, and, like any website, your IP address.
We may also disclose data when the law requires it, to protect someone's safety, or to defend legal claims. If the app is ever transferred to a new owner, your data would pass to them only under this policy, and we would tell you in advance.
Other users never see your entries. They see only the average rating and number of ratings for a recipe or exercise.
7. International transfers
Your synced data is stored in the European Union. We run the app from Montenegro. Some providers (Anthropic, RevenueCat, Supabase as a company, Google, Cloudflare) are based in the USA. Where data leaves the EU/EEA or the UK, we rely on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework where the provider is certified, together with the provider's security measures. You can ask us for a copy of the relevant safeguards at privacy@fibrea.fit.
8. How long we keep data
| Data | How long |
|---|---|
| Data only on your phone | Until you delete it, use "Erase all data", or remove the app |
| Synced data | As long as your account exists |
| Entries you deleted | Removed from the server 180 days after deletion (they are kept briefly so your other devices learn about the deletion) |
| Your account after you delete it | Deleted immediately with all synced data and files; server backups are overwritten within 7 days |
| Withdrawn cycle / Health / photo consent | The server copy is erased immediately |
| Plate photos | Not stored by us |
| AI requests at Anthropic | Deleted by Anthropic within 30 days; if its automated safety systems flag a request, it may be kept up to 2 years. Anthropic does not use API data to train its models |
| AI fair-use counters | 3 days (deleted automatically every night) |
| Consent records | As long as your account exists |
| Your e-mails to us | 2 years after the conversation ends |
| Subscription records | Kept by Apple, Google and RevenueCat under their rules and tax laws |
9. Your rights
Depending on where you live, you can:
- access your data and get a copy — in the app: Settings → Data → Export (a JSON file with everything stored on your phone, which after sync includes your account data);
- correct it — edit any entry or your questionnaire;
- delete it — delete entries, erase all data on the phone, or delete your account in Settings → Account or at https://fibrea.fit/delete-account/;
- withdraw consent at any time (section 5);
- object to processing based on legitimate interests, or ask us to restrict it;
- port your data to another service (the export file is machine-readable);
- complain to a data protection authority (section 15).
E-mail privacy@fibrea.fit for anything you cannot do in the app. We answer within one month (this can be extended by two months for complex requests; we will tell you). We may need to confirm that the request comes from the account owner. Requests are free unless they are clearly unfounded or excessive.
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. The AI coach suggests training plans; you decide whether to follow them.
10. Security
Every synced record is protected so that only your account can read it (row-level security on the database, checked by automated tests). Data travels over encrypted connections (HTTPS/TLS) and is encrypted at rest by our hosting provider. Server keys are never in the app. No system is perfectly secure; if a breach puts your rights at risk, we will notify the supervisory authority and, where required, you.
11. Children
Fibrea is meant for people aged 16 and over. The AI coach is available only to users aged 18 and over. We do not knowingly collect data from children under 16. If you believe a child has given us data, write to privacy@fibrea.fit and we will delete it.
12. Health and safety notice
Fibrea gives general fitness, breathing and nutrition guidance. It is not a medical device and does not diagnose, treat or prevent any condition. Cycle predictions are estimates and must not be used for contraception or to plan pregnancy. See our Terms of Use.
13. Changes to this policy
When we change this policy we will update the version and effective date at the top. If a change affects how we use data you have already given us, or needs a new consent, we will tell you in the app before it takes effect and ask again where required.
14. Contact
privacy@fibrea.fit — Sergey Karaev, Montenegro.
15. For users in the EU, EEA, UK, Switzerland and Montenegro
- We process your data in line with the General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection, and the Montenegrin Law on Personal Data Protection.
- You may complain to the supervisory authority in the country where you live or work or where an infringement took place. In Montenegro this is the Agency for Personal Data Protection and Free Access to Information (Agencija za zaštitu ličnih podataka i slobodan pristup informacijama). In the UK it is the Information Commissioner's Office (ICO).
16. For users in the United States
- Consumer health data. Residents of Washington, Nevada and other states with consumer health data laws: see our separate Consumer Health Data Privacy Policy at https://fibrea.fit/health-privacy/. We collect consumer health data only with your consent or as needed to provide the feature you request, and share it only as described in section 6.
- California and other state privacy laws. We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not use sensitive personal information to infer characteristics about you. You may request to know, delete or correct your information by e-mailing privacy@fibrea.fit; we will not discriminate against you for using these rights. An authorised agent may act for you with your signed permission.
- Children. We do not knowingly collect data from children under 13 (or under 16 — see section 11).
17. Other countries
If the law where you live gives you more rights than this policy describes (for example Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act or Türkiye's KVKK), you have those rights too. Write to privacy@fibrea.fit and tell us which country you are in; we will answer under the law that applies to you. You can also complain to your national data protection authority.