MyNF · fitnznutrition

Privacy policy

Effective date: 18 October 2026.

Who we are

MyNF is operated by fitnznutrition in the United Arab Emirates. Contact us at fitnznutrition@gmail.com for support or privacy requests.

Information we collect

We process your email address, account identifier, authentication information and, when you choose Google sign-in, the identity information supplied by Google. For new email/password accounts, Google Firebase Authentication processes your email address and password, sends verification emails and maintains your authentication identity. MyNF does not store those passwords. Existing MyNF password accounts continue to use password hashes. Health records are not sent to Firebase Authentication.

Information you enter may include your name, year of birth, sex, height, weight, waist measurement, city, country, time zone, fitness goals, activity level, diet preferences, allergies, food restrictions, groceries, food portions, meals, hydration, exercise and cardio records. Assessments may include sleep, stress, health conditions and pregnancy, postpartum or breastfeeding information that you choose to provide. We also store targets, recommendations, summaries and progress derived from these records.

With your authorization, Android Health Connect and supported Google Health/Fitbit connections provide available steps, distance, heart rate, sleep, exercise, calorie and supported heart-rate variability records. On iOS, Apple Health/HealthKit supplies the records you authorize. Data may include source identifiers, record identifiers, units, start/end times and corrections. Available categories depend on the platform, device and permissions. Phone motion sensors can supply activity and step information when permitted.

Technical information includes app installation and notification identifiers, push tokens, permission settings, synchronization state, request times, IP addresses and security/audit events. We use your selected city and country to obtain approximate city coordinates and weather; this feature does not require precise device GPS location.

How we use information

We use it to authenticate you, operate your account, synchronize authorized health records, show meal and activity totals, provide wellness plans and recommendations, calculate progress, send the reminders you select and troubleshoot or secure the service. Estimates and health scores are general wellness information, not medical diagnoses.

Health-data choices and limited use

Health connections are optional. You control read permissions through the health platform or provider and can disconnect a supported connection in MyNF. Revoking permission stops future access to the affected categories. It does not automatically erase data already imported; use Profile → Privacy & data or contact us to request deletion. Disconnecting MyNF does not delete original records held by Apple, Google or another source app.

MyNF uses information obtained through Google Health in accordance with the Google Health API Developer and User Data Policy, including its Limited Use restrictions. Google API information is also subject to the applicable Google API Services User Data Policy. Health data is used for the user-facing wellness functions you authorize, not sold or used for advertising, credit decisions or data brokerage. Human access to connected Google health data is limited to permitted situations such as specifically authorized support, necessary security investigations or legal requirements.

Service providers and transfers

• Render hosts the MyNF API, synchronization worker and PostgreSQL database. The current hosted environment is in Singapore.
• Google supplies Google sign-in, authorized Google Health/Fitbit data, Firebase Authentication for new email/password accounts, Firebase website hosting and Android Firebase Cloud Messaging.
• Expo's push service and Firebase Cloud Messaging process notification addresses and message content for delivery. Reminder and achievement text can reveal wellness information on your lock screen; you can control notifications in MyNF and Android settings.
• Cloudflare R2 delivers exercise videos. Video requests can expose normal network request information, including your IP address, to the delivery service.
• Open-Meteo receives city search terms or city coordinates to provide weather information used by the app.

Providers process the information needed for their role. Processing may occur outside your country, including Singapore and other locations used by these providers. We may disclose information where legally required or necessary to protect security. We do not currently operate an advertising SDK in MyNF.

Storage and security

Authorized records and account data are stored on MyNF's backend. The app also stores cached records and pending uploads on your device for offline use. Authentication tokens use the platform's secure storage; provider tokens are encrypted on the backend. Connections to the hosted API use HTTPS. Access controls and password hashing help protect accounts. These safeguards do not eliminate all risk, and this policy does not claim that every local database field is separately encrypted.

Retention and deletion

Free-account history: after you accept the 30-day retention policy in Profile → Privacy & data, saved wellness data becomes eligible for automatic deletion after 30 days without online foreground use of MyNF. Opening and using MyNF online resets this timer. Background health synchronization and notifications do not reset it. Entirely offline use cannot reset the server timer. The screen shows whether automatic cleanup is enabled. Until you accept, this inactivity rule does not apply to your existing history.

Inactivity cleanup removes your profile, assessments, meals, workouts, health history, plans, progress, connection credentials, notification registrations and account-linked audit entries. Your email/login identity and the minimum account security and retention state remain so you can sign in and start again. Login identity remains until you request account deletion. Uninstalling alone does not delete backend data.

Your deletion controls: Profile → Privacy & data provides “Delete my data — keep login” and “Delete my account and data.” A successful confirmed request deletes the selected records from the primary database immediately and invalidates existing sessions. You can also follow the account-deletion instructions without reinstalling MyNF. Email requests are handled within 30 days after ownership is verified.

Subscriptions: billing is being prepared for testing; existing users outside a billing test retain their current access. Where a store subscription is enabled, verified active membership protects history from inactivity cleanup. After a verified membership end, the existing 30-day retention rules resume for accounts that have accepted that policy. A temporary verification outage protects stored records from accidental deletion without extending unverified paid access. Deleting MyNF data or uninstalling the app does not cancel store billing. Read the English and Arabic subscription terms.

Devices and connected sources: the updated app clears its local session and cached data during deletion. Other installations must reconnect to detect an invalidated session and clear cached information; an offline device cannot be remotely erased. Original records in Apple Health, Health Connect, Fitbit or another provider are unaffected. Explicitly reconnecting a source may import its available history again. Device or operating-system backups are controlled separately by your device settings.

Backups and technical logs: the hosted database uses Render’s three-day point-in-time recovery window. Removed records can remain in those restricted recovery copies until that window expires. We do not use those copies for ordinary app access. Any disaster recovery must reapply subsequent deletion requests before normal service resumes. No long-term production database exports are part of the current backup workflow. Render application logs are retained for seven days. A minimal deletion receipt (internal account number, deletion scope and time, without email or health values) is retained in those logs so deleted data can be removed again after disaster recovery. Account-linked audit records in the primary database remain with the account history and are removed by data or account deletion. We do not intentionally log passwords, provider tokens or health measurement values.

Store purchases and membership

When you participate in subscription testing or purchase an available membership, MyNF receives store purchase references, product and plan identifiers, purchase status, renewal and expiry information, and an opaque identifier linking a purchase to your MyNF account. We use these to verify payment, provide or restore membership, process renewals and refunds, and prevent a purchase being claimed by another account. Purchase references are encrypted on the MyNF server. We do not receive your full payment-card number or bank credentials; Apple or Google processes store payments.

Google Cloud Pub/Sub delivers authenticated Google Play subscription notifications to the MyNF backend. These may include purchase references and status-change information. We verify store records before changing membership. Apple store notifications are used when the iOS subscription integration becomes available. Store providers process information under their own privacy policies and retain their own transaction records.

Deleting your MyNF account removes MyNF-held membership records but does not delete store records or cancel billing. A data-only reset preserves the membership information needed to restore access. The backup and technical-log limits described above also apply to MyNF-held purchase records. No payment-card information should be sent to MyNF support.

Your choices and requests

You can edit supported profile and logged entries, manage notification settings and revoke health permissions. Contact us to request access, correction, export or deletion, or to ask about rights available under applicable law. We may verify account ownership before acting. Do not send passwords, verification codes or detailed medical records by email.

Adults only

We ask for your full date of birth to check that you are at least 18. We retain your birth year and the time your adult eligibility was confirmed, rather than storing your full date of birth. Existing accounts must complete this check before using health features or connected-device syncing. Privacy and account-deletion controls remain available.

MyNF is intended for adults aged 18 and over. We do not intend to collect information from children. If you believe a person under 18 has supplied personal information, contact us so we can investigate and remove it where appropriate.

Changes

We will update this page and its effective date when practices change, and provide additional notice or obtain consent where required.