# Undiet Privacy Policy

**Effective date:** 21 October 2026

Undiet is a weight journey companion for iPhone and Android. It is made and operated by Krnic CommV, a Belgian commanditaire vennootschap (CommV) in Gent, Belgium ("Undiet", "we", "us"). We are the controller of the personal data described in this policy.

Some of what you put into Undiet is health data: your weight, how your days feel, what you eat and drink, and medication doses if you log them. This policy explains, in plain words, what we process, why, where it lives, who helps us, and what you can do about it. If anything is unclear, write to **undiet@krnic.be**.

---

## The short version

- **Your journey lives on servers in the EU** (the European Union (Frankfurt, eu-central-1)), under your account, so it follows you across devices.
- **Weight, feelings and logs are health data.** We store them only with your explicit consent, which the app asks for during onboarding and which you can withdraw at any time.
- **Progress photos never leave your phone.** They are processed and stored on the device only. We do not receive them, back them up or see them.
- **No ads, no data brokers, no cross-app tracking.** We do not sell or rent your data and there is no advertising SDK in the app.
- **Product analytics is pseudonymous and about actions, never values.** The app records that a screen was opened or a check-in saved, never what you weighed, how you felt or what you wrote. You can switch it off in Profile, under Privacy.
- **You are in control.** Export everything from the app, delete everything from the app, immediately and irreversibly.

---

## 1. What we process, and why

| Category | What it is | Why we process it | Legal basis (GDPR) |
|---|---|---|---|
| **Account** | Your email address, or the identifier Apple or Google gives us when you sign in with them; the account id we assign; the time you created the account and last signed in; the policy version you accepted. | To create and secure your account, sign you in and send you sign-in and account emails. | Contract (art. 6(1)(b)) |
| **Profile** | A display name or nickname you choose, optional height, your goal if you set one, the program you are on, your reminder settings. | So the app can show your journey and address you by the name you picked. | Contract (art. 6(1)(b)) |
| **Health data** | Daily check-ins (weight, how the day felt), quick logs (meal, drink, movement, note, GLP-1 dose), the periods of your diet timeline, derived trends and analytics. | This is the product: keeping your journey and showing it back to you. | Explicit consent (art. 9(2)(a) together with art. 6(1)(a)), see section 2 |
| **Community content** | Posts, comments, reactions, the credits you earn and give, reports you file, people you block. | To run the community, show your content to other members and keep it safe. | Contract (art. 6(1)(b)); legitimate interest in keeping the community safe (art. 6(1)(f)) |
| **Progress photos** | Photos you take in the app, the cut-outs made from them and the comparisons you build. | Only on your device. We never receive them. | Not processed by us (see section 3) |
| **Product analytics** | Pseudonymous event records: your account id, the event name (for example "check-in saved"), a few small typed properties, your operating system, the app version, a session id and a timestamp. Never content, never health values. | To understand which parts of the app are used, where people get stuck and whether changes help. | Legitimate interest (art. 6(1)(f)), with a one-tap opt-out, see section 4 |
| **Crash reports** | A technical report when the app crashes: the error, the stack trace, device model, operating system version, app version, and a pseudonymous identifier. | To find and fix bugs. | Legitimate interest (art. 6(1)(f)) |
| **Subscriptions** | Whether you have Undiet Plus, which plan, when it renews or ends, and the pseudonymous subscriber id our billing provider assigns. We never see your card or your store account. | To unlock Undiet Plus and keep it in sync with the store. | Contract (art. 6(1)(b)) |
| **Push notifications** | The device push token, your reminder preferences, and the notifications we send (reminders, replies to your posts). | To deliver the notifications you asked for. | Contract (art. 6(1)(b)); you can turn them off in the system settings at any time |
| **Support** | What you send us by email, and our replies. | To help you. | Legitimate interest (art. 6(1)(f)) |
| **This website** | Pageviews and taps on this site, counted without cookies (page, device type, campaign tag if any, country). No IP address is stored. | To know whether the site works and where visitors come from. | Legitimate interest (art. 6(1)(f)) |

We do not use your data for advertising, we do not profile you for marketing and we do not sell or share it with data brokers.

## 2. Health data and your explicit consent

Weight, how you feel, what you eat and drink and any medication you log are **special category data** under article 9 of the GDPR. We process them only on the basis of your **explicit consent**. The app asks for it in its own step during onboarding, in plain words, separately from accepting the terms. We record which wording you said yes to and when.

You can **withdraw this consent at any time** by closing your account (Profile, then Account, then Close your account), which deletes everything, or by writing to undiet@krnic.be. Withdrawal does not affect the lawfulness of processing before it. Because the journey cannot exist without this data, withdrawing consent means the app can no longer keep a journey for you.

What we do **not** do with health data: we never use it for advertising, we never share it with other members unless you explicitly choose to show a figure on your public card, we never use it to train machine learning models, and we never send it to analytics or crash reporting.

## 3. Progress photos: on your device, and only there

Progress photos are the most private thing in the app, and we treat them that way. When you take one, the app cuts the figure out of the background **on the device** (using the operating system's on-device vision tools; on Android, Google's ML Kit running locally) and stores the result in the app's private storage on your phone. The ghost overlay comparison is drawn on the device from those files.

- Photos are **never uploaded** to our servers, to any processor, or to any cloud of ours.
- They are **not included** in your account export, because we do not have them.
- They **cannot become a post**. There is no button for it.
- If you delete the app, or delete the photos in it, they are gone. We cannot restore them.
- Your own device backup (iCloud or Google backup) may include the app's data, depending on your device settings. That is between you and Apple or Google.

## 4. Product analytics and how to opt out

We want to know which screens people use and where they get stuck, so we can make the app better and decide what to build. To do that, the app records **that** an action happened, never **what** it contained:

- recorded: "home viewed", "check-in saved", "diet started", "post published", "paywall viewed", and similar events, with a few small properties such as which kind of check-in, plus your operating system, app version and a session id;
- never recorded: your weight, your feelings, your notes, your photos, the text of your posts, the program's name in free text, or anything else you typed or measured.

These events are written first to our own database in the EU, under your pseudonymous account id. Our server then forwards them in batches to **PostHog**, a product analytics service, in its **EU region**. There is no PostHog or other third-party analytics SDK inside the app, no device fingerprinting and no advertising identifier.

**Opt out at any time** in the app: Profile, then Privacy, then switch off product analytics. Opting out stops both the recording and the forwarding. The legal basis is our legitimate interest in understanding and improving the product; you can object by using the switch.

## 5. The community

The community is where members support each other. What you post there (posts, comments, reactions) is visible to other members under the name you chose. Your journey, your health data and your photos are **not** visible to anyone unless you explicitly choose to show a figure (for example your current program or the trend of the current period) on your public card. You can change that at any time in Profile, under Community privacy.

To keep the community safe we use **automated moderation**: new posts and comments are checked by an AI model before they are shown, and content that is hateful, harassing, glorifies disordered eating, gives medical dosing advice or otherwise breaks the rules is held back or removed. The check is run for us by Anthropic (see section 6): it receives the text of the post or comment only, never your name, your account id, your email or anything from your journey, and it does not keep the text to train its models. If the check cannot run at that moment, the content is shown and checked again later. A person reviews reports and appeals. Report and block controls are on every post and profile. When you block someone, they no longer see your content and you no longer see theirs. The legal basis for moderation is our legitimate interest in keeping the community safe, and the contract with you.

Credits are a community mechanic: you earn them by taking part, never by losing weight, and give them to support others. They have no monetary value.

## 6. Who helps us process your data

We use a small number of service providers ("processors"), each bound by a data processing agreement to process data only on our instructions. We never give them more than they need.

| Processor | What it does for us | What it sees | Where |
|---|---|---|---|
| **Supabase** | Database, authentication, file storage for non-photo data, and the server functions the app talks to. | All account, profile, health, community, analytics and push data described above. | EU (the European Union (Frankfurt, eu-central-1)) |
| **Resend** | Sends our transactional email: sign-in codes and links, account notices, replies from support. | Your email address and the content of those emails. | EU data region for sending; the company is based in the United States |
| **Sentry** | Crash and error reporting. | Technical crash reports with a pseudonymous id. No health values, no content. | EU region |
| **PostHog** | Product analytics dashboards, fed by our server, not by the app. | The pseudonymous event records of section 4. | EU region |
| **Anthropic** | Automated moderation of new community posts and comments (section 5). | Only the text of the post or comment being checked. No name, no account id, no email, no health data from your journey. | United States, under Standard Contractual Clauses and the EU-US Data Privacy Framework |
| **RevenueCat** | Keeps Undiet Plus in sync with the App Store and Google Play. | A pseudonymous subscriber id and the subscription status, product and dates. Never your card. | United States, under Standard Contractual Clauses |
| **Apple** | App Store distribution, in-app purchase billing, Sign in with Apple, push notification delivery (APNs). | What Apple needs for those services, under Apple's own terms. For purchases and your Apple account, Apple is an independent controller. | Apple's infrastructure |
| **Google** | Google Play distribution and billing, Sign in with Google, push notification transport (Firebase Cloud Messaging), on-device ML Kit for photo segmentation on Android. | What Google needs for those services, under Google's own terms. Firebase Cloud Messaging carries notifications and sees the device token; it does not see your journey. ML Kit runs on the device. For purchases and your Google account, Google is an independent controller. | Google's infrastructure |

Our own servers and database are in the EU. Where a processor is based outside the EU (RevenueCat, Anthropic, and Resend's company), transfers are covered by the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards at undiet@krnic.be.

## 7. If you used the earlier Undiet (before version 2.0)

Undiet 2.0 runs on a new backend. The earlier app kept accounts and entries in a Firebase database (Google). When you sign in to 2.0 with the same email address, the app **imports your earlier entries** (weigh-ins, logs and profile) into your new account, so your history is not lost. The import reads from the legacy database only; nothing new is written there. We keep the legacy copy only for as long as the migration runs and then delete it. You can also ask us to delete your legacy data right away at undiet@krnic.be.

## 8. How long we keep things

- **Your account and journey:** until you delete them. There is no automatic expiry.
- **Deleted data:** removed from the live database immediately when you close your account, and from encrypted backups within **30 days**.
- **Community content:** deleted with your account. A removed post that was reported may be kept, without your name, for as long as needed to handle the report and any legal obligation.
- **Analytics events:** kept in pseudonymous form for up to 24 months, then aggregated or deleted. Deleted with your account id when you close your account.
- **Crash reports:** 90 days.
- **Support emails:** 24 months after the last message, so we can follow up.
- **Subscription records:** for as long as the law on accounting and tax requires, held by Apple, Google and our billing provider.
- **Legacy (pre-2.0) data:** for the duration of the migration period, then deleted.

## 9. Your rights

Under the GDPR you can:

- **Access and export.** Open Profile, then Account, then **Export my data**. The app gives you a file with everything we hold about you (photos are not included because we do not have them). You can also ask us by email.
- **Correct.** Edit your profile and entries in the app, or ask us.
- **Delete.** Open Profile, then Account, then **Close your account**. This deletes your account and everything in it, immediately and irreversibly, on our servers; the app then clears its local data. Details and an email fallback: [https://undiet.krnic.be/delete-account](https://undiet.krnic.be/delete-account).
- **Withdraw consent** for health data, at any time (section 2), and **opt out** of analytics (section 4).
- **Object** to processing based on legitimate interest, and **restrict** processing while we look into a request.
- **Portability.** The export is a machine readable file you can take elsewhere.
- **Complain.** You can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, GBA/APD), [https://www.dataprotectionauthority.be](https://www.dataprotectionauthority.be), or with the supervisory authority where you live.

We answer requests within one month. Write to **undiet@krnic.be** from the email address of your account, or sign in and use the tools in the app.

We make **no automated decisions** about you with legal or similarly significant effects. The moderation described in section 5 is automated, but a person reviews reports and appeals, and nothing in the app decides anything about your health.

## 10. Children

Undiet is for people aged **16 and over**. We do not knowingly create accounts for, or process the data of, anyone younger. If you believe someone under 16 is using the app, tell us at undiet@krnic.be and we will delete the account.

## 11. Security

Data travels encrypted (TLS) and is stored encrypted at rest. Access to the database is restricted with row level security, so the app can only read and write the rows that belong to the signed-in account. Server functions that delete or export an account check your identity with your own session token. Photos never leave the device. We keep the number of people and services with access as small as we can.

No system is perfectly secure. If we ever learn of a breach that affects your data, we will inform you and the authority as the law requires.

## 12. Changes to this policy

We will update this page and the effective date when something material changes, and tell you in the app before new processing starts. The app records which version of this policy you accepted.

## 13. Contact

- **Controller:** Krnic CommV, Gent, Belgium. Enterprise number: [Belgian enterprise number (KBO/BCE), to be completed].
- **Privacy and support:** undiet@krnic.be
- **Studio:** info@krnic.be
- **Supervisory authority:** Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, GBA/APD), [https://www.dataprotectionauthority.be](https://www.dataprotectionauthority.be)

See also the [Terms of Use](https://undiet.krnic.be/terms), [how to delete your account](https://undiet.krnic.be/delete-account) and [Support](https://undiet.krnic.be/support).