Privacy Policy

The short version

• You do not have an account. Profast never asks for your name, email address or phone number, and there is no sign-up screen.
• Your fasting history, weight log and food log stay on your device. They are not uploaded to us.
• What does leave your device is limited to three things: what you post inside a fasting group you chose to join, a meal photo at the moment you ask the AI to read it, and anonymous app-usage and advertising measurement.
• We do not sell your data, and we never use Apple Health data for advertising or marketing.

1. Identity — there is no account

Profast signs your device in to Firebase Authentication anonymously. That produces a random identifier tied to the app on this device. It is not linked to your name, your email address, your Apple ID or any other real-world identity, and we have no way to look you up.

If you delete the app and reinstall it, you get a new anonymous identifier and the old one is orphaned.

2. What stays on your device

The following never leaves your phone. It is stored in the app's own local storage and, in some cases, in Apple Health if you granted that permission:

• Your fasting sessions — start time, end time, protocol, streak
• Your weight entries and water intake
• Your food log and manual calorie entries
• Your goals, reminders and app settings
• Your location (see §5)

Deleting the app deletes all of it. We hold no copy.

3. What leaves your device, and why

3.1 Fasting groups and the leaderboard

Profast lets you join a shared fasting group with other people. This is a social feature, so it necessarily involves a server. If — and only if — you join or create a group, the following is written to Google Firestore:

• The display name you typed for yourself in that group
• Your fasting status within that group (whether you are fasting today, whether you completed the fast, exemption days you marked)
• Messages and cheers you send inside the group
• Your position on the group leaderboard

Everyone in that group can see this. If you never join a group, nothing in this section applies to you and no such data is created.

3.2 AI meal photo scanning

When you point the camera at a plate and ask Profast to estimate its calories, the photo is sent — over an encrypted connection, through our Firebase Cloud Function — to OpenAI, which returns an estimate of the food and its macros.

• The photo is sent only at the moment you take it and press scan. Profast does not scan your camera roll and does not upload photos in the background.
• We do not store the photo. Our function passes it through and keeps no copy.
• OpenAI processes it under its API terms. OpenAI states that data submitted through its API is not used to train its models.
• Only the resulting text estimate — “chapati, 2 pieces, 210 kcal” — comes back to your device, and that estimate is stored locally.

3.3 Barcode scanning

When you scan a product barcode, the barcode number alone is sent to the Open Food Facts database to look up the product. No personal data accompanies it.

3.4 Push notifications

If you allow notifications, Firebase Cloud Messaging issues a device token so we can send you fasting reminders and group activity alerts. The token identifies the device installation, not you.

4. Apple Health

If you grant permission, Profast reads the following from Apple Health so your dashboard can show a complete day:

• Steps, active energy burned, exercise minutes
• Sleep analysis
• Dietary energy, protein, fat and water already logged by other apps

And writes the following:

• Body weight and water intake you log in Profast
• Each completed fast, recorded as a Mindfulness session — Apple Health has no fasting category, and this is the closest one it offers. You can turn this off in Profast's settings.

We make three commitments about Health data, and they are absolute:

1. Health data is read and used on your device only. It is never transmitted to our servers, to our analytics providers, or to anyone else.
2. Health data is never used for advertising, marketing, or any use-based data mining, and is never shared with data brokers.
3. Health data is never sold.

You can revoke Health access at any time in the iOS Settings app under Privacy & Security → Health → Profast. Profast keeps working without it.

5. Location

Profast asks for “While Using the App” location for one purpose: computing accurate Sehri and Iftar times during Ramzan, which depend on the real sunrise and sunset where you are.

• It is a single fetch, taken once when you activate the Ramzan feature, and cached. There is no continuous tracking.
• The coordinates are used on your device to calculate sunrise and sunset. They are never transmitted to us or to any third party.
• If you decline, everything else in the app works; you enter your city's times manually.

Separately, and regardless of whether you grant location permission: our analytics and attribution providers see the IP address of your connection, as any internet service does, and can resolve it to an approximate country or region. That is a much coarser thing than your GPS position, but it is honest to say it happens.

6. Calendar, Reminders and Photos

• Calendar — if you enable calendar sync, Profast reads your events to schedule fasts around them and can write fasting blocks back. This happens through Apple's EventKit on your device. Your calendar contents never leave your phone.
• Reminders — if you enable it, Profast imports your Apple Reminders into its Inbox and keeps them in sync, again entirely on your device.
• Photos — Profast only asks for permission to add to your photo library, so it can save a shareable progress card. It cannot read your photo library.

7. Analytics and advertising

This is the part most fasting apps describe vaguely. Here is exactly what happens.

7.1 Product analytics — PostHog

Profast uses PostHog to understand where new users get stuck in the setup flow. It records a small, fixed set of events:

• Which onboarding screen you reached, and whether you finished onboarding
• Whether the subscription screen was shown, and whether a purchase was completed

These events carry a randomly generated identifier created by PostHog on your device. We do not call PostHog's user-identification function, so these events are not tied to your anonymous Firebase identity or to anything else about you. Your fasting data, weight, food log and health data are not sent to PostHog. PostHog processes this on servers in the United States.

7.2 Attribution and advertising — AppsFlyer

Profast uses AppsFlyer to measure which advertising campaigns lead to installs, so we do not waste money on ads that do not work.

If — and only if — you tap “Allow” on the App Tracking Transparency prompt, AppsFlyer may access your device's advertising identifier (IDFA) and use it to link your install to an ad you saw, and to build audiences for our advertising. This is the “tracking” that Apple's prompt refers to, and it is the reason the prompt appears.

If you tap “Ask App Not to Track”, the IDFA is not accessed and no cross-app tracking takes place. Attribution then falls back to Apple's own privacy-preserving SKAdNetwork. You can change this decision at any time in iOS Settings → Privacy & Security → Tracking.

Data types AppsFlyer may receive: device advertising identifier (with consent), device model and OS version, IP address, install and app-open timestamps, and the purchase events listed below.

7.3 Subscriptions — RevenueCat

Purchases are processed by Apple. We never see your card details, and we never handle payment information of any kind. RevenueCat manages your subscription status on our behalf and receives the App Store transaction receipt and your anonymous identifier so it can tell the app whether your subscription is active. It is also given your AppsFlyer device identifier, so that a subscription can be attributed to the campaign that led to the install.

8. Who we share data with

Only the service providers listed above, each of which processes data on our instructions for the purpose stated:

We do not sell your personal data, and we do not share it with data brokers or advertising networks beyond the attribution use described in §7.2.

We may disclose information if we are legally required to, or to protect the rights and safety of our users.

9. International transfers

Profast is available worldwide, and the providers above operate servers in the United States and the European Union. Using the app means your data may be processed outside the country you live in, including in the United States. Where the GDPR applies, these transfers rely on Standard Contractual Clauses.

10. Retention

• Local data — kept until you delete it or delete the app.
• Group data in Firestore — kept while you are a member of the group; removed when you leave the group or erase your data.
• Meal photos — not retained by us.
• Analytics and attribution events — retained by those providers under their own retention schedules, typically no more than 24 months.

11. Your rights, and how to erase everything

Profast has an in-app erase. Open Settings → Delete My Data. It:

1. Removes your member record from every fasting group you joined,
2. Deletes your anonymous identity from our backend, and
3. Wipes every byte the app stored on your device, including the shared storage the widget and Live Activity read from.

The app then continues as a clean, empty install. This is immediate and cannot be undone.

Depending on where you live, you may also have the right to access, correct, port or object to the processing of your personal data — under the GDPR (Europe), the Digital Personal Data Protection Act, 2023 (India), or the CCPA (California). Because we hold no account and cannot identify you, the in-app erase is in practice the fastest route to all of them. For anything else, write to us at the address in §14.

12. Children

Profast is not directed at children under 13, and we do not knowingly collect data from them. Intermittent fasting is not appropriate for children, and the app is intended for adults. If you believe a child has provided us with data, contact us and we will delete it.

13. Changes

If we change how Profast handles data, we will update this page and change the date at the top. Material changes will be announced in the app.

14. Contact

Questions about this policy or your data:

• Email: hello@profastapp.com
• Website: https://profastapp.com

Appendix — Apple's “App Privacy” labels

For consistency with the App Store product page, these are the declarations this policy supports:

Data used to track you (only with your ATT consent)

• Identifiers → Device ID
• Usage Data → Product Interaction
• Purchases → Purchase History

Data linked to you

• Purchases → Purchase History
• User Content → Other User Content (group messages, only if you join a group)
• Identifiers → User ID (anonymous)

Data not linked to you

• Usage Data → Product Interaction (onboarding and paywall events)
• Diagnostics → Crash Data, Performance Data
• User Content → Photos or Videos (a meal photo, transiently, for AI scanning)
• Location → Coarse Location (resolved from IP by the analytics providers — not your device's GPS position, which never leaves the phone)

Data not collected

• Health & Fitness — read and written on device only, never transmitted
• Precise Location — used on device only, never transmitted
• Contact Info (including email address — the app has no sign-up and never asks for one), Contacts, Browsing History, Search History, Financial Info, Sensitive Info