BoraFit

Legal

Privacy Policy

Effective May 13, 2026

BoraFit ("BoraFit", "we", "us") is a nutrition and weight-tracking app. This policy explains what data we collect, why, how we protect it, and what choices you have. We try to keep this short and plain.

1. Information we collect

We collect only what BoraFit needs to do its job. That covers four categories:

  • Account information. When you sign up, our auth provider (Clerk) stores your name, email address, and (if you sign in with Google) a unique Google account identifier. We do not receive or store your Google password.
  • Health and fitness data you log. Body weight, height, sex, date of birth, activity level, food log entries (including the foods, portions, dates, and any photos you upload), water intake, and any goals or strategies you set in the app.
  • Google Health data, if you connect it. When you authorize BoraFit to read from Google Health, we receive weight readings (and optionally body-fat readings) associated with your Google account. See Section 4 for the specific rules that apply to this data.
  • Product analytics and session replay. We use PostHog to record anonymized events and session replays (interactions, clicks, page views) so we can understand how the app is used and fix bugs. Replays mask password fields and any element we tag as sensitive.

2. How we use your information

  • To operate the core features of BoraFit (logging food, tracking weight, computing macro targets, suggesting AI-parsed meals).
  • To sync your weight readings from Google Health into your BoraFit history when you choose to connect that integration.
  • To improve the app: diagnose crashes, measure feature usage, prioritize improvements.
  • To send you essential service notifications (e.g. account changes). We do not send marketing email.
  • To comply with legal obligations and protect against fraud or abuse.

We do not sell your personal data. We do not use your health data to target advertising. We do not allow advertisers on BoraFit.

3. Artificial intelligence features

BoraFit uses Google's Gemini AI to interpret typed meal descriptions and photos of meals into structured nutrition data. When you use these features:

  • The text you type and the photo you upload are sent to Google's Gemini API for processing.
  • We do not send your name, email, or other identifying account information along with these requests.
  • Google's handling of this data is governed by their API terms; we use Gemini configured for the lowest available data retention.
  • The structured output (the food entries Gemini suggests) is stored only if you choose to log it.

4. Google user data

If you choose to connect Google Health, BoraFit requests access to the googlehealth.health_metrics_and_measurements.readonly scope. This scope allows BoraFit to read body weight and body composition measurements from your Google account. We do not write to your Google account, and we do not request any other Google scopes for the Health integration.

BoraFit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely, that means:

  • Google Health data is used only to provide and improve user-facing features visible inside the BoraFit app.
  • We do not transfer this data to third parties except as needed to provide the service, or for security purposes, or to comply with applicable law.
  • We do not use this data to serve advertising.
  • We do not allow humans to read this data unless we have your explicit consent, it is necessary for security or fraud-prevention purposes, it is required by law, or the data has been aggregated and anonymized.

You can disconnect Google Health at any time from your BoraFit weight page, or revoke access directly from your Google Account permissions page. When you disconnect, we stop fetching new readings; previously imported readings remain in your BoraFit history unless you delete them.

5. Who processes your data on our behalf

BoraFit is a small operation. We rely on these processors to run the service. Each is bound to handle your data only on our instructions:

  • Cloudflare — application hosting, edge compute (Workers), and database (D1).
  • Clerk — user authentication and session management.
  • Google (Gemini) — AI parsing of meal text and photos when you use those features.
  • Google (Health API) — only if you connect Google Health to BoraFit.
  • PostHog — product analytics and anonymized session replay.
  • Open Food Facts and USDA — public food databases used to look up nutrition values. We send the barcode or search term you provide, and they return public nutrition data. They do not receive your identity.

6. Where your data is stored

Your data is stored on Cloudflare's distributed infrastructure, primarily within Cloudflare's network of edge data centers. Data may be processed in any country where our processors operate. By using BoraFit you consent to this international processing. We rely on standard contractual clauses and equivalent safeguards where required.

7. How long we keep your data

We keep your data for as long as your account is active. If you delete your account, we delete the personal data tied to it within 30 days, except where we are legally required to retain it. Aggregated, fully anonymized analytics may be retained indefinitely because it can no longer be linked to you.

8. Security

We use industry-standard security practices: TLS encryption for all traffic, encryption at rest in our database, OAuth-based access tokens (we never see your Google password), and least-privilege access controls. No system is perfectly secure, and we cannot guarantee absolute protection against every possible threat.

9. Your rights

Depending on where you live, you may have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Delete your data ("right to be forgotten"). You can delete your account from inside the app, or by emailing the address below.
  • Object to or restrict certain processing.
  • Export your data in a portable format.
  • Withdraw consent at any time (for example, by disconnecting Google Health).
  • Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at the email below. We will respond within 30 days.

10. Children

BoraFit is not directed to children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this policy as the product evolves. When we make material changes, we will update the "Effective" date at the top and (where appropriate) notify you inside the app or by email. Continued use of BoraFit after a change means you accept the updated policy.

12. Contact

Questions about this policy, or requests under your data rights: mauscoelho@gmail.com.