LeanFastPrivacy policy
Last updated: 2 October 2026 · First issued: 30 September 2026
- LeanFast works fully on your iPhone without an account. Most of your data never leaves the device.
- Food photos and progress photos are processed on the device and never uploaded.
- If you choose to create an account, your fasting data is synced to servers in the EU (Frankfurt).
- No advertising, no ad identifiers, no third-party analytics or tracking SDKs. We never sell your data.
- You can export your data or delete your account at any time in the app.
Contents
- Who is responsible
- What data we process
- Purposes, legal bases and retention
- Health data
- On-device processing
- Apple Health
- Service providers and partners
- Transfers outside the EU
- Cookies and tracking
- Children
- Do you have to provide data?
- Your rights
- Security
- Changes to this policy
1. Who is responsible
The controller responsible for processing your personal data under the EU General Data Protection Regulation (GDPR) is:
Anis Chebbi
08022 Barcelona, Spain
Email: support@lean-fast.com
We are not required to appoint a Data Protection Officer (Art. 37 GDPR). Please send all privacy questions and requests to the email address above.
2. What data we process
Stored only on your device
- Profile answers: age, sex, height, weight, goal weight, goal, activity level, fasting experience, wake and sleep times, safety-check answers.
- Your plan and history: program, weekly schedule, fasts, water, weight and food logs, streaks.
- Progress photos: these stay on your device only and are never synced or uploaded.
- Emergency contact: if you add one for the "I don't feel well" screen, the name and number are stored on this iPhone only. They are never synced.
- Photos you scan with Lens: analysed on the device and discarded. Only the resulting food entry is kept, if you log it.
Only if you create an account
- Account data: your email address (or the identifier from Google or Apple if you sign in that way), account ID, and sign-in timestamps.
- Synced data: the profile answers, plan and history listed above, excluding progress photos and scanned photos.
- Technical data: IP address and device/app information that our hosting provider logs when the app connects, for security and abuse prevention.
Purchases
Payments are handled entirely by Apple. We never receive your payment details. The app only learns whether a LeanFast Prism subscription or purchase is active on your Apple ID.
When you contact us
Your email address and whatever you write to us. If you write from the app (Settings › Help & support), the email is pre-filled with details that help us answer: app version, device model, iOS version, language and region, whether you use Prism or have an account, which program you follow, whether reminders are on, and whether an Apple Watch is paired. You see all of it before sending and can delete any of it. It never includes your name, weight or health data.
When you visit this website
Our web host processes your IP address and browser information in server logs to deliver the site and protect it from attacks.
3. Purposes, legal bases and retention
| Purpose | Data | Legal basis | Kept until |
|---|---|---|---|
| Provide the app's features on your device | Profile, plan, history | Contract (Art. 6(1)(b)); for health data, explicit consent (Art. 9(2)(a)) | You delete it in the app or delete the app |
| Create your account and sign you in | Email or sign-in identifier, account ID | Contract (Art. 6(1)(b)) | You delete your account |
| Back up and sync across devices | Synced data | Contract (Art. 6(1)(b)); for health data, explicit consent (Art. 9(2)(a)) | You delete the item or your account. Items you delete are removed from the cloud at the next sync |
| Look up a product by barcode | Barcode number, IP address (seen by Open Food Facts) | Contract (Art. 6(1)(b)) | Not stored by us |
| Manage your Prism subscription | Purchase status from Apple | Contract (Art. 6(1)(b)) | While the entitlement is active |
| Security, abuse prevention, server logs | IP address, technical data | Legitimate interest (Art. 6(1)(f)): keeping the service secure and available | Rolling logs, typically deleted within 30 days |
| Answer your messages | Email, message content, and the app and device details you choose to send | Legitimate interest (Art. 6(1)(f)): responding to your request; or contract where it concerns your account | Up to 2 years after the conversation ends |
| Legal obligations (e.g. tax records for purchases, where applicable) | As required | Legal obligation (Art. 6(1)(c)) | As required by law |
When you delete your account, your account and all synced data are deleted immediately. Encrypted backups kept by our hosting provider are overwritten on a rolling basis and may take a short time to expire.
4. Health data
Weight, eating patterns and some safety-check answers (for example pregnancy or a history of disordered eating) are health data, a special category under Art. 9 GDPR. We process them only to give you a safe and personal plan, based on your explicit consent, which you give by entering them. You can withdraw consent at any time by deleting the data or your account. This does not affect processing that happened before. We never use health data for advertising and never share it with third parties other than the processors listed below, who handle it only on our instructions.
5. On-device processing
Text recognition on nutrition labels, barcode detection, meal recognition and written advice run on your iPhone using Apple's frameworks, including Apple Intelligence where your device supports it. This processing happens locally. Neither we nor Apple receive the images for this purpose. See Apple's Apple Intelligence privacy information.
5a. Apple Health
If you connect Apple Health (it's off by default), LeanFast reads your height, weight, step count and sleep times to fill in your profile, suggest an activity level and keep your weight chart up to date. It saves the weight and water you log in LeanFast to Health. You choose each data type in Apple's permission screen and can change it at any time in the Health app › Sharing › Apps.
Data from Apple Health is used only to provide LeanFast's features to you. It is never used for advertising, marketing or data mining, never sold, and never shared with third parties. It is not stored in iCloud by LeanFast. Weigh-ins imported from Health become part of your LeanFast history on your device. If you've created an account, they're synced to your account like any other weight entry (see section 6.1), so they're available on your other devices.
Apple Watch
The LeanFast Watch app exchanges your current fast, today's eating window and water directly with your iPhone over Apple's WatchConnectivity. This data doesn't pass through our servers. On the Watch it is stored only on the device.
6. Service providers and partners
We share data only with the providers below, grouped by what they do. Processors act on our instructions under a data processing agreement. Each link leads to that provider's own privacy policy.
6.1 Accounts, database and hosting
| Provider | What it does | Data | Where | Privacy policy |
|---|---|---|---|---|
| Supabase, Inc. | Sign-in and database for account and sync | Account data, synced data, technical data | EU (Frankfurt, Germany) | supabase.com/privacy |
6.2 Sign-in providers (only if you choose them)
| Provider | What it does | Data | Where | Privacy policy |
|---|---|---|---|---|
| Google Ireland Ltd. / Google LLC | Sign in with Google | Name, email, Google account identifier | EU / USA | policies.google.com/privacy |
| Apple Inc. / Apple Distribution International Ltd. | Sign in with Apple | Email (or a private relay address), Apple identifier | EU / USA | apple.com/legal/privacy |
6.3 Email delivery
| Provider | What it does | Data | Where | Privacy policy |
|---|---|---|---|---|
| Resend (Plus Five Five, Inc.) | Sends your 6-digit sign-in codes | Email address, email content | EU (Ireland) / USA | resend.com/legal/privacy-policy |
| Apple Distribution International Ltd. (iCloud Mail) | Receives and stores the emails you send to support@lean-fast.com | Email address, message content | EU (Ireland) / USA | apple.com/legal/privacy |
6.4 Payments
| Provider | What it does | Data | Where | Privacy policy |
|---|---|---|---|---|
| Apple (App Store) | Processes subscriptions and purchases as the merchant of record | Purchase and billing data, handled by Apple | EU / USA | apple.com/legal/privacy |
6.5 Food data
| Provider | What it does | Data | Where | Privacy policy |
|---|---|---|---|---|
| Open Food Facts (association, France) | Product lookup when a barcode isn't in the built-in database. Open Food Facts is an independent recipient, not our processor | Barcode number, IP address | EU (France) | world.openfoodfacts.org/privacy |
6.6 Website
| Provider | What it does | Data | Where | Privacy policy |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosts and protects this website and routes support email | IP address, browser data, emails sent to our support address | Global network | cloudflare.com/privacypolicy |
We don't use analytics, advertising, attribution or crash-reporting SDKs in the app. If that ever changes, we'll add the provider here before it goes live.
7. Transfers outside the EU
Your synced data is stored in the EU. Some of the providers above are US companies, or have US parent companies, and may access data from the USA, for example for support or security. We only allow such transfers where the European Commission has found an adequate level of protection, including under the EU–US Data Privacy Framework for certified companies, or where the provider has agreed to the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of the relevant safeguards.
8. Cookies and tracking
This website doesn't set cookies. It stores one setting in your browser's local storage, your preferred currency on the pricing section, and that setting never leaves your device. The app doesn't use the advertising identifier (IDFA), doesn't track you across other companies' apps or websites, and never asks for tracking permission because it doesn't need it.
9. Children
LeanFast is for adults. It is not intended for anyone under 18, and the in-app safety check doesn't create fasting plans for them. If you believe a child has created an account, contact us and we'll delete it.
10. Do you have to provide data?
No. You are not legally or contractually required to give us any personal data. Without an account, everything stays on your device. Some features need certain data to work. For example, the plan needs your height and weight, and sync needs an account.
11. Your rights
Under the GDPR you have the rights listed below. Most of them take one tap in the app:
- Access and portability (Art. 15, 20): Settings › Export my data gives you a JSON file of your data.
- Erasure (Art. 17): Settings › Delete account removes your account and synced data. Settings › Delete all data clears this device.
- Rectification (Art. 16): edit your details directly in the app.
- Restriction (Art. 18) and objection (Art. 21) to processing based on legitimate interest: email us.
- Withdraw consent (Art. 7(3)): delete the data concerned. This takes effect for the future.
- Complain to a data protection supervisory authority. Ours is the Spanish Agencia Española de Protección de Datos (AEPD). You can also contact the authority in the EU country where you live or work, which you can find on the European Data Protection Board's list of members.
For anything else, email support@lean-fast.com. We reply within one month, as the law requires.
12. Security
Data travels over encrypted connections (TLS). On our servers, row-level security means each account can read and change only its own records. Sign-in uses one-time codes instead of passwords, so there is no password to leak. No system is perfectly secure, but we keep the data we hold to a minimum.
13. Changes to this policy
If we change how we handle your data, we'll update this page and its date. For significant changes, we'll also tell you in the app before they apply.