Privacy Policy

Effective date: October 21, 2026 · Dynamic Vision Works

1. Introduction

Welcome to ThaliFit (the “App”), a food and fitness coaching application for Indian, Gulf and global cuisines, developed and operated by Dynamic Vision Works (“we,” “our,” or “us”). This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use ThaliFit on Android and iOS devices.

By creating an account or using ThaliFit, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

Contact: For any privacy-related inquiries, please email us at privacy@thalifit.com.

2. Information We Collect

2.1 Account & Identity Information

  • Phone number: used for SMS OTP authentication via Firebase Authentication.
  • Google account details: name, email address, and profile photo when you sign in with Google.

2.2 Personal & Health Profile

When you set up your profile and goals, we collect:

  • Full name, age, and gender
  • Height, weight, waist measurement, target weight, and estimated time to goal
  • Diet type, food preferences, allergies, and regional cuisine preferences
  • Activity level, gym frequency and intensity, sports activities, and daily walk/run minutes
  • Goal type (weight loss, gain, maintenance, or other)
  • Units preference (metric or imperial)

2.3 Daily Activity & Nutrition Logs

  • Nutrition logs: meals with macronutrient breakdowns (calories, protein, carbs, fat, fiber, sodium), health scores, timestamps, logging source (photo, manual, or menu scan), and optional food images.
  • Exercise logs: activity type, category, duration, intensity, calories burned, and notes.
  • Workout plans and logs: exercises, sets, reps, weights, and session history from the workout planner and logger.
  • Kaya coaching conversations: messages you send to Kaya, Kaya’s replies, and the coaching notes shown in the App.
  • Steps and calories: optionally synced from Apple Health (iOS) or Google Health Connect (Android). This data is read-only and syncing is entirely optional.

2.4 Device & App Data

  • Push notification token (for meal reminders and streak alerts)
  • Notification preferences and meal timing patterns
  • Streak data and app usage patterns
  • Theme and UI preferences
  • Local caches stored on your device (meal plan cache, recent foods, menu preferences, insights cache)

2.5 Analytics Data

We collect app usage analytics through Firebase Analytics, including:

  • App events such as sign-up, login, meal logged, goal set, profile completion, and screen views
  • User properties including Firebase user ID, diet type, and age group (stored as bucketed ranges such as 18–24, 25–34, etc., not exact age)
  • Onboarding funnel completion steps

2.6 Subscription Data

  • Subscription status, plan, free trial status, purchase and renewal dates, and an app user ID, processed by RevenueCat to manage your subscription.
  • We do not receive or store your card or payment details. Payments are handled entirely by Apple or Google.

2.7 Advertising Measurement Data

  • We use the Meta (Facebook) SDK to measure our advertising. It records app events such as install, app open, free trial start, and subscription purchase, along with basic device information.
  • On iOS, the device advertising identifier is only used if you allow tracking when the App asks. On Android, the advertising identifier can be reset or deleted in your device settings.
  • We do not share your meals, body measurements, health data, workouts, or Kaya conversations with Meta.

3. How We Use Your Information

We use the information we collect to:

  • Provide and personalise the core App experience, including AI-assisted food logging, calorie and macro tracking, meal planning, workout planning, and portion guidance
  • Provide Kaya, the in-app AI coach, which uses your profile, meals, workouts, and activity to give suggestions and answer your questions
  • Generate personalised daily calorie and macronutrient targets based on your profile and goals
  • Deliver AI-powered food analysis when you scan meals or restaurant menus
  • Create weekly meal plans and Indian recipe suggestions tailored to your preferences
  • Send push notifications for meal reminders, streak alerts, coaching check-ins from Kaya, and relevant updates
  • Sync health data (steps and calories) from Apple Health or Google Health Connect when you opt in
  • Analyse app usage patterns to improve features, fix issues, and enhance the user experience
  • Manage subscriptions and free trials
  • Measure the performance of our advertising
  • Prevent fraud and ensure App security through Firebase App Check

4. How We Share Your Information

We do not sell your personal data to any third party.

We share information only with the following service providers who process data on our behalf to operate the App:

4.1 Firebase (Google)

  • Firebase Authentication: phone OTP and Google Sign-In processing
  • Cloud Firestore: storage of user profiles, logs, and preferences
  • Firebase Realtime Database: real-time job states (e.g., weekly meal planner)
  • Firebase Storage: food images you upload
  • Firebase Cloud Functions: server-side processing for AI food analysis and notifications
  • Firebase Analytics: aggregated app usage analytics
  • Firebase App Check: fraud prevention via Play Integrity (Android) and DeviceCheck (iOS)

4.2 OpenAI

We use OpenAI’s API exclusively on the server side (via Firebase Cloud Functions) to power AI food analysis, meal and workout planning, and Kaya coaching. Your food images and meal data are sent to OpenAI for processing. When you use Kaya, your messages and the relevant parts of your profile, nutrition, workout, and activity data are also sent to OpenAI to generate a response. Under OpenAI’s API terms, data sent through the API is not used to train OpenAI’s models by default. OpenAI’s API keys are never exposed to the App directly.

4.3 Expo

We use Expo services for push notification delivery, over-the-air app updates, and device location detection (country/region only, for food localisation).

4.4 Apple Health & Google Health Connect

If you choose to connect, we read step count, active calories burned, and basal calories burned. This data is read-only and is never shared with any third party beyond what is described in this policy.

4.5 RevenueCat

We use RevenueCat to manage subscriptions and free trials. RevenueCat receives your app user ID and subscription and purchase information from Apple or Google. It does not receive your health, nutrition, or workout data.

4.6 Meta (Facebook)

We use the Meta SDK to measure the performance of our ads, as described in section 2.7. Meta does not receive your meals, body measurements, health data, workouts, or Kaya conversations.

We may also disclose your information if required by law, legal process, or governmental request, or to protect our rights, privacy, safety, or property.

5. Permissions We Request

The App requests the following device permissions, each for a specific purpose:

5.1 Android Permissions

  • Camera: food photo logging and menu scanning.
  • Storage (Read/Write): accessing food images for logging.
  • Location (Fine and Coarse): detecting your country/region for food localisation and regional cuisine suggestions.
  • Health Connect (Steps, Active Calories, Total Calories): optional syncing of health data.
  • Notifications: meal reminders, streak alerts, and coaching check-ins.
  • Advertising ID: ad measurement through the Meta SDK.

5.2 iOS Permissions

  • Camera: food photo logging and menu scanning.
  • Photo Library: selecting food images from your library.
  • Location (When In Use): country detection for regional food suggestions.
  • HealthKit (Steps, Active Energy, Basal Energy): optional syncing of health data from Apple Health.
  • Notifications: meal reminders, streak alerts, and coaching check-ins.
  • App Tracking Transparency: asks whether we may use your device’s advertising identifier to measure ads. Declining does not affect any feature.

6. Data Storage and Security

Your data is stored on Firebase infrastructure. Our Firebase Cloud Functions are hosted in the europe-west1 (EU) region. If you are located outside the EU (including India), your data may be transferred to and processed in the EU. By using the App, you consent to this cross-border transfer of data.

We implement appropriate technical and organisational measures to protect your personal information, including:

  • Encrypted data transmission (HTTPS/TLS) for all communications between the App and our servers
  • Firebase Authentication with secure session management
  • Server-side API key management (OpenAI keys are never exposed to the App)
  • Firebase App Check for request validation and fraud prevention

Local data on your device (AsyncStorage) includes cached meal plans, recent foods, notification data, and preferences. Firebase Authentication sessions are stored in the iOS Keychain or Android’s secure storage as managed by the Firebase SDK.

7. Data Retention and Deletion

We retain your personal data for as long as your account is active or as needed to provide the App’s services. You may request deletion of your account and all associated data at any time by contacting us at privacy@thalifit.com.

Upon receiving a verified deletion request, we will:

  • Delete your user profile, nutrition logs, exercise logs, workout plans, meal plans, Kaya conversations, and food images from our servers
  • Remove your push notification token and preferences
  • Remove your analytics user properties

We act on deletion requests within 7 days and complete deletion from our servers within 30 days. Deleting your account does not cancel an App Store or Google Play subscription; cancel it in your store’s subscription settings. Purchase records held by Apple, Google, and RevenueCat are kept as required for billing and legal purposes.

Please note that local data stored on your device (AsyncStorage caches) must be cleared by uninstalling the App. Some anonymised, aggregated analytics data may be retained for service improvement purposes.

8. Children’s Privacy

ThaliFit is intended for users aged 18 and above. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have collected data from a minor, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@thalifit.com so we can take appropriate action.

9. Your Rights

Depending on your location and applicable laws — including Oman’s Personal Data Protection Law (Royal Decree 6/2022), India’s Digital Personal Data Protection Act 2023, and the EU General Data Protection Regulation — you may have the following rights regarding your personal data:

  • Access: request a copy of the personal data we hold about you.
  • Correction: request that we correct inaccurate or incomplete data.
  • Deletion: request deletion of your personal data and account.
  • Data Portability: request a copy of your data in a structured, machine-readable format.
  • Withdraw Consent: withdraw your consent to data processing at any time (for example, disconnecting Apple Health or Google Health Connect).
  • Object: object to certain types of data processing where applicable.

To exercise any of these rights, please contact us at privacy@thalifit.com. We will respond to your request within 30 days.

10. Third-Party Links

The App may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

11. Health Data Handling

ThaliFit accesses health data exclusively through Apple HealthKit (iOS) and Google Health Connect (Android). This access is:

  • Read-only: we only read step count, active calories burned, and basal calories burned
  • Optional: health data syncing is prompted during onboarding and can be disabled at any time through your device settings
  • Private: health data is used solely within the App to show your activity, balance your meal and workout plans, and inform Kaya’s suggestions. It is never shared with advertisers or data brokers, and is never used for advertising

User-entered health data (weight, height, age, and goals) is stored in our Firebase database and is subject to the same security and retention practices described in this policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you through the App or by other appropriate means before the changes take effect.

We encourage you to review this Privacy Policy periodically. Your continued use of ThaliFit after any changes constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Dynamic Vision Works

Email: privacy@thalifit.com

Website: https://thalifit.com

This privacy policy was last updated on October 21, 2026.