LyteFast

Privacy Policy

Last updated: 20 October 2026

This Privacy Policy explains how LyteFast SASU ("LyteFast", "we", "us") handles personal data in the LyteFast apps for iPhone, iPad and Apple Watch, and for Android phones, tablets and Wear OS watches (together, the "App").

In short:

  • Your weight, food, fasting and activity logs are stored on your device. LyteFast has no user accounts and does not keep a copy of your logs on its servers.
  • The App contains no advertising, no tracking and no third-party analytics. We never sell your data.
  • Some features send data off your device so they can work: a meal photo or description you ask us to analyse, a barcode you scan, a photo you send for a Muscle Rating. Each is sent only when you use that feature, and only for it.
  • Apple Health and Health Connect are used only with your permission, only to show and record your own data, and that data never leaves your device through LyteFast.

1. Who Is Responsible for Your Data

LyteFast SASU
Registered in France
60 rue François 1er, 75008 Paris, France
Email: contact@lytefast.com

LyteFast is the data controller for the processing described in this policy. For any question or request about your data, write to contact@lytefast.com.

2. Data Stored Only on Your Device

The App stores the following on your device, and we do not receive it:

  • Your profile: the name you enter (optional), sex, age, height, start and target weight, goal, units, calorie budget, activity level and fasting plan;
  • Your logs: weigh-ins, meals and food entries, fasts, activities, streak, and the notes and preferences you set;
  • Your settings and reminders.

Your phone and your watch exchange a summary of this data (current weight and goal, the current fast, today's totals) and the actions you take on the watch. This exchange runs directly between your own devices, through Apple's Watch Connectivity on iPhone and Google's Wearable Data Layer (part of Google Play services) on Android.

This data stays until you delete it in the App or uninstall the App. Your device's own backups (iCloud or Google backup) may include it, under your settings and the provider's policy.

3. Data Sent off Your Device, and Why

Data is sent only when you use the feature that needs it:

  • AI meal photo scan: the photo you take or choose is uploaded to our cloud storage (Cloudflare R2) through our server (hosted on Fly.io) and analysed by OpenAI to estimate the food, calories, macronutrients, carbon footprint (CO₂e) and gluten content.
  • Text meal estimate: the description you type is sent through our server to OpenAI for the same estimate.
  • Barcode scan: only the barcode number is sent to Open Food Facts, an open food database, to look up the product. On Android, the barcode is read on your device by Google's ML Kit, which may send Google diagnostic information about its own use.
  • Muscle Rating: the photo you choose is sent through our server to xAI (the Grok model) to rate muscle groups. Please send only photos of yourself.
  • Body preview: your height, current and target weight and sex, and any photo you choose to add, are sent to our server to prepare the preview.
  • Reviewer code: if you enter one, the code is sent to our server to check it.

We use this data only to give you the result you asked for. We do not use it for advertising or profiling, we do not combine it with other data about you, and it is not linked to an account (the App has none). Our server passes each request to the provider named above and returns the result; uploaded photos and requests are kept only as long as needed to process them and to keep the service secure and working. OpenAI and xAI process this data as our service providers under their API terms.

Legal basis: performance of our contract with you, since you ask for the feature (Article 6(1)(b) GDPR). When a photo or an entry reveals information about your health, we process it on the basis of your explicit consent (Article 9(2)(a) GDPR), which you give by choosing to use the feature and can withdraw at any time by not using it.

4. Health Data: Apple Health and Health Connect

If you allow it, the App reads and writes health data on your device: on iPhone, your weight, your height (read only), the calories, protein, carbohydrates and fat you eat, and your active energy in Apple Health. On Android, it only writes: it saves your weigh-ins to Health Connect and does not read any data from it. You choose which data types to share, and you can change or withdraw this at any time in the Health app or in Health Connect's settings.

We use this data only to show and record your own data in the App. It is not sent to our servers or to any AI provider, not used for advertising or marketing, not sold, and not shared with any third party.

Use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. Data from Apple HealthKit is used only as described here and in line with Apple's HealthKit guidelines.

5. Subscriptions and Payments

Subscriptions are sold and billed by Apple (App Store) or Google (Google Play). They process your payment; we never receive your card or bank details. The App receives from them only what it needs to unlock the features you paid for: which subscription is active, and a purchase identifier. Apple and Google act as independent controllers for this processing; see their privacy policies.

Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).

6. Device Permissions

The App asks for permissions only when a feature needs them:

  • Camera: to photograph a meal or yourself and to scan barcodes;
  • Photos: to choose a photo you want analysed;
  • Notifications: for fasting and streak reminders, which are scheduled on your device;
  • Apple Health or Health Connect: see section 4;
  • On Android, start at boot: to reschedule your reminders after the phone restarts.

7. What We Do Not Do

  • No user accounts, so no email address or password.
  • No advertising, no advertising ID, no tracking across apps or websites.
  • No third-party analytics or crash-reporting tools.
  • No sale or rental of personal data.
  • No automated decision with legal or similarly significant effects about you (Article 22 GDPR). The estimates and ratings the App shows are information for you, not decisions.

8. Who Receives Data

Only the services named in this policy, each for the purpose stated:

  • Fly.io (hosting of our server) and Cloudflare (storage of uploaded photos), as our service providers;
  • OpenAI and xAI, as our service providers for the AI analyses;
  • Open Food Facts, which receives only barcode numbers;
  • Apple and Google, for app distribution, payments, health data platforms and phone-watch sync;
  • Public authorities, when the law requires it.

9. International Transfers

Some of these providers process data outside the European Economic Area, notably in the United States. Where a country does not offer an adequate level of protection, transfers rely on the European Commission's Standard Contractual Clauses or on the EU-U.S. Data Privacy Framework where the provider is certified.

10. Security

Data sent by the App travels over encrypted connections (HTTPS). Data on your device is protected by your device's own security. No system is perfectly secure, but we limit what leaves your device to what each feature needs.

11. Your Rights

Under the GDPR you have the right to access, rectify and erase your personal data, to restrict or object to its processing, to data portability, and to withdraw your consent at any time. Because your logs stay on your device, you can view, edit and delete them directly in the App, and uninstalling the App deletes them. For anything else, write to contact@lytefast.com; we may need to ask a question to identify your request, since the App has no account.

You can also lodge a complaint with the French data protection authority, the CNIL (Commission Nationale de l'Informatique et des Libertés): www.cnil.fr.

12. Children

LyteFast is intended for adults (18 and over) and is not directed to children. We do not knowingly process children's personal data. If you believe a child has used a feature that sent data to us, contact us and we will delete what we can.

13. Changes to This Policy

We may update this policy when the App or the law changes. We will change the date at the top and, for significant changes, tell you in the App.

14. Contact

LyteFast SASU, 60 rue François 1er, 75008 Paris, France
Email: contact@lytefast.com