Privacy Policy

Weighly is built and operated by BitCraftery ("we," "our," or "us") — a trading name of a sole trader based in the United Kingdom, not a registered company. This Privacy Policy explains what information the Weighly app and our website at weighly.bitcraftery.com handle, why, and the choices and rights you have. It describes how Weighly actually works today.

Our Approach

• Weighly is free. There are no subscriptions, in-app purchases, or adverts.
• Your weight entries, goals, progress photos, and food diary stay on your device. We do not upload them to our servers.
• We do not track you across other apps or websites, and we never sell your data. If you accept analytics cookies on our website, they measure how our own site is used and nothing beyond it.

Information We Handle

• Signing in: signing in is the only way to use Weighly — with Apple on iOS, and with Apple or Google on Android. The provider gives us a stable, anonymous identifier for your account and, only if you choose to share them, your name and an email address (which may be an Apple private-relay address). We store these on our servers so your account works across your devices and reinstalls.
• On your device only: your weight entries, goals, progress photos, food and meal diary, chosen units, language, theme, and reminder settings stay on your device and are not sent to us.
• Device and notifications: if you enable notifications, we store an app installation identifier and your device's push token — from Apple Push Notification service on iOS, or Firebase Cloud Messaging on Android — linked to your account, so we can deliver the reminders and notifications you ask for.
• Food search and barcodes: when you search for a food by name or scan a barcode, the text you typed or the barcode number is sent to our servers to find the food, along with your app installation identifier (used to check you are signed in). We keep searched terms and scanned barcodes — stored without who searched them — so the shared food database grows and future searches are faster. New search terms are processed on our behalf by Anthropic's Claude API to generate nutrition information; only the search text itself is sent to Anthropic, never your identity. Barcodes we don't recognise are looked up in the Open Food Facts public database, again with the barcode number only.
• Food contributions: if a scanned product isn't found, you can type in its nutrition and submit it. The product name, barcode, and nutrition values you submit are stored on our servers and join the shared food database, without your name or identity attached.
• Camera: barcode scanning uses your camera. What the camera sees never leaves your device and is not recorded — only the detected barcode number is looked up.
• Help and feedback: when you contact us through Help and Feedback, we receive the message you write and up to four photos you choose to attach, so we can respond and improve the app. Feedback is kept for up to 12 months.
• App analytics (optional): only if you opt in, we collect pseudonymous usage events (such as which screens you open or when a weight is logged) using Google Firebase Analytics, tied to your account's anonymous identifier. These events never include your weight, body measurements, or other health figures. Analytics stays off until you agree, and you can change your choice at any time in Settings. This bullet describes analytics inside the app; analytics on our website is separate, cookie-based, never tied to your account, and described under Cookies and Website Analytics below.
• Crash and performance data: to keep the app stable, we collect crash reports and basic performance diagnostics using Google Firebase Crashlytics, linked to your account's identifier so that when you report a problem we can find the crash that caused it. Crash reports never include your weight, body measurements, or other health figures. This is on by default and you can turn it off in Settings.

Apple Health

On iOS, if you choose to connect Apple Health, Weighly reads your workouts, active and resting energy, heart rate, step count, and workout distances to show your activity and to personalise your daily calorie target.

• Connecting is optional. The app works without it, and you choose exactly which categories Weighly may read.
• Health data is read and processed on your device only. It is never sent to our servers, to Firebase, or to any other third party, and it is never included in analytics or crash reports.
• We never use Apple Health data for advertising or marketing, and we never sell it or disclose it to data brokers — nor would we; this is also prohibited by Apple's rules for apps that use HealthKit.
• Weighly does not write data to Apple Health.
• You can review or withdraw Weighly's access at any time in the Health app (Profile → Apps) or in iOS Settings → Privacy & Security → Health. Withdrawing access does not affect the rest of the app.

Our Website

This section covers visiting weighly.bitcraftery.com — it applies to you even if you never install the app.

• Server logs: like almost every website, our server briefly processes standard technical data when you request a page — your IP address, the page requested, date and time, and your browser type — solely to deliver the page and keep the site secure. We do not build access logs of visitors ourselves. The site is hosted for us by DigitalOcean, and traffic passes through Cloudflare for security and performance; both process this technical data on our behalf as part of serving the site, on the lawful basis of our legitimate interests in running it securely.
• Bot protection: Cloudflare may set a strictly necessary cookie, __cf_bm, to tell humans and abusive bots apart. It lasts about 30 minutes, identifies no one to us, and, being strictly necessary, needs no consent.
• Nothing else: the website sets no other cookies and loads nothing from third parties unless you accept analytics, as described next.

Cookies and Website Analytics

When you first visit, the site asks whether we may use optional analytics cookies. Nothing analytics-related is loaded, and no analytics cookie is set, unless you choose Accept — declining, ignoring, or dismissing the banner all mean no. The site works identically either way.

• If you accept, we load Google Analytics (Google's gtag.js), which sets first-party cookies: _ga (a random identifier that distinguishes your browser from others on this site; kept for 13 months) and _ga_<stream> (keeps track of your browsing session; kept for 13 months). These tell us things like which pages are visited and roughly where visitors come from. They identify your browser on our site only and are not used to follow you around the web.
• Google processes this data on our behalf, partly outside the UK, and your IP address is processed transiently to derive an approximate location. Analytics event data is retained by Google Analytics for 2 months, then deleted. We have turned off the Google settings that would share analytics data for Google's advertising purposes, and the website has no adverts.
• Website analytics is never linked to a Weighly account, and website and app analytics are never joined.
• Your choice itself is remembered on your device (a small "weighly.cookieConsent" record in your browser's local storage, kept for up to 12 months). Storing it is strictly necessary — it is how a "no" is remembered.
• You can change your mind at any time using the Cookie choices link in the footer of every page. Withdrawing consent stops measurement immediately and deletes the analytics cookies from your browser.

How We Use Your Information

• To provide and secure your account and the app's features.
• To send the reminders and notifications you enable.
• To run food search and barcode lookup, and to grow the shared food database.
• To respond to your feedback and support requests.
• To fix crashes, improve stability, and, with your consent, understand how the app is used.
• With your consent, to measure how our website is used so we can improve it.
• To meet our legal and regulatory obligations.

Legal Bases (UK and EU GDPR)

• Performance of a contract: running your account and providing the app.
• Consent: app analytics, website analytics cookies (required by the Privacy and Electronic Communications Regulations as well as UK GDPR), and, where required, notifications. You can withdraw consent at any time — in the app's Settings, or via the Cookie choices link on our website.
• Legitimate interests: keeping the app and website stable and secure (including the website's server logs and bot protection) and responding to your support requests.
• Legal obligation: where the law requires us to retain or disclose information.

Storage, Retention, and Security

• On-device data remains until you delete it or remove the app.
• Account and server-side data is kept while your account is active; feedback is kept for up to 12 months.
• Searched terms, scanned barcodes, and the food entries they produce are kept in the shared food database indefinitely — they are stored without your identity and cannot be traced back to you.
• Data sent to our servers is transmitted over encrypted connections (HTTPS).
• Website analytics event data (if you accept analytics cookies) is retained for 2 months; the analytics cookies themselves last up to 13 months, and your consent choice is kept on your device for up to 12 months before we ask again.
• Deleting your account removes your account and all associated server-side data, including installs, push tokens, feedback, and any attached images.

Who We Share It With

• Apple, for Sign in with Apple and for delivering push notifications to iOS devices.
• Google, for signing in with Google on Android and for delivering push notifications to Android devices through Firebase Cloud Messaging.
• Google Firebase, which processes crash, performance, and (if you opt in) analytics data on our behalf.
• Google, which processes website analytics (Google Analytics) on our behalf if you accept analytics cookies on our website — the data described under Cookies and Website Analytics only, never anything from the app.
• Anthropic, whose Claude API processes new food-search terms on our behalf to generate nutrition information — the search text only, never your identity.
• Open Food Facts, a public food database our servers query with the barcode number only.
• DigitalOcean, which hosts our servers and website, and Cloudflare, which provides security and performance for the website — both process technical data (such as IP addresses) as part of serving it.
• We do not share your data with advertisers or data brokers, and we do not sell it.

International Transfers

Our service providers — including Apple, Google (for sign-in, notifications, Firebase, and website analytics), DigitalOcean, Cloudflare, and Anthropic — may process data outside the United Kingdom and the European Economic Area, including in the United States. Where they do, the transfer is protected by appropriate safeguards: the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it, and otherwise the UK Addendum to the EU Standard Contractual Clauses or the ICO's International Data Transfer Agreement.

Your Rights

• You can access, correct, export, or delete your data.
• You can withdraw app analytics consent or disable crash reporting at any time in Settings, and withdraw website analytics consent via the Cookie choices link in the site footer.
• You can delete your account and all associated data from within the app, using Delete Account and All Data in your Account settings.
• If you are in the UK or EU, you can complain to your data protection authority (in the UK, the Information Commissioner's Office).

Tracking and Advertising

Weighly does not use the advertising identifier (IDFA), shows no adverts, and does not track you across other companies' apps or websites. You will not see an App Tracking Transparency prompt because we do not track. Our website offers optional Google Analytics, only with your consent: its cookies are first-party, they identify your browser on our site only, they are not used to follow you around the web, and we have disabled the Google settings that would use this data for advertising.

Children

Weighly is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will remove it.

Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the date above and, for significant changes, let you know within the app.

Contact Us

If you have any questions about this Privacy Policy or your data, please get in touch with BitCraftery at [email protected].