Last updated: September 21, 2026
This Privacy Policy explains how GorilaFit ("we", "the App") collects, uses, protects, and stores personal data. The App follows a local-first approach: your day-to-day logs — meals, workouts, body measurements and progress photos — stay on your device in an encrypted database and are never uploaded to our servers.
There is one deliberate exception, and we want it stated plainly rather than buried: your fitness profile is synchronised to the cloud so you can recover it when you sign in on a new phone. Section 5 says exactly which fields that covers.
The data controller is Grigore Victor Stefan. For requests related to your data (deletion, access, questions), please contact: support@gorilafit.info.
An encrypted SQLite database (SQLCipher, AES-256) holds everything you log day to day: meals and their nutrition values, workouts, exercises and sets, water intake, weight history, body measurements, progress photos, favourites, and the history of AI answers. None of this is uploaded to our servers. It leaves your phone only if you export it yourself (section 12) or if your own device backup includes it (section 13).
Your account document users/{your-id} contains:
accountType and expiry date), written by RevenueCat, not by the App;Why the profile is in the cloud: so that signing in on a new or reset phone restores your setup instead of making you redo it from scratch. Under GDPR this is health-related data (special category); section 19 explains the lawful basis and your rights over it.
Two further documents hold nothing but counters: ai_usage/{your-id} and nutrition_usage/{your-id} store today's date and how many AI requests or food lookups you have made today, so that daily fair-use limits can be enforced on the server where they cannot be bypassed. They contain no content of any kind.
If you rate a recipe, your rating is stored as recipes/{recipe}/ratings/{your-id} — a number from 1 to 5, tied to your account.
Security rules make these documents readable and writable only by you, and your subscription fields writable by nobody but our server.
AI features are optional. Nothing is ever sent automatically: every request starts with you tapping a button, and only after you have given consent inside the App. You can withdraw that consent at any time in the app settings.
Your request goes to our own server function, which adds the API key and forwards it to OpenRouter (privacy policy), which routes it to the model that produces the answer: DeepSeek (privacy policy).
International transfer: DeepSeek is established outside the European Economic Area. Text you send to the AI is therefore processed outside the EEA. If you are not comfortable with that, do not use the AI features — every other part of the App works without them.
We say this explicitly because it is easy to assume that tapping a button sends nothing. It does send your numbers — that is what makes the answer about you.
Your name, email address, user id, authentication tokens, location, device identifiers and payment information are never included in an AI request — unless you type them into the chat yourself, which we strongly discourage.
If there is no data to analyse — an empty week, a day with no meals logged — the App does not contact the AI at all. It tells you there is nothing to analyse instead of sending an empty request.
We do not store your AI requests or answers on our servers; the answers you keep are saved in the encrypted database on your phone. Retention at OpenRouter and DeepSeek is governed by their own policies, linked above.
The first time you use any AI feature the App asks for your consent explicitly, and stops there if you decline — the request is never sent. The same check runs before every AI feature, including the daily insight card on the home screen, which is generated automatically and therefore never runs without your prior consent.
Withdrawing consent is not just a flag: the daily insight already generated from your data is deleted from your device at the same moment. Past answers you chose to keep in your history remain until you delete them yourself.
When you search for a food, the App queries up to three public nutrition databases, in order, stopping as soon as it has enough results:
Only the words you typed are sent. Your search text is translated into English before it reaches USDA and FatSecret, because those databases are English-only. Food names are translated back into your language on your device, using Google ML Kit's offline translation — that step involves no network request and no third party.
Barcodes you scan are looked up the same way: the barcode number is sent, nothing else.
We use Firebase Analytics to understand which parts of the App are used, and Firebase Crashlytics to find and fix crashes.
What is measured: that an event happened — a screen was opened, a food was logged, a workout was started, the subscription screen was viewed, an AI question was asked. Alongside these we record a few properties of your account: your subscription type, your app language, your unit system (metric or imperial), your chosen strategy, and whether you finished onboarding.
What is not measured: the content of your logs. No analytics event carries what you ate, how much you weigh, what you searched for, or what you asked the AI.
Crashlytics collects the error and its stack trace, your device model and operating system version, so a crash can be reproduced and fixed.
Unlike analytics and advertising, crash reporting starts with the App and is not tied to the consent form. We rely on legitimate interest for it (section 19): without crash reports we cannot tell that the App is broken for you. Crash reports contain no personal data beyond the device model and OS version, and none of your logged content.
The free version shows occasional full-screen ads through Google AdMob (how AdMob uses data). A paid subscription removes them.
Nothing is assumed in our favour. The App ships with all four Google Consent Mode signals — analytics storage, ad storage, ad user data and ad personalisation — declared as denied by default, in the Android manifest and the iOS configuration file. They stay denied until you say otherwise. Outside the EEA, where a consent form is not required, the App grants them itself at startup.
If you are in the European Economic Area or the United Kingdom, the App shows Google's consent form (UMP) before the advertising library is even started. No ad is requested and no ad identifier is read until you have answered it. If you decline, the advertising library is not started at all for that session.
On iOS, after the consent form, the system's App Tracking Transparency prompt asks separately whether the App may track you across other companies' apps and websites. Declining it is honoured regardless of what you answered in the consent form.
To change your mind later: the privacy options are available from the App's settings wherever the law requires them. You can also reset or limit your advertising identifier, and change the tracking permission, in your device's own privacy settings.
Requests to our server functions and to Firestore carry an attestation token, issued by Google Play Integrity on Android and by App Attest / DeviceCheck on iOS. It proves the request comes from a genuine, unmodified install of GorilaFit, and it is what stops someone from draining the AI budget with a script.
This token says something about the app and the device, not about you. It contains no personal data and is not used to identify or track you.
Reminders are generated and scheduled on your device. There is no push server, and no reminder content ever leaves your phone. You can turn them off in the App, or revoke the notification permission in your device settings.
You can export your data from the App. The file is generated locally on your device and is not encrypted after export — once it leaves the App it is an ordinary file, so store or share it carefully.
We do not back up your logs to our servers. However, the local encrypted database may be included in your device's own backups (iCloud or Google Drive), depending on your device settings. To exclude GorilaFit, disable backup for the App in your device settings.
For server-side deletion requests or manual assistance, contact support@gorilafit.info.
| Category | Where | Retention period |
|---|---|---|
| Account (email, created date) | Firestore | Until you delete the account |
| Fitness profile (age, weight, height, sex, goals) | Firestore | Until you delete the account |
| Subscription status | Firestore / RevenueCat | Until you delete the account |
| Recipe ratings | Firestore | Until you delete the account |
| Daily usage counters | Firestore | Overwritten each day; no history kept |
| Meals, workouts, measurements, photos, AI history | Your device only | Until you delete them, uninstall, or clear storage |
| AI requests | OpenRouter / DeepSeek | Per their own policies — we keep no copy |
| Analytics events | Firebase Analytics | Per the retention set in Firebase (default 14 months) |
| Crash reports | Crashlytics | 90 days |
| Payment receipts | Apple / Google / RevenueCat | As required by tax and accounting law |
| Service | What it receives | Policy |
|---|---|---|
| Google Firebase (Authentication, Firestore, Storage, Remote Config, App Check) | Account, fitness profile, subscription status, recipe ratings, usage counters | policies.google.com/privacy |
| Firebase Analytics & Crashlytics | Feature usage, account properties, crash diagnostics | firebase.google.com/support/privacy |
| Google AdMob | Advertising identifier, ad interactions (with consent) | AdMob data usage |
| RevenueCat | Purchase receipts, subscription status | revenuecat.com/privacy |
| OpenRouter | AI request text (routing) | openrouter.ai/privacy |
| DeepSeek | AI request text (the model that answers) — outside the EEA | deepseek.com/privacy |
| Open Food Facts | Your search terms | openfoodfacts.org/privacy |
| USDA FoodData Central | Your search terms, translated to English | usda.gov/privacy-policy |
| FatSecret Platform | Your search terms, translated to English | fatsecret.com/privacy |
| Apple App Store / Google Play Billing | Payment processing — we never see card details | Apple · Google |
Google ML Kit's translation runs offline on your device and is listed here only to make clear that it is not a third-party transfer.
In-app purchases are processed by the Apple App Store or Google Play. The App has no access to card numbers or billing addresses. We receive only receipts and subscription status, through RevenueCat. For tax and accounting purposes we may retain transaction metadata (transaction id, product, date) without any payment details.
The "Report a bug" button opens your own email app with a pre-filled message containing your platform, operating system version, app language and whether the build is a release build — details that help us reproduce the problem and that you could not reasonably be expected to write yourself.
Nothing is transmitted in the background: the message is sent only if you press Send, and you can edit or delete any part of it first.
We comply with the EU General Data Protection Regulation for all users in the European Economic Area.
Your fitness profile — age, sex, weight, height, target weight, BMI, BMR and goals — is health-related and therefore special category data. It is stored in Firestore so that your setup survives changing phones. Your daily logs are not: they stay on your device.
When you use an AI analysis, a summary of those health figures is transmitted to the processors named in section 6, including one outside the EEA. That is why AI features require your explicit consent before first use and can be switched off at any time.
If you are an EU/EEA resident, you have the right to access your data, have it corrected, have it erased, restrict or object to processing, receive it in a portable format, and withdraw consent at any time where processing is based on consent.
To exercise these rights, contact support@gorilafit.info. We respond within one month and will verify your identity first. Note that data held only on your device is under your direct control — the App lets you delete or export it without asking us.
Some of our processors operate outside the EEA. Where that is the case we rely on the safeguards those providers offer, including Standard Contractual Clauses where applicable. The AI processing chain described in section 6 involves a provider established outside the EEA; this is stated there explicitly so you can decide whether to use those features.
If you believe our processing infringes the GDPR, you may lodge a complaint with your local supervisory authority. In Romania this is the ANSPDCP.
California residents may request disclosure of the personal information collected and opt out of the sale or sharing of personal information. GorilaFit does not sell your data. To opt out of personalised advertising, use your device's privacy settings.
The App is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has provided personal data, contact support@gorilafit.info and we will delete the account and its data.
AI analyses are informational and do not replace medical advice. We make no automated decisions producing legal or similarly significant effects.
For auto-renewable subscriptions the App uses Apple's standard EULA:
https://www.apple.com/legal/internet-services/itunes/dev/stdeula/
On the subscription screen, "Terms of Use" opens that page and "Privacy Policy" opens this document.
We may update this policy as the App changes. The "Last updated" date at the top shows the current version. Continued use after a change means you accept the updated policy.
Email: support@gorilafit.info
Postal: Romania, Arges, Pitesti, Str. Gheorghe Sincai Bloc p21 sc b ap 11