Privacy Policy — Stay at Zero

Last updated: 2026-10-08

Effective date: 2026-08-29

Controller: Paweł Graczyk

Contact: support@stayatzero.com

Product: Stay at Zero (web application for personal fasting tracking)

Keep this document in sync with Settings links and Connect-account copy.

1. What this policy covers

This policy describes how we process personal data when you use Stay at Zero, including:

• guest / local-only use in your browser
• connecting an account (sign-in via our identity provider)
• syncing fasting history to our servers
• optional body profile, weight samples, resting heart rate samples, sleep sessions, activity samples, State of Mind samples, Mood Changes flags, and meals (when you choose to store them on your account)
• optional Apple Health (HealthKit) read on iOS for activity, weight, resting heart rate, sleep, State of Mind (valence, emotion labels, associations, momentary or daily kind), and Mood Changes (a presence flag only) (device-local; cloud sync only with the health-data consent)
• optional import/export of backups
• optional meal recognition from a description or a plate photo

Stay at Zero is a personal fasting tracker. It is not a medical device and does not provide medical advice.

2. Data we process

2.1 On your device (even without an account)

Stored in your browser (including IndexedDB / local storage), for example:

• fasting sessions (start/end times, planned duration/goal, optional names, sync/revision metadata)
• offline change queue (outbox) and conflict-resolution state used for sync
• cached body profile fields, weight samples, resting heart rate samples, sleep sessions, and State of Mind / Mood Changes samples when you have used those features (including HealthKit imports on iOS)
• the plate photo of each meal you saved from a plate photo, and one small product picture per barcode used on your saved meals (§2.6)
• local consent flags for storing your body profile and your health data on your account, and the account they were given for
• UI preferences (theme, language, timer defaults, and similar settings)
• OAuth tokens when you are signed in (stored in browser storage)

Device-local data stays on that browser until you clear it, sign out / clear device data, or the browser removes site data.

2.2 On our servers (when you connect an account)

If you connect an account, we store data needed to provide sync and account features, including:

Body profile, weight samples, resting heart rate samples, sleep sessions, activity samples (steps / energy), State of Mind samples, Mood Changes flags, and meals are optional. We store them on your account only after you connect and turn on the matching in-app consent; until then they stay on your device. There are two consents, each with its own switch:

• Body profile (Account → Body profile): date of birth, height, physiological sex, PAL, and goal weight.
• Health data (Account → Data): weight samples, resting heart rate, sleep, activity, State of Mind, Mood Changes, and meals.

Fasting history syncs with any connected account and needs neither consent. Turning a consent off stops further uploads of that data; what is already on your account stays until you delete it (see §7). Both consents are cleared on this device when you sign in with a different account or clear data on this device. State of Mind and Mood Changes are more sensitive than weight: they describe feelings, not body mass. On iOS, Apple Health (HealthKit) may be read for activity, body mass, resting heart rate, sleep analysis, State of Mind, and Mood Changes with your system permission; samples stay on-device until you sync with consent. Android Health Connect has no equivalent, so those two types are read on iOS only. They are not used in metabolic estimates. Date of birth, height, and physiological sex are used to estimate basal metabolic rate (BMR) and total daily energy expenditure (TDEE) with the Mifflin–St Jeor formula and your activity level — they are not used for identity verification or advertising. Physiological sex here means biological/physiological sex for the formula, not gender identity. Sleep summaries may inform rough metabolic confidence only; they are not medical sleep diagnostics.

2.3 Identity provider (Zitadel or successor)

Sign-in is handled by our OIDC identity provider. That provider processes authentication data under its own terms and privacy policy. We receive tokens and claims needed to identify your Stay at Zero account (typically a stable sub, and email when available).

Important: Deleting your Stay at Zero account removes Stay at Zero server data for that account and then attempts to delete your identity-provider login (self-deletion). If identity-provider deletion fails (for example missing permission), Stay at Zero data may already be gone — retry delete or contact support. See §7.

2.4 Processors / hosting

We use service providers (processors) to host and operate Stay at Zero — for example cloud application hosting, managed databases, CDN / static hosting, and identity/authentication for sign-in. They process personal data only on our instructions and as needed to provide their services.

Where practicable we use infrastructure in the EU/EEA. If a transfer outside the EEA is required, we use safeguards required by law (such as Standard Contractual Clauses). Optional product analytics providers are described in §4.

2.5 Meal description dictation (optional)

You can dictate a meal description with the microphone button instead of typing it. Speech is recognized by your browser or your iPhone, not by Stay at Zero:

• Web app: your browser’s built-in speech recognition (Web Speech API) recognizes the speech. Your browser may send the audio to its vendor’s speech recognition service (for example Google in Chrome or Apple in Safari). That processing is governed by the browser vendor’s privacy policy. Before the first use we show a one-time notice.
• iPhone app (iOS 27 or later): Apple’s speech recognition runs on your device and the audio does not leave the phone. On first use, iOS may download a speech model for your language from Apple; no audio is sent for that.
• Stay at Zero does not record, store, or receive the audio. The recording never reaches our servers.
• Only the recognized text shown in the description field reaches Stay at Zero, and only when you continue with it, the same as a typed description. Interim recognition results are not logged.
• The microphone starts only after you tap the button and your browser or iOS grants microphone access. You can hide the button in Settings → Preferences.

2.6 Meal recognition (description, photo and barcode, optional)

With a connected account you can let Stay at Zero draft a meal from a description, from one new food name, or from one photo of your plate with an optional note. You always see the draft and accept or correct it before anything is saved. You can also skip recognition and enter the values yourself.

• Google Gemini API (processor). Our server sends the description text, the food name, or the photo with your note to Google’s Gemini API, which lists the foods and estimates the amounts. We use the paid Gemini API: under Google’s terms for it, Google does not use this content to improve its products and may keep it only for a limited time to detect abuse.
• Photo without metadata. Before sending, the app makes a new, smaller JPEG from the pixels on your device, and our server encodes a new JPEG again. Location (GPS), the camera model, and other photo metadata are not sent to us or to Google.
• Recognition keeps nothing. The recognition request does not store the photo, the description text, or the note: not on disk, in the database, or in logs. They exist only in memory while the request runs. Logs hold technical facts only, such as the photo size after scaling, the number of lines, the length of the note, and error codes. The original photo from your camera is never kept.
• A saved meal keeps its plate photo. When you save a meal you made from a plate photo, the same smaller JPEG (longer side at most 1280 px, without location, camera model, or other metadata) stays with that meal: on your device, and on your account once you turn on the health-data consent, so your other devices can show it. Our server decodes and encodes the photo again before keeping it, so no metadata survives. Cancelling, a failed recognition, a description, or a barcode keep no plate photo. Deleting the meal or the account deletes the photo (§2.7).
• What we store. The meal lines you accept and save, the plate photo of a meal saved from a plate photo — on your device, and on your account once you turn on the health-data consent — and technical recognition records: a count of recognitions (a welcome grant of 10, valid for 3 months), reservation and settlement events, and call rows with the model, token counts and a price snapshot. Those rows do not contain the description, food names, the search phrase or the image. An anonymous daily cost total has no account identifier and stays after the account is deleted. A one-way code of the sign-in subject records that the welcome grant was claimed and is kept for 12 months. Accepting the recognition terms is stored on the account. The USDA search cache key is a one-way code of the English phrase, not the phrase.
• Anthropic. When a Claude model is configured, the same text or photo may be sent to Anthropic instead of Google. Anthropic is named here before a production key is turned on.
• USDA FoodData Central. Nutrition values come from the U.S. Department of Agriculture’s FoodData Central. It receives only short English search phrases (for example “rice cooked”), never the photo, your text, or your account.
• Before the first photo we show a one-time notice that the photo goes to Google and that a saved meal keeps a smaller copy of it.

Barcode. You can also add a packaged product by its barcode: scan it with the camera, take a photo of it, or type its number.

• Read on your device. The camera picture and the photo of the code are read on your device and never leave it. We do not receive, send, or store them.
• Open Food Facts. Only the code number and your app language reach our server. Our server looks the product up in Open Food Facts (a non-profit association in France, with servers in the EU) and keeps the product data in a shared cache. Open Food Facts receives only the code, from our server, without your account or any other identifier. The product cache holds no personal data.
• Product photo. Your device loads the product photo on the product screen directly from Open Food Facts (images.openfoodfacts.org). Open Food Facts therefore sees your device’s IP address and the product code in the image address, but no referrer and no account data — as with any image loaded from another website.
• Saved product picture. When you save the meal, the app makes one small copy of that product photo (longer side at most 256 px, without metadata) for each barcode — one per barcode, shared by all your meals with it. It stays on your device and, with the health-data consent, on your account, so reopening the meal shows it without asking Open Food Facts again. We do not keep the Open Food Facts address. It is not your photo and does not go to Google. It disappears when none of your saved meals has that barcode any more. The copy is shown with its source and licence (CC BY-SA 3.0).
• What we store. The barcode stays on the meal line you save, the same as the USDA id of other lines, and the small product picture above. Export and account deletion cover them like the rest of the line. Logs hold the result and the time of a lookup, not the code.
• Scanning does not use recognition units. “Estimate from name”, for a product without nutrition values, sends the product name to Google Gemini like a new food name above.

2.7 Where saved photos are kept

• On your device. Plate photos and product pictures are kept in the app’s browser storage (IndexedDB) for the account or guest profile that saved them. Clearing data on this device removes them.
• On your account. Our server keeps the photo files in a private Google Cloud Storage bucket in the same region as our application server, not in the database. The bucket has no public access and no public or signed links: the app gets a photo only through our API, after sign-in, and only for your own account. Each photo is a new file without metadata. Object versioning and soft-delete copies are turned off, and we make no separate backups of the photo files.
• Deletion. Deleting a meal deletes its plate photo; a product picture is deleted when no saved meal on your account has that barcode any more; deleting the account deletes all photo files of the account. The files are removed in the background, usually within minutes. If the storage is unavailable, deletion is retried, and a periodic check removes files that nothing points to — at the latest within 30 days.

3. Purposes and legal bases (GDPR)

Fasting history and body measurements can be sensitive in context. We process them only to provide the tracking/sync and optional metabolism estimates you request. We do not sell personal data.

4. Cookies and similar technologies

We use browser storage required for the product (preferences, offline data, auth tokens). We do not use third-party advertising cookies.

Product analytics (optional). If you turn on Product analytics in Settings (or accept an in-app prompt), we send anonymous usage events to PostHog (EU cloud, eu.i.posthog.com) so we can see which parts of the app work. Events may include route names, button/feature names, coarse duration buckets, and locale — not notes, labels, exact fast timestamps, body measurements, or your email.

With the same opt-in, we may also record session replays (a reconstruction of what you see in the app: taps, scrolls, and screen layout) via PostHog so we can diagnose usability issues. Input fields are masked in recordings (including notes, labels, time editors, and body/weight fields). Replays do not include your email or account password. Analytics and session replay are off by default. You can turn them off anytime in Settings → Legal; we then stop sending events and stop recording. When you connect an account with analytics on, we may link the anonymous analytics id to your opaque account id (not your email) so we can understand connected vs guest usage.

Marketing site (stayatzero.com). Google Analytics loads only after you choose Accept analytics on the cookie banner. Accepting can also enable anonymous product analytics in the web app via a same-site consent cookie and/or an ?analytics=1 handoff. You can withdraw that in app Settings. This handoff does not apply to native desktop/iOS shells.

5. Retention

After account deletion, server-side Stay at Zero account data (including fasting history, body profile fields, weight samples, resting heart rate samples, sleep sessions, State of Mind samples, Mood Changes flags, activity samples, and meals) and associated conflict records are removed from the primary database. Account erase anonymizes the account (tombstone) and purges associated personal content from the live database. Residual copies may persist until backup windows expire.

6. Sharing

We share personal data only with:

• processors who host or operate the service for us, including Google (Gemini API) for meal recognition when you use it (§2.6)
• Open Food Facts, which receives a product barcode from our server when you scan one, without any personal data; your device loads the product photo from Open Food Facts directly (§2.6)
• authorities when legally required
• a successor if the service is transferred (you will be informed where required)

We do not sell your personal data.

7. Your rights and controls

Depending on applicable law (including GDPR if you are in the EEA/UK), you may have rights to access, rectify, erase, restrict, object, and data portability, and to lodge a complaint with a supervisory authority (the President of the Personal Data Protection Office (UODO) in Poland).

In-product controls today:

• Export — download a Stay at Zero backup (when online with a connected account), including the saved plate photos and product pictures
• Import — restore from a Stay at Zero backup or supported Zero biodata.json fasting history
• Body profile / weight / RHR / sleep / State of Mind — edit or clear fields; weight, resting heart rate, sleep, and State of Mind samples can be deleted individually; cloud erase of account body data requires a connected online session
• Account sync consents — turn the body-profile consent (Account → Body profile) or the health-data consent (Account → Data) off at any time; this stops further uploads, and data already on your account stays until you delete it
• Clear data on this device — removes local browser data for this app, including both consents; does not delete server data
• Delete account — permanently deletes your Stay at Zero account and server fasting / body / weight / RHR / sleep / activity / meal data (anonymize tombstone + purge), then deletes your identity-provider user (self-delete via Zitadel User API). Requires sign-in with a token that can call Zitadel APIs and self-delete permission on the identity provider.

For rights requests we cannot fulfill in-app, contact support@stayatzero.com.

8. International transfers

Where practicable we process data in the EU/EEA. If we process data outside your country or outside the EEA, we use appropriate safeguards required by law (for example Standard Contractual Clauses).

Meal recognition (§2.6) is processed by Google, which may handle the request in the United States and other countries. This transfer relies on Standard Contractual Clauses and Google’s certification under the EU-U.S. Data Privacy Framework. The English search phrases sent to USDA FoodData Central go to the United States and contain no personal data. Barcode lookups and product photos (§2.6) are served by Open Food Facts from the EU, without a transfer outside the EEA.

9. Children

Stay at Zero is not directed at children under 16 (EU digital-consent default; your country’s age of digital consent applies if higher). Body profile date of birth is rejected under age 13 for product safety. Do not use the service if you are under your country’s applicable age.

10. Health disclaimer (privacy-related)

Stay at Zero stores self-reported fasting activity and, if you opt in, self-reported body measurements, resting heart rate samples, sleep session aggregates used for rough BMR / TDEE estimates and confidence, and optional State of Mind / Mood Changes context from Apple Health. State of Mind does not diagnose mood or change a fast. It does not diagnose, treat, or monitor disease (including sleep disorders). Longer or medical-related fasting decisions belong with a qualified clinician. See also in-app safety information and the Terms of Service.

11. Changes

We may update this policy. We will change the “Last updated” date and, for material changes, provide additional notice where required (in-app or email if available).

12. Contact

Privacy questions and rights requests: support@stayatzero.com