Privacy Policy

Beta version · In force since September 10, 2026 · Last updated: October 9, 2026

Sign-up changed on October 2, 2026: it starts with the questions and ends with your mobile number, no longer asks for an e-mail, and asks, optionally, for your biological sex, the race you are training for, your eating pattern, and how you heard about FuelBalance; your sport can also be the gym, Hyrox, or another one, with the name you type (sections 3.1 and 3.2). If you have already finished setup, nothing changes.

The training week arrives on October 3, 2026: setup now asks, optionally, which days you train, which of them are hard, at what time, and how long a hard session lasts. If you already have an account, you can answer in Profile → My week (section 3.2).

Reminders reach the iPhone from October 4, 2026: in the iPhone app, anyone who turns on meal reminders gets the notices through Apple's notification service (section 3.14). Nothing changes for those on Android or in the browser.

Usage data changes on October 4, 2026: versions of the app published from that date on send Amplitude, besides the screens opened and the buttons tapped, whether some actions worked or failed (with the kind of failure, never the error's text), each step of the initial setup as a screen, and a few characteristics of the account: the plan, whether Strava and the health reading are connected, whether reminders are on, and the app's language (section 3.8). Your name and your mobile number stay out.

Crash reports from October 4, 2026: versions of the phone app published from that date on send Google (Firebase Crashlytics) a technical report when the app crashes or hits an error: the kind of error, the point in the code and device data — without your account identifier, and without the app putting the content of your logs in them (section 3.20).

The free plan's limit, from October 7, 2026: in app versions published from that date on, when the free plan's limit is in force, a free account logs up to 3 meals a day, by text, with the shortcuts or from the favorites; Fuel.IA (the chat and the daily insights) and logging by photo and by voice are on the paid plan. In that case the app does not ask Google Gemini for the day's insight. To apply the limit we count, per day, the meals logged and the questions to Fuel.IA, and we keep only the numbers and a random code for each question, never its text (sections 3.6 and 3.19).

Permission for the AI, from October 7, 2026: app versions published from that date on send data to Google Gemini only after you tap Allow on the "Before using the AI" screen, which appears when you first open the home screen and, if you answered Not now, again at the first meal analysis or the first message to Fuel.IA. You can refuse and keep logging with the shortcuts and by hand, and withdraw the permission later (section 5). We keep on your account the answer, when it was given, and the version of the text you saw (sections 3.4 to 3.6 and 5).

Subscribing inside the app, from October 6, 2026: app versions published from that date on may sell the paid plan through the phone’s own store — Google Play on Android and the App Store on iPhone. Whoever buys that way pays the store, and the store tells FuelBalance through RevenueCat, which is added as a supplier (sections 3.19, 6.1 and 8). For anyone who buys nothing, nothing changes.

The notice after a workout, on October 5, 2026: anyone who connected Strava and turned on reminders gets a notification when a new workout reaches Strava and no meal was logged after it. This policy starts describing that notice on this date (sections 3.7 and 3.14), when it also starts suggesting how much protein and carbohydrate to eat back, worked out from the weight and the goal in your profile. If you did not connect Strava or did not turn on reminders, nothing changes.

Sharing with a dietitian or coach, from October 9, 2026: through FuelBalance Pro, a professional who invites you — by a link or by typing your mobile number, which we use only to find your account — can see the scopes you choose — meals, body, sleep — for 180 days, and every time they open your data it is recorded for you to see. It only happens if you allow it (section 3.21). Until you do, nothing changes for you.

Reading Health Connect (Android) and Apple Health (iOS) takes effect on October 1, 2026 and only happens if you allow it (section 3.18). Until you do, nothing changes for you.

The changes about phone sign-in (a number and an SMS code instead of Google and Apple, with the number stored by Firebase Authentication) take effect on September 28, 2026. Until that date, the data of existing accounts follows the previous version of this policy.

This policy explains how the FuelBalance app (Android and iOS) and the website https://fuelbalance.app handle your personal data today. It describes what the app and the website do in this beta phase, including what does not yet exist. It is not a list of plans.

#Summary

• FuelBalance is in beta and free to use; a paid plan is being rolled out, bought on the website, where Stripe is who charges you, or inside the app, where the phone’s store — Google Play or the App Store — is (section 3.19). It compares the meals you log with your estimated expenditure for the day: your basal metabolism, calculated by the app, plus the calories from workouts coming from Strava.
• The person responsible for your data is Paulo F O de Souza, an individual entrepreneur (empresário individual) (CNPJ 61.942.112/0001-56). For any matter, write to contact@pfengineer.tech.
• Age combined with biological sex (optional), weight, height, body fat, goals, meals, plate photos, and workouts are health data. For this data in general, the app has no consent screen of its own yet: the consent screens that exist are the one for sending to Google's AI and the FuelBalance Pro invite, for showing your data to a dietitian or coach you choose (section 3.21); the other notice is the one on the screen where you enter your mobile number. Section 5 explains what that means.
• Google's AI (Gemini) receives your data only after you allow it, on a screen of its own shown before the first send; you can refuse, and withdraw the permission later (section 5). With permission, photos and descriptions of meals, your messages to Fuel.IA, and a summary of your day go to Google. The summary includes age, weight, goals, the meals logged during the day (item by item, with times), and your Strava workouts. Name, e-mail, and account identifier do not.
• Our Gemini account is paid for by us; you pay nothing. Under this arrangement, Google says it does not use this content to improve its products, but it keeps a record of it for 55 days to detect abuse.
• If you connect Strava, we keep the imported activities in your account with no automatic deletion deadline, including data that may reveal the route.
• We use Amplitude, which stores the data in the United States, to measure use of the app and the website. It receives the screens opened, the buttons tapped, and whether some actions worked or failed, along with your account identifier, a few of its characteristics (plan, connections, language), and device data, but not the content of your logs, your name, or your mobile number. Today there is no option in the app to turn this off.
• When the phone app crashes or hits an error, it sends Google's Firebase Crashlytics a technical report: the kind of error, the point in the code and device data. The report does not carry your account identifier, and the app does not put the content of your logs in it; section 3.20 explains the one case we do not control. Today there is no option in the app to turn this off.
• We do not sell personal data, we do not show advertising, and we do not share your data for third-party marketing.
• Your account can be deleted from the app, immediately, at Profile → Settings → Account (instructions at https://fuelbalance.app/delete-account/). Downloading a copy of your data is still by e-mail: we respond and complete within 15 days.
• FuelBalance is for people 18 and older, but the app does not yet verify age.
• Section 14 lists what you might expect to find and does not yet exist, and what to do instead.

#1. Who is responsible for your data

FuelBalance is offered by PAULO F O DE SOUZA, an individual entrepreneur (empresário individual), trade name PF Engenharia de Software e Arquitetura, registered under CNPJ 61.942.112/0001-56, with address at Rua José Santos Junior, 169 – Campo Belo – São Paulo/SP – CEP 04609-010. He also uses the brand PFEngineer. In this policy, "FuelBalance", "we", and "us" refer to him.

We are the controller of your personal data: we decide what it is used for and how.

• Officer in charge of personal data processing (Encarregado): Paulo Felipe Oliveira de Souza.
• Single contact channel: contact@pfengineer.tech. Use this e-mail for support, privacy questions, requests about your rights, data deletion, and complaints.

Requests are read and handled manually by us. We respond to and complete requests — questions, complaints, account deletion, and requests about your data, such as receiving a copy or erasing the data — within 15 days (section 11).

#2. Who this policy applies to and what phase we are in

• Users of the FuelBalance app, who sign in with their mobile number and a code sent by SMS.
• Visitors to the website fuelbalance.app.
• People who joined the waitlist through the website.

FuelBalance is in beta: it is a test version that still changes often. It is free to use, and a paid plan is being rolled out: when you subscribe, the payment happens on a Stripe page or in your phone’s store, and the app never sees your card details (section 3.19). When something that affects your data changes, we update this policy (section 15).

Today, the only source of workouts is Strava. The integrations with Garmin Connect and TrainingPeaks do not exist in the app, and no data is collected by them. Fuel.IA by voice, in the chat, and the "Voice" button on the logging screen do exist (sections 3.5 and 3.4).

#3. What data we process, where it comes from, and why

The LGPD calls data concerning health sensitive personal data. In FuelBalance, we treat as health data: age combined with weight and height, target weight and target date, body goal, estimated basal metabolism, weigh-ins and body fat, meals, plate photos and descriptions, calories and macronutrients, the day's balance, AI insights, conversations with Fuel.IA, and workout data such as heart rate, power, and calories.

#3.1 Account and login

• How it works: you enter your mobile number and receive a one-time code by SMS. Sending the SMS and verifying the code are done by Google's Firebase Authentication, which creates the account on your first sign-in and gives you access to it afterwards. To prevent abuse, Firebase may confirm that the request comes from the genuine app (through Play Integrity, on Android) or show a Google reCAPTCHA check; on Android, the code may be read from the SMS automatically.
• Data: the account identifier created by Firebase, the mobile number, and the dates the account was created and last signed in. On the first screen of the initial setup we also ask for your name, so the app knows what to call you, unless the account already has one; it is stored in your profile in the app's database. We do not ask for an e-mail or a password. Accounts that signed up before this change keep the e-mail given at that sign-up.
• Where it lives: in Google's Firebase Authentication, which processes this data in the United States. The mobile number lives in Firebase Authentication and, along with the name (and, on accounts that gave one, the sign-up e-mail), in your profile in the app's database (Cloud Firestore).
• Name shown: the name you give at sign-up. Accounts created before the named sign-up use the name on the Strava account (section 3.7) or "Athlete".
• Accounts created earlier with Google or Apple: they keep the identifier, name, e-mail, and photo that Google or Apple handed us at the time (and, with Apple's option to hide the e-mail, Apple's forwarding address), stored in Firebase Authentication and copied to the profile in the database when the initial setup was finished. In Settings, these accounts can link a mobile number: the number then gives access to the same account, with the same data. If the number is already tied to another account, the link is refused and nothing changes.
• Why: to create and maintain your account, identify you, and separate your data from other people's.
• Use of the number and the e-mail: we do not send news, offers, or advertising to your number. It receives the codes you request and, on accounts without an e-mail, notices about your own account (content removal, suspension or termination, as described in the Terms of Use, section 5), never marketing. We do not send news or offers to your e-mail; on accounts that have an e-mail, we use it to answer your requests and for notices about your account and about changes to these documents or to the service.
• Legal basis: performance of the contract, that is, the Terms of Use.

#3.2 Initial setup and profile

• Data you provide: goal (performance, lose fat, maintain weight, or gain muscle), main sport (cycling, running, triathlon, duathlon, gym, Hyrox, or other, and then the name you type), age, height, and weight and, if your goal is to lose fat or gain muscle, the target weight and the pace you pick, as a percentage of your weight per week. Optional: biological sex (female or male; you can leave it unanswered), used only to calculate basal metabolism; the race you are training for (section 3.15); your eating pattern (high-carb, Mediterranean, carb periodization, or plant-based); and your training week: the days you train, which of them are hard, the time of your sessions on weekdays and at the weekend (before 7 am, morning, lunchtime, afternoon, or evening), and how long a hard session lasts. If you do not pick an eating pattern during setup, the home screen asks again from the third day of use.
• Data calculated by the app: estimated basal metabolism, the day's target balance, which the app calls the "daily goal" (section 12), and the target date for your weight, worked out from the target weight and the pace you pick or, when there is a main race, the race date.
• Technical data: the phone's time zone, the profile's creation and update dates, the date of the last change to the training week, and the indication that setup was completed.
• How it arrives: the app asks the questions one screen at a time. If you do not have an account yet, you answer before creating it: the answers stay only in the app's memory — they are not sent to any server or saved on the device — until you confirm your mobile number, on the screen after the plan (section 3.1). Then the account is created and everything is saved at once. If you leave halfway or close the app or the tab, nothing is kept. If the number already has an account with setup finished, you simply sign in to it: this time's answers are discarded and what was in the account does not change. If you are already signed in, you answer the same way and everything is saved when you tap "Save my plan". Once the plan is saved, the Strava connection screen appears, and you can skip it. Age is a free number: the app does not check that you are 18 (section 13).
• What you can change in the app: weight, target weight, goal, and target date, on the profile screen; the training week, in Profile → My week, where you can also delete it ("I don't keep a fixed week"). To correct age, height, sex, sport, or eating pattern, write to us.
• Why: to calculate basal metabolism, the target balance, and the day's balance, track your goal, give context to the AI (section 3.6), group your logs by the days of your time zone, and, with the training week, plan what to eat the day before and ahead of each session. The training week does not go to the AI or to Amplitude.
• Legal basis: consent for health data. Today the app does not collect this consent in the specific and highlighted way the LGPD requires (section 5).
• How you heard about FuelBalance (optional): once the plan is saved, one last question, which you can skip, offers Instagram, Strava, a friend or my team, a coach or a training group, a race or an event, Google, ChatGPT or another AI, and somewhere else. We keep the answer and its date in your profile, to know where athletes come from and where promoting FuelBalance is worth it. It does not go to the AI or to Amplitude, and nobody else sees it. Legal basis: legitimate interest (art. 7º, IX). To object, just skip the question; if you already answered, ask us by e-mail to delete it.

#3.3 Weigh-ins

• Data: the day's weight, body fat percentage (optional), the date, and the source of the entry. The most recent weight and body fat are also copied to your profile and recalculate basal metabolism.
• How it arrives: you log it in the app or, if you allow it, it comes from Health Connect / Apple Health (section 3.18), written there by your scale's own app. A day you logged by hand is never replaced by what comes from there. Today it is not possible to delete a weigh-in from within the app. For that, write to us.
• Why: to show your progress and give context to the AI, which receives the body fat percentage, how many days ago the last weigh-in was, and the change in weight and in lean mass.
• Legal basis: consent for health data. Today the app does not collect this consent in the specific and highlighted way the LGPD requires (section 5).

#3.4 Meals

How you log today:

• Before the first send to Gemini, by photo, text, or voice, the app shows the "Before using the AI" screen and sends only if you tap Allow (section 5). Without permission, nothing goes to Gemini; a photo is read only on the phone itself, as described below.
• Photo, taken with the app's camera or chosen from the gallery: with permission, the photo goes to Google Gemini, which identifies the foods, portions, calories, and macronutrients. When you do not allow it, or when Gemini does not respond (no internet, usage limit, or error), the app tries to recognize the plate on the phone itself, with Google's ML Kit. On-device recognition does not send the photo, but it may already have reached Google in the failed Gemini attempt (for example, because of a usage limit).
• Text: the description you write goes to Gemini.
• Chat with Fuel.IA: if your message looks like an account of a meal, the text also goes to Gemini to build a suggested log entry. It is saved only if you tap to confirm.
• Shortcuts in the "Quick" section (gel, bar, sports drink, whey, and banana): they are saved with one tap, with fixed values, no AI.
• Voice: the "Voice" button on the logging screen appears wherever there is speech recognition — on a phone, the device's own (Google's on Android, Apple's on iPhone); in a browser, the browser's (Chrome, Edge and Safari; Firefox has none, and there the button stays "Coming soon"). The app asks for the microphone permission, and it is that recognizer which listens; it may process the audio on those companies' servers depending on your device or browser settings, and the app only receives the text. That text goes to Gemini to identify the foods, exactly as a typed description does. When Fuel.IA by voice is available, the "Voice" button opens that chat with Fuel.IA (section 3.5): you tell it what you ate, the conversation follows the path described there — including the reply spoken by Text-to-Speech — and the identified foods come back for you to confirm here. We do not keep the audio or the transcript: what is saved is the meal, if you confirm it.

Review before saving: in a meal analyzed by photo or text, you can correct the calories, protein, carbohydrates, and fats of each item and remove items. The name and quantity of items cannot be edited. Meals suggested in the chat can only be confirmed or discarded.

Data stored: the meal's title and time, the meal type (for example breakfast or pre-workout), the logging method, and, for each item, name, quantity, grams when the quantity is in grams, an emoji, calories, protein, carbohydrates, fats, fiber, and the confidence level of the estimate. We also store the day's totals (section 3.7). We do not store the photo or the text you wrote.

Favorites: you can keep a logged meal as a favorite, to repeat on another day. We store the name it gets (the list of foods), the items with the same data as a meal, and the totals, until you remove it in the favorites themselves.

Photos:

• The photo is sent to Gemini with the metadata recorded in it. A photo chosen from the gallery is reduced to up to 1280 pixels wide before sending, but the app copies the original metadata onto it, including the location where it was taken, when present. If you do not want this, turn off location recording in your phone's camera before photographing, or choose a photo without location.
• The app does not delete the photo after the analysis. The copy stays in the app's temporary area on the phone until the system clears it or you uninstall the app.
• Photograph only the plate. Avoid people, documents, and screens in the image.

After saving: you can change the time or delete the day's meals, in the list on the home screen. Meals from previous days can only be deleted by request via e-mail.

Shared food database: when you save an item with a quantity in grams (for example "150 g") and that food does not yet exist in the database, the app creates an entry with:

• the food's name, as it appears in the meal;
• the nutritional values per 100 g and a usage counter;
• the creation and update dates;
• your account identifier, which created the entry.

Our database rules allow any account connected to the app to read these entries and increase their usage counter. They are not deleted when you delete the meal. If you ask by e-mail, we remove the entries you created. When you request account deletion, we remove your account identifier from them (section 11). Avoid giving foods names that identify you or other people.

• Why: to calculate what you consumed, build your diary and history, and calculate the day's balance.
• Legal basis: consent (art. 11, I) for sending to the AI, asked on the "Before using the AI" screen before the first send and revocable at any time (section 5). For the other health data in this section, today the app does not collect consent in the specific and highlighted way the LGPD requires (section 5).

#3.5 Fuel.IA (AI chat)

• Only with your permission: nothing from the chat goes to Gemini before you tap Allow on the "Before using the AI" screen (section 5). Without it, Fuel.IA shows only its fixed greeting and asks for permission when you send the first message.
• What goes to Google Gemini: when you open the chat, the summary of your profile and your day described in section 3.6, together with a fixed greeting generated by the app, so Fuel.IA can write its first line about your day even before you type; after that, with each message of yours, the messages of the open conversation and the same summary. The on-screen greeting with your first name is not part of what is sent.
• Fuel.IA by voice: the chat's microphone icon opens Fuel.IA by voice. The app requests the microphone permission and uses the phone's own speech recognition (Google's on Android; Apple's on iPhone), which may process the audio on those companies' servers according to the device settings; the app receives only the transcribed text. That text goes to Gemini as a chat message, with the summary in section 3.6, and Fuel.IA's reply — which may contain your calories, macronutrients, weight and goals — goes to Google Cloud Text-to-Speech, which returns it as audio. That request goes through a function of ours on Google Cloud, hosted in São Paulo, which talks to Text-to-Speech on our behalf; it keeps neither the text nor the audio. Fuel.IA by voice works on the phone and in the web app. The spoken greeting does not include your name. We do not store the audio, the transcript or the reply: the spoken turns appear in the chat conversation and disappear with it. If you say you ate something, the text also goes to Gemini to build the suggested log entry (section 3.4).
• Storage: we do not store the conversations on our servers. They stay in the app's memory while the chat is open and disappear when you close it. Google keeps the requests to and responses from the Gemini API for 55 days, to detect abuse (section 6.1).
• Caution: avoid sending diagnoses, medications, or other people's data.
• Wrong answers: there is no button to report an answer. If it is wrong, or offensive, or dangerous, write to contact@pfengineer.tech with the date and the text.
• Legal basis: consent (art. 11, I) for sending to the AI, asked on the "Before using the AI" screen before the first send and revocable at any time (section 5). For the other health data in this section, today the app does not collect consent in the specific and highlighted way the LGPD requires (section 5).

#3.6 Insight of the day and the summary sent to the AI

• When the insight is generated: when you open the home screen, if you have allowed the AI (section 5), the app asks Gemini for a short message and a recommendation of protein, carbohydrates, and fats for the day — even on a day with nothing logged yet, from your profile, once your weight is known. Without permission, nothing is sent and the day's message comes from the app's own rules (an insight already generated that day may keep showing). On a free account, when the free plan's limit is in force, the insight is not requested from Gemini either: the card shows out of focus, with the message from the app's rules underneath (section 3.19). A new request happens only when the day's numbers change or you switch languages.
• The summary sent, in the insight and in Fuel.IA, contains:
  • sport (the name you typed, if you picked other), goal, age, weight, height, and target weight;
  • your eating pattern, when you picked one (biological sex is not sent);
  • number of meals, calories, and macronutrients consumed during the day;
  • calories burned in the day's workouts and, for each workout coming from Strava, the name you gave the activity, the type, the calories, the distance, and the duration;
  • the day's balance, calculated here as what was consumed minus only the workout calories, and the target balance;
  • estimated basal metabolism, reported as a separate number;
  • the day's target intake and how much still fits, computed from the numbers above (in Fuel.IA, also split across the main meals still ahead);
  • when present, body fat percentage, weight change, and lean mass change;
  • the time and weekday at the moment of the conversation (Fuel.IA only, not the insight);
  • the target date for your weight and, computed from it and your weight, the required weekly pace and the prudent limit;
  • reference ranges the app computes from your weight, goal and kind of day (protein per day and per meal, minimum fat and carbohydrate on a training day);
  • the kind of training day (rest, easy, long or recovery), today's training minutes and yesterday's kind of day and training minutes;
  • for each workout, the start and end time, whether the calories were measured by Strava, estimated or unknown and, when present, the average heart rate and power;
  • whether the post-workout window is open or closed and the time the last workout ended (Fuel.IA only);
  • for each meal of the day, the time, the meal type, the title when it differs from the type, the calories and macronutrients and, for each item, its name and quantity (the photo, the original text, the emoji and the food identifier do not go); in Fuel.IA, also how long ago the last meal was and which meals and snacks are still ahead;
  • the fiber consumed during the day;
  • in Fuel.IA, the macronutrient recommendation already generated for the day and how much of each is still missing;
  • yesterday's totals: calories consumed and protein, workout calories, number of meals and of workouts;
  • how many consecutive days you have logged something;
  • how many days ago your last weigh-in was;
  • when you have a race added, the main race or the next one: the name you gave the race, sport, distance, elevation gain, time goal, the duration the app estimates, the date, how many days are left and the preparation phase (section 3.15);
  • when you log your sleep: the hours slept last night, the stages (light, deep and REM) and the morning HRV, if given, the average of your recent nights and your HRV compared with your own average of the previous 7 days (section 3.16);
  • warnings the app computes when they apply: target intake below basal metabolism, a workout without measured calories, and age under 18.
• What does not go: name, e-mail, account identifier, and profile photo. Note: the activity name on Strava, the meal title, the names of meal items and the race name are free text (the app strips links, e-mails and long digit runs before sending). If they contain any other personal information, it goes along with them.
• What we store: the day's insight (message, tone, and recommended macronutrients) and a code with the numbers that generated it: calories consumed and burned, basal metabolism, target balance, number of meals and of workouts, the language and, when there is one, the race's identifier, date and phase, and last night's hours slept and HRV.
• Legal basis: consent (art. 11, I) for sending to the AI, asked on the "Before using the AI" screen before the first send and revocable at any time (section 5). For the other health data in this section, today the app does not collect consent in the specific and highlighted way the LGPD requires (section 5).

#3.7 Strava (if you connect it)

Connecting Strava is optional.

• How the connection happens: when you tap Connect (right after the initial setup, on the home screen, or in Settings), the app opens Strava's authorization page directly. On the phone, the page opens in a system browser tab; in the web app, in the browser itself. The browser comes back to our site with a code, and what exchanges that code for the access keys is a function of ours on Google Cloud, hosted in São Paulo — neither the browser nor the app sees the client secret or the access keys. The app does not show a screen of its own beforehand about the imported data. We ask Strava for permission to read your profile and your activities, including private ones (read and activity:read_all).
• Right after authorization: we import your profile and your 30 most recent activities. After that, each time the home screen loads, we import the new activities.
• When a new workout reaches Strava: Strava tells our server. That notice carries only the activity's identifier, the identifier of your Strava account, and the time, and it is kept so the same workout is not handled twice. With it, one of our functions fetches the activity from Strava and decides whether to send the notice after a workout (section 3.14). That lookup does not store the activity: it only enters your history when the home screen loads.
• Profile data stored: Strava athlete identifier, first name, last name, photo, city, and country.
• Data stored for each activity: name, type, date and time, distance, moving time, average speed, average power, average heart rate, elevation gain, and estimated calories. We also store the complete response that Strava sends for the activity, which may include the summary polyline of the route and the start and end coordinates.
• Data calculated from them: calories burned, the day's balance, total distance, number of workouts, a summary of the day's main workout in the history ("activity name · km"), and the connection state (athlete identifier, permissions, and sync dates).
• Where it appears: only to you, on the home screen and in the history, for any date. It also enters the summary sent to Gemini (section 3.6) and the code stored with the insight.
• Retention: it stays in your account with no automatic deletion. Activities deleted or changed on Strava after being imported are not updated in FuelBalance.
• Access keys: they stay on our server (Firestore, at athletes/{your id}/private/strava), written and read only by our Google Cloud functions; the database rules deny that path to any app — on the phone and in the browser alike. The connection belongs to the account: it works in both places at once and survives signing out and changing devices.
• Old keys on the phone: earlier versions of the app kept the keys in the device's secure storage. The current version deletes those keys from the phone the first time it runs; if the connection existed only on the phone, Strava shows as disconnected and reconnecting is one tap. On iPhone, the old storage (Keychain) may have entered the device's encrypted backup.
• Disconnecting: the link in Settings — on the phone and in the browser — revokes our access at Strava and deletes the keys; the sessions already imported stay in your account until you ask for their deletion by e-mail or delete the account. Signing out does not undo the connection. You can also revoke access in Strava's own settings (https://www.strava.com/settings/apps).
• Strava itself handles your data according to its privacy policy (https://www.strava.com/legal/privacy).
• Legal basis: consent for health data. Today the app does not collect this consent in the specific and highlighted way the LGPD requires (section 5). The connection only happens if you authorize it on Strava's page.

#3.8 App usage data (Amplitude)

Events sent: each screen opened (for example home, history, meal logging, chat, profile, and Settings), taps on some buttons, with little information about the tap, and the result of some actions:

• login and phone linking: that you requested the SMS code or a resend and on which screen (login or Settings), and that you opened the option to link a phone. The number and the code are not in the events;
• meal logging: the mode chosen (photo or text), that you requested the analysis, the number of items confirmed, that you used a shortcut from the "Quick" section (without saying which), that you edited values, removed an item, or changed how many of a food there were (without saying which food or how many), and the confidence level of the on-device recognition suggestion you chose;
• chat: that you sent a message and its length in characters, the number of items of a suggested meal that you logged, and that you changed how many of one of its foods there were (without saying which or how many);
• others: tabs used, that you opened the app by tapping a notification (and the screen it led to), that you opened a workout, Fuel.IA (and from where), a weigh-in, the goal, the profile, or Settings, tapped to log a meal (and from where) or to connect Strava (and from which screen), deleted a meal (by swiping or with the button), changed a meal's time, confirmed a goal (without saying which), switched language (Portuguese or English), opened these documents (and from where), tapped to subscribe (monthly or yearly, and from where), tapped Fuel.IA, its insights or the race strategy while on the free plan, saw the Pro screen (and what led to it: the day's meal limit, Fuel.IA, photo or voice, the insights or the race strategy), left the initial setup from its first screen, tapped to save the plan when finishing it, confirmed the mobile number at its end, or, through it, signed in to an account that already existed;
• initial setup: each step of the setup counts as a screen opened (for example the goal step or the training week step), without the answers you gave in it;
• result of actions: whether the action worked or failed and, when it fails, the kind of failure (for example "no connection" or "plan limit"), never the error's text. This covers: sending and confirming the SMS code (at login and when linking a phone, and whether it was a resend); the analysis of a meal (with the mode and the number of items found) and saving it (from the logging screen or from Fuel.IA); Fuel.IA's reply; connecting and disconnecting Strava; authorizing the health reading (section 3.18); turning on meal reminders; saving the plan at the end of the setup, a weigh-in (without the value), and a race (without saying which), and deleting a race; deleting the account; and the subscription, when the plan becomes paid while the app is open;
• sessions: the start and end of each app usage session, sent automatically by Amplitude.

Identifiers: your FuelBalance account identifier and a device identifier generated by Amplitude. Your name and your mobile number do not go to Amplitude.

Account characteristics: along with the identifier, Amplitude keeps the plan (free, on trial, or Pro, and whether the subscription was cancelled), whether Strava is connected, whether the health reading is authorized, whether meal reminders are on, and the language chosen in the app. They serve to compare usage between groups of accounts, for example those who subscribe and those who do not.

Technical data: operating system and version, device model, manufacturer, and brand, app version, Android API version, language, platform, and country.

What we turn off in the app: the app does not include in the events the IP address, city, region, carrier, latitude and longitude, advertising identifier, App Set ID, or IDFV, and it does not use the device's location. The events do not carry message text, photos, food names, calories, macronutrients, weight, body fat, the chosen goal, or workout data.

IP address: as in any internet connection, your phone's IP address reaches Amplitude's servers when the events are sent. We configure the app not to include this address in the events.

Amplitude's own use: Amplitude's terms of service allow it to use the data we send, including with machine learning, to improve its services (section 7).

• Where: Amplitude's servers in the United States (section 8).
• Why: to understand how the app is used, find problems, and decide on improvements.
• Legal basis: legitimate interest. Today there is no option in the app to turn off this sending. If you object by e-mail, we delete at Amplitude the usage data linked to your account identifier, but today we cannot prevent the app from continuing to send new events while you use it. To stop the sending, stop using the app and request account deletion.

#3.9 Technical data and connections

• Remote configuration: on opening, the app queries Google's Firebase Remote Config to find the addresses of these documents. For this, Firebase uses an app installation identifier and technical data about the app and the device.
• Direct connections: your phone connects directly to Google's servers (Firebase and Gemini), Strava's, and Amplitude's. All of them receive the connection's IP address.
• Access logs: today we do not keep access logs of our own (IP address, date, and time). The providers may keep technical logs according to their own rules.
• Legal basis: legitimate interest, so the app works and stays secure.

#3.10 Phone permissions

• Camera: requested when you open the camera to photograph a meal.
• Photos: you choose the photo in the system picker. The app receives only the chosen photo.
• Microphone and speech recognition: requested when you open Fuel.IA by voice from the chat's microphone icon (section 3.5) or use the "Voice" button to log a meal (section 3.4). Speech recognition is the phone system's or, in the web app, the browser's.

• Health Connect (Android) and Apple Health (iOS): requested only when you tap Connect in Settings → Connectors. Three read permissions — weight, body fat, and sleep — and nothing else (section 3.18). The app asks for no write permission and has no way to record anything there.

FuelBalance does not access the phone's GPS location or your contacts.

#3.11 Data stored on your phone

• Local copy of the database: Firebase keeps a copy on the phone of the data the app read or wrote, so it can work without internet: profile, meals, weigh-ins, insights, daily totals, and Strava activities, including the complete Strava response.
  • This copy is not deleted when you sign out of the account. It disappears when you uninstall the app or clear its data in the phone's settings.
  • On Android, the system's automatic backup was not disabled in the app, so this copy may go to your Google account backup. On iPhone, it may enter the iCloud backup, according to your settings.
  • If you lend or share the phone, keep this in mind.
• Strava access keys: see section 3.7.
• Language preference: stored in a local storage of the app.
• Connection to Health Connect or Apple Health: a local note that you connected (on iOS) or disconnected (on Android), with the date, so the app knows whether to read. It does not leave the phone.
• Meal photos: in the app's temporary area (section 3.4).
• System log: all versions of the app write some technical data to the phone's system log, such as the account identifier when saving meals, setup and the Strava connection, and the names of the identified foods. Development versions, which may be used in testing, also write the text of the messages to Fuel.IA, the summary sent to the AI, the AI's responses, and the reads and writes to the database. This log stays on the phone and can be read by anyone who connects the device to a computer with developer tools.
• Strava login through the browser: if you signed in to Strava through the phone's browser to connect, that session is controlled by the browser and by Strava.

#3.12 The fuelbalance.app website

Site visits (Amplitude)

• Data: pages viewed (the full page address, including link parameters such as ?lang=pt, the domain, the path, and the title), the start and end of sessions, a random identifier for the browser and the session, the browser and system (reported by the browser), language, and time.
• What is turned off: session recording, clicks, forms, campaign source, downloads, performance, network errors, and the IP address in the events. The site also does not allow these options to be turned back on from the Amplitude dashboard. Note: because the full page address is sent, parameters that are in the link (for example utm_source) go along with it.
• Identifier: it stays in the browser's session storage and disappears when you close the tab. The site does not use cookies to identify you.
• IP address: it reaches Amplitude's servers on the connection, as in any access over the internet.
• Where: United States (section 8).
• Why: to measure interest in FuelBalance and improve the site.
• Legal basis: legitimate interest. The site has no button to decline this measurement. You can block third-party scripts in your browser or write to us.

The pages of this policy and of the Terms of Use load neither Amplitude nor other third-party services.

Site language: if you choose a language, the site stores that choice in the browser's local storage (fb_lang) until you clear your browser data.

Hosting: the site is delivered by Google's Firebase Hosting, which receives the IP address and the technical data the browser sends on any access.

Waitlist

• Data: name (optional; if left blank, we store a dash), e-mail, the page's language, the date and time of sign-up, and the source "landing".
• Where it lives: it is sent from your browser straight to our database in Google Cloud Firestore, in the São Paulo region.
• Why: as the form says, to send the invitation to the beta and FuelBalance news. We do not use the list for any other purpose and we do not share it.
• Legal basis: consent, given when you submit the form.
• To leave: write to contact@pfengineer.tech. Removal is done manually. Today there is no automatic unsubscribe link.

Instagram: the link to our Instagram profile only takes you to Meta's site if you click it.

Download link (fuelbalance.app/baixar): this page loads neither Amplitude nor any other third-party service, and stores nothing. It only checks, in your own browser, whether the device is Android, iPhone or a computer, to pick the destination: on Android it opens Google Play; on iPhone, the App Store; on a computer, it shows a QR code. Google Play receives the campaign label that is already in the link (for example, instagram), which the store uses to count where installs came from. Nothing about you goes into that label. The App Store receives nothing but the app's address. On Google Play, Google's privacy policy applies; on the App Store, Apple's.

#3.13 When you contact us

If you write to contact@pfengineer.tech, we process your name, your e-mail, the content of the message, and the history of the conversation, to respond to and resolve the request.

• Legal basis: performance of the contract, compliance with a legal obligation in requests about LGPD rights, and the regular exercise of rights.
• If the message brings health data, we use that data only to handle the request.

#3.14 Reminders and the notice after a workout, by notification (optional)

• How it works: in Settings you can turn on meal reminders. The device asks for the notification permission and registers a push token — an identifier created by Google's Firebase Cloud Messaging that lets us deliver notices to that device. On an iPhone, delivery also goes through Apple's notification service (APNs): Google hands the notice to Apple, which takes it to the device.
• Data: the token, the platform (web, Android or iPhone), the device's time zone and, on Android, whether the installed version of the app shows the notice after a workout itself (that is what brings the button described below), stored in your profile in the database (pushTokens). For the notice after a workout, also the time the last one was sent, stored in your profile.
• Why: for two notices, and only those. We never use the tokens for marketing.
  • Meal reminders: a nudge at 9am, 1pm, 4pm and 7pm (Brasília time) when that window's meal was not logged. Whoever already logged hears nothing.
  • The notice after a workout, only for those who also connected Strava (section 3.7): when a workout of 20 minutes or more reaches Strava, ended less than 3 hours ago, and you have not logged a meal after it. At most one notice every 4 hours. When the WhatsApp channel is active and your last message to us is less than 23 hours old, the notice goes there instead of the notification (section 3.17).
• What the notice after a workout says, and from which data: the title carries the name you gave the workout on Strava, its distance, and its calories. The text suggests how much protein and, for workouts of an hour or more, how much carbohydrate to eat back — for example "25–30 g of protein and 80–95 g of carbohydrate". Those grams are worked out on our server from the weight and the goal in your profile and from how long the workout lasted: the weight and the goal are not written in the notice, but the suggestion comes from them. With no weight in your profile, the notice carries only the general protein range. The notice also gives examples of foods in those amounts — for example "1 scoop of whey + 1 slice of white cheese" —, chosen by the time it arrives and by the eating pattern in your profile: if you chose plant-based, you get only plant foods. The eating pattern is not written in the notice either. This is health data (section 5).
• Where the notice travels: the text of each notice is delivered by Google's Firebase Cloud Messaging and, on an iPhone, by Apple as well. It may show on the device's lock screen, depending on your phone's notification settings. Tapping a notice opens the app on the screen where a meal is logged. The notice after a workout also carries a Log a meal button, which leads to the same screen. On Android, for the app versions that show that button, the notice reaches the device as data and the app itself draws it on the screen, with the same text; it is not kept anywhere besides the notification.
• How to turn it off: disable reminders in Settings — the device stops receiving the reminders and the notice after a workout right away (there is no switch for the notice alone), and the token stays stored, marked as off, until you delete your account — or block the notifications: the site's, in the browser; the app's, in the phone's settings. Disconnecting Strava (section 3.7) also ends the notice after a workout.
• Legal basis for the notice after a workout: consent for health data. Today the app does not collect this consent in the specific and highlighted way the LGPD requires (section 5).

#3.15 Races

• Data: race name, date, sport, distance (optional; for triathlon and duathlon, each leg's), elevation gain (optional), priority (A, B or C), time goal (optional, in hours, minutes and seconds), the weight you want to be on race day (optional) and whether it is your main goal. When you pick the race from the app's list, we also store which race on the list it was (a public identifier, the same for everyone). The main race is also copied to your profile.
• How it arrives: you pick it from the list of the main races in Brazil that comes with the app, during the first setup or under Profile → Races, where you can also type in your own. The list only holds public information from the organisers' sites (name, date, city, distances) and lives in the app itself: searching and browsing it sends nothing to us. You can edit and delete races in the app.
• What for: showing how many days are left, marking the day on the history calendar, adjusting the day's target and giving the AI context (section 3.6). When a race is your main goal, its date becomes the deadline of your target weight and the day's target asks for no deficit in the last week before the race, on race day and on the two days after it. On the home screen, the app shows on how many of the last 7 days the balance landed close to the target, computed from the daily totals we already store.
• Legal basis: consent for health data. The race, together with your weight and goals, concerns your training and your eating. Today the app does not collect this consent in the specific and highlighted way the LGPD requires (section 5).

#3.16 Sleep and HRV

• Data: hours slept last night, the split into light, deep and REM sleep (optional), the morning HRV in milliseconds (optional), the date (the morning you woke up) and the source of the entry.
• How it arrives: you enter it in the app, on the Rest card of the home screen, or, if you allow it, the night comes from Health Connect / Apple Health (section 3.18), written there by your watch's own app. A night you logged by hand is never replaced by what comes from there. You can correct the night in the app. Today it is not possible to delete a sleep entry from within the app. For that, write to us. HRV is still only what you type: we do not read HRV from anywhere.
• What for: showing the night on the Rest card, the average of your last 7 nights and the HRV compared with your own average of the previous 7 days — never with a population table — and giving the AI context (section 3.6): a short night changes the day's recommendation.
• Legal basis: consent for health data. Today the app does not collect this consent in the specific and highlighted way the LGPD requires (section 5).

#3.17 Conversation on WhatsApp

This channel is paused today. Whoever writes gets a single automatic message asking them to use the app, and nothing they sent is downloaded, analysed or stored. What follows is how the channel works when it is active, and it covers the conversations that already happened.

• Who talks to whom: the channel is run by FuelBalance on the WhatsApp Business number we publish. What speaks on our side is a program, not a person. We only reply: we never start a conversation with someone who has not written first.
• Data: your phone number, your WhatsApp profile name when it comes with the delivery, the content of what you send (text, photo of the plate, voice note, caption and taps on buttons), the identifier of each message, and the moment of the last message you sent us.
• How it arrives: through Meta's WhatsApp Business Platform. Meta delivers the messages to our server and, as in any WhatsApp conversation, processes that data under its own terms and privacy policy.
• What for: identifying the meal and logging it in your day, answering what you ask about your day, creating your account when you ask for it, reminding you of a meal if you turn reminders on, and, for those who connected Strava, sending the notice after a workout here (section 3.14) when your last message to us is less than 23 hours old.
• What happens to the photo and the voice note: they are sent to Google's Gemini to be read, exactly like the meals logged in the app (sections 3.4 and 6.1). We do not store the photo or the audio: what stays is the result, that is, the items, quantities, calories and macros of the meal.
• What stays on our server: the meal in your day; the state of the conversation, so that "that's right" and "adjust" mean something (whatever you send before the account exists is kept for a few minutes and then discarded); the identifiers of the messages already answered, so none is answered twice; the moment of your last message; and, if you turn reminders on, that choice with its date.
• Your account is born in the conversation: if you have no account and tap Create my account, your WhatsApp number becomes your FuelBalance login, and that tap is your acceptance of the Terms of Use and of this policy. Until you tap, nothing you sent is analysed.
• Health data: the photo of the plate, what you write about what you ate and the questions about your day are health data, and Fuel.IA's answer uses your day's summary (section 3.6).
• Legal basis: consent for health data. The acceptance is the tap on Create my account; today it is not collected in the specific and highlighted way, per purpose, that the LGPD requires (section 5).
• How to leave: write "parar lembretes" to turn reminders off, block the number on WhatsApp to stop receiving anything, or ask for your account to be deleted (section 11). The notice after a workout stops arriving here if you disconnect Strava or go 23 hours without writing to us. Deleting the conversation on your phone does not delete what was already logged in your day.

#3.18 Health Connect (Android) and Apple Health (iOS)

This connection is optional and starts switched off. It exists so you do not have to type what your scale and your watch already recorded.

• Data: weight, body fat percentage, and sleep — the length of the night and, when your watch records it, the split into light, deep, and REM sleep. We read the last 30 days.
• How it arrives: you tap Connect in Settings → Connectors and the system itself (Health Connect on Android, Apple Health on iOS) asks what you allow. Whoever wrote those numbers there was your scale's or your watch's app, not us. Once allowed, the app reads on open and whenever you come back to it.
• Read only: FuelBalance writes nothing to Health Connect or Apple Health, and asks for no permission to do so. We also do not read workouts from there: workouts come from Strava (section 3.7), and reading both would count the day's burn twice.
• What for: to become your weigh-ins (section 3.3) and your nights (section 3.16) inside the app, with the same purposes and the same destination described there. What you logged by hand is never replaced.
• Where it stays: in your record in Firestore, alongside what you type, and subject to the same retention and the same deletion (sections 9 and 11). None of it goes to Amplitude, which only learns whether the reading is authorized (section 3.8), or is used for advertising — we show no advertising.
• How to switch it off: inside the app, in Settings → Connectors → Disconnect: the reading stops at once. On Android, Health Connect withdraws the permission when the app is closed. On iOS, the app stops reading, but the system permission stays until you remove it in Settings → Health → Data Access & Devices. Outside the app, on Android: Health Connect → App permissions → FuelBalance. Revoking stops the reading immediately. What was already copied into your day stays in the app: to erase it, ask for deletion (section 11).
• Legal basis: consent for health data. Here the consent is the system's own, specific per data type and revocable at any time — it is the point where the app comes closest to what the LGPD requires (section 5).

#3.19 Subscription and payment (Stripe, Google Play and the App Store)

There are two ways to subscribe, and in neither does FuelBalance see your card details.

On the website. When you tap subscribe on FuelBalance web, you are taken to a payment page hosted by Stripe (buy.stripe.com), which is who charges you. On WhatsApp, when the day’s free logs or question run out, the reply may carry links to that same page (section 3.17).

• Data you enter on Stripe’s page: email, name, phone number and your card details. None of it passes through FuelBalance: the page is Stripe’s, and the app never sees, receives or stores a card number.
• What FuelBalance sends along: your account identifier, appended to the address of the payment page. That is all, and it serves one purpose — knowing whose payment it is when Stripe tells us. Without it, the money arrives with no owner.
• What Stripe sends back: automatic notices that a payment came in, failed, or that the subscription ended, with the customer identifier at Stripe. On our side we keep only the state of your plan (free or paid, how long it is good for, and whether a payment failed) and the link between the Stripe customer identifier and your account.
• The phone number: the payment page asks for it because the Brazilian tax receipt (nota fiscal) and billing support need it. We do not use that number to send you marketing, on WhatsApp or anywhere else — and it is not necessarily the same number you sign in with.
• Why: to charge the subscription, unlock the paid features and keep the plan current.
• Legal basis: performance of a contract (art. 7º, V) and, for keeping payment records for tax purposes, legal obligation (art. 7º, II).
• Stripe is also a controller of the payment data it receives: it has its own fraud-prevention and financial-regulation obligations, and processes that data under its own privacy policy.
• Tax receipt: we issue it ourselves, outside Stripe, using the name given at checkout.

In the phone’s store. In the Android app the subscription can be bought through Google Play, and in the iPhone app through the App Store: the purchase screen is the store’s, the payment goes to the store with the payment method on your store account, and the store is who charges, renews, cancels and refunds, under its own rules. Between the store and FuelBalance sits RevenueCat, a service that confirms the purchase with the store and tells us when it starts, renews, fails or ends.

• Data the store receives: those of your store account (Google or Apple) and the payment method registered there. None of it passes through FuelBalance.
• What FuelBalance sends RevenueCat: your account identifier at FuelBalance, so the purchase is tied to it, and what the app needs to talk to the store (device and installation identifiers generated by the service itself, the device model and the system version). We do not send your name, email, phone number or anything you log in the app.
• What RevenueCat keeps: your account identifier, the identifiers of your purchase in the store (not the card number) and the subscription history — start, renewals, cancellation, refund, failed charge. It processes that data as our processor, under its own terms.
• What comes back to us: automatic notices that the subscription started, renewed, had a charge declined, was cancelled, paused or refunded, with the date it is good through. On our side we keep only the state of your plan (free or paid, through which store, how long it is good for, and whether a payment failed), the same as for Stripe.
• Restore purchases: the button with that name asks the store for purchases already made on your store account — on a new phone, for instance — and ties the plan to your FuelBalance account.
• Why: to charge the subscription, unlock the paid features and keep the plan current.
• Legal basis: performance of a contract (art. 7º, V).
• Google and Apple are controllers of the payment data they receive in their stores, and process it under their own privacy policies.

The free plan’s limit. When the subscription is on sale, the free plan logs up to 3 meals a day, by text, with the shortcuts or from the favorites, and Fuel.IA (the chat and the daily insights) and logging by photo and by voice are on the paid plan; the paid plan has no limit.

• What we count, per day: how many meal analyses the AI ran, how many meals you logged with the shortcuts and favorites, and how many questions you asked Fuel.IA, in the app and on WhatsApp. We also keep a random code for each question, created by the app, so that retrying a reply that failed does not count twice. We do not keep the text of the question or what was logged in this count.
• Where it lives: on your account, one record per day. The AI and question numbers are written by our server; the shortcuts and favorites one by the app, and the database rules only let it grow.
• Why: to apply the free plan’s limit and to know what the service costs for each plan.
• Legal basis: performance of a contract (art. 7º, V).
• For how long: while the account exists; they are deleted with it (section 11).
• Receipt and refunds: the receipt for a store purchase is issued, and refunds are processed, by the store itself, under its rules.

#3.20 Crash reports (Firebase Crashlytics)

This applies to the phone app (Android and iPhone), in versions published from October 4, 2026 on. The web app sends no crash reports.

• When: when the app crashes or hits an error it could not handle. The report is put together on the device and sent, as a rule, the next time the app opens.
• What the report carries: the kind of error (for example, "format error") and, when there is one, its code (for example, permission-denied); the sequence of functions that were running; the moment of the failure; and the app's identifier and version. According to Google's documentation, Crashlytics adds by itself data about the device and its state at that moment: model, processor architecture, amount of memory and disk space, system name and version, whether the system is modified (root or jailbreak), whether the app was in the background, the screen rotation, and whether the proximity sensor was triggered.
• Identifiers: installation and session identifiers created by Firebase. They tell one device and one session of use from the others, but they are not your account identifier: the report does not tell us who you are.
• The text of the error: for the app's own errors, the app sends only the kind of error and drops the text, because it can repeat a piece of what the app was processing — a food's name, a number. The case we do not control: when the failure happens in a system or library component, it is Crashlytics that puts the report together, and it includes the name and the technical message of that error. That message is written by the component, not by the app, and we have no way to filter it.
• What is not part of the report: photos, meals, weight, workouts, messages, your mobile number and your account identifier.
• IP address: it reaches Google's servers with the connection, as with any access over the internet.
• Where and for how long: Google's servers, which may be outside Brazil (section 8). Google states that it keeps the reports for 90 days.
• Why: to know that the app failed, in which version and at which point in the code, so we can fix it.
• Legal basis: legitimate interest. Today there is no option in the app to turn off this sending. Because the report does not carry your account identifier, we cannot find or delete the reports of a specific person, not even when they delete their account: they expire by themselves after 90 days.

#3.21 Sharing with a dietitian or coach (FuelBalance Pro, optional)

Takes effect on October 9, 2026, and only happens if you allow it.

• How it works: a dietitian (CRN) or physical education professional (CREF) registered on FuelBalance Pro sends you an invite link (or a request by your mobile number, as in the next item). When you open it, signed in to your account, you see their name, council and registration number, write the name they will call you by, and choose what they can see, in separate scopes. They only see anything after you tap Allow access. The name, council and registration number are given by the professional; we clear each sign-up by hand or, when the professional sends a photo of their council card and it matches what they typed, at once and automatically; today we do not check the registration with the council, so the automatic clearing trusts the photo.
• Invite by your mobile number: instead of the link, the professional can type your mobile number on the panel. We use the number only to look for a FuelBalance account with it; the number typed is not kept. If the account exists and its setup is finished, you get a request on the Professionals with access screen — with the professional's name, council and registration number and the date — and, if notifications are on for the device and the app is up to date, a notice. See request leads to the same invite as the link; Decline shows nothing of yours and does not tell the professional, and their requests by your number stop reaching you. The professional is never told whether the number has a FuelBalance account: the answer is the same either way, and the panel offers to open their WhatsApp, with the message and the link written, for them to send to the number. That conversation is between you, on WhatsApp, outside FuelBalance. To prevent abuse, we count how many numbers each professional tries per day (only the count, not the numbers), and the same request does not reach you more than once a week.
• What they can see, by scope:
  • Meals: from the 14 days that ended yesterday and today — per day, the calories eaten, protein, carbohydrate, fat, fiber and the number of meals; when opening one of those days, each meal with its time, how it was logged (photo, text, voice or by hand), the items, amounts, grams, the confidence of the analysis and the text you wrote or said. Not older days. Not the photos either, because they are not kept.
  • Body: weigh-ins and body fat percentage from the last 180 days (except those that came from Strava), height, age, sex, the basal metabolism the app estimates, the target weight and its deadline.
  • Sleep: the hours of each night, the phases and the morning HRV, from the last 14 days.
  • Always, with any scope: the name you wrote on the invite, your sport and your goal.
• What they never see: workouts, calories burned, balance, balance targets and the Fuel.IA insights — they come from Strava or are worked out with its data, and Strava does not allow them to be shown to anyone else —; the name on your profile (they see only what you write on the invite), your mobile number and e-mail; the conversation with Fuel.IA; the photos.
• How they see it: the professional does not access our database. On every read, a server of ours checks that your permission is active and within its term and hands over only the scopes you allowed, cut field by field and limited to the windows above.
• Term and how to take access away: access lasts 180 days. In Settings → Professionals with access you see who has access, what they can see and until when, and take access away right there, at any time: it takes effect at once. Deleting your account also ends every access.
• Who viewed my data: every time the professional opens your data — the day's list, your file or a day in detail — it is recorded: the day, how many times, what was opened and, for a day in detail, which day. You see that record on the same screen. It is written before the data leaves our server: if writing it fails, the professional receives nothing. The professional's list of athletes shows only the name you wrote, the scopes and the dates of the access, without a record — including after you take access away, so they know the access ended.
• The consent record: we keep every permission and every withdrawal, which the app cannot change. For a permission: the professional, the scopes, the date, the version and language of the text and a fingerprint (SHA-256 hash) of the exact text you read on the screen. For a withdrawal: the professional, the date and who ended the access (you, or the deletion of the professional's account).
• What the professional does with what they saw: they receive this data to follow you and become responsible for it, under the LGPD and their council's rules, including professional confidentiality. What they already saw or noted stays with them after you take access away, as in a consultation.
• Legal basis: specific and highlighted consent (art. 11, I), given on the invite screen, per scope and per professional.

If you are the professional: we keep the name, council, registration number and e-mail you give, the status of your sign-up (waiting or cleared), the code of your invite link, the thresholds you adjust in the triage, the list of athletes who gave you access and how many mobile numbers you tried each day (only the count; the numbers are not kept), besides the mobile sign-in account (section 3.1). If you send, at sign-up, a photo of your council card (optional), it goes to Google Gemini (section 6.1), which reads the name, council, region, registration number, whether a validity date has passed and whether the photo looks edited or is a photo of a screen or a copy. We do not ask the AI for, nor keep, the card's other data (CPF, RG, birth date, parents), and the photo is not kept: we keep only what was read and the score. The score comes from a rule of ours that compares what was read with what you typed — the council and the number must match exactly, and the name at least by first and last name —; at 80% or more, the panel opens at once, without a human review. Below that, a person checks. The automated decision only clears: it never refuses or suspends a sign-up, and you can ask for a review of any decision about your sign-up at the e-mail in section 16 (LGPD art. 20). We read at most 5 photos per account per day. Legal basis: performance of a contract (art. 7º, V) and legitimate interest (art. 7º, IX) in checking who may receive athletes' health data. We use the e-mail only for the sign-up notices — that it arrived and that the panel was cleared —, sent through Resend (section 6.1). Legal basis: performance of a contract (art. 7º, V). Once cleared, you delete the account from the panel itself, which ends at once the access athletes gave you; while the sign-up waits or is suspended, ask for the deletion or a correction by e-mail (section 16). Your name, council, registration number and account identifier remain in the records of the athletes who gave you access — the ended access, the consent records and "Who viewed my data" — for as long as their accounts exist: it is their proof of who saw their data.

#4. Summary of purposes and legal bases

#5. Consent for health data: how it works today

The LGPD allows health data to be processed with the person's specific and highlighted consent. We want to be clear about how this happens today in FuelBalance:

• Sending to Google Gemini has a consent screen of its own. When you first open the home screen — and, if you answered Not now, again before the first send: the first meal analysis or the first message to Fuel.IA — the app shows the "Before using the AI" screen: it says what goes to Google, what Google does with it, and what still works without the AI, with the buttons Allow and Not now. Without Allow, nothing goes to Gemini. We keep on your account the answer, the date it was given or withdrawn, the version of the text you saw, and the type of device, so that we can demonstrate the consent.
• To withdraw this consent, write to contact@pfengineer.tech asking to turn the AI off: we record the withdrawal on your account and, from then on, the app stops sending, free of charge; if you want to use the AI again, it asks again. When the Use Google's AI option is available in Settings → Artificial intelligence, you can also turn it off there, at once.
• Showing your data to a dietitian or coach has a screen of its own too. On the FuelBalance Pro invite, you choose the scopes and tap Allow access; we keep the record with the fingerprint of the text you read, and you take access away in Settings → Professionals with access (section 3.21).
• For everything else, there are no consent screens yet. There are no separate options to authorize or refuse the use of health data, the transfer outside Brazil, or the Strava import.
• Apart from the AI screen and the FuelBalance Pro invite, the only notice appears on the screen where you enter your mobile number — at the end of the initial setup or, if you already have an account, at login: "By continuing, you agree to the Terms of Use and the Privacy Policy", with links to the two documents. During setup the questions come before this notice, but the answers are only saved after you confirm your number (section 3.2); the Strava connection screen comes after.
• We process your health data from the moment you confirm your number at the end of setup, after this notice — before that, the answers stay only on your device — and from then on as you use the app or connect Strava.
• We keep no record of when you saw the notice or of the version of these documents at that time.
• You can use the app without the AI. Refusing the AI, you keep logging with the "Quick" section shortcuts and by hand, and the day's message is worked out on the phone; analysis by photo, text, and voice with Gemini, Fuel.IA, and the insight stay off. The other separate choices that exist today are not connecting Strava and not authorizing the Health Connect or Apple Health reading.

If you do not agree, do not use the app. If you have already used it, write to contact@pfengineer.tech requesting the deletion of your data (section 11).

To withdraw your consent, at any time and free of charge, write to the same e-mail. Since the app does not work without this data, honoring the withdrawal means erasing your health data, which in practice ends the use of the account. The withdrawal applies from then on.

#6. Who we share with

We do not sell personal data, we do not show advertising, and we do not share your data with partners or for third-party marketing.

#6.1 Providers we use to deliver the service

About these providers:

• Google Gemini: we use the Gemini API with billing enabled, which makes it a paid service under the Gemini API terms (version updated April 28, 2026). Under those terms, Google says it does not use the requests or the responses to improve its products, that it treats them as a processor, according to Google's data processing addendum for products in which it is a processor, and that it logs them only to detect and prevent violations of its Prohibited Use Policy and for disclosures required by law or by authorities. It also says this data may be stored temporarily in any country where Google or its agents have facilities. On the Gemini API usage policies page, Google states that it keeps the requests, the context sent, and the responses for 55 days for this purpose and that authorized Google staff may access this data for human review. The terms: https://ai.google.dev/gemini-api/terms
• Meta (WhatsApp): the conversation happens inside WhatsApp, so Meta also processes this data on its own account, under its own terms and privacy policy (https://www.whatsapp.com/legal/privacy-policy). We have not signed a negotiated contract with Meta: the standard WhatsApp Business Platform terms apply. Message content is end-to-end encrypted between you and our server, and it is on our server that it is read to produce the reply.
• ML Kit: according to Google's documentation, ML Kit sends data such as device and app information, device or installation identifiers, performance metrics, configuration, the size of inputs and outputs, and error codes. It does not send the photo.
• Contracts: we have not signed negotiated contracts with any of these providers. We use each one's standard terms, which already carry data processing rules: the Firebase terms include the Firebase data processing terms; the paid Gemini API terms refer to Google's data processing addendum for products in which it is a processor; and Amplitude's terms of service include a data processing addendum. Amplitude's addendum does not carry standard clauses approved by the ANPD or another LGPD mechanism for the transfer to the United States (section 8).
• Privacy policies: Google (https://policies.google.com/privacy) and Amplitude (https://amplitude.com/privacy).

#6.2 Services you use directly

These companies process your data on their own account, according to their policies:

• Google and Apple, for those who created the account earlier with Google or Apple and still have that data tied to it (https://policies.google.com/privacy and https://www.apple.com/legal/privacy/).
• Apple, which delivers the notifications on the iPhone — the reminders and the notice after a workout, with their text — to those who turn on reminders in the app (section 3.14) (https://www.apple.com/legal/privacy/).
• Your mobile carrier, which delivers the SMS with the code (and, on accounts without an e-mail, the notices about your account).
• Strava, when you connect your account (https://www.strava.com/legal/privacy).
• Meta (Instagram), only if you click the link to our profile on the site.

#6.3 Authorities

We may provide data when the law requires it or by order of a competent authority, limited to what is necessary. We may also use data to defend ourselves in judicial, administrative, or arbitration proceedings.

Before complying, we check that the request has a legal basis and comes from who it says it comes from. A request with no grounds, or broader than the law allows, is refused and challenged by the appropriate means. We hand over the minimum that answers what was asked — never the whole account when the question is about one day.

We keep a record of every request: who asked, what they asked for, when, on what grounds, what was handed over and who decided. As of the date of this policy that record is empty — no authority has asked for any FuelBalance user's data.

#6.4 Professionals you allow

If you give a dietitian or coach access through FuelBalance Pro, they see the scopes you chose, while the access lasts, and are responsible for what they saw under the LGPD and their council's rules (section 3.21). Nobody receives your data this way without your Allow access.

#7. What we do not do

• We do not sell personal data.
• We do not show advertising and we do not use your data for advertising.
• We do not share your data for third-party marketing or with commercial partners.
• We do not share health data to obtain an economic advantage.
• We do not use your data for statistics sold or transferred to third parties, for research, or to train AI models. Note: Amplitude's terms of service allow it to use the usage data we send, including with machine learning, to improve its services. This data does not include the content of your logs (section 3.8).
• We do not use advertising identifiers and we do not track you across other apps or sites.
• We do not send Amplitude the content of your logs (photos, texts, foods, calories, weight, goals, or workouts), your name, or your mobile number.
• We do not put in crash reports your account identifier or the content of your logs; for the app's own errors, not the text of the error either (section 3.20).
• We write nothing to Health Connect or Apple Health, and we read nothing from there beyond weight, body fat, and sleep (section 3.18).

#8. International transfer of data

Some data leaves Brazil. This table shows where it goes and under what conditions.

We have not signed standard contractual clauses with any provider. For the Gemini API, the paid service terms refer to Google's data processing addendum for products in which it is a processor, and the May 7, 2026 version of that addendum includes standard contractual clauses approved by the ANPD. The Firebase data processing terms and Amplitude's addendum do not carry these clauses. On request, we send a copy of Google's clauses free of charge. If you want more information about any transfer, write to us.

About the transfer to Google Gemini: what is sent and why is in sections 3.4 to 3.6; how long Google keeps it and in which countries, in section 6.1. We are responsible for the processing as controller, and Google acts as processor. Your rights, including the right to petition the ANPD, are in section 11.

#9. How long we keep it

Today there is no automatic deletion of account data. It stays stored for as long as the account exists or until you delete it (from the app or by e-mail).

#10. Security and incidents

What we do today:

• Communication between the app, the site, and the services we use is encrypted (HTTPS).
• The database rules make it so that each account can only read and change its own data. There are two exceptions: the shared food database, which any connected account can read and whose usage counter any connected account can increase, and the waitlist, in which it is only possible to create sign-ups, without login, and no one can read them from the app or the site.
• Login is done with your mobile number and a one-time code sent by SMS and verified by Firebase Authentication. There are no passwords. Anyone with access to your phone or SIM card can receive the code: protect the device and ask your carrier for a SIM PIN. If you cancel or lose the line, the carrier may reassign the number to someone else, who would then receive the code and get into your account. Let us know before cancelling the line so we can change the number or delete the account.
• The Strava access keys live only on our server, on a database path no app can read; the code-for-keys exchange happens in our functions, and Strava's client secret lives in Google Cloud's secret vault.
• We do not send name, e-mail, or account identifier to the AI, nor IP address, location, or advertising identifiers in the usage events.
• The pages of this policy and of the Terms do not load third-party services.

What we do not yet do and you should know: the local copy is not deleted when you sign out, the photos are not deleted from the phone after the analysis, and the food database can be read by other accounts (sections 3.4 and 3.11).

No system is completely secure. Protect your phone with a passcode or biometrics.

Incidents: if a security incident occurs that may bring relevant risk or harm to you, we will notify the ANPD and the affected people, as the LGPD requires, saying what happened, which data was affected, and what you can do.

#11. Your rights and how to exercise them

The LGPD guarantees you, free of charge:

1. Confirmation that we process your data.
2. Access to your data.
3. Correction of incomplete, inaccurate, or outdated data.
4. Anonymization, blocking, or elimination of unnecessary or excessive data, or data processed in violation of the law.
5. Portability of your data to another provider.
6. Elimination of data processed on the basis of your consent.
7. Information about whom we share your data with (section 6).
8. Information about the possibility of not consenting and the consequences (section 5).
9. Withdrawal of consent (section 5).
10. Objection to processing based on legitimate interest, such as the analysis of app and site usage.
11. Review of decisions taken solely on the basis of automated processing that affect your interests (section 12).

What you can do in the app today:

• correct weight, target weight, goal, and target date, on the profile screen;
• log new weigh-ins;
• delete the day's meals or change their time, in the list on the home screen;
• disconnect Strava, via the link in Settings;
• delete the account, at Settings → Account, with a two-tap confirmation — everything goes immediately (see below);
• sign out of the account, via the exit icon at the top of the Profile screen (the Strava connection belongs to the account and stays in place).

Everything else, by e-mail to contact@pfengineer.tech. For example:

• delete the account, if you prefer not to — or cannot — do it from the app;
• receive a copy of your data in electronic format;
• correct age, height, or sport;
• delete weigh-ins, meals from previous days, or the data imported from Strava;
• object to the sending of usage data to Amplitude and request the deletion, at Amplitude, of the data linked to your account (section 3.8);
• withdraw consent;
• request the review of an estimate or recommendation.

Account deletion: from the app (Settings → Account) deletion is immediate and does everything at once: we delete your login account and the data stored under your account in the database (profile, weigh-ins, meals, daily totals, insights, Strava data, reminder registrations, and old records), return to Strava the authorization you had given, remove your account identifier from the entries you created in the shared food database, and register the request to delete the usage data at Amplitude, completed within 15 days. The e-mail request does the same, completed within 15 days, and in our reply we say what was deleted and what could not be deleted, and why. The records of the new-workout notices Strava sent us (section 9) are not part of this deletion: to have them deleted, ask by e-mail. If you ask, we also delete your sign-up on the waitlist. We cannot delete the copy that is on your phone or in the device's backups: for that, uninstall the app or clear its data. Full instructions, including without the app: https://fuelbalance.app/delete-account/.

Deadlines: we respond to every request within 15 days. Confirmation that we process your data and access in simplified format are sent as soon as we read your request. The complete declaration, with the origin of the data, the criteria used, and the purpose, comes out within 15 days counted from the request. The other requests about your data, such as receiving a copy, correcting or deleting data, and deleting the account, are completed within 15 days.

Identification: to protect your account, we ask you to tell us the account's mobile number and, for older accounts, that the request come from the e-mail registered on it. Since we keep no e-mail for accounts created with a phone number, and when the e-mail is Apple's hidden one, we agree with you on a way to confirm that the account is yours.

If you are not satisfied with our response, or if we do not respond within the deadline, you can file a petition with the National Data Protection Authority (ANPD) (https://www.gov.br/anpd/). The ANPD asks you to show that you made the request to us first, for example with the e-mail you sent, and accepts your own statement when there is no other proof. You can also turn to the Procon of your city or the courts, without having to contact us first. The consumidor.gov.br (https://www.consumidor.gov.br/) only receives complaints against suppliers registered on the platform.

#12. Estimates and artificial intelligence

FuelBalance makes automatic calculations and recommendations. They are all estimates and are not a diagnosis, prescription, or medical or nutritional guidance (see the Terms of Use).

• Basal metabolism: calculated with the Mifflin-St Jeor formula using weight, height, age, and, if you gave it, biological sex. Without it, we use the intermediate value between the male and female constants, which sits up to 83 kcal a day from either. The result may be quite different from your real metabolism.
• The day's balance: on the home screen and in the history, it is what you consumed minus the day's estimated expenditure (estimated basal metabolism plus the workout calories). In the summary sent to the AI (section 3.6), the balance reported is what was consumed minus only the workout calories, and basal metabolism goes as a separate number. Because of this, the balance on the screen may not match what Fuel.IA or the insight say.
• The day's target balance (in the app, the balance "goal" for the day): with a target weight and a target date, the kilograms still to go, counted at about 7,700 kcal per kilogram, divided by the days until that date. It has a ceiling: to lose, a pace of 0.7% of your weight per week, and never more than 1,000 kcal a day; to gain, 0.5% of your weight per week, and never more than 500 kcal a day. Once the app knows your training week, it asks a little less on hard training days and a little more on light ones, without changing the week's total. Under 18, the app never asks for a deficit or sets a deadline. Without a target weight and a target date, the target balance is 500 kcal below to lose fat, 0 to maintain weight or for performance, and 300 kcal above to gain muscle. Close to a main race, the rule in section 3.15 applies.
• Calories burned in workouts: they come from Strava. Since the Strava activity list does not carry calories, the app uses the work reported in kilojoules as if it were the same number in kcal. Activities without this value, like many runs without a power meter, count 0 kcal.
• Meals: Gemini identifies foods and portions and estimates calories and macronutrients. When on-device recognition is used, the app only has an internal table with six common foods (rice, beans, chicken, meat, banana, and egg). For the others, calories and macronutrients stay at zero until you correct them.
• Insight and macronutrient recommendation: generated by Gemini from the summary in section 3.6, with your permission; without it, the day's message comes from the app's own rules.
• Fuel.IA: the answers are generated by artificial intelligence, not by a person.

Today there is no button to report AI answers. If an answer or estimate is wrong, or offensive, or dangerous, or if you want to understand the criteria used and request a review, write to contact@pfengineer.tech.

#13. Children and adolescents

FuelBalance is not intended for people under 18. The app deals with weight goals, calorie deficit, and an AI nutrition assistant (Fuel.IA), and the Gemini API terms also require 18 or older.

What happens today:

• setup asks for age, but the app does not check or block anyone who reports being under 18;
• the age question comes before the Strava connection screen, but the answer does not prevent connecting;
• we do not direct content or marketing to children and adolescents;
• the age you report is stored in your profile, and we have access to it; if the reported age is under 18, or if we learn by another means that the account belongs to someone under 18, we notify through the channel in section 5 of the Terms of Use (the account's e-mail, when there is one; on accounts without an e-mail, SMS to the account's number) and, after the period set out in the Terms of Use (section 13), we close the account and delete the data. During that period, the account holder or the legal guardian may request a copy of the data.

If you are a mother, father, or guardian and believe that a minor uses FuelBalance, write to contact@pfengineer.tech.

#14. What does not yet exist and what to do instead

This table is not a promise that these features will exist. It shows how to act today.

#15. Changes to this policy

• We publish each new version at this address, with the update date at the top.
• If the change alters the purpose, the form, or the duration of the processing, the sharing of data, or who the controller is, we will notify by e-mail, those who have an e-mail on their account or are on the waitlist, at least 15 days before it takes effect, saying what changed. Accounts created with a phone number give us no e-mail: for them, we publish the new version at this address with the same advance notice, and the app does not show that notice yet. If the change uses your health data for a new purpose, it does not apply to your data just because of that notice or because you kept using the app: for that, we will need your consent for the new purpose. For other changes, if you disagree, you can withdraw consent and request the deletion of your data.
• Wording corrections that do not change the processing of data, and changes that only reduce the processing, are published with the new date, without prior notice.
• New, optional features that only process or share data after a separate authorization, given on a dedicated screen (such as section 3.21), take effect on publication: until you authorize them, nothing changes for you.
• A change to this policy never, on its own, broadens what you authorized before.

#16. Legislation and contact

This policy follows Brazilian law, in particular the Brazilian General Data Protection Law (LGPD, Lei nº 13.709/2018), the Internet Civil Framework (Marco Civil da Internet, Lei nº 12.965/2014), and the Consumer Protection Code (CDC, Lei nº 8.078/1990).

• Controller: PAULO F O DE SOUZA, individual entrepreneur (empresário individual), trade name PF Engenharia de Software e Arquitetura, CNPJ 61.942.112/0001-56
• Address: Rua José Santos Junior, 169 – Campo Belo – São Paulo/SP – CEP 04609-010
• Officer in charge (Encarregado): Paulo Felipe Oliveira de Souza
• E-mail: contact@pfengineer.tech