Privacy Policy

flabr is a personal health-tracking service. The data controller is the operator of this site, reachable at contact@flabr.io. Contact us any time about your data or this policy.

Account: email, display name, and a securely hashed password (we can never see the password itself).
Health data you choose to log: medication doses, weight & body composition, food and water intake, custom foods and recipes, activity and sleep (if you connect Apple Health), workouts, side effects, and goals.
Technical: the cookies listed below. We collect nothing else — no location, no contacts, no browsing history.

Solely to provide the service to you: showing your logs, trends, and milestones. Because health information is special-category data under the EU/UK GDPR, we process it only with your explicit consent, which you give when creating an account (Art. 9(2)(a)). You can withdraw consent at any time by deleting your account, which erases your data. We do no profiling and no automated decision-making.

We do not sell your data. We will never share it on our own initiative — not with advertisers, data brokers, analytics companies, AI companies, or anyone else. There are no ads, no trackers, and no third-party analytics anywhere in the app, and we never use your data to train AI models. Your data leaves this server in exactly two ways, both started by you: exporting it, or connecting an outside service yourself (see “Optional AI connections”). The one exception neither of us controls: like any service, we can be legally compelled to disclose data by a valid court order — if that ever happens, we will tell you unless the law forbids it.

If you choose, you can connect your flabr data to an AI assistant of your preference (for example, Claude via its connectors feature) to analyze it in a chat. This is entirely opt-in and off by default: no connection exists until you generate a private key in Settings, we never push anything to any AI provider, and the connection is read-only — an assistant can read your logs but can never change them or touch your account. When you connect an assistant, you are disclosing your data to that provider, and their privacy policy — not this one — governs what they do with it, including whether your chats are used for model training. Review the provider's privacy settings before connecting. You can rotate or revoke your key in Settings at any time, which cuts off access immediately.

Your data is stored in a single database on our hosting provider (Hostinger), which processes it on our behalf under its data-processing terms. Two features contact external services from our server: food search (USDA FoodData Central) and barcode lookup (Open Food Facts). Only the search text or barcode number is sent — never your identity, IP address, or any health data. All traffic to the app is encrypted (HTTPS).

We use only strictly necessary cookies: a session cookie (keeps you signed in), a remember-me token (so you stay signed in between visits), and a timezone cookie (shows your entries at the right local time). There are no advertising or analytics cookies — which is why you don't see a cookie banner.

Until you delete it. Deleting an entry removes it immediately; deleting your account permanently erases everything — your profile and every log — with no retention period and no backups kept of deleted accounts beyond the host's routine short-lived server backups.

You can exercise every one of these yourself, instantly, from inside the app:
· Access & portability — download a complete machine-readable copy of your data (Account → Export my data), or connect an AI assistant of your choosing to read it (Settings).
· Rectification — edit any entry from History.
· Erasure & withdrawal of consent — delete your account (Account → Delete account).
If you are in the EU/UK you also have the right to lodge a complaint with your data-protection supervisory authority. For anything else, email contact@flabr.io and we will respond within 30 days.

If a breach ever affects your data, we will notify you without undue delay and notify the relevant authorities within the legally required windows (72 hours where the GDPR applies).

flabr is a personal tracking tool for general wellness. It does not provide medical advice, diagnosis, or treatment, and it never recommends medication doses — always follow your prescriber's instructions and talk to them before changing anything.

If this policy changes in a way that matters, we will show you the updated version in the app before it takes effect. The effective date at the top always reflects the current version.