Privacy policy.

01 · Summary

The short version

• Your health data never leaves your device. Weight, body composition, measurements, photos, medication records, nutrition diary, water and workouts are stored only on your phone. There are no accounts.
• Online features are limited to: food search, optional anonymous product analytics, app-integrity checks, advertising, and optional Health Connect sync.
• We never sell personal information, and we never link your health data to advertising.
• Your health database and photos are excluded from Android cloud backup and device transfer.

02 · Who We Are

About this policy

Kevin DONG publishes the Android application Weight Track Assistant (including its GLP-1 companion features). This policy covers what the app does and does not do with your data.

The app is a personal tracking and wellness tool. It is not a medical device and does not provide medical advice; see also the health disclaimer in our store listing. For any privacy question or request, write to support@weightasst.com.

03 · On-Device Data

Your health data stays on your device

The following data is created, stored and processed exclusively on your device. We do not receive, collect or upload it:

• Weight entries, trend calculations and goals
• Body composition (body fat, muscle, body water, bone mass, visceral fat) and body measurements (14 sites)
• Progress photos
• Medication records, doses, titration timeline, symptoms, injection sites, check-ins and related notes (GLP-1 companion)
• Nutrition diary entries, targets and estimates; water intake; workouts
• App settings, unit preferences, profile details (height, birth date, sex)

The app has no user accounts or sign-up. In-app tools let you delete profiles and entries at any time, and uninstalling the app removes this on-device data (standard Android behaviour).

Note: if you used the optional account sync in earlier app versions (3.x or earlier), some weight, diary or photo data from those versions may remain stored in our cloud backend — see Your rights for how to have it deleted.

04 · Backup & Transfer

Android backup & device transfer

Your health database, progress photos and privacy/safety preference files are excluded from Android cloud backup and Android device-to-device transfer by the app's configuration. If your device's own backup service is on, non-sensitive app preferences may be backed up under your Google account settings.

05 · Online Features

When data does leave your device

Only the following flows involve network communication. None of them includes your health database, photos, or the health values you log.

Food search

When you search for a food, your search term is sent to our food-search service (the “Weight-Food API”), hosted on Cloudflare's network, which may in turn query the USDA FoodData Central database to return results. Requests are processed in memory only for as long as needed to return a result; we do not write search terms or request data to persistent logs or databases, and search terms are never linked to your on-device health data.

Product analytics (optional, anonymous)

With your consent (asked at first launch; changeable anytime inPrivacy Center), the app sends Google Firebase Analytics anonymous product-usage events (for example which screens and features are opened). These events contain no health values and no content of your entries, and cannot identify you.

App integrity (Firebase App Check)

When online features are used, the app may send a device-integrity attestation token (Firebase App Check, including Google Play Integrity) to verify that requests come from the genuine app and to protect the service from abuse.

Advertising (Google AdMob)

The app shows ads served by Google AdMob. Ad requests involve device-level advertising data such as your device advertising ID, IP address and ad-interaction data, handled by Google under its advertising policies.

• In the EEA, UK and Switzerland, ads (including whether they are personalised) are controlled by your consent choice in the Google consent dialog shown at first launch.
• Your health data is never used for advertising. Ad requests contain no health values, diary content or photos.
• You can opt out of ads personalisation via Google's Ads Settings or your Android privacy options (reset or delete advertising ID).

Health Connect (optional)

If you connect Health Connect, the app reads the data types you grant (weight, body fat, lean body mass, body water, bone mass) and, at your action, writes weight and body-fat entries back. This data stays on your device and is shown inside the app's screens. It is never shared, sold, or used for advertising. You can revoke permissions or disconnect at any time in Android or Health Connect settings.

Sharing you initiate

Exports (JSON, PDF, CSV), the doctor visit summary (Care Brief), photo sharing and printing happen only when you choose them. The destination is controlled by you; we receive nothing.

Reference policies of the processors involved:

• Google (Firebase · AdMob · Play Integrity)
• Cloudflare
• USDA FoodData Central
• Health Connect

06 · What We Never Do

Hard commitments

• We never sell or rent personal information, and we never sell or share your health data (including “sale” and “sharing” as defined by the California CCPA/CPRA).
• We never link, or allow advertisers to link, your health data, photos or diary content to advertising.
• We do not require an account, and we do not collect contacts, precise location, microphone or camera data (the app holds no such permissions).
• We do not build advertising or marketing profiles of you.

07 · Legal Bases

EEA / UK legal bases

Where the GDPR applies: (a) consent: product analytics, personalised advertising and any optional Health Connect connection, each withdrawable at any time; (b) contract: serving the food-search feature you invoke; (c) legitimate interests: protecting the service against abuse and ensuring app integrity.

The app is designed so that your health data remains on your device under your control; where any optional processing of data you choose to share takes place, it relies on your explicit consent.

08 · Your Rights

Rights and choices

In the app, at any time: export all data (JSON / PDF / CSV), delete profiles or individual entries, toggle product analytics, review every data flow in the Privacy Center, withdraw ad consent via the consent dialog, lock the app with biometrics, or uninstall to erase on-device data.

Depending on your region you may have rights of access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent (GDPR / UK GDPR); and rights to know, delete, correct, and opt out of sale or sharing (California CCPA/CPRA; note that we do not sell or share personal information as defined by that law). To exercise any right that requires our involvement, email support@weightasst.com. You also have the right to complain to your local data-protection authority.

Account and data deletion (including legacy cloud data). Earlier versions of the app (3.x and below) offered optional account sign-in with cloud backup. If you used that, some weight, diary or photo data from those versions may remain stored in our cloud backend. That data is never used for advertising or shared with anyone. You can request deletion of your account and this data at any time via our deletion form (forms.gle/MjKsVJz5QWQTQkAM6) or by emailing support@weightasst.com; we process deletion requests within 30 days.

09 · Retention

How long data is kept

On-device data is kept until you delete it (permanently erased on uninstall, subject to device-level backups you configured). We do not retain search queries on our servers: food-search requests are processed in memory only for as long as needed to return a result, and are not written to persistent logs or databases. Anonymous analytics events are retained per Google Firebase's standard retention settings.

10 · Security

Security

Data on your device is protected by Android's app sandbox; you can add biometric app lock inside the app. Data in transit uses TLS encryption. Access to our service infrastructure is restricted to authorised operators.

11 · Children

Children's privacy

The app is a general-audience wellness tool and is not directed at children under 13 (or the higher minimum age required by your country, e.g. 16 in parts of the EEA). We do not knowingly collect data from children. If you believe data from a child has reached our servers (for example via a search query), contact us and we will delete it.

12 · Transfers

International data transfers

Processors named above (Google: Firebase, AdMob and Play Integrity; Cloudflare; USDA) operate globally and may process data in your region or elsewhere. Where required, transfers rely on European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU–US Data Privacy Framework as applicable.

13 · Changes

Changes to this policy

We publish the version number above. If we make material changes (for example adding a new online feature), we will update the version, describe what changed, and highlight the change in the app or on this page before it takes effect.

14 · Contact

Contact us

If you have any questions about your privacy, reach out any time.