Privacy Policy

Last updated: March 31, 2026

Summary: We collect minimal data needed to provide the service. We never sell your data. We never show ads. Your health data stays yours.

1. Who We Are

My Fasting Journal ("we", "our", "us") is a free health tracking application. Our website is myfastingjournal.com.

2. Data We Collect

Account Data: Email address, name, and hashed password (SHA-256). We never store your password in plain text.

Profile Data: Height, age, sex, activity level — provided voluntarily during onboarding. Used to calculate your BMR and metabolic estimates.

Health Data: Fasting sessions (start/end times), daily logs (weight, mood, energy, focus, sleep, water intake), and goals you set.

Garmin Connect Data (optional): If you connect your Garmin account, we sync: weight, body composition, sleep details, daily activity stats (steps, calories, heart rate, stress, body battery), and nutrition data from connected apps (e.g., MyFitnessPal). Your Garmin credentials are stored encrypted on our server and used solely for data synchronization.

Technical Data: IP address (for rate limiting and security only), browser type. We do not use analytics cookies or tracking pixels.

3. How We Use Your Data

To provide fasting tracking, health insights, and metabolic calculations
To sync data from Garmin Connect (if you opt in)
To send account-related emails (confirmation, password reset)
To improve the application

We never use your data for advertising, profiling, or selling to third parties.

4. Third-Party Services

Garmin Connect: If you connect your Garmin account, we access your data through Garmin's API. Garmin's own privacy policy applies to data collected by Garmin devices.

Brevo (email): We use Brevo (formerly Sendinblue) to send transactional emails. They process your email address only for delivery purposes.

We do not use Google Analytics, Facebook Pixel, or any advertising networks.

5. Data Storage and Security

Your data is stored on a dedicated server in France (OVH). We use:

HTTPS encryption for all connections
Hashed passwords (SHA-256)
JWT tokens with 90-day expiry for sessions
Rate limiting to prevent brute-force attacks

6. Data Retention

We keep your data for as long as your account is active. If you delete your account, all your data (fasts, logs, profile, Garmin data) is permanently deleted within 30 days.

7. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

Access: Request a copy of all your data (available via Export in Settings)
Rectification: Correct any inaccurate data in your profile
Erasure: Delete your account and all associated data
Portability: Export your data in CSV or JSON format
Object: You can disconnect Garmin sync at any time

To exercise these rights, contact us at privacy@myfastingjournal.com.

8. Children's Privacy

My Fasting Journal is not intended for users under 18 years of age. We do not knowingly collect data from minors. Fasting should only be practiced by adults under medical guidance.

9. Changes to This Policy

We may update this policy from time to time. We will notify registered users of significant changes via email.

10. Contact

For privacy-related questions: privacy@myfastingjournal.com