Privacy policy

Last updated: August 19, 2026

Kaizmax (“the app”) helps its users follow a personalized diet and training program. This policy describes what data we collect, why, how it is protected, and what your rights are.

1. Data we collect

• Account: email address and password (hashed, never readable by us).
• Questionnaire profile: sex, year of birth, height, weight, goal, activity level, training experience, training location and gear, sport practiced, diet, exclusions (allergies) and food preferences.
• Tracking data: meals and workouts checked off, food diary (including products added by scanning their barcode), hydration, supplements taken, fasting window, weigh-ins (entered by hand, or imported from your health app if you allow it — see section 6), target weight, loads lifted in sessions, declared slip-ups.
• Personal recipes (optional): the recipes you create (name, ingredients, macros, steps), visible only to you.
• Progress photos (optional): if you add any, they are stored in a private space strictly reserved for your account. You can delete them permanently at any time.
• Goal-advice photo (optional): this photo is sent for analysis then immediately deleted. It is never saved, neither by us nor in any technical logs.
• Google or Apple sign-in (optional): if you choose to sign in that way, they pass us your email address and an identifier — never your password, which we never see at any point. Apple lets you hide your address behind a private relay; we then only ever know the relay address.
• Support messages: when you write to us from the app, your message and our replies are kept for as long as it takes to handle your request. It is free text: nothing requires you to put health information there.

2. Purposes

• Generate and adjust your personalized diet and training program.
• Calculate your calorie needs and track your progress.
• Send you local reminders (meals, workouts, weigh-in) if you enable them — these reminders are handled on your device.
• Manage your Premium subscription where applicable.
• Answer the support requests you send from the app.
• Measure app usage in order to improve it — only if you have accepted it; the “usage statistics” switch in the settings stops it at any time.
• Count our revenue, as accounting requires. That measurement happens on our servers, from payment events, and carries nothing from your tracking data — see the Google Analytics 4 entry in section 3.

We do not sell your data to anyone. Your account and tracking data (weight, goal, program, workouts, photos) are never used for advertising. The kaizmax.com website, on the other hand, may store advertising cookies if you accept them — see section 5; this concerns neither the app nor any health data.

3. Hosting and sub-processors

• Supabase (database, authentication, storage) — data hosted in the European Union (Ireland region).
• Google Gemini — used only to analyze the goal-advice photo, if you choose to use it. The data sent is limited to what is strictly necessary (sex, age, height, weight and the photo — not retained). Google may process it outside the European Union.
• RevenueCat — Premium subscription management (purchase identifier; never your health data).
• Stripe (Stripe Payments Europe, Ltd.) — payment for subscriptions taken out from the website. Stripe receives your email address, your billing address and your account identifier, and it is the only party that sees your card details: they never pass through us. It keeps the payment records for as long as accounting rules require, independently of the deletion of your account with us. Stripe may process this data outside the European Union.
• Cloudflare (Cloudflare, Inc.) — hosting for the kaizmax.com website and for the recipe photos shown in the app. As such your IP address is visible to it on every load, as with any web request; nothing from your account or your tracking data is sent to it. Cloudflare may process this data outside the European Union.
• Google and Apple — only if you choose “Continue with Google” or “Continue with Apple”. They then pass us your email address and an identifier; we send them nothing in return, neither your tracking data nor your measurements.
• Sentry — technical error reporting, hosted in the European Union (Germany region). When the app hits a fault, it sends the error message, the stack trace, the device model and OS version, along with your account identifier — never your email, your name, or any health data. That identifier lets us connect a fault to your support request when you write to us, and lets us measure how many people a given bug actually affects. It is cleared when you sign out.
• Firebase (Google Ireland Limited) — two distinct services, both inside the app. Analytics measures usage (screens opened, subscription purchased, barcode scanned), tied to your account identifier and never to your email or name. Cloud Messaging delivers notifications: a device-specific token is kept for as long as you stay signed in, and deleted when you sign out. No health data is sent to either one, and the app reads no advertising identifier. Usage measurement can be turned off at any time in the app's settings. Google may process this data outside the European Union.
• Open Food Facts — an open food database, queried only when you scan a product barcode. Only the barcode is sent, along with your IP address as with any web request; not your account, not your measurements, not your meals.
• Google Analytics 4 (Google Ireland Limited) — audience measurement for the website — in-app measurement goes through Firebase, above — and only if you have accepted it. This service stores cookies on your device and receives your browsing information; Google may process it outside the European Union. What exactly is sent, how long the cookies last and how to change your mind are detailed in section 4. If you also accept advertising, that same service turns on its advertising features (see section 5). That same service also receives, from our servers and without any cookie, one event per payment collected — the amount, the currency and the product — so that we can count our revenue. That measurement cannot go through your device: a renewal, a refund or a purchase made from the website never reach it. It carries neither your account identifier, nor your email, nor anything from your tracking data — only a pseudonym derived from your account, which cannot be traced back to it. Being an accounting measure rather than a description of your browsing, it does not depend on the settings switch.
• Meta (Meta Platforms Ireland Limited) — measurement of our Facebook and Instagram ads on the website only, and only if you have accepted advertising. Meta may process this data outside the European Union. Details in section 5.
• TikTok (TikTok Information Technologies UK Limited) — the same for our TikTok ads: website only, and only if you have accepted advertising. TikTok may process this data outside the European Union. Details in section 5.
• Snap (Snap Group Limited) — the same for our Snapchat ads: website only, and only if you have accepted advertising. Snap may process this data outside the European Union. Details in section 5.

4. Website audience measurement (cookies)

This section is about the kaizmax.com website, and only that. No measurement cookie is stored before you agree. On your first visit, a banner asks for your choice, and it asks category by category: audience measurement, described here, and advertising, described in section 5, are accepted or declined separately. Declining does not cost one click more than accepting. Until you answer, the site runs without any of these cookies.

• What is sent to Google if you accept: the pages you view and their titles, the page or site you came from, the date and time, your device type, your browser, your operating system and its language, as well as your IP address, from which Google infers an approximate location. Add to that a random identifier, stored in the cookies, which recognizes the same browser from one visit to the next.
• What we do not send: nothing from your Kaizmax account, not your email, and not the values you type into the calorie calculator. No health data.
• What it is for: knowing how many people visit the site and which pages are actually useful to them, so we can improve what helps and drop what does not. That category does nothing else: no reselling, and no advertising use as long as you have not accepted the "Advertising" category (section 5).
• Cookies stored: _ga and _ga_<identifier>, set by Google Analytics, kept for 13 months at most.
• If you decline: Google's script is not loaded at all, and any _ga cookies already present are deleted. The site works exactly the same way.
• Changing your mind: at any time, with the button below. Your answer is kept in your browser's local storage (not in a cookie) for 6 months; after that, you are asked again.

5. Advertising (website cookies)

This section is also about the kaizmax.com website, and only that. Advertising is a separate category from audience measurement: you can accept one and decline the other. Until the "Advertising" category is accepted, none of the scripts below is loaded and none of their cookies is stored. Declining does not cost one click more than accepting.

• Meta Pixel (Meta Platforms Ireland Limited) — cookies _fbp and _fbc. Used to measure how well our Facebook and Instagram ads perform, and to avoid showing them to someone who is already subscribed.
• TikTok Pixel (TikTok Information Technologies UK Limited) — _ttp and _tt_enable_cookie cookies. Same purpose for our TikTok ads.
• Snap Pixel (Snap Group Limited) — _scid, _scid_r, _schn and _sctr cookies. Same purpose for our Snapchat ads.
• Google Analytics advertising features: if you accept advertising, the ad_storage, ad_user_data and ad_personalization signals are set to "granted" (Google Consent Mode v2), which allows the audience measurement described in section 4 to be linked to Google Ads. This link stores _gcl_* and _gac_* cookies (90 days at most), used only to attribute a subscription to the ad that was clicked. If you decline, those three signals stay "denied" and these cookies are not stored.
• What is sent to Meta, TikTok and Snap: the page you are viewing, and the fact that a subscription was taken out. As with any script loaded from a third-party server, your IP address and your browser are also visible to them.
• What is never sent to them: no health data. Not your weight, not your goal, not the result of the calorie calculator, and not a single answer from the questionnaire. Nothing from your Kaizmax account either, and not your email.
• Outside the European Union: Meta, TikTok and Snap may process this data outside the European Union.
• If you decline: none of these scripts is loaded, and any _fbp, _fbc, _ttp, _tt_enable_cookie, _scid, _scid_r, _schn, _sctr and _gcl_* cookies already present are deleted. Meta and TikTok are additionally told to stop sending without waiting for a page reload; Snap offers no such interface, so deleting the cookies and not loading it are the only measures that apply there. The site works exactly the same way.
• The mobile app is not concerned: it contains no advertising tooling, stores none of these cookies, and therefore asks you for no tracking permission — the iOS "Allow tracking" prompt never appears. Everything described in this section stops at the website.
• Changing your mind: at any time, with the "Manage my cookies" button in section 4 — both categories are set there separately. As with audience measurement, your answer is kept for 6 months in your browser's local storage, then you are asked again.

6. Health apps (Apple Health and Health Connect)

If you turn it on in settings, Kaizmax can read your weigh-ins from your phone's health app: Health Connect on Android, Apple Health on iPhone. This sync is off by default and only starts after your explicit permission.

• What is read: body weight only. No other type of health data is requested or accessed.
• Read-only: Kaizmax never writes anything to the health app and never modifies anything in it.
• What it is for: filling in your weight chart without you having to enter every weigh-in by hand. Nothing else.
• Where it goes: imported weigh-ins join your tracking data, in your account, hosted in the European Union (see section 3).
• What never happens: this data is not sold, not shared with third parties, not used for advertising, and not sent to any behavioural analytics service.
• How to stop: switch it off in Profile, or revoke the permission from Health Connect / Apple Health. Weigh-ins already imported stay in your history and are deleted along with the rest of your data (see sections 7 and 8).

7. Retention

Your data is kept as long as your account is active. Deleting your account deletes all of your data (profile, programs, tracking, photos) from our systems.

8. Your rights (GDPR)

Under the General Data Protection Regulation, you have rights of access, rectification, portability, erasure and objection. Most of these actions are possible directly in the app (edit the questionnaire, delete a photo). You can permanently delete your account and all your data at any time in the app: Settings → "Delete my account". For any other request:

Contact: [email protected]

You may also lodge a complaint with your local data protection authority.

9. Security

Exchanges between the app and our servers are encrypted (TLS). Data access is partitioned per user at the database level itself (row-level security): an account can technically only read its own data. Progress photos are only accessible via time-limited signed links generated for your session.

10. Minors

The app is for adults only: it computes calorie needs and training loads from formulas established for adults, and using it assumes the capacity to enter into a contract. By creating an account you declare that you are 18 or over.

11. Health disclaimer

The generated programs are indicative estimates based on recognized formulas. They do not constitute medical advice and replace neither a doctor, nor a dietitian, nor a certified coach.

12. Changes

This policy may change. The update date appears at the top of the page; significant changes will be flagged in the app.