Privacy Policy

Last updated: July 19, 2026

Your privacy matters to us. This Privacy Policy explains what information Fastiya collects, how it is used, and who it is shared with.

Health Data (Apple HealthKit)

With your permission, Fastiya reads the following data types from Apple Health: sleep analysis, heart rate variability (HRV), resting heart rate, active and basal energy, workouts and activity, weight, VO2 max, date of birth, and biological sex.

Health data read from Apple Health is used only to power in-app features (fasting insights, body-state scoring, sleep analysis, coaching) and is never sold, shared with third parties for advertising, or used for data mining/profiling unrelated to app functionality.

You control this access at all times through your iPhone’s Settings app (Settings > Privacy & Security > Health), and you may revoke it at any time.

Nutrition & Food Data

To support meal logging and analysis, Fastiya processes:

• Food photos you submit, which are analyzed using a third-party image-recognition service accessed via our secure backend infrastructure to identify foods and estimate nutrition.
• Barcode scans, which are looked up against the public USDA FoodData Central and Open Food Facts databases. No personal data is sent with these lookups.
• Meals and macros you log manually.

Account Data

To create and manage your account, we process the email address or Apple ID you sign in with (via Firebase Authentication), your subscription status (via RevenueCat), and any profile information you choose to enter, such as date of birth, sex, weight, and goals.

Analytics

We use Firebase Analytics to understand how the app is used, including events such as app opens, fasting starts and stops, and paywall views. This information is used to improve the product and is not used for advertising.

AI Coaching

AI coaching requests are transmitted over TLS-encrypted connections via a secure server-side proxy and are not stored long-term. We reserve the right to limit the number of coaching requests per device.

Third-Party Processors

Fastiya uses the following third-party services to operate the app. Each processes only the data needed for its specific purpose:

• Firebase (Google) — authentication, analytics, and backend infrastructure.
• RevenueCat — manages and validates subscription purchases.
• Apple (StoreKit / HealthKit) — processes in-app purchases and provides access to the Health data you authorize.
• USDA FoodData Central & Open Food Facts — public nutrition databases queried for food and barcode lookups; no personal data is sent.
• Third-party image-recognition service — performs image recognition/OCR on food photos you submit for meal logging.

Apple Watch Data

Fasting state, sleep data, and composite health scores are synced between your iPhone and Apple Watch using Apple’s WatchConnectivity framework. This data is not transmitted off your devices beyond the processors listed above.

Data Retention & Deletion

You can delete your account and all associated data at any time from within the app, under Settings. Account deletion is permanent and irreversible — once deleted, your data cannot be recovered. Residual copies may persist in encrypted backups for up to 30 days before being permanently purged.

Your Rights (GDPR & CCPA)

If you are located in the EU/UK or California, you have the right to access, correct, delete, or receive a copy of your personal data, and to opt out of certain processing. To exercise any of these rights, contact us at support@studiozcreatives.com and we will respond in accordance with applicable law.

Children’s Privacy

Fastiya is not directed at children under 13 (or under 16 in regions where that age applies), and we do not knowingly collect personal information from children under that age. If you believe a child has provided us with personal information, please contact us so we can delete it.

Security

We use reasonable administrative, technical, and physical safeguards, including encryption in transit, to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

International Data Transfers

Our service providers, including Firebase and RevenueCat, may process data on servers located in the United States or other countries. Where required, we rely on appropriate safeguards, such as standard contractual clauses, to protect data transferred internationally.

Changes to This Policy

We reserve the right, at our sole discretion, to modify or replace this Privacy Policy at any time. Material changes will be reflected by updating the “Last updated” date above.

Contact

If you have any questions about this Privacy Policy, you can reach us at support@studiozcreatives.com.