BeastLift
Last updated 19 October 2026
This policy explains what information BeastLift ("the app", "we", "us") collects, why, who it is shared with, and the choices you have. BeastLift is made by Nikolaos Georgousis (self-employed), Kleanthous 8, 54642 Thessaloniki, Greece ("we" are the data controller). Contact: beastliftapp@gmail.com.
1. The short version
- Your training, body and food data stay on your phone unless you create an account to back them up and sync them.
- Weight, body fat and your food log are health data. We only process them with your explicit consent, which you give on the "Save your beast" screen, and we never use them for advertising or analytics.
- Usage analytics and crash reports are off unless you agree (onboarding, or Settings > Privacy & data).
- Free accounts see ads from Google AdMob. Pro accounts see none.
- You can export all your data and delete your account and data from inside the app at any time.
2. What we collect and why
| What | When | Why (legal basis) |
|---|---|---|
| Your answers to the setup questions: goal, motivation, experience, where and how often you train, focus areas, obstacles, your name (as you type it) and your beast's name | Onboarding and Edit profile | To build your plan and personalise the app (contract) |
| Body information: sex, age (stored as birth year), height, weight, body fat | Onboarding, You > Weight, the nutrition plan | To calculate your plan, calorie targets and your beast's shape. Weight and body fat are health data (explicit consent, GDPR Art. 9(2)(a)) |
| Training: workouts, exercises, sets, weights, times, notes | When you train | To run your plan and show your progress (contract) |
| Nutrition (Pro): foods and meals you log, water, your meal plan, diet and foods you skip, nutrition goals | When you use Nutrition | To track your day and plan meals. The food log is health data (explicit consent) |
| Steps and weight from Apple Health or Health Connect | Only if you turn it on in Settings and allow it | To show steps and import weights. Read only; we never write to Apple Health or Health Connect, and this data is never used for ads (explicit consent) |
| Account details: email address and a sign-in ID from Apple or Google | Only if you sign in | To back up and sync your data (contract). If you use Sign in with Apple, we keep a token that lets us revoke the sign-in when you delete your account |
| Purchases: an anonymous app user ID and your subscription status | When you subscribe or restore | To unlock Pro (contract). Payment is handled entirely by Apple or Google; we never see your card |
| Usage events (which screens and features are used, never your values) | Only if you agree to "Share usage data" | To improve the app (consent) |
| Crash reports (error details, device model, OS and app version) | Only if you agree to "Share usage data" | To fix bugs (consent) |
| Advertising data (see section 4) | Free accounts | To show ads (consent where required; legitimate interest for contextual ads) |
| Barcodes and food searches | When you scan or search packaged foods | To look the product up (contract) |
We do not collect your location, contacts, photos or microphone. The camera is used only to read barcodes: no picture is recorded, stored or sent.
3. Where your data goes
- On your device. Everything is stored locally in the app. Reminders are scheduled on the device.
- Supabase (database and sign-in, hosted in the EU, Frankfurt): only if you create an account, to back up and sync your data. Supabase acts as our processor under its data processing agreement.
- RevenueCat (subscriptions, USA): your anonymous app user ID and purchase status. RevenueCat acts as our processor under its data processing agreement and the EU Standard Contractual Clauses.
- Apple and Google: payments, Sign in with Apple, Google Sign-In, and on your device, Apple Health or Health Connect if you allow it.
- PostHog (analytics, EU) and Sentry (crash reports, EU region): only with your consent. Events never contain names, email, weight, body fat, measurements, height, age, sex, free text or anything from your food log. IP addresses are discarded.
- Google AdMob (ads for free accounts, see section 4).
- Open Food Facts (France): the barcode or search words you look up, and your IP address as part of the request. We send nothing else, and no account is used.
- Pictures: some recipe photos are loaded from our storage provider or, until they are moved there, from theunitools.com and Wikimedia Commons; those servers see your IP address when a picture loads, like any website.
We do not sell your personal data. Some providers are outside the EU; where they are, transfers are covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
4. Advertising
Free accounts see ads from Google AdMob (Google Ireland Ltd.). In the EU, the app first shows Google's consent form so you can choose personalised or non-personalised ads, or refuse. On iPhone, the app asks for tracking permission (App Tracking Transparency); if you say no, ads are not personalised with your device's advertising ID. Google may receive your IP address, device information and advertising ID (if allowed). Your health, body and food data are never shared with Google or used for ads. Upgrading to Pro removes all ads. More: https://policies.google.com/technologies/partner-sites
5. How long we keep it
- On your device: until you delete it or the app.
- In your account: until you delete your account. Deleting it in the app (Settings > Delete account) removes your data from our servers straight away and from backups within 30 days, and revokes Sign in with Apple.
- Analytics and crash data: 12 months.
- Purchase records: as long as the law requires (tax and accounting).
6. Your rights
You can, at any time:
- see and export your data (Settings > Privacy & data > Export my data),
- correct it (Edit profile, or edit any entry),
- delete it (Settings > Delete account),
- withdraw consent for usage data (Settings > Privacy & data) or health data (delete your data or account; the app needs it to work),
- object to or restrict processing, and ask for portability.
Write to beastliftapp@gmail.com for anything the app doesn't cover; we answer within one month. You can also complain to the Hellenic Data Protection Authority (www.dpa.gr) or your local authority.
7. Age
BeastLift is for people aged 16 and over. We don't knowingly collect data from younger children. If you believe a child under 16 has used the app, contact us and we will delete their data.
8. Security
Data on the device stays in the app's private storage. Data sent to our servers travels encrypted (HTTPS) and each account can only read its own rows. No method is perfectly secure, but we take reasonable care and will tell you about a breach when the law requires.
9. Changes
If we change this policy, we'll update the date above and, for important changes, tell you in the app.
10. Contact
Nikolaos Georgousis, Kleanthous 8, 54642 Thessaloniki, Greece. Email: beastliftapp@gmail.com.