Privacy Policy

1. Who we are

FastBro acts as the data controller for the personal data processed by this app (GDPR Art. 4(7)). You can reach the controller at Privacy.appsss@proton.me.

2. Where your data lives — two buckets

FastBro is local-first. Health-sensitive data never leaves your device. Server-side data is the minimum needed to power social features, progression, account recovery, and the closed-beta reward. We send no advertising or general analytics; during the closed beta, we record limited purpose-specific engagement events only to determine beta reward eligibility. Crash reporting exists but is strictly opt-in: nothing is collected or sent until you explicitly enable it in Settings, and it stops immediately when you turn it off (see section 3).

1. On your device only (IndexedDB): every fasting session (start, end, duration, protocol), every food log entry, every Ledger check-in, and every Lab Note you unlock. Clearing site data, uninstalling the PWA, or clicking "Delete my account" wipes these rows — we have no copy.
2. On our server (Supabase): your anonymous account ID; the hash of your recovery code (single-use); your public display name (visible on leaderboards); XP total, level, and badges; your streak count (a single number, not the sessions behind it); squad / friend / referral relationships; leaderboard entries (numbers only); a transient "currently fasting" signal (is_fasting boolean + started_at timestamp, overwritten on every fast start / stop — never appended); Ghost Race data when you race a friend (the race goal, status and timestamps, live progress snapshots while the race runs, and the final result — fasting duration and outcome — each visible only to you and your opponent); streak-wager data when you wager a friend (the wager week and each participant's streak total for that week); limited closed-beta reward metadata when applicable (the beta program, event category, feature category, activity date, unique action identifier, and reward criteria totals — not fasting history, food logs, calories, protocols, Ledger entries, or Lab Notes); premium purchase records if you buy Premium (the SKU, Google order id, purchase time, and an HMAC-SHA256 hash of the Google purchase token — never the token itself); a push-notification subscription identifier (FCM token) if you enable notifications; your in-app Feedback form submissions; and your device's IANA time-zone name (see section 3). If you enable notifications on the web rather than in the Android app, the push subscription also carries its endpoint URL, the browser's cryptographic push keys, and your browser's user-agent string. FastBro itself does not store IP addresses anywhere: the abuse-prevention rate limiter uses only a hashed recovery-code counter and a platform-wide counter that contain no IP or personal data of any kind (see section 3).

3. Why we collect the server-side data (purpose & lawful basis)

Each piece of server-side data has a single, narrow purpose. We do not use it for anything else.

1. Provide the FastBro service (GDPR Art. 6(1)(b) — performance of contract): account creation, recovery-code flows, progression (XP, level, badges), and the social surface (Squads, friends, leaderboards, referrals). Leaderboard entries are platform-wide: your display name and your numbers (XP, level, streak count, weekly and lifetime fasting totals) are visible to every signed-in FastBro user, not just your connections.
2. Display your public profile (GDPR Art. 6(1)(b)): your display name, streak count, and leaderboard numbers are the platform-wide leaderboard fields described above; the transient "currently fasting" indicator (boolean only) is visible only to people you have explicitly connected with. We never share your food log, Ledger entries, or Lab Notes with anyone — those live only on your device.
3. Protect the service from abuse (GDPR Art. 6(1)(f) — legitimate interest): the account-recovery and email-lookup services are rate-limited so one client cannot brute-force recovery codes, enumerate email addresses, or flood the service. These limits are enforced with two counters that contain no IP address and no personal data: (1) per recovery code, a SHA-256 hash of the code itself, and (2) one platform-wide counter per service. FastBro's own code never reads, uses, or stores your IP address — like any internet service, our infrastructure providers (Supabase/Cloudflare, both operating in the EU) process connection metadata as transient part of delivering the request, as described in section 4. None of this is linked to your account or profile and none of it is used to derive or infer your location.
4. Schedule week-based features to your calendar (GDPR Art. 6(1)(b) — performance of contract): your device's IANA time-zone name (for example "Europe/Berlin") is stored on your profile so week-based features — streak-wager weeks and closed-beta activity dates — resolve on your local calendar, not the server's. A time-zone name describes the rule for your region's clock, not where you are: FastBro never collects or stores GPS or other precise location, never combines this field with location data, and never uses it to infer your position or movement.
5. Deliver the racing and wagering features you opt into (GDPR Art. 6(1)(b)): Ghost Races and streak wagers you create or accept store only what your opponent needs to see and compare — the race goal, live progress, final fasting duration and outcome, or the week's streak totals. Nothing else about your fasts is shared with your opponent.
6. Process your one-time Premium purchase (GDPR Art. 6(1)(b) — contract): the purchase record exists so the same purchase token can never be replayed on another account, and so restore-after-reinstall works. Payment itself is handled entirely by Google Play; FastBro never receives or stores payment card data. Only a cryptographic hash of the purchase token is kept, never the token itself.
7. Send notifications you explicitly enable (GDPR Art. 6(1)(a) — consent): the push-notification identifier is stored only while notifications are enabled and is removed when you revoke permission or delete your account.
8. Crash reporting you explicitly opt into (GDPR Art. 6(1)(a) — consent): when you enable "Help improve FastBro — send anonymous crash reports" in Settings, the app stores a technical crash report when something breaks — an error message, a stack trace, the app version, your Android/OS version, device model, and a short log of recent in-app actions (screen names and event categories only, never their content). Reports are keyed to a random, per-install identifier generated on your device and are never linked to your account, your display name, or any identifier that could connect a report to you. They are stored in our EU-hosted Supabase project and are write-only for the app: other users cannot read them, and only the FastBro operator can. Turning the toggle off stops all capture immediately.
9. Respond to valid legal requests (GDPR Art. 6(1)(c)): on a lawful request from law enforcement we disclose the minimum data we hold and log every such request internally.

4. Sub-processors

1. Supabase Inc. — authentication, database, and storage for the server-side data above. See supabase.com/security for their Data Processing Addendum.
2. Cloudflare Inc. — CDN, Workers, and security for the FastBro domain. As part of operating their network, Cloudflare automatically processes standard connection metadata (such as IP address, country, and device type) according to Cloudflare's own security and privacy practices. FastBro does not separately log, store, export, or control this data — see Cloudflare's privacy policy for details.
3. Google LLC (Google Play) — payment processing for the one-time Premium purchase. FastBro never sees or stores your payment card details: Google Play handles payment and returns a purchase token that FastBro verifies with Google before granting access. Google's own privacy practices govern the payment data you enter in Play.
4. Google Fonts — CSS for the UI fonts (loaded from fonts.googleapis.com). Google may log the IP that fetched the CSS; see fonts.google.com/about for details.

6. How long we keep your data

1. Device-local data — until you wipe your browser storage, uninstall the PWA, or click "Delete my account" in Settings. We have no copy.
2. Server-side data — until you click "Delete my account" in Settings. Account deletion cascades through every row associated with your user_id in a single Postgres transaction and is irreversible.
3. Recovery-code hash — deleted immediately after a successful recovery (single-use property).
4. Feedback messages — retained only as long as necessary to review and act on them, then deleted.
5. Display name — deleted on account deletion, or when you change it in Settings.
6. Premium purchase records — retained only as long as needed to administer the purchase (anti-replay protection and refund handling), and deleted when you delete your account. Only an HMAC-SHA256 hash of the purchase token is stored — never the token itself.
7. Push-notification subscriptions — removed when you disable notifications in Settings, or when you delete your account.
8. Abuse-prevention rate-limit counters — short-lived by design and free of personal data: a per-code counter (SHA-256 hash of the recovery code, per minute) and one platform-wide counter per service (per minute / per hour). They contain no IP addresses and nothing that can be linked to you; entries age out on their windows and nothing else is derived from them. Deleting your account does not alter these counters (they are never linked to your account), and there is nothing in them that could identify you to remove.
9. Crash reports — kept only as long as needed to diagnose and fix the underlying problem, then deleted. They are keyed to a random per-install identifier rather than to your account, so deleting your account in the app also deletes the reports THAT device uploaded (the app sends its own identifier with the delete request). Reports from another or an older device carry no account link and cannot be reached from the app — you can ask us to delete stored reports via the controller contact address in section 1, and turning the crash-report toggle off stops all further collection.

7. Your rights (GDPR Art. 15–22, UK GDPR, CCPA / CPRA)

1. Access (Art. 15) and portability (Art. 20) — Settings → "Export my data" downloads every byte of your data — including the device-local rows — as JSON.
2. Erasure (Art. 17) — Settings → "Delete my account" removes your account and every server-side row in one transaction.
3. Rectification (Art. 16) — edit your display name inline in Settings; rectify anything else by contacting the controller.
4. Restriction (Art. 18) and objection (Art. 21) — contact the controller. We do not currently process server-side data for direct marketing, so objection-to-marketing is not applicable.
5. Withdraw consent (Art. 7(3)) — deleting your account withdraws all consent for server-side processing, and turning off the crash-report toggle in Settings stops all crash-report collection immediately. There is no separate health-data consent: health data lives only on your device and is yours to keep or delete.
6. Lodge a complaint with your supervisory authority — see your country's DPA list.

8. Children

FastBro is not directed at anyone under 18. If you are under 18, do not use FastBro without a parent or guardian's involvement. We do not knowingly collect personal data from anyone we know to be under 18 — contact the controller if you believe we have, and we will delete the record.

9. Changes & contact

Material changes will be summarised in Settings → About at least 14 days before they take effect. The effective date at the top of this page is canonical; older versions are available on request.

Privacy questions, formal requests, and complaints: Privacy.appsss@proton.me. We acknowledge within 14 days and respond substantively within 30 days (extendable to 60 days for complex requests, in which case we tell you why).

10. Document history

v8 (14 October 2026) — retention fix, no new collection: deleting your account in the app now also deletes the anonymous crash reports uploaded by that device (the app sends its random per-install identifier with the delete request), and the deletion has always removed every row linked to the account itself — see /legal/data-deletion for the full list of what is removed and what is kept (sections 2, 3, 6).

v7 (22 September 2026) — clarified two existing disclosures, no new data collection: (1) leaderboard entries (display name and fasting numbers) are visible platform-wide to every signed-in user, not only to connections (sections 2 and 3); (2) on the web, a push-notification subscription stores its endpoint URL, cryptographic push keys, and the browser user-agent string alongside the FCM token already listed (section 2). The parked analytics draft is not included in this version.

v6 (18 September 2026) — strengthened the abuse-prevention disclosure: FastBro's rate limiting no longer stores IP addresses at all (hashed recovery-code counter plus a platform-wide counter with no IP or personal data — sections 2, 3 and 6). No change in what the service collects about you; the parked analytics draft is not included in this version.

v5 (18 September 2026) — added two disclosures for data that was already collected but under-described: IP addresses stored in abuse-prevention rate-limit buckets, and the device time-zone name stored with your profile (sections 2, 3 and 6). No new data collection and no new third-party recipients; the parked analytics draft is not included in this version.

v4 (18 September 2026) — added the disclosure for opt-in, anonymous crash reporting (sections 2, 3, 6 and 7). No other processing changed.

v3 (1 September 2026) — added Ghost Race, streak wagers, Premium purchase records, and push notifications.

v2 and earlier — available on request.