Privacy Policy

Who we are

Deficit App LLC ("Deficit," "we," "us" or "our") operates the Deficit mobile app and related services (the "Service"). This Privacy Policy explains how we collect, use, share and protect your information, and the choices you have. It should be read together with our Terms of Use.

Information we collect

Information you provide

• Account information: name, email address, password or sign-in credentials (such as Sign in with Apple), and date of birth or age.
• Profile and body information: sex, height, weight, body measurements, activity level and goals, used to estimate your calorie needs.
• Nutrition and activity logs: foods, meals, beverages, calories and nutrients you record, and exercise you log manually.
• Communications: messages you send us, such as support requests and feedback.

Information from connected services

If you choose to connect them, we receive data from Apple Health, Fitbit, Oura and Whoop. Depending on the permissions you grant, this may include calories burned, active energy, steps, workouts, heart rate, heart rate variability, sleep, recovery and weight. See Connected health services.

Information collected automatically

• Device and usage information: device model, operating system, app version, language, time zone, features used, and crash and performance logs.
• Network information: IP address and approximate location derived from it (city or region level). We do not collect precise GPS location.

We do not use third-party advertising trackers or sell access to your data.

Connected health services

Connections are optional. You choose which services to connect and which data types to share, and you can change this at any time.

• Apple Health (HealthKit): data from HealthKit is used only to provide and improve the health and fitness features of Deficit. We do not use HealthKit data for advertising or data-mining, and we never sell it or share it with third parties for advertising or marketing. You can change permissions in the iPhone Settings app under Health > Data Access & Devices.
• Fitbit: Deficit's use and transfer of information received from Google APIs, including Fitbit data, adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access in your Fitbit or Google account settings.
• Oura and Whoop: we access data through their official APIs only with your authorization, and use it only to provide Deficit's features to you. You can revoke access in your Oura or Whoop account settings.

If you disconnect a service, we stop receiving new data from it. You can also ask us to delete data we previously imported from it.

How we use information

• Provide the Service, including calculating calories in, calories out and your calorie deficit, and showing your progress.
• Create and manage your account, and authenticate you.
• Respond to your requests and provide support.
• Send service-related messages, such as security alerts and changes to our terms. With your permission, we may send reminders or app notifications, which you can turn off.
• Maintain, secure, debug and improve the Service, and develop new features. When we analyze usage to improve the Service, we use de-identified or aggregated data where practical.
• Detect and prevent fraud, abuse and security incidents.
• Comply with legal obligations and enforce our Terms of Use.

We do not use your health data to make decisions that produce legal or similarly significant effects about you, and we do not use it for targeted advertising.

How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as follows:

• Service providers: companies that provide services to us, such as cloud hosting, databases, crash reporting, analytics and email delivery. They may use information only to perform services for us, under contracts that require them to protect it.
• At your direction: when you ask us to, for example if you choose to export your data or share it with someone.
• Legal reasons: when we believe in good faith that disclosure is required by law, subpoena or court order, or is necessary to protect the rights, property or safety of Deficit, our users or others.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this Privacy Policy. We will notify you before your information becomes subject to a different privacy policy.

We may share aggregated or de-identified information that cannot reasonably be used to identify you. We commit not to attempt to re-identify such information.

HIPAA

Deficit is a consumer wellness app. It is not a healthcare provider, health plan or business associate, so the information you provide is generally not "protected health information" under HIPAA. We still treat your health information as sensitive and protect it as described in this policy and as required by applicable consumer health privacy laws.

Data retention

We keep your information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or de-identify your personal information within 30 days, except where we must keep it longer to comply with law, resolve disputes or enforce our agreements. Residual copies in secure backups are deleted on a rolling basis within 90 days.

Security

We use administrative, technical and physical safeguards designed to protect your information, including encryption in transit and at rest, access controls limited to personnel who need it, and regular review of our practices. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach of security affects your information, we will notify you and the appropriate authorities as required by law, including the FTC Health Breach Notification Rule.

Your choices and rights

• Access and correct: view and edit most of your information in the app.
• Export: request a copy of your data in a portable format.
• Delete: delete your account and data from the app's settings, or by emailing us.
• Withdraw consent: disconnect Apple Health, Fitbit, Oura or Whoop at any time.
• Notifications: turn off push notifications in your device settings, and unsubscribe from emails using the link in each message.

To make a request, email support@deficitapp.com. We will verify your identity, usually by confirming your account email, and respond within 45 days. If we need more time, we will tell you why. You may use an authorized agent where state law allows; we may ask for proof of the agent's authority. We will not discriminate against you for exercising your rights.

Consumer health data

This section applies to "consumer health data" under laws such as the Washington My Health My Data Act, Nevada SB 370 and Connecticut's consumer health data provisions.

• Categories we collect: body measurements and weight, nutrition and calorie intake, physical activity and calories burned, and, if you connect a device, heart rate, heart rate variability, sleep and recovery data.
• Sources: you, and the connected services you authorize.
• Purposes: to provide the calorie-tracking features you request, to secure and improve the Service, and to comply with law, as described in How we use information.
• Sharing: only with service providers who process it on our behalf, and as required by law. We do not sell consumer health data.
• Consent: we collect consumer health data only with your consent or as necessary to provide the Service you request, and we ask for separate consent before any sharing beyond that.
• Your rights: you may confirm whether we hold your consumer health data, access it, see a list of third parties it was shared with, withdraw consent and request deletion by emailing support@deficitapp.com. If we deny your request, you may appeal by replying to our decision; if you are not satisfied, you may contact your state Attorney General.

California residents

If you are a California resident, the California Consumer Privacy Act, as amended (CCPA), gives you additional rights. In the past 12 months we have collected the following categories of personal information:

We collect this information from the sources and for the purposes described above, and keep it as described in Data retention. We do not sell or share personal information, including that of consumers under 16, as those terms are defined in the CCPA. We use sensitive personal information only to provide the Service and for other purposes permitted by the CCPA, so we do not offer a right to limit its use.

You have the right to know what personal information we collect, use and disclose; to access, correct and delete it; and to not be discriminated against for exercising these rights. Submit requests as described in Your choices and rights.

Shine the Light: we do not disclose personal information to third parties for their own direct marketing purposes.

Do Not Track and Global Privacy Control: because we do not sell or share personal information or track you across other apps and websites, we do not change our practices in response to these signals.

Other U.S. states

Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah and Virginia, may have rights to access, correct, delete and obtain a copy of their personal data, and to opt out of targeted advertising, sale and certain profiling. We do not engage in targeted advertising, sale or such profiling. We process sensitive data, including health data, only with your consent. To exercise your rights, email support@deficitapp.com. If we decline your request, you may appeal by replying to our response with "Appeal" in the subject line. We will respond to appeals within the time required by law. If your appeal is denied, you may contact your state Attorney General.

Children and teens

Deficit is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13 without verifiable parental consent, we will delete it promptly. If you believe a child under 13 has provided us information, please contact us at support@deficitapp.com.

Users aged 13 to 17 may use Deficit only with the permission and supervision of a parent or legal guardian. Parents or guardians may contact us to review, correct or delete their teen's information.

International users

Deficit is operated in the United States, and your information is stored and processed in the United States. If you use the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date. If we make material changes, including any change in how we use or share health data, we will notify you in the app or by email before the change takes effect and, where required by law, ask for your consent.

Contact us