Prolumen privacy policy

Effective date: 9 November 2026. Last updated: 9 November 2026.

Canonical URL: https://prolumen.app/privacy-policy.html — this is the address the app links to, the store forms use, and the Health Connect privacy-policy declaration points to.

Prolumen ("the app", "we") is a fitness and nutrition tracker for iOS and Android, published as app.prolumen. This policy explains what the app stores, where it goes, and the choices you have. Questions: support@prolumen.app.

The short version: Prolumen is local-first. Your data stays on your device unless you sign in. It is never sold, never used for advertising, and never sent to an AI service. Signed out, the only network requests are barcode or text lookups to Open Food Facts; signed in, your records sync to the Supabase project configured for Prolumen. Progress photos are uploaded only if you turn on photo backup or explicitly share a photo with a partner.

1. What we store and where

Prolumen keeps the following in the app's private storage on your device:

• your profile: name (optional), date of birth, sex (optional), height, activity level and body-fat percentage (optional);
• nutrition targets, goal plan, weight and body measurements;
• foods you create, meal entries, recipes, saved meals and favourites;
• workouts, templates, cardio sessions, sleep entries, recovery check-ins, hydration and habits;
• progress photos, in a private folder inside the app;
• goals, reminders and app preferences (units, theme, week start, dashboard layout);
• a device-local queue for photo backup and partner sharing, and sync/health cursors.

If you sign in, the app also keeps your session token in the device's secure storage. Your password is handled by Supabase Auth and is not stored by the app.

This data is not readable by other apps. The device's own operating-system backup (iCloud or Google backup) may include the app's files if you have device backup turned on; that backup is controlled by your platform account, not by Prolumen.

2. Signed out: what leaves the device

Without an account, nothing leaves the device except the cases below.

Open Food Facts. When you scan a food barcode or search for a food, Prolumen sends a request to world.openfoodfacts.org. A barcode lookup sends only the barcode; a search sends only the words you typed, plus the page number. Requests carry a Prolumen/<version> (app.prolumen) User-Agent string and no profile, diary, device identifier or account data. Open Food Facts is an independent project with its own privacy policy. The bundled USDA food database is read locally and makes no network request.

Your health platform. If you connect Health Connect (Android) or Apple Health (iOS), Prolumen reads only the data types you allow, and writes back weight, water, food or workouts only if you turn those write-backs on. Health data is handled by the platform on your device and is not sent to Prolumen's servers while you are signed out. You can disconnect and delete imported data at any time in Settings › Integrations.

Exports you start. When you export a backup or CSV file and choose a destination in the system share sheet, that file goes wherever you send it. You control that choice.

Prolumen contains no analytics SDK, no advertising SDK and no crash-reporting SDK, and does not send health or diary data to any AI service. The only third-party SDK that receives purchase data is the subscription SDK RevenueCat described in section 4; it receives purchase history and an app-user identifier, and never receives health, nutrition, photo or diary data.

3. Signed in: cloud sync and partner sharing

Cloud sync is optional. If you create an account and sign in, the records listed below are uploaded to the Supabase project configured for Prolumen, over TLS. Each row is tied to your user id and protected by row-level security, so only your authenticated account can read or change it. The synchronized records are:

• profile, nutrition targets, goal plan and goal check-ins;
• weight, body measurements and measurement types;
• hydration, food diary entries, custom foods, portions, aliases, meal categories, saved meals, recipes, favourites and day status;
• exercises, routines, workout templates and sessions, sets, cardio sessions, sleep sessions, recovery check-ins, habits, reminder definitions and suggestion preferences;
• partner summaries that you choose to share, and partner messages/reactions.

App preferences, the scheduled local notifications on this device, the sync cursor, health-platform cursors and imported health records that are specific to one device stay on that device. Progress photo metadata is not uploaded by ordinary sync, so not even the existence of a photo is synced.

Progress photos. Photos are uploaded in only two cases, both of which you start:

• Photo backup (Pro, off by default). A compressed copy is uploaded to the private progress-photos storage bucket under your user id so another signed-in device can download it.
• Partner sharing. A downscaled copy is uploaded only when you explicitly share a photo with a connected partner. Your original file is never uploaded.

Partner features. Partner accountability is invite-based and private: only two connected accounts can see a shared summary, and every interaction belongs to that one partnership. Shared summaries contain only the scopes you grant. Partner messages and reactions are stored in the same Supabase project. Reports you send, including the reason and optional details, are stored for moderation. There is no public feed, no follower graph and no discovery. You can block or report a partner; see section 5 and the terms of use.

4. Payments

If you buy a Pro subscription, the payment itself is processed by the App Store or Google Play. Prolumen uses the subscription SDK RevenueCat (react-native-purchases) to read product prices from the store, complete the purchase, keep the Pro entitlement attached to your account, and restore purchases on another device. RevenueCat receives:

• purchase and subscription history for the products you buy: the product and plan, the purchase and renewal dates, the expiry date, the trial or renewal state, the store the purchase came from, and whether it is active or refunded or cancelled;
• an app-user identifier. When you are signed in, this is your Supabase account id (a random UUID); while you are signed out it is the SDK's own anonymous identifier generated on this device. It is used only to attach the purchase to the right account and to restore it after a reinstall or on another device;
• the paywall placement that led to the purchase (for example check-in, onboarding, Settings or a locked feature), as a short non-sensitive label, so purchase conversion can be measured per surface.

RevenueCat does not receive your health or fitness data, your nutrition or food diary, your workout records, your progress photos, your body measurements or your email. No health data is ever sent to the subscription SDK; the only identifier that ties a purchase to you is the random account id above. RevenueCat processes this data as a service provider under its own privacy policy, and your store's terms and refund rules apply to the payment. The store data disclosures describe the same purchase data and nothing more.

You can manage or cancel a subscription in the store's subscription settings, and Restore purchases is available on every Prolumen paywall. Deleting the app or your account does not cancel a store subscription by itself.

5. Your choices

• Inspect what is stored, area by area, under Settings › Data.
• Export a full JSON backup, a backup with photos, or CSV files per area.
• Delete one category (for example all nutrition data) without touching the rest.
• Delete everything on the device: all records, progress photo files and scheduled reminders. The app then returns to onboarding.
• Delete your account in the app; this also removes the cloud copy, uploaded photos and partner data. Local account data is removed after the server confirms.
• Turn cloud sync off and, if you want, delete the synchronized cloud copy while keeping the device copy.
• Disconnect a health platform and optionally delete the data imported from it.
• Block a partner at any time. A block ends the partnership and deletes shared summaries and messages, and prevents new invites or messages in both directions.
• Report a partner, a shared summary or a message. Reports are reviewed through an operator-only moderation process.

Deleting data cannot be undone unless you exported a backup first.

6. Security

Data on the device sits in the app's private sandbox. Cloud sync uses TLS in transit and row-level security in the database, with a private storage bucket scoped to your user id. The subscription SDK receives only purchase data and an app-user identifier. No system is perfectly secure, but we collect the minimum needed and never ask for more than the feature you are using.

7. Children

Prolumen is not directed at children under 16, and we do not knowingly collect data from them.

8. Changes

If this policy changes materially, the new version will be published at the canonical URL above and the "last updated" date will change. Continued use after an update means you accept the updated policy.

9. Data sources and attributions

• USDA FoodData Central — U.S. Department of Agriculture, released under CC0 1.0 (public domain). Source: https://fdc.nal.usda.gov/
• Open Food Facts — available under the Open Database License (ODbL) 1.0. Source: https://world.openfoodfacts.org. Product names, brands and nutrition values belong to their respective owners. Open Food Facts data is used under the ODbL and is not redistributed as a standalone database.

10. Contact

Questions about this policy or your data: support@prolumen.app.

Nutrition and body values shown by Prolumen are estimates for general information, not medical advice. Prolumen is not a medical device and does not diagnose, treat or prevent any condition. Talk to a qualified professional before changing your diet, training or medication.