LAST UPDATED · OCT 8, 2026 · English translation; the Spanish version governs

Your data and your privacy

This notice explains what personal data Fituba processes, why, with whom and how you exercise your rights, under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties.

Who is responsible

Fituba is a personal logging tool operated by Carlos de León, who is responsible for processing your data, at Primavera 2074, Col. Del Fresno, 44909 Guadalajara, Jalisco, Mexico. Privacy and support contact: hola@fituba.com.

What data we keep

• Your account: email, the name or alias you choose, time zone, units and your consents. Your password is handled by our sign-in provider and is never stored in plain text.
• Data to estimate your goals, if you enter it: age, sex, weight, height, daily activity and goal.
• Your logs: meals and drinks, calories, protein, carbs and fat, body weight, weight training, cardio, exercise sessions, saved meals and any feedback you leave on estimates. Steps are paused in the app; the ones you already logged or write in a message are kept with your other logs.
• Your body measurements, if you log them: waist, required when you save measurements; hips and neck, optional; and your height, asked only once if it isn't in your profile. With them and the sex in your profile we show you waist-to-height, waist-to-hip and an estimated body fat percentage using the US Navy equations. They're saved without AI and don't appear on your public profile or in Friends.
• Your consistency: points, streaks, rank and logged dates.
• Technical data: what's needed to keep you signed in, protect your account and prevent abuse.

Food, weight, measurement and activity logs can reveal information about your health, so they are sensitive personal data. We ask for your express consent before you enter the app, and you can withdraw it anytime.

What we use it for

Purposes needed to provide the service: creating and protecting your account, saving your history, calculating your metrics, charts, points and streaks, estimating the logs you send with AI, closing past days, giving you support and preventing fraud or abuse.

Optional purposes, only if you turn them on: your public profile, Friends and challenges, optional acquisition measurement, the invite code you choose to keep when you sign up, and using your feedback to improve estimates. If you don't turn them on, or turn them off, you keep using Fituba the same way.

We don't sell your data, use it for advertising or use it to train AI models.

AI logging

When you log with AI, we send the OpenAI API the text of that log, your units, time zone and goals and, if you fix or repeat a log, up to three of your logs from the same day as reference, so an OpenAI model can estimate calories, protein, carbs and fat and extract your activity. We don't send your name, email or full history. We ask that the response not be stored as a conversation; the provider's operational retention periods may apply. You must accept the updated notice before using this feature.

Messages that only contain clear activity, like “lifted for 60 min,” are logged with our own rules, without AI. You can review and fix every estimate or log in Manual without AI. Dictation uses your browser's or keyboard's speech recognition; Fituba only receives the text.

If you sign in with Google

With “Continue with Google,” Google confirms your identity and email. Our sign-in provider stores that account's identifier and the basic data Google sends: your email and, if Google includes them, your name and photo. We don't receive your Google password or your contacts. The sign-in page loads Google's button, which Google operates under its own privacy policy.

Your public profile, if you turn it on

If you turn it on from Profile, you get a profile at fituba.com/your_username. It shows your @username, rank, total points, streak and a calendar of points per day. It's self-reported consistency data, not a measure of fitness. Your initial username comes from the part of your email before the @, normalized and with a suffix if needed; review it and change it from Profile if you'd rather use another public name. Changing it changes your URL; the old link stops showing the profile and is reserved to prevent impersonation.

The profile can be opened without an account and shared with friends or your coach. It doesn't include your full email, private profile name, meals, weight, measurements, goals or exercise details. Sharing its link doesn't give professional access to that data or create a friendship. No directory is published and we don't ask search engines to index these profiles during this beta. New accounts start with the profile off, and using Fituba doesn't require it. Accounts that already had it on keep it. You can turn it off from Profile anytime: the link stops showing the profile immediately and you keep your @username, points and rank in case you turn it back on.

Friends and challenges, if you turn them on

Friends is optional. People can find you by your full email or @username and send you a request inside Fituba. When you accept a friendship, you share only your @username, points and consistency days for the last seven days, including today, on Mexico City time. The leaderboard updates when each person opens Friends.

If you propose and accept a 7-, 14- or 30-day challenge, counted from the day it's accepted on Mexico City time, you both see only the challenge progress: points, logged days, active days, weights days, cardio distance, days on food goal (protein at 90% and calories between 85% and 110% of each person's goal) or the percentage of weight each person loses. Your weight, meals and goals are never shared. Each account calculates its own progress, which updates when each participant opens Friends. Either of you can cancel the challenge. Friends doesn't show your email or your logs. You can remove friends or turn the feature off from your profile.

Emails

Resend delivers the confirmation and account recovery emails. With your account, Twilio SendGrid sends you a summary every Sunday and a nudge if you go several days without logging: they're on by default, carry consistency and averages, never meals or weight, and you can turn them off anytime from your profile or from the email itself.

Who it's shared with

We work with providers that process data on Fituba's behalf and only to provide the service: Vercel (app hosting), Supabase (database and sign-in), OpenAI (AI estimates), Resend and Twilio SendGrid (email). These providers may process information outside Mexico, including in the United States. If you choose to sign in with Google, Google confirms your identity under its own policy. We don't transfer your data to third parties for their own purposes, unless a competent authority requires it under the law.

Public tools

The calorie calculator, the portion calculator and the food table run in your browser: what you type there isn't sent or saved.

Your browser

We use our own protected cookie to keep you signed in, and a cookie that remembers your language. If you allow optional measurement, we use another first-party cookie described below. Your browser may save preferences, drafts and notices you've already seen so they don't repeat, and for 30 days the invite code you arrived with, if you had one. There are no advertising trackers on Fituba.

Minors

Fituba is for people 18 and older. We don't knowingly collect data from minors; if we find an account belonging to a minor, we'll delete it. If you're a parent or guardian and believe a minor gave us data, email us.

Security

We apply reasonable administrative, technical and physical measures: an encrypted connection, an encrypted session, database access to logs limited to each user, and passwords handled by our sign-in provider. No system is infallible; if a breach significantly affects your data, we'll notify you so you can protect yourself.

Your rights and your control

You have the right to access, correct and delete your data or object to its use (known in Mexico as ARCO rights), as well as to withdraw your consent and limit the use of your data.

• From the app: edit your logs and goals, export your data and turn off the public profile, Friends, emails or measurement anytime.
• By email: write to hola@fituba.com from your account's email, saying which right you want to exercise and for which data. We verify your identity before providing, correcting or deleting information and respond within the legal deadlines.

If you withdraw your consent for health data, you won't be able to log anymore; we'll confirm whether you also want to delete your account.

Retention

We keep your logs as long as you keep your account. Fixes keep a revision of the log to protect your history. If you ask us to delete your account, we'll confirm the scope and removal date; providers' backups may be kept temporarily according to their cycle. Don't share other people's data in your logs.

Changes to this notice

If the use of your data changes substantially, we'll explain it here and in the app, and ask for new consent when required. The date on this page identifies the current version.

Optional acquisition measurement

In “Optional measurement,” at the bottom of the public site, you can allow or reject this measurement without affecting your access. It's off by default and honors Global Privacy Control and Do Not Track. We don't use Google Analytics, advertising, session recording or fingerprinting for this.

With permission, we keep one entry per browser for 30 days: the source category, the public landing page (food pages count as one category), interest and date. We don't store the referrer URL, search queries, free-form parameters, email or food content in these events. A signed first-party cookie, readable only by the server, holds the random identifier; the preference is kept for 30 days in your browser.

If you create an account, we link that entry to your internal identifier to count sign-ups, first saved result and return on days 1 to 7. The administrator sees aggregate acquisition metrics. No health data is added to the events. This link is pseudonymous, not anonymous. Entries are kept up to 90 days and purged as new measurements arrive; if there's no activity, the purge happens at the next one.

“Withdraw permission” stops the measurement and deletes the entry identified by the current cookie. To ask for deletion of earlier data or data from another device, use the privacy contact. Without permission we can't attribute that visit to a sign-up. Operational metrics for existing accounts and logs are kept separate. To prevent abuse, the server uses temporary counters with a protected representation of the IP, without storing the IP in acquisition events.

Invite codes

If you arrive through a link from a creator, dietitian or partner that includes a code (for example ?ref=name), we keep it only in your browser for 30 days and show it to you when you sign up, where you can remove it. If you keep it, we link it to your new account to count how many accounts arrived with that code, how many saved a first log and how many came back in their first week. It doesn't depend on optional measurement and isn't assigned to existing accounts.

We only share those totals per code with the partner, never your name, email, logs or health data. To remove the code from your account, use the privacy contact.