Legal

Privacy Policy

Last updated: 4 August 2026 · Applies to Simple Shred: Fat Loss Plan (iOS & Android) and to this website

The short version: Your weigh-ins, your check-ins and your weekly progress photos stay on your phone. We do not require an account and we do not sell personal data. Two things do leave your device, and we tell you before either happens: the answers you gave during setup, which are sent to Google's Gemini API to write your plan; and — only if you switch it on — a meal photo or a step screenshot, sent to be checked against your plan and kept by nobody. Your progress photos are never sent, and the photo check can be switched off at any time. See What leaves your device.

About this website: the app and the website are two different things. simple-shred.com uses Google Analytics cookies, but only if you agree to them — we ask on your first visit, "Reject" is a real answer, and you can change your mind at any time via the Cookies link in the footer. See This website. There is no analytics or tracking of any kind inside the app itself.

1. Who we are

Simple Shred: Fat Loss Plan ("the app") and the website at simple-shred.com ("the website") are developed and published by MX Development, which is the controller for the processing described here. For any privacy question, contact us at info@mxdevelopment.nl.

Sections 2 to 8 describe the app. Section 9 describes the website, which is separate and works differently.

2. Data the app handles

• Weekly progress photos — taken with your camera or attached from your photo library, at your initiative. Stored locally on your device and never sent anywhere.
• Meal photos and step-count screenshots — stored locally on your device. If you switch on the meal check, a copy is sent to be checked against your plan and is not retained; see What leaves your device.
• Plan and checklist data — your protocol settings, completed checklist items and progress history. Stored locally on your device.

The app does not ask you to create an account and does not collect your name, email address or contact details.

3. Camera and photo library access

The app requests camera and photo library permissions solely so you can attach meal photos, step-count screenshots and weekly progress photos to your checklist. Photos are only captured or read when you actively choose to add one. You can revoke these permissions at any time in your device settings; the related features will then be unavailable.

Attaching a photo never sends it by itself. Sending only happens for a meal photo or a step screenshot, only after you have separately switched the check on, and only when you tap to run it. That switch lives under Protocol → Pace & cardio → Photos and can be turned off again at any time, after which you tick meals and steps off yourself.

4. Notifications

If you allow notifications, the app schedules local reminders on your device (for example, when a checklist item is still open). These are generated on your phone and are not sent from a server.

5. What we do not do

• We do not upload your weigh-ins, your checklist history or your weekly progress photos anywhere. They stay on your device.
• We do not keep a copy of anything that is sent for checking or planning — not the text, and not the images. Each is used to generate one result, which is returned to your device and then exists nowhere else.
• We do not use any photo to identify you, to estimate calories or nutrition, or to make any statement about your health.
• We do not ask for your name, email address or any account.
• We do not sell or rent personal data to third parties.
• We do not show third-party advertising.

6. Subscriptions and payments

Simple Shred offers an optional paid subscription. Payment is processed entirely by Apple or Google; we never see your card details. To know whether your subscription is active, the app uses RevenueCat (RevenueCat, Inc., United States) as a processor. When you open the paywall or subscribe, RevenueCat receives an anonymous customer id generated on your device, your purchase and receipt events, and basic technical data such as platform, app version and country. It does not receive your name, email address, photos or any of your checklist data. See RevenueCat's privacy policy. This processing is necessary to perform the contract when you buy a subscription (Art. 6(1)(b) GDPR).

7. What leaves your device

Everything in this section goes to Google's Gemini API (Google Ireland Limited / Google LLC) through a server of ours, which holds the API key so your app never has to. Each request produces one result, which is returned to your device. We keep no copy of any request or response on any server of ours; our database holds nothing but a per-day request count.

We use Google's paid API tier, under which Google does not use your prompts or the responses to train or improve its models. Google logs them briefly for abuse detection under its API terms.

Text — how your plan gets written

• Building your protocol — your setup answers (goal, weekly schedule, the meals you already eat, the ingredients you never want planned) and your age, height and starting weight, because portion sizes depend on them.
• Adapting a meal — the meal you typed and your never-plan list.
• Reading your day — the description you wrote.

Writing your plan is what the app is for, so this is not an optional extra: it is how the service works, and the lawful basis is performance of the contract between us (Art. 6(1)(b) GDPR). A screen during setup tells you exactly what is sent before the first request is ever made. Your weigh-in history, your checklist history and your photos are not part of it, because none of them are needed to produce the result.

Images — the meal check and the step count

Two images can be sent, and only these two: a photo of the meal you are about to eat, checked against the meal your plan lists for that slot, and a screenshot of your step counter, from which the number is read. Both are resized on your device first. Neither is retained by us.

Your weekly progress photos are never sent under any circumstance.

This one is genuinely optional and is off until you switch it on. We ask separately, in plain language, the first time you attach a meal photo, and "No thanks" is a real answer — you then tick meals and steps off yourself and every other screen behaves identically. The lawful basis here is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time under Protocol → Pace & cardio → Photos.

What the check does is compare a photo against your own plan and answer one of three things: it matches, it does not, or it cannot tell. It does not estimate calories or nutrition, does not identify anyone, and makes no statement about your health.

The anonymous identifier

To keep usage fair and prevent abuse, your device holds an anonymous identifier issued by our infrastructure provider Supabase. It is not linked to you, your device identifiers or any contact details, and is used only to count requests per day. This is necessary for the legitimate interest of keeping the service running and affordable (Art. 6(1)(f) GDPR).

8. Other third-party services

The app is distributed through the Apple App Store and Google Play. Apple and Google may process device-level data (such as crash reports and aggregate install statistics) under their own privacy policies. If future versions of the app add services that process personal data (for example, optional cloud backup or analytics inside the app), this policy will be updated first and the app will ask for any required consent.

9. This website

This section is about simple-shred.com only. It does not apply to the app, which contains no analytics and no tracking of any kind.

Hosting

The website is a set of static pages hosted on GitHub Pages (GitHub, Inc.). Like any web host, GitHub processes your IP address and request details in order to deliver the pages to you and to protect the service against abuse. We have no access to those server logs.

Google Analytics — only with your consent

The website uses Google Analytics 4 (Google Ireland Limited) to understand how many people visit, which pages and guides they read, and roughly where they come from. To do this, Google Analytics sets cookies in your browser and processes an analytics identifier, your IP address, the pages you view, your approximate location derived from your IP, and technical data such as browser, device type and referring site.

None of this happens until you say yes. On your first visit we ask, and no analytics cookie is placed while the question is open or if you decline. Rejecting takes one click, is exactly as easy as accepting, and nothing on the site behaves differently afterwards. If your browser sends a Global Privacy Control signal we treat that as a refusal and never ask.

The lawful basis is your consent (Art. 6(1)(a) GDPR, and Art. 5(3) of the ePrivacy Directive for the cookies themselves). You can withdraw it at any time, as easily as you gave it, using the Cookies link in the footer of every page. Withdrawal takes effect immediately and does not affect the lawfulness of anything measured beforehand.

We use this only in aggregate, to decide what to write and improve. We do not use it to build a profile of you, we do not link it to anything in the app, and we do not sell or share it for advertising — advertising and personalisation signals are switched off. The app sends nothing to Google Analytics.

Google acts as our processor for this and may transfer data to the United States under the EU–US Data Privacy Framework and its standard contractual clauses. See Google's privacy policy and how Google Analytics uses cookies.

The cookies this sets

If, and only if, you accept:

• _ga — distinguishes one browser from another. Expires after 2 years.
• _ga_9GYDBKTJBP — keeps session state for this property. Expires after 2 years.

Your own choice is remembered in your browser's local storage under ss_consent_v1, so we do not have to ask again. That entry is strictly necessary to honour your decision, is never sent anywhere, and we re-ask after six months. Clearing your browser data removes it and the banner returns.

Other ways to refuse or remove it

• Use the Cookies link in the footer and choose Reject.
• Install Google's official opt-out browser add-on.
• Block or delete cookies for simple-shred.com in your browser settings, or browse in a private window.
• Email info@mxdevelopment.nl and we will action any objection or deletion request.

Analytics data is retained by Google for 14 months and then deleted automatically. We hold no copy of it outside the Google Analytics interface.

10. Data retention and deletion

Because your data lives on your device, you are in control of it. Deleting the app deletes the checklist data and photos stored inside it. Photos saved to your own photo library remain yours and are governed by your device. The anonymous subscription record held by RevenueCat can be deleted on request — step by step instructions are on the delete your data page.

11. Children

The app is intended for adults and is not directed at children under 16.

12. Your rights

Depending on where you live (for example under the GDPR in the European Union), you may have rights of access, correction, deletion and objection regarding personal data. Since the app stores data locally and we do not hold personal data about you, most of these rights can be exercised directly on your device. For the website analytics described in section 9, you can withdraw your consent at any time through the Cookies link in the footer, or use any of the other methods listed there. For any request or question, email info@mxdevelopment.nl. You also have the right to lodge a complaint with your national data protection authority — in the Netherlands, the Autoriteit Persoonsgegevens.

13. Changes to this policy

We may update this policy as the app and the website evolve. The "last updated" date at the top reflects the current version. Material changes will be announced in the app or on this page.