Privacy Policy

PRChase is maintained by Daniel Yordanov. For anything about your personal data, write to support@prchase.app.

Only what you enter yourself: name, phone number and email on registration; sex, date of birth, height, weight, and goal; the food, water, weight, measurements, and workouts you log; the messages and photos you send in chat; progress photos; questionnaire answers if you connect with a coach.

Your phone number also serves as your login username — that's why it's required.

If you allow it, the app reads only today's calories burned from your phone's health record (Health Connect on Android) — the total figure the record shows. The number is shown only on your screen — it's not saved on the server and isn't visible to your coach. The permission is optional and can be revoked at any time in Health Connect settings.

On iPhone the same number is read from Apple Health under the same terms: optional, shown only on your screen, never saved on the server and never shared with anyone.

If you sign in with Google or Apple, we receive from them only the name and email you allow, plus a unique account identifier. For notifications we keep an identifier of your phone (a Firebase Cloud Messaging token on Android or an Apple Push token on iPhone) — only to send them to you; you can turn them off in your phone's settings.

We don't collect location, contacts, your list of installed apps, or anything else from your phone beyond what's listed here.

On login and registration we also keep your IP address briefly (up to 15 minutes) — solely to stop automated password-guessing attempts and abuse of invite codes. It's not used for anything else and isn't linked to your other data.

We process most of your data because it's necessary to provide the service you requested — we can't calculate your targets without weight and a goal, and we can't connect you with a coach without a profile (Art. 6(1)(b) of Regulation (EU) 2016/679).

Access to Health Connect and connecting with a coach go through your explicit, voluntary consent — you turn them on and off yourself, at any time, without it affecting the rest of the app.

The IP address on login/registration is processed on the basis of legitimate interest — the security of all users' accounts.

Everything is kept on your device, so the app works without internet too. If you have a registered account, the same data is also kept on a server on Cloudflare, so it isn't lost when you change phones. Photos are stored in Cloudflare R2 and aren't served at a public address — every access goes through a check of who's asking.

Your password is never stored as text anywhere — only an irreversible fingerprint of it is kept, which can be verified but not reversed.

Only you. The one exception is the coach you've connected with yourself — they see your nutrition, weight, measurements, workouts, progress photos, and questionnaire while the connection is active. If you end it, their access stops immediately, including to what was already recorded.

Scanning a barcode sends only the barcode number itself to an external product database (Open Food Facts) to return nutritional values. Nothing of yours is sent along with it.

PRChase uses a few outside services. Each receives only what it needs to do its job.

Cloudflare — hosting, the database, storage for photos (R2), and sending the emails with confirmation and password-reset codes.

Artificial intelligence — when you scan a product, the app may ask a language model (through Cloudflare Workers AI) to match the product to the closest food in our database and fill in its vitamins. Only the product's label data goes to the model — name, brand, category, ingredients and nutrition values. Nothing about you is sent: no name, phone or account, and no diary, weight or workouts. The answer is stored by barcode and applies to every user. Because no personal data is sent, there is none to be used for training models.

Notifications — Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service) receive your device identifier and the text of the notification so they can deliver it.

Payments — if you buy a subscription, the payment goes through Google Play or the App Store and your card number never reaches us. We only receive confirmation of the plan you bought — through the RevenueCat service.

Sign in with Google or Apple — your choice. They know you are signing in to PRChase, but not what you enter in it.

For as long as you have an account. If you delete it from Profile → Account & Security → Delete Account, your records are removed from the server and the app also clears the device. The action is irreversible, which is why it requires confirming twice.

If you don't have access to the app, you can also request deletion from the account-deletion web page. Requests are processed within 30 days.

As a user in the EU you have the right to receive a copy of your data, to request correction or deletion, to withdraw your consent, and to file a complaint with the Commission for Personal Data Protection. For any of this, write to support@prchase.app — we respond within 30 days.

If, despite the measures taken, your data is put at risk by a security breach, we will notify the Commission for Personal Data Protection within the legally required timeframe (up to 72 hours of becoming aware of it), and notify you without undue delay if the breach poses a real risk to your rights and freedoms.

If the way we handle data changes, the text here is updated and you'll find out in the app. Last updated: October 17, 2026.