Lumen Fit

Privacy policy

For the iPhone app Lumen Fit and this website. Last updated: November 2026. The German version is the binding one.

In short

1. Controller

Ahmed Abou Dmag

Contact: via the contact form. There is no data protection officer because none is required.

2. What is stored only on your iPhone

Your profile name, a verification trace of your password (never the password itself), your workouts, plans, sets and weights, your food diary, goals, body data, habits and settings. Name and password trace are kept in the iOS keychain, everything else in the app's storage. We have no access to it.

3. Apple Health

If you allow it, Lumen Fit reads values from Apple Health (for example steps, sleep, weight, workouts) and, if you wish, writes workouts and weight there. This data is processed on your iPhone. It is never used for advertising or marketing, never sold and never passed to advertisers or data brokers. Health data only reaches our server if you share a summary with a connected person (section 6), and then only the values you share.

4. What is sent to our server

So that settings arrive without an update and friends can connect, the app registers with our server. We store:

There is no account with email or password. Legal basis: providing the app you use (Art. 6(1)(b) GDPR). Stored until you delete the account.

5. Usage reports (only after you say yes)

The app asks once whether it may send small usage counters. Only after "Yes" is anything sent: which tab and feature you open first each day, at what time of day, rough session length, paths in the app, where a flow is abandoned, chosen settings, error types (for example a crash), server response times, app version, iOS version and device type. Never health values, weight, food, sleep, workouts, texts, names, location or error messages. The counters are linked to your account and are therefore not anonymous. They are deleted after 90 days. Legal basis: your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time on the app's privacy page with the "Nutzung melden" switch.

6. Friends and stats (only after you share)

You can connect with others via QR code, link or code. The server then stores the connection and, only for the areas you share with that person, a summary (for example today's steps, gym days this week, recent workouts). In challenges the app only reports your number (for example the number of workouts). Reactions between connected people are deleted after 30 days. Stats and leaderboards are private by default; only what you share there becomes visible. Legal basis: your consent (Art. 6(1)(a), for health values Art. 9(2)(a) GDPR). You can change what you share or remove a connection at any time.

7. Meal photo with AI (only after explicit consent)

Before you have your first meal photo estimated, the app asks for your consent. Without "Allow" no photo is sent. With consent, the photo (downscaled, without location and capture time), the chosen meal and any hint you type yourself go through our server to OpenAI (OpenAI, L.L.C., USA) for analysis. Our server neither stores nor logs the photo or the answer; it only counts how many photos your account sent per day (for the daily limit). The request to OpenAI is sent with the setting not to store the response; OpenAI's API terms apply to processing at OpenAI. This transfers data to the USA. Legal basis: your explicit consent (Art. 6(1)(a), Art. 9(2)(a) and Art. 49(1)(a) GDPR). You can withdraw it at any time in the app's photo sheet; after that no photo is sent. The photo itself stays on your iPhone until you accept or discard the estimate.

8. Other services the app contacts directly

With every connection the respective service technically sees your IP address. Your name, health data or workouts are never sent with these requests.

9. Where the data is kept

Our server and this website run on Cloudflare (Cloudflare Workers, D1 database and Pages). Cloudflare technically processes IP addresses to deliver requests and may process data outside the EU. We do not analyse access logs.

10. This website

No cookies, no tracking, no analytics, no external fonts. The contact form sends your text and, if you like, a reply address to our server. We only store the text, reply address and time and delete them after 180 days. To prevent abuse, the server counts messages per IP address for one hour; for this it stores only a hash of the IP, never the IP itself. Legal basis: our legitimate interest in answering requests (Art. 6(1)(f) GDPR).

11. Deletion

In the app under Profile, Account, "Delete account": this immediately deletes all data of your account on our server (account, settings, connections, shares, challenges, reactions, usage counters, photo counters) and then everything of Lumen Fit on this iPhone. Data in Apple Health stays; you decide there. If you only delete the app, the little data on the server stays until you delete the account or ask us via the form. Usage counters are deleted after 90 days, reactions after 30 days and contact form messages after 180 days anyway.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Write to us via the contact form. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the country where you live.

13. No automated decisions

There are no automated decisions with legal effect and no profiling for advertising. The AI estimate for a meal photo is only a suggestion that you check and change.