Document 2 of 6
Data Protection Policy
This document says what information M4Plan handles, why, where it goes, how long it stays, and what you can require of us. It is written to be read, not to be waved at you.
- Version
- 2.6
- Effective
- 24 October 2026
- Applies to
- M4Plan v1.2.0 and later
- Versions
- French, English, Finnish
Section 1Who is responsible
The controller is Kevin Di Silvestro, an individual resident in Switzerland, publisher of M4Plan. Contact: m4plan.info@gmail.com.
Because M4Plan is offered to people resident in the European Union, the GDPR applies to this processing under its Article 3, alongside the Swiss Federal Act on Data Protection.
We have not appointed a data protection officer: the size and nature of the activity do not require one. Your requests are handled directly by the publisher, at the address above.
Section 2The principle: your device first
M4Plan is built to work without us. Goals, tracking, nutrition, workouts, weight, photos, widgets and the blocking check-in work on a device that has never been connected to an account, within the limits of the free plan. In that setup your information is written into the app’s private storage, protected by the operating system, and we receive none of it. Only a few technical requests, unrelated to it, leave the device: the version check and the app’s updates each time it opens, and Open Food Facts when you search for a food or scan a code (section 7). A subscription requires an account: the store and our subscription provider then process your purchases, as described in sections 3 and 7.
Creating an account adds four things, and only those: online backup, syncing between your devices, access to the account area from a browser, and the AI-assisted nutrition estimate. That is the moment, and not before, when your information reaches us.
Section 3What we handle
The table below lists everything M4Plan touches. The “where” column gives the destination: “device” means the information never reaches us.
| Category | Contents | Where |
|---|---|---|
| Account | Email address, password (never stored in the clear), display name, internal identifier, session tokens | Server |
| Profile | First name, year of birth or age, sex if you enter it, height, starting weight, the intentions, obstacles and answers you chose at setup | Device, then server if you have an account |
| Routine | Goals, chosen times and days, ticked boxes, free notes, streaks, current challenge, archives and, if you create the screen-time goal on Android, the number of minutes the screen was on each day (never the list or duration of your apps) | Device, then server if you have an account |
| Activity | Workouts, exercises, sets, loads, repetitions, durations, distances, how it felt, the programme followed | Device, then server if you have an account |
| Food | Meals, foods, quantities, calories and macronutrients, scanned barcodes, favourites, diets and allergies you declare (they can reveal a religious belief or a health condition) | Device, then server if you have an account |
| Measurements | Weigh-ins and their date, calculated trend, weight target | Device, then server if you have an account |
| Photos and videos | Meal photos, progress photos, workout videos | Device; encrypted copy in transit to a private space if you have an account |
| Game | Points, point transactions, badges, chests, rewards you set yourself | Device, then server if you have an account |
| Settings | Language, theme, chosen widgets, sounds, reminders, display preferences, consents given and their date | Device, then server if you have an account |
| Local diagnostics | The last twenty app incidents: message, call stack, version, device model, system version | Device |
| Technical identifiers | A random identifier written by the measurement tool, only after you accept (once you are signed in, replaced by the internal account identifier, never your address); a session token while you are signed in; an installation identifier that Google’s barcode reader (ML Kit, on Android) may use if you scan a code; a technical identifier assigned by the subscription provider, anonymous until you have an account | Device, and server for accepted measurement; Google for barcode reading; subscription provider |
| Usage measurement | If you accept it: screens opened, actions taken, a recording of what happens on screen, incidents, device model, system and app version | Server, European Union |
| Health Connect (Android) and Apple Health (iPhone) | If you allow it: steps, weight, active calories, exercise minutes, sleep (duration, bedtime and wake-up times), resting heart rate, VO2 max, oxygen saturation, workouts (duration, distance, elevation gain and floors climbed) and, during a workout, heart rate, power, cadence and swim strokes; with a separate permission, the app also writes there the workouts done on an M4Plan watch (type, duration, distance, calories) | Device; steps, weight, session measurements and goals linked to a measure go to the server if you have an account |
| AI estimate | Only when you ask: the description you type or the photo of the meal. On our server, a log of your estimates (date, text or photo mode, volume processed, never the content) | A provider in the United States, for the time of the response and its technical security periods; log on our server |
| Feedback | Message, category, reply address if you give one, app version, language, account identifier if signed in | Our mailbox (email service hosted by Google) and our database |
| Website | Email address left in a form; for the early-testers study: first name (optional), phone used (Android or iPhone), wish to join the WhatsApp group, share code and the code of the person who invited you, rank and tier assigned; for the pilot coaches list: number of people coached (optional); for each form: page language, text of the box ticked and date of agreement, country of connection when you sign up (derived by the host, never the IP address); audience measurement if you accept it | Server, United Kingdom (London) |
| Subscription | If you subscribe or receive free access: plan, store, status, purchase, trial end and renewal dates, history of events sent by the store with the price paid and the offer applied, and your benefits (free time, consistency discount) with their origin, expiry date and status | Server, United Kingdom (London); subscription provider in the United States |
| Consistency | For each recorded action (goal done, workout done, meal, weigh-in, progress photo, waist measurement): the section concerned, the technical identifier of the line, the day concerned and the time it reached us, without its content. Per week, the number of days on which you acted. For your account, a gauge from 0 to 100 and a level | Server, United Kingdom (London) |
| Emails from the app | Your email address, your first name if you gave it and your language; a log of what was sent (type of message, date, language, unsubscribe token and the date of any opposition); your refusal of the come-back offer, if any, and its date; never the text of the messages | Server, United Kingdom (London); delivery by a provider in the United States |
| Benefits, referrals and cancellation | If you use a code, a referral or an offer: your referral code, the link between the inviting account and the invited account with the date of the latter’s first payment, the codes used, your benefits (free time, discount) with their origin, expiry date and status, and, if you cancel, the reason chosen from a list and the optional free text of your answer | Server, United Kingdom (London) |
| Ambassador programme | If you take part: the public link of the video you submit, the date you agreed to the charter, the decision taken, the review note and the reward code | Server, United Kingdom (London) |
| Wake-up and screen (Android) | If you create a screen-time, bedtime or wake-up goal and grant access to usage data: screen-on or unlocked time, number of unlocks, times of the first unlock and of switch-off, and the time of the next alarm set on the phone (4-day log). Never the list or duration of your apps | Device; the daily total of minutes goes to the server if you have an account |
| Protection against abuse | A fingerprint of the IP address (never the address itself) and the name of the function called, to limit abusive requests, kept for 48 hours at most | Server, United Kingdom (London) |
| M4Plan watch (Wear OS) | If you link a watch: measured workouts (duration, heart rate, distance) and steps for the day; the watch’s GPS, with your permission, during a run or a bike ride, only to calculate the distance, with no route kept; the title, artist and playback state of the track playing on the phone, during a workout, for the Music page; the day’s snapshots (goals, steps, calories, sleep) that the phone sends to the watch | Watch and phone, over their link; a recorded workout then follows the usual path (device, then server if you have an account); no data from the watch reaches us directly |
Section 4What we do not do
- We do not sell, rent or trade any information about you.
- We show no advertising and work with no ad network and no data broker.
- We do not use your content to train an artificial intelligence model, and we have excluded that contractually with our provider.
- We do not collect your precise location, in the app or elsewhere, except with your permission on an M4Plan watch: the watch’s GPS, during a run or a bike ride, is used only to calculate the distance, and no route is kept. If you sign up for the early tester programme on our website, we only record your country, inferred from your connection address by our hosting provider, to know where sign-ups come from. Language is taken from your phone settings.
- We do not read the list of your other apps, how long you use them, your contacts or your messages. The blocking check-in shows inside the app; it observes nothing.
- We do not look at your photos and notes. Technically, access to a storage space is never nil; in practice we do not open it, except where the law requires it or where you ask us to, to resolve an incident.
- We do not track people who have not accepted usage measurement.
- Information read from Health Connect or Apple Health is passed to no third party, used for no advertising, and never sent to the nutrition estimate provider. It serves to show and track your activity inside the app, and an imported weigh-in counts, like one you enter, as an action of the day in the measure of your consistency: only the fact that it took place is kept, never its value.
Section 5Why, and on what basis
| Purpose | Legal basis |
|---|---|
| Running the app on your device | No processing by us: the information is not sent to us |
| Creating and keeping your account, backing up and syncing your information | Performance of the contract, Article 6(1)(b) |
| Handling special category information (weight, heart rate, sleep, oxygen saturation, food diary) where it qualifies as such | Explicit consent, Article 9(2)(a) |
| Importing your data from Health Connect or Apple Health | Consent, Articles 6(1)(a) and 9(2)(a), withdrawable in Health Connect or Apple Health |
| Estimating the make-up of a meal you describe or photograph | Performance of the contract at your request, Article 6(1)(b), plus explicit consent for the special category |
| Measuring product usage and recording the screen | Consent, Article 6(1)(a), asked at the end of setup and revocable |
| Answering feedback or a support request | Performance of the contract and legitimate interest in replying, Articles 6(1)(b) and 6(1)(f) |
| Protecting the service against abuse, intrusion and fraud, in particular through a temporary fingerprint of the IP address | Legitimate interest, Article 6(1)(f) |
| Keeping proof that you accepted these documents | Legal obligation to demonstrate consent, Articles 5(2) and 7(1) |
| Meeting a legal obligation or a valid official request | Legal obligation, Article 6(1)(c) |
| Collecting an address left on the website | Consent, Article 6(1)(a) |
| Knowing the country of study sign-ups | Legitimate interest, Article 6(1)(f) |
| Managing your subscription: trial, purchases and renewals sent by the store, payment problems, offers | Performance of the contract, Article 6(1)(b) |
| Measuring the consistency of your account and the discount level it opens, from the sole fact that an action was recorded on a given day and the time it reached us, never from its content nor from the value of a weight | Performance of the contract, Article 6(1)(b), and explicit consent for the special category, Article 9(2)(a) |
| Writing to you about your account and subscription: address confirmation, sign-in link, welcome, trial-end reminder, renewal notice, payment incident, deletion confirmation, notice before an inactive account is deleted | Performance of the contract, Article 6(1)(b) |
| Telling you when the app is released and sending you the code of a programme you signed up for on the website | Consent, Article 6(1)(a), given in the website form and withdrawable in one click in every message |
| Managing codes, referrals, benefits and the Ambassador programme | Performance of the contract, Article 6(1)(b) |
| Checking that the app is up to date and delivering its updates | Legitimate interest, Article 6(1)(f) |
| Measuring, as aggregated statistics, what the app produces (for example the average change in weight or the most scanned foods), never presenting a group of fewer than five accounts | Statistical processing, Article 5(1)(b), with the safeguards of Article 89(1); anonymised results |
| Being able to restore the service after an incident, using a one-off encrypted copy of the database that the publisher keeps for 30 days at most | Legitimate interest, Article 6(1)(f) |
| Offering you a way back, in a single email sent three months after a paid subscription ends | Legitimate interest in offering our own service to a former customer, Article 6(1)(f); you can object from the moment you create your account and at any time, in the app settings or in one click in the message |
Section 6Your consents, and how to withdraw them
Several things happen only if you accept them. Withdrawing a consent has no retroactive effect on what has already been processed, and degrades no other feature. If you are signed in, these choices follow your account from one device to another.
| What is asked | When | Where to withdraw |
|---|---|---|
| Usage measurement: screens opened and actions | At the end of setup | Settings, Features and data |
| Screen recording | At the end of setup, together with usage measurement, through a single box (“Measurement and optimisation”) | Settings, Features and data |
| Reading Health Connect or Apple Health | When you turn the feature on | Health Connect, Apple Health, or app settings |
| Camera, microphone, photo library | At first use of the feature concerned | Phone settings |
| Notifications and reminders | When you arrive in the app, then when you turn a reminder on | Phone or app settings |
| Website audience measurement | On your first visit | Website banner, asked again every 6 months; at any time by writing to us, or by clearing the site’s data in your browser |
What is stored on your device
Measuring usage means writing an identifier on the device or in the browser. Nothing is written before you accept. When you withdraw, sending stops at once and the identifier is no longer used; it stays on the device until you uninstall the app, or until you clear the site’s data in your browser.
| What is stored | Where | What it is for | Duration |
|---|---|---|---|
| Measurement identifier, app | The app’s private space | Linking together the events of one device and, once signed in, those of your devices attached to the same account, using the account’s internal identifier (never the email address) | Until uninstall, or sign-out while measurement is accepted; no longer used after consent is withdrawn |
| Measurement identifier, website | Browser | Linking together the visits of one browser | 12 months |
| Session token | Private space, or browser | Keeping you signed in without asking for your password again | Until you sign out |
| Memory of your answer | Private space, or browser | Not asking the question every time you open | 6 months on the website, life of the install in the app |
The AI-assisted nutrition estimate has no separate switch: it runs only when you call it, and what is sent is described in the AI Usage Policy. Not using it is enough for nothing to leave.
Section 7Who handles your information for us
We use a small number of providers, each bound by a processing agreement that forbids any use of their own, except Google and Apple, which act on their own behalf (distribution, payments, sign-in, barcode reading). No other recipient receives your information.
| Provider | Role | What it receives | Where |
|---|---|---|---|
| Supabase | Database, authentication, media storage, server functions | Everything you sync with your account | United Kingdom (London) |
| PostHog | Usage measurement, if you accept it | Events, technical properties, screen recordings, incident reports, account identifier if you are signed in | European Union |
| Anthropic | Nutrition estimate, only when you use it | The description or photo of the meal | United States |
| Resend | Delivery of our emails: your feedback message and the messages the app sends you (address confirmation, welcome, trial and subscription, renewal notice, deletion confirmation, inactivity notice, release announcement, come-back offer) | Email address, first name if you gave it, content of the message; for feedback: message, category, reply address | United States |
| Vercel | Hosting the website and the account area | Technical connection logs, including the IP address | European Union, logs possibly in the United States |
| Distribution of the app, collection of the subscription, Google sign-in if you choose it, barcode reading (ML Kit, on Android), the email service that receives your feedback and requests | What the store collects on its own side, including your purchases, and your address and profile photo for authentication; through barcode reading, technical diagnostic information (device model, versions, installation identifier); your messages, in the email service | Per Google | |
| Apple | Distribution on iPhone, subscription payments, Apple sign-in if you choose it | What the store collects on its side, including your purchases, and an identifier for authentication | Per Apple |
| Open Food Facts | Product entries when you scan a barcode, and food search results | The scanned barcode, or the text you type in the food search with the app language, with no identifier about you | European Union |
| RevenueCat | Subscription management and purchase validation | Technical identifier of your account (anonymous until you have one), IP address, device model and app version, purchase history and receipts sent by the store | United States |
| Expo | Remote updates of the app | IP address, platform, app version, release channel, identifier of the installed update | United States |
Section 8Transfers outside Europe
Your account and your media are hosted in London (United Kingdom), outside the European Union, under the European Commission’s adequacy decision applicable to that country. A one-off encrypted copy of the database may also be kept by the publisher, in Switzerland, for 30 days at most (section 9). Usage measurement is stored in the European Union, but its provider is a US company which may access it from the United States to run the service. Three further flows leave Europe, all limited. The app update service (Expo) also receives, each time the app opens, technical information (IP address, platform, version) unrelated to your account. Finally, barcode reading involves Google (ML Kit), on Android: when you scan a code, it may receive technical diagnostic information (device model, versions, installation identifier), unrelated to your account, and processes it for its own purposes, under its own rules and in its own processing locations.
Nutrition estimate. When you describe or photograph a meal, that text or image goes to an artificial intelligence provider in the United States, for as long as it takes to get an estimate. Neither your name, nor your address, nor your account identifier goes with it. The provider undertakes not to use that content to train its models and does not keep it beyond its technical safety periods.
Emails. Your feedback message and the emails the app sends you (address confirmation, welcome, trial and subscription, account deletion, inactivity notice, release announcement, come-back offer) pass through a delivery provider based in the United States. It receives your email address, your first name if you gave it, and the content of the message.
Subscription. If you subscribe, your account’s technical identifier and your purchase history, sent by the store, are processed by our subscription management provider, based in the United States, to validate purchases and keep the subscription state. Even without a subscription, the app may present an anonymous identifier to it, with the IP address, the device model and the app version, to display the plans on offer. No health data, no name and no address is passed to it.
These transfers are covered by the European Commission’s standard contractual clauses, together with each provider’s own safeguards. You may ask us for a copy of those safeguards.
Before each transfer we check the protection the provider actually offers, including any certification under the EU-US data protection framework, and we keep a record of that check. You may ask us for its result.
Section 9How long we keep what
| Information | Period |
|---|---|
| Account information | As long as the account exists |
| Account left inactive | Email notice after 12 months without any activity at all, deletion 30 days later; an account is deleted only if the notice could be sent to a confirmed address |
| After a deletion request | Account disabled at once, erased on the seventh day |
| Safety history of your backup (previous versions, deleted items, version kept before a reset, an import or a swap) | One version per hour for 24 hours, then one per day up to 14 days, and 30 days for a version preceding a sudden drop in content; deleted items: 90 days before final erasure, then up to 90 days in the history; version kept before a reset, an import or a swap: 90 days, restorable from the app. Everything is erased with the account |
| Usage measurement events | 12 months |
| Screen recordings | 30 days |
| Incident reports | 12 months |
| Local incident log | 20 entries, replaced as they come |
| Feedback messages | Feedback sent from an account is erased with that account; other feedback, and the copy received in our email service, is deleted on request |
| Address left on the website | Kept 24 months, or until you ask to be removed. If you unsubscribe, we keep only the address, the date of refusal and a token, so that we do not write to you again |
| Proof of your consents | Life of the account |
| Information left on your device | Until you erase it or uninstall the app |
| Subscription and its event history | As long as the account exists, deleted with it. At the subscription provider, purchase history tied to the technical identifier follows its own retention policy, and is erased on request |
| Consistency traces (day and time of receipt of each action) | As long as the account exists. They are kept even if you delete the original entry or reset your data: this is what prevents consistency from being rebuilt after the fact. They are erased with the account |
| Log of emails sent | Life of the account, erased with it; 24 months for a sign-up made on the website |
| Log of your assisted estimates | Life of the account, erased with it |
| IP address fingerprint to limit abuse | 48 hours at most |
| Online copy of a photo or video deleted in the app | Until the account is deleted |
| One-off encrypted copy of the database (publisher’s computer, Switzerland) | 30 days at most, then deleted |
Section 10Security
- Every exchange with our servers goes over an encrypted connection (TLS).
- Stored information sits on infrastructure encrypted at rest by the host.
- Every table that holds personal information is protected by an access rule enforced by the server: an account can only read its own rows, even if the app were modified.
- Photos and videos live in a private storage space with no public access. Displaying them uses a signed link that expires after one hour.
- Passwords are never stored in the clear: the authentication service keeps only a cryptographic hash.
- Access to production data is limited to the publisher, with two-factor authentication.
- On your device, your information sits in the app’s private space, isolated by the system. We do not encrypt it ourselves: protection depends on your phone being locked. An unlocked, lent or compromised device exposes its contents.
- In the event of a breach likely to create a risk, we notify the supervisory authority within 72 hours and, where the risk is high, we notify you directly.
No arrangement is infallible. If you suspect unwanted access to your account, change your password and write to us.
Section 11Your rights
You have the following rights, free of charge and without having to justify yourself:
- Access: obtain a copy of the information we hold. The app export contains the content of your app; for what we hold only on the server side (subscription, consistency, benefits, emails sent), write to us.
- Rectification: correct what is inaccurate, mostly directly in the app.
- Erasure: delete your account and its content. Deleting an entry removes it from the app at once; its safety trace disappears within the periods in section 9. Deleting a photo or video in the app does not delete its online copy: it is erased with your account.
- Restriction: ask us to freeze processing while a dispute is resolved.
- Objection: object to processing based on our legitimate interest, and at any time to marketing, in one click from the link in each message concerned, in the app settings or by writing to m4plan.info@gmail.com.
- Portability: get your information in a machine-readable format. The built-in export answers this immediately.
- Withdrawal of consent: at any time, without effect on the past, in settings.
- Post-mortem directives: if you live in France, decide what happens to your information after your death.
Write to m4plan.info@gmail.com: we answer within one month, extendable by two months for a complex request, in which case we tell you. We may ask for something that confirms the account is yours.
If our answer does not satisfy you, you can complain to a supervisory authority: the CNIL in France, the Office of the Data Protection Ombudsman in Finland, the Federal Data Protection and Information Commissioner in Switzerland, or the authority of your country of residence.
Section 12Deleting your account
Deletion is done from the app settings, without writing to us, and from a dedicated page on the website if you no longer have the app. Your account is disabled at once, then everything is erased after seven days: if you sign in again within that window, the deletion is cancelled and nothing has been lost. After that it is final.
Deleted: your authentication account, all your rows in the database (goals, tracking, workouts, meals, weight, points, badges, settings, subscription state and its history) and all media you placed in the private space. We also delete the person record held about you by our usage measurement provider, if you had one, and, on request, any address you left in a website form. Deleting the account does not cancel a running subscription: you cancel it with the store.
Temporarily remaining: the safety history of your backup, erased with the account within the periods in section 9; any messages you sent us, deleted on request; anything a legal obligation requires us to keep.
Untouched: the information left on your device. Erase it by uninstalling the app or using the local erase offered in settings. Remember to export your backup before deleting anything.
Section 13Taking your information with you
The app produces on request a backup file containing the content of your app, with the photos and videos present on this device. It does not contain what we hold only on the server side (subscription, consistency, benefits, emails sent): write to us to receive it. This file is not encrypted: treat it as a sensitive document, and avoid dropping it in a shared space.
Section 14Minors
The service is reserved for people aged 16 and over. This condition rests on your declaration at setup: we do not check your age and we do not knowingly collect the information of younger people. If you notice that an account was created by a younger person, write to us: we delete it without delay.
Section 15What other people can see
Some features show your information outside the app. None of them sends it to anyone, but all of them make it visible to whoever looks at your screen. Widgets exist on Android only.
- Widgets show your weight, your goals for the day, your remaining calories and your appointments of the day on the home screen, without unlocking.
- Notifications may appear on the lock screen, depending on your phone settings, and may then show the title of one of your goals, a weight you have just entered or received from Health Connect or Apple Health, or the result of a workout. Set how notifications appear on the lock screen in your phone settings if you do not want this.
- The blocking check-in reminder is a notification: it does not show your boxes, which only appear once the app is open.
- A backup file you share carries all of your content to the recipient.
- During a workout, the name of the workout and of the current exercise appear on the lock screen: Live Activity and Dynamic Island on iPhone, workout notification on Android.
- A linked M4Plan watch shows your information (goals, steps, calories, streak, appointments) on its watch faces, tiles and complications, without unlocking: anyone looking at your wrist sees it.
Section 16Automated decisions
We take no decision producing legal effects or significantly affecting you based solely on automated processing, and we do no advertising profiling. The figures shown by the nutrition assistant are a calculation applied to the values you entered, which you can override. The AI estimate of a meal is a suggestion you review and confirm before saving. The consistency gauge and the discount level are calculated automatically: they only open a benefit, close no access, and apply only through an action on your part.
Section 17Changes to this policy
We update this policy as the app evolves. A substantial change, in particular a new provider or a new purpose, is announced to you before it takes effect, in the app, on m4plan.app or by email, with at least 30 days’ notice when it reduces your rights. Your agreement is asked again when you open the app that carries the new text, and your consent where necessary. The version in force and its date appear at the top of the document, and earlier versions remain available on request.
Section 18Contact
For any question, request to exercise your rights, or complaint: m4plan.info@gmail.com. We acknowledge receipt and answer within one month.