Draft skeleton. Section structure only — every specific (retention periods, processors, legal bases, contact) is a placeholder pending a real policy review.

This policy covers the Elo app and this website, operated by Hapiga.

1. What we collect

In plain terms: the things you log, the account details you give us, and basic technical data about how the app is used.

What you log: meals, calories, macros, water, sleep, activity, weight (if you choose to add it), non-scale notes, and your plan settings.
Account: email address and authentication details. Confirm sign-in methods.
Device & usage: app version, device type, crash logs, and interaction events used to improve the product.
Health & fitness sources: list any integrations (Apple Health, Google Fit, wearables) and the fields read.

2. How we use it

to run your account and sync your data across devices;
to generate your plan, weekly budget, insights and the companion’s reactions;
to power the community features you opt into;
to fix bugs, measure reliability and improve the app;
confirm any use for model training, aggregate research, or marketing.

3. Legal bases

Map each purpose to a legal basis (contract, legitimate interests, consent). Health data generally needs explicit consent.

4. Sharing

In plain terms: we don’t sell your data. We share it with the service providers that run Elo, and only what they need.

List processors (hosting, analytics, crash reporting, email, payments) and their locations.
Other members of the herd see only what the community feature is designed to show — never your weight or a ranking. See the community section for what stays hidden.
We may disclose data if required by law or to protect people from harm.

5. Retention

State how long each type of data is kept, and what deletion removes vs. anonymises.

6. Your choices & rights

export your logged data;
delete your account and associated data from the app;
opt out of non-essential analytics (confirm the setting);
depending on where you live, rights to access, correct, restrict or object — expand per jurisdiction.

7. International transfers

Describe where data is processed and the safeguards for cross-border transfers.

8. Children

Elo is not directed to children under 13, and we do not knowingly collect their data.

9. Security

We use encryption in transit and at rest and limit internal access. Confirm specifics. No method is perfectly secure.

10. Changes

We’ll post updates here and change the date above. Significant changes will be flagged in the app.

11. Contact

Privacy questions: privacy@elo.app.