GoodGirlPower
Language RU EN
Learn about the launch

Coming to iOS, Android, web and Telegram

Privacy Policy

Version of 2026-10-17

The GoodGirlPower app (the “App”) helps you track nutrition, your cycle and how you feel. To do that it processes health information — a special category of personal data under Article 10 of Russian Federal Law No. 152-FZ, and under Article 9 of the GDPR where that applies. This document sets out plainly what is collected, why, where it goes and how to delete it.

Data controller: Pavel Duglas, private individual, address: 350 Nguyen Van Linh, Da Nang 555000, Viet Nam. Data protection enquiries: support@goodgirlpower.app.

1. What we process

Account data. Your email address (used for one-time-code sign-in) and, if you sign in with Google or Apple, the identifier and email address those services provide. Your name or preferred form of address, if you enter one.

Body and health data. Age, height, weight, chest, waist and hip measurements; your goal (weight loss, maintenance, muscle gain, cutting) and activity level; cycle status (regular, irregular, menopause); gynaecological conditions (PCOS, endometriosis, perimenopause) and other conditions (hypothyroidism, insulin resistance) if you record them. Derived values: BMI, body type, body fat percentage, lean mass, calorie and macronutrient targets.

Journals. Food entries (products, portion weights, calories and macros), activities, period days and recorded symptoms, morning sleep surveys, evening check-ins (mood, anxiety, obstacles), psychological journal entries, day plans, vitamins and medication, home test results. Lab history — the results, values, reference ranges and collection date read from the lab reports you sent to the assistant; it is kept separately from the conversation and is not deleted when you start a new conversation.

Images. A body photo for composition analysis if you upload one, meal photos for recognition, and photos or PDFs of lab reports if you send them to the assistant.

Voice. An audio recording when you dictate a meal or an amount. The recording is sent for speech recognition and is not stored on your device or on our servers — only the recognised text is kept.

Assistant conversations. Your messages and the assistant’s replies.

Technical data. Your user identifier, interface language, usage counters for paid features, and your plan status. App usage records: platform (iOS, Android, web or Telegram Mini App), App version, the days on which you used the App (Moscow time), and the time of the first and last visit each day; these are kept for guest access without registration as well. Log of requests to artificial intelligence services: for each request the App records the feature, model, number of tokens or audio length, cost, time and outcome (success or error). The text of requests and replies is not recorded; for guest access, an irreversible hash of the network address is recorded instead of the user identifier, and the address itself is not stored.

The App does not collect location, contacts or advertising identifiers, and does not track you across other apps or websites. The App does not read data from Apple Health or Health Connect.

2. Why we process it

We process your data to operate the App and provide personal recommendations: calculating calorie and macronutrient targets, tailoring advice to your cycle phase and wellbeing, recognising food from photos, voice and barcodes, answering your questions, sending reminders, showing your history, and applying free-plan limits. Technical data is also used to run the service itself: accounting for load and AI service costs, and usage statistics for the owner of the App.

We do not use your data for advertising, do not sell it, and do not share it with third parties for any purpose beyond those listed in section 4.

Health data is processed on the basis of your consent (Articles 9 and 10 of No. 152-FZ; Article 9(2)(a) GDPR where applicable), given by a separate checkbox during registration. Consent is voluntary, but the App cannot be used without it, because without body and health data it cannot perform its only function.

You may withdraw consent at any time by deleting your account in the App (Settings → More → Delete account) or by writing to support@goodgirlpower.app. Withdrawing consent results in deletion of your data (section 6).

4. Who receives your data

Hosting and database. Data is stored in a Supabase database and file storage; hosting region: the Netherlands (Amsterdam), provider VDSina. Access is restricted at the database level: row-level security policies permit reads and writes only by the owner of each record.

Artificial intelligence services. To produce a recommendation, recognise a meal photo, read a lab report or transcribe your voice, the App sends the relevant data to external AI services — AIML API, OpenAI and Anthropic (United States), and Evolink (operated by EVO GLOBAL TECHNOLOGIES LIMITED, Hong Kong), which carries the request when the Anthropic service is unavailable. Anthropic and Evolink receive your data only after you consent to the transfer to them specifically. Requests are proxied through our server: API keys are not held in the App. For personal recommendations — the morning review, the day summary, assistant replies and lab report analysis — the request includes your profile and records from every section of the App: body and health data (including diagnoses, medications, allergies and intolerances), the cycle calendar and marked symptoms, sleep, evening check-ins with notes, psychological diary entries including their text, the food diary, vitamins and medications, day plans and activity, lab history. To recognise a meal photo, a label or your voice, only the image or audio recording itself is sent. This is a cross-border transfer to countries that do not provide adequate protection for data subjects (the United States and Hong Kong; Article 12 of No. 152-FZ) and is carried out solely on the basis of the separate consent you give at registration.

Product database. When you scan a barcode, the request goes to the open Open Food Facts database (France). Only the barcode is sent — none of your data.

Video. Tutorial videos are streamed from the Kinescope platform. Only the fact of a video request is transmitted; your data is not.

App updates. On launch, the iOS and Android app checks with Expo servers (650 Industries, Inc., United States) whether an update is available. The request contains the platform, the build and installed update versions, the update channel and a random installation identifier that is not linked to your account; the server also sees the device’s network address. Your entries, email and health data are not sent.

Purchases. You buy the subscription in the iPhone app through the App Store, and subscriptions are tracked by RevenueCat, Inc., United States. It receives your account identifier (this is how we learn the subscription is paid) and, from the store, purchase details: the product, dates, subscription term and status, and the store country. Card details are handled by the store and never reach us. Health data and your entries are not sent to RevenueCat.

Browser reminders. If you turn them on in the web version (Settings → Notifications), our server sends reminders about timed tasks and vitamins through your browser’s notification service: Google (Chrome and other Chromium-based browsers), Apple (Safari), Mozilla (Firefox) or Microsoft (Edge). The task text and the names of vitamins and medicines pass through this service in encrypted form, and the notification service cannot read them. To send reminders on time, the server stores your browser’s subscription address, time zone and language. They are deleted when you turn reminders off or delete your account; when you sign out, the browser unsubscribes and the record is deleted on the next delivery attempt.

Telegram reminders. If you turn them on in the app opened in Telegram (Settings → Notifications) and allow our bot to message you, our server sends reminders about timed tasks and vitamins as bot messages through Telegram’s servers. The task text and the names of vitamins and medicines pass through Telegram; these are regular messages, so, unlike browser reminders, they are not encrypted from Telegram and are kept in your chat with the bot under Telegram’s rules. To send reminders, the server stores your chat ID with the bot (it matches your Telegram user ID), time zone and language. They are deleted when you turn reminders off, delete your account or block the bot (in the last case, on the next delivery attempt).

Google and Apple sign-in. If you choose this method, you interact with the respective service under its own privacy policy.

5. What is stored on your device

To work offline, the App keeps a copy of your entries on the device. Sensitive data — psychological journal, check-ins, sleep, cycle log, food diary, vitamins and medication, day plans, lab history and assistant conversations — is stored encrypted (AES-256), with the encryption key held in the operating system’s secure store (Keychain on iOS, Keystore on Android). Your sign-in session is protected the same way.

Backing up App data to Google’s cloud on Android is disabled — your health records are not included in device backups.

Please note: if you use the App without registering, the local copy is the only one and does not transfer to a new device. Create an account if you want your data to persist.

6. Retention and deletion

Data is kept for as long as your account exists, except for the AI request log (see below). Records of App usage are deleted together with the account. The AI request log is kept without a time limit; when an account is deleted, its records lose their link to the user: the user identifier is removed from them.

Deleting your account in Settings → More → Delete account happens immediately and irreversibly: your credentials, profile, all journals and uploaded images are removed. The local cache on the device is cleared. Deletion cannot be undone and we cannot restore the data afterwards.

Without registration the App works through an anonymous guest session. The data you enter is kept on your device and is not synchronised with the server. On the server, an App usage record and the AI request log (section 1) are kept for the guest session. If you ran an analysis of your body data as a guest (for example from a photo), the corresponding request was sent to the AI services as described in section 4. A guest has no account that can be deleted, so these records remain on the server without your email address or name: a guest session has neither.

7. Your rights

You have the right to confirmation that your data is processed and information about that processing, to access your data, to require its correction, restriction or erasure, to withdraw consent, and to lodge a complaint with the supervisory authority (Roskomnadzor in Russia, or your local authority) or with a court (Articles 14, 20, 21 of No. 152-FZ; Articles 15–21 GDPR where applicable).

To exercise any of these rights, write to support@goodgirlpower.app. We respond within the periods required by law.

8. Age limits

The App is not intended for anyone under 14. If you are between 14 and 18, use the App with the knowledge and consent of a parent or other legal guardian.

9. The App does not provide medical care

Calculations, recommendations and assistant replies are informational. They are not medical advice, a diagnosis or a prescription and do not replace consulting a doctor. Replies are generated in part by artificial intelligence and may contain errors. If you are pregnant or breastfeeding, have an eating disorder or a chronic condition, or take medication, make nutrition decisions only together with your doctor.

10. Changes to this policy

If we change this policy we update the version date at the top and publish the new version at https://goodgirlpower.app/privacy. If the changes affect what data we process or why, we will ask for your consent again.