Privacy Policy

ark.fit is built "local-first": by default, all your tracking data lives on your device, in an encrypted store. We never sell, rent or share your data.

We apply strict minimisation: we transmit only what is strictly necessary, and only with your explicit consent for each purpose.

Stored locally, in a store that is encrypted at rest (iOS file protection + AES-GCM field encryption of sensitive fields, key held in the Keychain):

• Profile: target weight, pace, dietary approach, aversions and restrictions (encrypted).
• Food journal: foods, portions, nutrition values, timestamps.
• Weight and trend: your weigh-ins and the adaptive engine's smoothed trend.

This data never leaves the device unless you deliberately choose to send it.

If you connect Apple Health, ark.fit reads on the device certain metrics (weight, height, age, sex, steps, active and resting energy, heart rate) to calibrate your budget and enrich the display. This raw data stays on the device and is never transmitted as such.

The app works without Apple Health. If you allow writing, ark.fit records your meals' energy into Health; full erasure (section 6) removes those samples.

An account is not required for the core app. You can sign in with Sign in with Apple only to enable the server features (AI Coach, AI recipe import, household sharing).

We ask for the minimum: no name or email is requested; we only receive an opaque session identifier.

Each AI use has its own consent, revocable at any time, and applies minimisation:

• Meal photo estimation: the photo (downscaled, EXIF/GPS metadata stripped) is routed via our backend to an AI provider — by default Infomaniak (sovereign, in Switzerland), or a stronger model (OpenAI, USA) if you choose it. Your health profile is never sent. The result is an editable range.
• AI Coach: sends only aggregate indicators (age, height, smoothed weight, step and energy averages, budget) to the sovereign provider Infomaniak. Never raw data or your journal.
• AI recipe import: sends the public text of a recipe page to the sovereign AI to extract ingredients and steps. No personal data.

The AI provider keys are never in the app (they live server-side) and the budget is enforced server-side.

• Access and portability: full export of your data as JSON, from Settings.
• Erasure: full deletion in one tap — data deletion, database VACUUM, cryptographic destruction of the encryption key (data becomes unrecoverable), and removal of samples written to Apple Health.
• Withdrawal of consent: each consent (photo AI, Coach, diagnostics) is an independent switch.

Uninstalling the app also deletes all local data.

If you allow it (separate consent, off by default), ark.fit sends technical error reports to our self-hosted diagnostics tool on our European infrastructure. Payloads are filtered (allow-list, no personal information). This is the only network telemetry, and it is optional.

• netcup GmbH (European Union) — primary backend production.
• Infomaniak (Switzerland) — hot standby site and sovereign AI by default.
• ark.swiss-owned infrastructure (Switzerland) — independent historical Borg backups.
• Apple — Sign in with Apple and Apple Health (processed on the device).
• OpenAI (USA) — only if you explicitly choose the "performant" model for photo estimation, with appropriate contractual safeguards (standard clauses).

No cookies, no advertising pixels: ark.fit is a native app, with no tracking.

ark.fit is a wellness tool, not a medical device, and provides no diagnosis or treatment. It is not intended for minors, pregnant people, or people with eating disorders.