Legal

Privacy Policy

Last updated 10 August 2026. Version 1.1.

Phase+ holds some of the most personal data there is: what you eat, what your body weighs, how you train, and where you are in your cycle. This page says exactly what is collected, who else ever touches it, and how to take it back. It is written to be read, not to be survived.

1. Who is responsible for your data

Phase+ is built and run by one person, in Barcelona. That person is the data controller under the GDPR, which means they decide what is collected and are answerable for it.

There is no data protection officer, because Phase+ is not required to appoint one at its size. Privacy questions go to the address above and are answered by the person who wrote the code.

2. What Phase+ collects

Only what the product needs to do its job. Nothing is bought from third parties, and nothing is inferred from your browsing elsewhere.

Account

• Your email address, and a username. The username is assigned automatically from your name at sign-up and you can change it.
• If you sign in with Google, Google confirms your email address to Phase+. Phase+ never receives your Google password.
• Your language and appearance preference, so the app looks the same on every device.

What you log

• Food. Meals, portions, macros, the time you ate, and any note or photo you attach.
• Body. Weight, and body composition figures if you enter them.
• Training. Workouts, duration, and the estimated burn Phase+ credits you.
• Cycle. Period start and end dates, and symptoms if you log them. This is optional, and the tab disappears if you switch it off.
• Sleep, if you log it.
• Blood markers, if you enter results from a panel.
• Progress photos, if you take them at a Check-in.
• Your goal and your answers at onboarding and at each Check-in, including what you say you want your body to do.

What Phase+ produces about you

• Your daily targets, and the Check-in written every 2 weeks: a summary, one adjustment, and the reasoning behind it.
• Meal plans and shopping lists, if you ask for them.

Use of the product

• Which steps of onboarding you completed, and when, so the funnel can be counted.
• Which screens you opened inside the app and which actions you took there: opening the app, switching tabs, starting to write an entry, attempting to log, and whether that attempt succeeded or failed and why. Not what you wrote and not what you logged: these records hold the shape of the action only, never its content, and the meal itself is covered by "What you log" above. This is Phase+'s own record, kept in the same database as the rest of your account, sent to nobody, and deleted with your account.
• How you arrived: a referral code or campaign code in the link you clicked.
• How many times a Check-in link you shared was opened. Not who opened it, and deliberately no IP address and no browser fingerprint on those views.
• Standard server logs at the hosting layer, which include IP addresses and are used to keep the service up and to stop abuse.

Payment

• Whether you have an active subscription, which plan, and when it renews.
• Card details are never sent to Phase+ and never stored by it. The card is entered on Stripe's own checkout page, and Phase+ only learns the outcome.

Support and feedback

• Anything you write in the feedback box or vote for on the roadmap board, and any email you send.

3. Why, and on what legal basis

4. Health data, handled separately

Your weight, your food, your training, your cycle and your blood markers are special category data under Article 9 of the GDPR, the strictest tier the law defines. Phase+ processes it on the basis of your explicit consent, which you give when you create an account and enter it, and which you can withdraw at any time by deleting your account or the individual entries.

Two consequences worth stating plainly. Withdrawing consent stops the processing but cannot un-write a Check-in you already read. And because this category is protected so strictly, Phase+ deliberately holds less of it than it could: there is no location tracking, no contacts access, no microphone, no background health sync you did not switch on, and no advertising identifier anywhere in the product.

5. What Phase+ never does

• Never sells your data. Not to advertisers, not to insurers, not to data brokers, not in aggregate, not "anonymised". There is no version of Phase+ where your cycle or your weight is a product sold to someone else.
• No advertising. No ad networks, no tracking pixels, no retargeting, no third-party ad cookies anywhere on the site or in the app.
• Your data is not used to train AI models. Phase+ sends some of what you log to Anthropic's Claude API to produce a result, and under Anthropic's commercial API terms that data is not used to train its models. If Anthropic is unavailable, the same request goes to xAI's Grok API, whose API terms also do not train on it, so that logging a meal never fails because one provider is down. Those are the only two. The table below sets out exactly what each receives. You choose whether any of this happens: the AI permission is a separate question from the rest, you are asked before anything is sent, and Phase+ works without it (you log foods from your own library instead, and barcode scanning still works).
• No automated decision with a legal effect. The Check-in is a suggestion about food and training. Nothing in Phase+ decides anything about your credit, your employment, your insurance or your access to a service.
• Phase+ is not a medical device and does not diagnose. It is a coaching tool. Nothing it produces is medical advice, and it is not a substitute for a doctor.

Turning the AI processing off. Open Account, then Settings, then Your data. Each permission is listed there with the date you gave it, and the AI one can be withdrawn and re-granted at any time. Withdrawing it stops the sending immediately, on the server as well as in the app, and Phase+ keeps working without it.

6. Who else processes your data

Phase+ is a small product built on other people's infrastructure. These are all of them, what each one gets, and why. Each acts as a processor under a data processing agreement, which means they may only use your data to provide their service to Phase+.

One more disclosure that most policies leave out. Because Phase+ is run by one person, that person holds administrative access to the database and can therefore see your data when fixing a bug, answering a support email, or investigating something broken. It is used for those things and not for reading about you.

7. Where your data lives

The database, your account and your photos are hosted in Zurich, Switzerland. Switzerland is covered by a European Commission adequacy decision, so this is not a restricted transfer: your data has the same protection it would have inside the EU.

Vercel, Anthropic, xAI, Stripe, Google and Resend are US companies and some processing happens in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses, and where the provider is certified, on the EU-US Data Privacy Framework. Check-in email is sent through Resend's European region, so the message itself is handled in the EU.

8. Sharing you switch on yourself

Nothing about you is visible to another person unless you make it so. Every route out of your account is deliberate, and every one can be revoked.

• The feed. A meal you post is visible to other Phase+ users along with your username and the macros of that meal, captured at the moment you post. It is a snapshot, so a post can never start showing a log you edited later, and posting one meal never exposes the rest of your diary.
• Your profile. If you use the social side, your username and profile photo are visible to other users. Your logs are not.
• A shared Check-in link. You can generate a link to one Check-in and send it to whoever you like. Anyone holding that link can open it without signing in, which is what makes it easy to send and also why you should treat it like a key. You can revoke it, and you can see how many times it was opened.
• A partner. You can share your cycle with one other person. That share exposes your cycle dates only, never your food, your weight or your photos, and you can end it at any time.
• A nutritionist. If you connect one, they see what that connection says they see, and it ends when you end it.

9. How long it is kept

10. Deleting your account

In the app, open Account and choose to delete your account. It is immediate and it is not a deactivation: your profile, every log, every Check-in, every photo and the account itself are erased, and nothing is retained in a shadow copy for later.

If you have an active subscription, cancel it before deleting, or email privacy@trainphase.com and it will be cancelled and refunded pro rata where due. The record of the payment itself has to be kept for tax purposes, as above.

You can also just export and leave. See your rights, next.

11. Your rights

Under the GDPR you have the right to:

• Access your data, and get a copy of it.
• Correct anything wrong. Most of it you can edit directly in the app.
• Delete it, which the app does in one action.
• Take it with you, in a machine-readable file.
• Restrict or object to processing based on legitimate interest.
• Withdraw consent at any time, without having to give a reason. Withdrawing it does not make what happened before unlawful.
• Not be subject to a decision made solely by automated means with legal effect. Phase+ makes none.

Email privacy@trainphase.com and you will get an answer within 30 days, usually much sooner. There is no charge and you do not have to explain why.

If you are unhappy with how it was handled, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es, C/ Jorge Juan 6, 28001 Madrid), or to the supervisory authority where you live. You are welcome to complain to Phase+ first, but you are not required to.

12. Security

• Everything travels over HTTPS, and is encrypted at rest by the database and storage provider.
• Every table carries row-level security, enforced by the database itself rather than by the app. This is the important one: it means one user's data is walled off from another at the layer below the code, so an application bug cannot expose your logs to somebody else.
• Progress photos sit in a private bucket, reachable only by their owner. Feed photos are public, because you published them.
• Sign-in is by Google or by a one-time email link. Phase+ never stores a password, so there is no password of yours to leak.
• If a breach ever affects your data, you will be told, and the AEPD will be notified within 72 hours as the law requires. No promise is made that a breach is impossible, because nobody can honestly make it.

13. Age

Phase+ is for adults. You must be 18 or over to use it. This is stricter than Spanish law requires, and it is deliberate: a tool that sets calorie targets and asks you to weigh yourself is not something to hand to a teenager. Accounts found to belong to someone under 18 are deleted. If you believe a minor has an account, email the address above and it will be removed.

14. Cookies

The public pages use a small number of cookies, and none for analytics until you accept them. The details, and how to change your mind, are in the Cookie Policy.

15. Changes to this policy

If this policy changes, the date at the top changes with it. If a change is significant, one that widens what is collected, adds a processor, or changes why your data is used, you will be told by email or in the app before it takes effect, not quietly.

16. Contact

privacy@trainphase.com. A real person reads it.

---

See also the Terms of Service, the Cookie Policy and the Aviso Legal.