Privacy Policy — Xoof
Last updated: 29 July 2026
Xoof is a training and nutrition logging app powered by AI parsing, operated by FOOX LTD (“we”, “us”, “our”) — the data controller for your personal data. This policy explains what data we collect, how we use it, and your rights.
Our pledge
1. What data we collect
Account data: email (required), optional full name, third-party sign-in account ID if you use social sign-in.
Authentication and security data: a one-way password hash, hashed refresh token, verification and reset records, failed-login counts, and temporary lockout timestamps. We never store your plaintext password.
Profile data: sex, birth year, height, body weight, preferred units, activity level, training intent, nutrition goal and target rate, dietary preferences, allergy avoidances, selected coach/focus, configured check-in dimensions, and a free-form bio describing your goals or experience.
Workout and check-in data: exercises, sets, reps, weights, durations, distances, heart-rate or intensity values, subjective notes, bodyweight history, wellbeing check-ins, configured dimensions, derived tags, and transcripts where returned. AI usage counters and credit balances are kept for fair-use limits.
Goal data: goals you set — a target body weight or a strength target for a specific exercise, the weekly rate you chose, and an optional target date — plus a starting point we record at creation from data you have already logged (your smoothed weight trend or latest scale entry for a body goal, your recent lifting history for a strength goal), and goal history and status: active, achieved, revised or stopped, when that changed, which goal replaced which, and whether you set it directly or after the in-app coach suggested reviewing it. Resolved goals are kept as history rather than deleted, and you can delete them with the rest of your data at any time. Progress, pace and arrival estimates are calculated deterministically inside Xoof from data you have already logged; producing them sends nothing to an AI provider and uses no AI credits, and arrival estimates are always shown as a range rather than a promised date. If you have consented to AI features, a compact summary of an active goal — the target, how far along you are, and whether you are ahead of or behind the pace you set — may be included in AI coaching context alongside your other recent activity; your detailed weigh-in or lift history is not.
Nutrition data: meals and foods you log, including portions, estimated energy, macros and fibre, food-group and processing information, notes, and nutrition targets. Products saved after a missing barcode stay private to your account and are not published to Open Food Facts. Daily food-quality scores are deterministic estimates derived inside Xoof from logged foods and do not send the day to an AI provider.
Coaching, service-use and communications data: coach messages and replies, summaries, bounded conversation memory, read state, first-party signup/activation/retention/checkout events, and feedback or bug reports. If you report an AI coach response, we also store the selected reason, your optional note, and a copy of the response you reported. The service events are server-side and use no advertising cookies.
Technical and operational data: hosting and security systems may process IP addresses, user-agent information, request timestamps and error diagnostics. Sentry is configured not to capture IP addresses, cookies, request bodies or authentication headers and uses a pseudonymous internal user ID.
Billing data: none. Xoof currently takes no payments of any kind — no subscription, no in-app purchase, no paid tier — so we do not collect, process or store card details, billing addresses or any other payment information, and we use no payment processor. A paid tier, Xoof Premium, is planned; we will update this notice to name the payment processor and the data it receives before any charge is possible.
Health-adjacent (special-category) information
Food and meal logs, dietary or allergy information, body measurements, body-weight and strength goals, wellbeing check-ins, and free-text fields — including your bio, workout or meal notes, coach messages, voice transcripts and AI outputs — may reveal information about your physical or mental health, injuries, or fitness condition. We treat this as special-category data under UK GDPR Article 9 and rely on your explicit consent as our lawful basis for processing it with AI. You can withdraw consent at any time (by contacting us, or from your account settings where available); withdrawing it does not affect manual, non-AI logging. Xoof is not a medical service and does not use this data to make any health decision about you.
2. Voice recordings and AI processing
When you record a workout, meal, or check-in by voice, the audio is uploaded over HTTPS and processed by a trusted AI provider. Meal and reviewed nutrition-label photographs may likewise be processed to produce an editable draft.
We do not retain raw audio or uploaded photographs after parsing. Where a feature returns a transcript, it is stored with the resulting workout or check-in so you can verify what was heard.
Text logging sends the submitted text through the same AI parsing path. No audio or photograph is involved.
AI coaching and summaries may use the submitted message plus the minimum relevant profile, recent or aggregate workout, nutrition, bodyweight and check-in facts, and bounded conversation history. These features run only after affirmative consent.
3. How we use your data
- To run the app — displaying workouts, meals, history, targets, and insights.
- To provide optional AI parsing and coaching with the minimum submitted input and relevant context needed for the requested feature, only after affirmative consent.
- To “ground” the parser on your past exercise names and categories so it reuses your own vocabulary.
- To enforce fair-use AI limits (usage counts and credit balances).
- To operate, secure, support and improve Xoof using authentication records, privacy-limited diagnostics, first-party service events and feedback. We do not use advertising cookies or third-party advertising analytics.
We do not use your data to train any AI model.
4. Where your data lives
- Account, profile and AI usage: stored in secure cloud infrastructure.
- Workouts, meals, private saved foods, targets, goals, bodyweight, check-ins, coaching, feedback and first-party service events: stored in secure cloud infrastructure.
- Daily food-quality scores, and goal progress, pace and arrival estimates: calculated on request from data you have already logged and not stored as separate records.
- Transcripts and structured data: stored with the resulting workout or check-in where returned; raw audio and uploaded photographs are not retained after parsing.
- AI processing: handled by trusted AI providers for transcription, image/text parsing, coaching and summaries.
All transit is over HTTPS/TLS.
Sub-processors
We use a small number of trusted third parties to run Xoof, sharing only the data each one needs. We never sell your data.
| Sub-processor | Purpose | Data shared |
|---|---|---|
| Cloud hosting provider | Hosting, database, storage, delivery and security | Stored account, profile, workout, nutrition, check-in, coaching, feedback, service-event and operational request data |
| AI processing provider | AI transcription, image/text parsing, coaching and summaries | Voice audio and photographs (transient), submitted text, and minimum relevant profile/activity/conversation context |
| Transactional email provider | Service emails | Email address and name, one-time codes, feedback you submit, and opaque service/report references needed to deliver the email. Generated coach content and report notes are not included in report-notification emails |
| Error-monitoring provider | Application error diagnosis | Privacy-filtered diagnostics and pseudonymous internal user ID; no IP address, cookies, request body or authentication headers |
5. Data retention
We keep each class of data only as long as we need it:
| Data class | Retention |
|---|---|
| Account & profile (email, password hash, profile, bio) | Until you delete your account |
| Workouts, meals, private saved foods, targets, bodyweight, check-ins, transcripts, coach messages/summaries/memory, feedback and AI content reports | Until you delete the entry where supported or your account |
| Goals, including resolved ones kept as history | Until you delete your account |
| First-party service events | Until account deletion |
| Raw voice audio and uploaded photographs | Not retained after parsing |
| AI usage counters & credit balance | Until account deletion (rolling counters reset on schedule) |
| Server / application logs | Automatically deleted after 30 days |
| Operational backups | Encrypted, short rolling cycle, overwritten in the ordinary course |
You can delete your account and its data at any time (Section 7).
6. Data security
- HTTPS/TLS for all transit.
- Bcrypt-hashed passwords; access tokens expire after 60 minutes; refresh tokens after 30 days.
- Repeated failed logins lock the account temporarily.
- Account deletion requires re-authentication (password or fresh social sign-in).
Data breach notification
If a personal-data breach is likely to risk your rights and freedoms, we will report it to the UK Information Commissioner’s Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to you, we will also notify you directly without undue delay.
7. Your rights
- Access — visible in the app at any time.
- Correct — edit profile, workouts, meals, and private foods in the app.
- Export — use “Request your data” in Profile to email us. We fulfil the request with a machine-readable JSON export of the account and associated records and respond within one month.
- Delete account — irreversible, requires re-auth. Already uninstalled, or would rather we did it? See xoof.me/delete-account — you never need to reinstall Xoof to delete your account.
- Withdraw consent — for health-adjacent AI processing (Section 1), at any time, without affecting manual logging.
- Object — contact us if you believe processing is unlawful.
UK/EEA users have GDPR / UK GDPR rights, including the right to lodge a complaint with your local data protection authority.
8. Microphone permission
Voice logging requires microphone access. We use the mic only while you're actively recording. Revoke any time via your browser or device settings. You can still log workouts by text without mic access.
9. Important health disclaimer
Xoof is a training and nutrition logging app, not a medical device or healthcare service. Intended for adults aged 18+. Not intended to diagnose, treat, cure, monitor, or prevent any disease. AI coaching, daily food-quality scores, and goal pace and arrival estimates are heuristics from data you logged, not medical advice. Goal targets and rates are yours to set, within conservative limits Xoof applies — they are not a recommendation about what your body weight should be. Never rely on Xoof for allergen information — barcode and product data can come from open, community-maintained sources and may be wrong; always check the physical packaging. Consult a qualified healthcare or fitness professional before starting a new training programme or significantly changing your diet. Full disclaimer: xoof.me/legal/health.
10. Children
Xoof is intended for adults aged 18 and over, and is not directed at children or young people. We do not knowingly collect data from anyone under 18, and will suspend and delete an account we learn is underage. We set the minimum at 18 rather than the UK age of digital consent (13) deliberately: Xoof supports dated body-weight goals and food tracking, which are not appropriate features for under-18s.
11. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top reflects the most recent change.
12. Contact
Questions or requests about this policy? Contact the data controller:
FOOX LTD — a company registered in England and Wales, company no. 17079734, registered with the UK Information Commissioner’s Office under reference ZC202100.
Email: fooxxed@gmail.com
Xoof is a service of FOOX LTD, a company registered in England and Wales (company no. 17079734).