1. Information We Collect
When you use Meus Desafios (My Challenges), we collect the following information:
- Authentication data (Google or Apple): when you sign in with Google or with Apple (Sign in with Apple), we receive your name, email address and a unique account identifier issued by the provider — and, in the case of Google, your profile picture. This data is used to create and maintain your account. Sign-in with Google and with Apple are the only ways to access the Service; we do not use passwords
- Profile data: display name, @ username (handle) and profile picture (which can be the picture from your sign-in provider or an image you upload)
- Usage data: challenge logs (water, calories, sleep, exercise), configured goals, scores, streaks and daily progress statistics
- Food descriptions (calorie counter): when you use the calorie counter, the text you type to describe a food is sent to our artificial-intelligence provider (OpenAI) to estimate calories and macronutrients. See section 5 about this international data transfer
- Food photos (calorie counter): when you use the photo feature, the picture of the food you capture or choose from your gallery is sent to our artificial-intelligence provider (OpenAI) to estimate calories and macronutrients. The full-resolution image is not stored; we keep only a low-resolution thumbnail, together with the generated estimate, to verify and improve the quality of the analysis — and we delete it when you delete your account. See section 5 about this international data transfer
- Social data: friend requests (sent, received, accepted, declined), friends list and history of social interactions
- App data (iOS and Android):in the app, your session is kept by access and refresh tokens (JWT) stored securely on the device (the operating system's protected storage). If you allow notifications, we also register a delivery identifier (push token) with Apple's (APNs) and Google's (FCM) services
- Technical data:infrastructure providers (hosting, CDN and error monitoring) may automatically collect device type, browser and IP address for security and performance purposes. This data is managed by the providers under their own privacy policies. We do not keep your IP address in your account data: it is used only transiently, as a counter to limit sign-in and session-refresh attempts, and is automatically deleted after about two minutes. We keep only the approximate country derived from it, described under “Country (approximate)”
- Activity data: date and time of your last sign-in and account creation and update dates
- Language and time zone:the app language and your device's time zone, used to show text and notifications in your language and to define the “day” your logs belong to
- Country (approximate): the country/region set on your device and the approximate country derived from your IP address at sign-in and when the app opens. Used only for internal usage statistics by country — never your precise location, and never for advertising. Linked to your account and deleted with it
- Usage analytics data (Google Analytics and Firebase Analytics): aggregated usage metrics for the site and the app — for example, screens and pages visited, app opens and navigation events — to understand overall usage and improve the Service. We do not collect advertising identifiers. See section 5 (international transfer) and section 7 (how to opt out)
2. Legal Basis for Processing
Your personal data is processed under the following legal bases provided for in the LGPD (Law No. 13,709/2018):
- Performance of a contract (Art. 7, V): data needed to provide the Service (authentication, profile, challenge logs, scores, social features and rankings, language and time zone)
- Legitimate interest (Art. 7, IX): technical infrastructure data for the security and performance of the Service; the internal usage statistic by (approximate) country, which is not covered by the analytics opt-out; and usage analytics on the site and in the app — anonymous and ad-free — to improve it, which you can turn off at any time (on the site, via the cookie notice; in the app, under Settings)
3. How We Use Your Data
We use your information to:
- Create and maintain your account
- Calculate scores, streaks and challenge progress
- Estimate calories and macronutrients from food descriptions and photos (with the help of artificial intelligence)
- Send reminders and notifications you have authorized, in the app
- Show your position in rankings among accepted friends
- Let you search for and connect with other users through the social feature
- Improve the experience and performance of the Service
4. Data Shared with Other Users
When you use the social features, some information is shared with other users:
- Public profile: your display name, username (handle) and profile picture are visible to other users searching for friends
- Accepted friends: when you accept a friend request, you and your friends start seeing each other in the ranking. Each friend sees your display name, your username (handle) and your total points, as well as your position. The details of each challenge (water, calories, exercise and sleep) and your weight remain private and are never shared with other users
- Private groups: in explicitly created groups, members can see the names, pictures, handles and scores of the other group members
- Friend requests: require explicit acceptance. If both users send each other a request, the friendship is accepted automatically
Never shared: individual log entries (exact sleep times, detailed water amounts, etc.), personal notes or raw input data.
5. Sharing with Third Parties
We do not sell or rent your personal information. We share data only with the service providers (processors) essential to run the app, listed below, or when required by law or court order. Each provider processes the data under confidentiality obligations and its own privacy policy.
- Google and Apple — account authentication (Sign in with Google and Sign in with Apple) and, in the app, notification delivery (FCM and APNs)
- OpenAI — estimation of calories and macronutrients from food descriptions and photos. The descriptions you type and the photos you capture or choose from your gallery are sent for processing outside Brazil (international data transfer). We do not store the full-resolution photo; we keep only a low-resolution thumbnail and the corresponding estimate, for quality control and improvement of the analysis. We recommend not including sensitive information in food descriptions and, when taking photos, avoiding framing faces, documents or other sensitive content
- Vercel — hosting and CDN for the application and the API
- Neon — database (PostgreSQL) holding the account data described in section 1, stored on servers in the United States (international data transfer), encrypted in transit and at rest
- Sentry — error monitoring and diagnostics for Service stability
- Upstash — API rate limiting: receives only a temporary counter per IP address, automatically deleted after about two minutes
- Google Analytics (site) and Firebase Analytics (app) — aggregated usage metrics (for example, screens and pages visited and app opens) so we can understand overall usage and improve the Service, without advertising identifiers. Collection is on by default and can be refused on the site via the cookie notice and in the app under Settings → Account → Privacy. This data is processed outside Brazil (international transfer)
- When required by law or court order
Some of these providers process data on servers located outside Brazil. In those cases, the international transfer takes place in accordance with the LGPD.
6. Storage and Security
Your data is stored on secure servers with encryption in transit (HTTPS). How your session is maintained depends on the platform:
- On the site (web): the session uses an encrypted cookie accessible only by the server (HTTP-only)
- In the app (iOS and Android):the session uses access and refresh tokens (JWT) kept in the device's secure storage, provided by the operating system itself
We implement technical and organizational measures to protect your information against unauthorized access, alteration or destruction.
Profile pictures you upload are stored directly in the Service's database.
7. Your Rights (LGPD)
Under the Brazilian General Data Protection Law (LGPD), you have the right to:
- Access your personal data
- Correct incomplete or inaccurate data (name, picture and handle can be edited directly in the app)
- Request the deletion of your account and all associated data
- Request data portability in a structured format
- Obtain information about who your data is shared with
- Object to processing and refuse usage analytics: on the site, via the cookie notice; in the app, under Settings → Account → Privacy (“Share usage data”)
To exercise any of these rights, email contato@meusdesafios.com.br. Requests are answered within 15 business days.
8. Data Retention
We keep your data for as long as your account is active. When you request account deletion, all associated personal data (profile, challenge logs, scores, streaks, social connections and the food-photo thumbnails with their estimates) will be removed within 30 days, except where retention is required by a legal obligation.
Declined friend requests and blocks are removed together with the account deletion.
9. Children and Teenagers
Meus Desafios is intended for people aged 13 or older. Sign-up requires this minimum age, verified at the start of use. We do not knowingly collect data from children under 13; if we become aware of an account below this age, we will take steps to delete the data.
For teenagers between 13 and 17, we recommend using the app with the guidance and consent of a parent or guardian. Because the app includes calorie and weight tracking features, we stress that it does not replace medical or nutritional advice: growing teenagers should seek guidance from a healthcare professional before adopting calorie goals or weight-change goals.
10. Changes to This Policy
We may update this Privacy Policy from time to time. The date of the last update is always shown at the top of this page. We recommend checking this page regularly.
11. Contact
For questions about this Privacy Policy or about how your data is processed, contact us by email: contato@meusdesafios.com.br