NineToFit

NineToFit Privacy Policy

Effective date: November 8, 2026

NineToFit is a weight-loss app for office workers, made by Senvista. This policy explains what information NineToFit uses, where it goes and what choices you have. It covers the NineToFit Android app and the web version at ninetofit.expo.app.

Who we are

NineToFit is published by SENVISTA LLC ("Senvista," "we," "us"), 41 Wheeler Ave #660863, Arcadia, CA 91066. Website: senvista.ai. Email: [email protected].

Information stored on your device

NineToFit saves the following in the app's private storage on your phone. In the web version, it is saved in your browser's storage for ninetofit.expo.app.

• Your profile:
  • sex (or "Prefer not to say"), age, height and weight
  • if you enter them, body fat %, muscle % and goal weight
  • activity level, weekly weight-loss pace, units, meals per day and search radius
• Your saved spot (optional): if you save an "Office" or "Home" spot, the app stores its label, a short address and its map coordinates.
• Your food journal: for each meal, the app stores:
  • the date and time, and the meal time (for example, lunch)
  • the meal's name and the restaurant name, if any
  • how you added it (restaurant pick, photo or by hand)
  • the food items, with calories, protein, carbs and fat
  • for photo entries, the AI's confidence score and, on Android, a link to the saved photo

  Together, these entries show what and when you ate, and at which restaurants.

• Weigh-ins: the date, your weight, and your body fat % and muscle % if you enter them.
• Meal photos (Android only): when you save a photo meal, the app keeps a copy of the photo in its private storage so it can appear in your journal. This is the same copy that's uploaded for an estimate (see below), so it doesn't include the original photo's hidden details (EXIF data), such as a location tag. The photo picker also makes temporary copies in the app's cache, which can keep those details. The app deletes them as soon as it has made its own copy, or at the latest when you close the Snap screen. Any left behind (for example, if the app was closed partway through) are deleted the next time the app starts. The web version doesn't save photos.
• Recent nearby searches: to avoid repeating the same lookups, the app keeps up to 6 recent search areas along with the public restaurant listings found there. Each area is stored as the rounded point that was sent to our server (rounded to about 110 meters, roughly a city block) and its search radius. The app stops using a search area after 3 days and deletes it the next time it saves a new search.

Senvista cannot see any of this information. The app never sends it to our server, apart from the specific items described in the next section.

Android backup. If backup is turned on for your Google account, Android may include NineToFit's stored data in your phone's backup, but not your saved meal photos. It may restore that data if you reinstall the app, or copy it to a new phone when you set it up. If you set up a new phone by copying data straight from your old one, and the old phone runs Android 12 or later, your saved meal photos may be copied too. Google handles this backup under your Google account settings. We can't access it. You can turn backup off in your phone's Settings.

iPhone. If we release an iPhone version, this will apply: your profile, journal, weigh-ins and other stored data aren't included in iCloud Backup, but your saved meal photos are, if iCloud Backup is on. Apple handles this backup. We can't access it.

Information sent to our server, and why

NineToFit's server is hosted by Expo (EAS Hosting) and runs on Cloudflare's network. As with any internet connection, each request shows our hosting provider your device's IP address and basic technical details, such as your device or browser type. Connections are encrypted with HTTPS.

The Android app contacts our server only when you use the features below. The web version is itself served from our server, so opening it also sends requests with the same technical details.

More detail:

• Photos are re-compressed before upload. The app doesn't upload your original photo file. On Android, the app redraws the photo, no larger than 1,568 pixels on its longest side, and saves it as a new JPEG. In the web version, the app redraws the photo and saves it as a new JPEG. In both cases, the uploaded copy doesn't include the original's hidden details (EXIF data), such as where the photo was taken. If the app can't make this copy, it shows an error and doesn't upload anything.
• The Snap screen checks first. When you open it, the app checks whether the photo feature is available. This check sends no photo and no personal content.
• Your exact location stays on your device. The app uses your exact position only on your device, to measure how far away restaurants are. Before a search is sent, the location is rounded to the nearest 0.001 degree, so neither our server nor the map service sees your exact position. Our server rounds it again. The search radius is widened by 0.1 mile only so that no restaurant inside your real search circle is missed. If you search from your saved spot, the app sends that spot's rounded location instead.
• Repeat searches stay on your device. If you search again from about the same spot, with the same or a smaller radius, within 3 days, the app answers from its saved results and sends nothing.
• Location is used only when you ask for it. NineToFit asks for location permission the first time you open the nearby search, unless you search from a saved spot. It uses your location only while you're using the app, never in the background.
• Health data never reaches our server. Your profile (apart from your search radius), journal entries and weigh-ins are never sent to our server.

Who we share information with

We share information only with the service providers that make these features work. Our server makes each request to them itself and doesn't forward your IP address, so apart from our hosting providers, they see our server's address instead of yours. Requests to the map services identify the app as NineToFit. No name or user ID is sent, because NineToFit doesn't have either.

• Expo (EAS Hosting) and Cloudflare host our website and server. They receive every request to our server, including your IP address, device or browser details and the request's contents: a photo, a note, a rounded location or address text. See Expo's privacy policy and Cloudflare's privacy policy.
• Anthropic (Claude AI) receives your meal photo and optional note so it can estimate the meal's nutrition. We don't send Anthropic any user ID, location or IP address. Anthropic handles this data under its commercial terms for API customers. According to Anthropic's Privacy Center:
  • By default, Anthropic does not use inputs and outputs from its commercial products, including the API, to train its models.
  • It automatically deletes API inputs and outputs within 30 days.
  • It may keep them longer to comply with the law or to enforce its Usage Policy. Content flagged for a policy violation may be kept for up to 2 years.

  Sources: How long do you store my organization's data? and Is my data used for model training?

• Overpass map-data services receive the rounded location and the search radius.
  • Our main service is overpass.private.coffee, run by Private.coffee, a non-profit association in Austria (privacy notice).
  • If the main service is slow, busy or unavailable, we may use Overpass.ch, run from Switzerland, as a backup.
• Photon, by komoot, receives the address text you typed, along with a fixed search hint pointing at the middle of the US (the same for everyone). It never receives your location. See komoot's privacy policy.
• Nominatim, by the OpenStreetMap Foundation, receives the address text you typed. See its privacy policy and usage policy.

The address you type is part of the web address (URL) of our request to Photon or Nominatim, so it may appear in their request logs. Restaurant listings come from OpenStreetMap: © OpenStreetMap contributors (copyright and license).

We would disclose information only if the law required it. Because our server doesn't store your information, the only records we could disclose are our hosting provider's technical request records.

Services from your phone, browser and other apps:

• On Android, your location comes from your phone's location services (Google Play services). In the web version, your browser may use its maker's location service.
• If you tap Directions, a Google Maps link opens with the restaurant's location only, never yours. Google Maps may then use your location under Google's privacy policy.
• View source opens, in your browser, the web page that a chain's nutrition figures come from (usually the chain's own nutrition page).

These services are covered by their own privacy policies.

What we don't do

• We don't sell your personal information or share it for targeted advertising.
• We don't show ads or use an advertising ID.
• The app contains no analytics, tracking or crash-reporting tools.
• There are no accounts, and we never ask for your name, email or phone number.
• We never use your location in the background, and we never use your microphone.

How long we keep information

• On your device: until you delete it, reset the app or uninstall it (see "Your choices"). The app stops using nearby search areas after 3 days.
• On our server: we have no database. Each request is handled and the result goes back to your device. Our server code doesn't save the photo, note, location, address or result.
• Abuse limits: to prevent abuse and control costs, our server limits how many requests can come from one internet address.
  • To do this, it keeps a small counter tied to your IP address in temporary memory. Photo estimates, restaurant searches and address searches each have their own counter. For IPv6 addresses, it uses only the network part.
  • Our code never writes these counters to disk or logs them.
  • They have no fixed expiry time. They disappear when the server restarts or when newer traffic pushes them out.
• Logs:
  • Our server code never logs your photos, notes, locations, address searches or IP address. When something fails, it records only technical details, such as error types, status codes and which outside service failed.
  • Our hosting provider (Expo's EAS Hosting, which runs on Cloudflare) records requests to our server and our server's error messages, and we can view them in its dashboard. These records can include your IP address, the time, the page or service requested, and your device or browser type. Your photo, location and address travel inside the request, not in the web address. The provider keeps these records under its own retention policy.
• Service providers: each provider keeps data under its own policy. Anthropic's retention is described above.

Security

• Only what's needed leaves your device. Locations are rounded, uploaded photos are re-compressed copies without hidden details, and no user IDs are sent.
• Connections are encrypted with HTTPS.
• Our server has no database, and our code doesn't log what you send.
• Request limits help prevent abuse.
• Data on your device is kept in the app's private storage (in the web version, your browser's storage for this site). NineToFit doesn't add its own encryption, so anyone who can unlock your phone, or use your browser, and open the app can see it. Use a screen lock.

No method of storing or sending data is perfectly secure, but we work to keep what we handle to a minimum.

Your choices

• Location:
  • You can deny location permission, allow only approximate location, or turn location off at any time in your phone's Settings.
  • You can still find food nearby by typing an address or ZIP code under Search location on the Me tab, saving it as your spot, and searching from that spot instead of your current location.
• Camera and photos:
  • Camera permission is needed only to take a meal photo in Snap.
  • You can pick a photo from your gallery instead. On Android 13 and later, this uses the system photo picker and needs no permission.
  • You can also add meals without a photo.
• Delete a journal entry: you can delete any meal from your journal. This also deletes the entry's saved photo.
• Reset everything (on the Me tab, under Data) deletes your profile, journal, weigh-ins and saved spot, along with your saved meal photos, the app's temporary photo copies and your recent nearby searches. You can also uninstall the app or, in the web version, clear the site data.
• Uninstall: uninstalling removes all NineToFit data from your phone. If Android backup is on, a copy may remain in your Google account backup, which you can manage in your Google account.
• Web version: clear the site data for ninetofit.expo.app in your browser's settings.
• Android backup: you can turn backup off in your phone's Settings.

Children and age

NineToFit is for adults 18 and over. During setup, the app asks for your age and requires you to be 18 or older. The app isn't directed to children, and we don't knowingly collect information from anyone under 18. Because NineToFit keeps information on the device, uninstalling the app removes it (see "Android backup" for the backup copy). If you have concerns, contact us at [email protected].

Health information and disclaimer

Your weight, body measurements and food journal are health information. This information:

• stays on your device and, if Android backup is on, in your Google backup
• is never sent to our server or shared with anyone

The only meal information that leaves your phone is a photo you choose to send for an estimate, and its optional note. The estimate that comes back passes through our server without being stored.

NineToFit gives estimates only and isn't medical advice. AI photo estimates and restaurant nutrition figures can be wrong, so review and adjust them. The app applies these safety limits:

• minimum daily calorie floors
• a calorie deficit capped at 25% of the calories you burn
• a top weight-loss pace of 2 lb per week
• goal weights that keep your BMI at 18.5 or above

These limits can't account for your personal health. Check with a doctor or dietitian before changing how you eat, especially if you're pregnant or have a medical condition.

United States only

NineToFit is offered only in the United States. Some of our service providers operate outside the US:

• the Overpass map services (Private.coffee in Austria, and the Overpass.ch backup, run from Switzerland)
• Photon (komoot, in Germany)
• Nominatim (the OpenStreetMap Foundation, which stores its data in the UK and the Netherlands)

The limited information they receive (a rounded location or the address text you typed) is processed outside the US.

Your state privacy rights

Depending on where you live (for example, California, Colorado, Connecticut, Virginia or another state with a privacy law), you may have the right to:

• know what personal information we have about you, and access it
• correct or delete it
• opt out of its sale or its use for targeted advertising

We don't sell personal information or use it for targeted advertising. There are no accounts and no server database. The only information about you outside your device that we can reach is our hosting provider's technical request records, which aren't linked to a name or account. Your data is on your device, where you can view, change or delete it.

You can still contact us at [email protected], with the subject "Privacy request," to ask a question or make a request. An authorized agent may also contact us for you. We will respond within the time your state's law requires, and we won't treat you differently for using your rights. If we deny your request, you can appeal by replying to our decision.

Changes to this policy

If we change this policy, we'll post the new version on this page and update the effective date. For significant changes, we'll make the update prominent, for example with a notice on this page or in the app.

Coming later

We plan to add optional accounts (including Google sign-in), a community dish database, reward points and paid subscriptions through Google Play. None of these features are available yet. Before any of them launch, we'll update this policy to explain what new information they use and who handles it.

Contact us

SENVISTA LLC
41 Wheeler Ave #660863, Arcadia, CA 91066
Email: [email protected]