Privacy Policy

Last updated: April 2026

No Rule ("we", "us", "our") operates the No Rule Nutrition mobile application and website (the "Service"). This policy explains how we collect, use, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data We Collect

We collect only the information necessary to provide the Service:

• Account information: name, email address, and a hashed password when you create an account.
• Profile data: sport, fitness goals, height, and weight that you choose to enter.
• Nutrition data: food logs, macro targets, meal plans, and barcode scans that you record.
• Wellbeing data: mood logs and notes you submit.
• Coach interactions: messages exchanged with your assigned coach.
• Calendar events: training sessions, check-ins, and competitions you create.

We do not collect analytics, advertising identifiers, location data, contacts, or any data from other apps on your device.

2. How We Use Your Data

• To provide and personalise the nutrition coaching service.
• To allow your assigned coach to view your progress and provide guidance.
• To display your historical trends (weight, mood, food logs) within the app.
• To authenticate your account and keep it secure.

We do not sell, rent, or share your personal data with any third parties for marketing or advertising purposes.

3. Third-Party Services

The app connects to OpenFoodFacts (openfoodfacts.org) to look up nutritional information for barcoded products. When you scan or search for a product, the barcode number or search term is sent to OpenFoodFacts. No personal information is included in these requests. OpenFoodFacts is an open-source, non-profit project.

Coach videos are hosted on YouTube. When you watch a video, YouTube's standard privacy policy applies to that embedded content.

4. Data Storage and Security

Your data is stored on secure servers hosted by Railway (railway.app) with encrypted connections (HTTPS/TLS). Passwords are hashed using bcrypt and are never stored in plain text. We implement reasonable technical and organisational measures to protect your data against unauthorised access, loss, or misuse.

5. Data Retention

We retain your data for as long as your account is active. If you or your parent/guardian request account deletion, we will permanently remove all personal data within 30 days.

6. Your Rights (UK GDPR)

You (or your parent/guardian, where applicable) have the right to:

• Access your personal data.
• Correct inaccurate data.
• Delete your data ("right to be forgotten").
• Export your data in a portable format.
• Withdraw consent at any time.
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Camera Permission

The app requests camera access solely to scan food barcodes. Camera data is processed on-device to extract the barcode number and is never transmitted, recorded, or stored as images.

8. Young Users

The Service is designed for athletes of all ages, including those under 16. We are committed to protecting the privacy of young users and comply with the UK Age Appropriate Design Code (Children's Code).

Users aged 13 and over may create an account and use the Service. By creating an account, users aged 13–17 confirm that a parent or guardian is aware of and consents to their use of the Service and the processing of their personal data as described in this policy.

Users under 13 require verifiable parental or guardian consent before an account can be created. A parent or guardian must provide their email address during registration and confirm consent. We will not knowingly process data from a child under 13 without this consent.

Parents and guardians may at any time review their child's data, request corrections, withdraw consent, or request deletion of their child's account and all associated data by contacting us at the email address below.

We apply the following safeguards for all users under 18:

• Data collection is limited to what is strictly necessary for the coaching service.
• No profiling, automated decision-making, or behavioural tracking is performed.
• No data is shared with third parties for marketing purposes.
• Coach interactions are conducted in a professional, safeguarding-aware context.
• Privacy settings are set to their most protective level by default.

9. Legal Basis for Processing

We process personal data on the following legal bases under UK GDPR:

• Consent (Article 6(1)(a)) — for users under 13, we rely on verifiable parental consent; for users 13 and over, we rely on the user's own consent.
• Contractual necessity (Article 6(1)(b)) — processing required to deliver the coaching service you signed up for.
• Legitimate interests (Article 6(1)(f)) — to maintain security and improve the Service, where these interests do not override your rights.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the app. Where changes affect how we process data of users under 18, we will seek renewed consent from the user or their parent/guardian as appropriate. The "last updated" date at the top reflects the most recent revision.

11. Contact

For any privacy-related questions, to exercise your rights, or to manage your child's account, contact us at:

Email: norulesnutrition@gmail.com

Business: No Rule