Privacy Policy

This policy explains what personal data Jim-Bro.ai collects, why, who it is shared with, and the rights you have over it. It covers this website and the app at app.jim-bro.kaldis.xyz.

Who is responsible

The data controller is Kostas Kaldis, a sole trader based in Greece. For anything about your data, email privacy@jim-bro.kaldis.xyz.

What we collect

Your account

• Your email address and name.
• If you sign up with a password, a one-way hash of it. We never store the password itself.
• If you sign in with Google, the identifiers Google returns (see Google sign-in below).
• Session records that keep you logged in: a session token, its expiry, and the IP address and browser user agent it was created from. Sessions expire after 30 days.

What you log

The point of the app is to keep a record of your training and nutrition, so it stores what you enter: your profile (sex, birth year, height, activity level, goals, target weight, dietary restrictions, notes, preferred units and language), meals and food diary, pantry, recipes, diet plans, water and step counts, workouts and sets, cardio results such as heart rate and VO2max, weigh-ins, body-fat estimates and body measurements.

Some of this is health data, a special category under the GDPR. We process it only because you choose to enter it, so that the app can track it and the coach can answer questions about it. You can leave any field empty.

Conversations with the coach

Your chat history is stored so the coach can keep context: your messages, its replies and the app data it looked up to answer. You can clear it at any time with “Reset conversation”.

Photos

• Food photos, nutrition labels and receipts are sent to our AI provider to be read, and the result opens in a form for you to check. The image itself is not stored on our servers.
• Images you attach in chat are sent to our AI providers to answer that message. Before the conversation is saved, each image is replaced by a short text description. The image file is not kept on our servers. Your device keeps a local copy of recent chat images so they still show in your history.
• The body scan runs entirely on your device. The photo never leaves it. Only the analysis models are downloaded, from Google’s model storage.

Payments

Card payments are taken on Viva Payments’ hosted checkout page. We never see or store your card number. We store the order reference, amount, status and dates, the plan you are on, and the reference Viva gives us so a subscription can renew.

Usage and referrals

• How many AI tokens each request used, so we can apply your monthly allowance and bill packs. These records are deleted after 365 days.
• If you arrived through a promo link, its code and when you arrived.

Google sign-in

If you choose “Sign in with Google”, we request only the basic openid, email and profile scopes. We receive your Google account ID, name, email address, whether Google has verified it, and your profile picture.

• We store your name, email and its verification status on your account, to identify you and sign you in. A Google sign-in links to an existing account with the same verified email.
• We store the Google account ID and the sign-in tokens Google issues, only to keep the link between your Google account and your Jim-Bro.ai account.
• We do not store your profile picture. It is discarded when you sign in.
• We do not access your Gmail, contacts, calendar, Drive or any other Google data, and we do not send your Google account data to our AI providers.
• We do not sell Google user data, use it for advertising, or use it to train AI models.

Jim-Bro.ai’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time from your Google account permissions. Deleting your Jim-Bro.ai account deletes the stored Google identifiers and tokens.

Why we use it

• To provide the service you signed up for (GDPR Art. 6(1)(b)): your account, logging, plans, the coach, billing and service emails.
• Your explicit consent (Art. 9(2)(a)) for health data you enter. You can withdraw it by deleting that data or your account.
• Legal obligations (Art. 6(1)(c)): keeping invoices and payment records as tax law requires.
• Legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse, and recording which promo link brought you.

We do not sell your data, show you third-party ads, or make decisions about you with legal or similar effects based solely on automated processing.

Who we share it with

We use these providers to run the service. Each receives only what its job needs:

• Moonshot AI (Kimi): runs the coach. It receives your chat messages, attached images and the app data the coach looks up to answer you. It also runs the coach’s web searches.
• Anthropic: reads photos (food, labels, receipts) and describes images you attach in chat.
• Viva Payments: takes card payments. It receives the amount, a description, and your name and email.
• Resend: sends account and billing emails, so it receives your email address and the message.
• Google: sign-in, if you use it. If analytics are on, Google Analytics on this website (see Cookies).
• Our hosting provider: the server that holds the database.

Some of these providers process data outside the European Economic Area. Where they do, the transfer relies on the European Commission’s Standard Contractual Clauses or an adequacy decision. Food lookups use our own copy of the OpenFoodFacts and USDA databases, so your searches are not sent to them. If you paste a link (for example a recipe), our server fetches that page.

We may also disclose data if the law requires it.

How long we keep it

• Account and logged data: until you delete it or your account.
• Sessions: 30 days.
• AI usage records: 365 days.
• Invoices and payment records: for the period Greek tax law requires, even after the account is deleted.

Cookies and local storage

In the app

• Strictly necessary cookies that keep you logged in, plus short-lived ones during Google sign-in.
• A fa_ref cookie that remembers a promo code for 60 days so it can be credited when you sign up.
• Local storage for your theme and interface preferences, recent chat images, and the offline copy of the app.
• The app has no analytics or advertising cookies.

On this website

• Measurements you type into a calculator are kept in your browser so you don’t retype them, and are never sent to us.
• Your unit, theme and cookie choices are stored the same way.
• Google Analytics cookies are used only with your consent in the EEA, UK and Switzerland. You can change your choice with “Cookie settings” in the footer. Advertising storage is always off.

Your rights

Under the GDPR you can ask to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw consent at any time. Email privacy@jim-bro.kaldis.xyz from the address on your account and we will respond within one month.

You can also complain to the Hellenic Data Protection Authority (dpa.gr) or the authority where you live.

Deleting your account

Email privacy@jim-bro.kaldis.xyz to delete your account. Deletion removes your profile, logs, plans, chat history, sessions and Google sign-in link from our database. Billing records are kept only as tax law requires. Data already sent to the providers above is handled under their own retention terms.

Security

Traffic is encrypted with TLS. Passwords are stored only as hashes, and the database is not exposed to the internet. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

Children

Jim-Bro.ai is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us data, email privacy@jim-bro.kaldis.xyz and we will delete it.

Changes

If we make material changes we will update the date above and tell account holders by email or in the app before the changes apply. See also the Terms of Service.