What we hold, and what leaves

It's Sal is operated by It's Sal. For anything in this policy, write to privacy@itssal.com.

This policy covers itssal.com and the app behind it. It does not cover any other site you reach from a link here.

Everything below is something you typed or something the app worked out from it. Nothing is bought from anyone else, nothing is sold on, and none of it is used to profile you. How many people opened a page is counted separately and anonymously — that is its own clause below, because it is the one thing here that is not about you.

Your account

Your name, your email address, a one-way hash of your password, your timezone and whether you use metric or imperial units.

Your intake answers

Sex, age, height, weight, goal weight, how active you are, what you are aiming for, whether you have fasted before, when you wake, when you prefer to eat, and any of the health flags you ticked.

Your program

The schedule, calorie and macro targets, hydration target and week-by-week ramp the app worked out from those answers, and every earlier version of them.

What you log

Every fast with its start, end, goal, rating and note; every weigh-in; every drink; every food entry with its weight and its energy; and any food you added to the catalogue yourself.

Your coach transcript

Every question you have asked the coach and every answer it gave.

Your plans

The meal weeks and training weeks written for you, the ones before them, and which sessions you marked as done.

Your kitchen rules

Any allergies you told us about, the foods you said you will not eat, what you like and dislike, your eating pattern and how much cooking you want to do.

Your board standing

Your experience total, one row for each time you earned some and what it was for, the name you chose for the board, and whether you are on it.

The server also writes ordinary operational logs when something goes wrong. Those hold error messages and timings, not the contents of your log.

Your weight, your body measurements, what you eat, when you fast and the health flags you ticked at intake are information about your health. Data protection law treats that as a special category and holds it to a higher bar than an email address.

It's Sal holds it because you gave it to us to get the thing the app does, and for no other purpose. We ask for your explicit consent when you create an account, and you can withdraw it at any time by deleting your account, which erases the data with it. There is no version of this app that keeps your weight after you have gone.

To run the service you asked for: to sign you in, build your program, draw your dial, keep your logs, answer you through the coach and write your plans. That is the whole of it.

There is no other use. Your data is not analysed to improve a model, not used to sell you anything, and not looked at except where a fault makes it unavoidable.

We count how many times each page is opened and which buttons get pressed, so there is some basis for deciding what to work on next. It is counted on this server, by us, and it is built so that it cannot be turned into a record of you.

Opening a page writes one row, and the row holds four things:

• The path — /pricing, never the whole address and never anything after a ?
• Whether the screen was a phone, a tablet or a desktop
• The site that linked here, if any — reddit.com, never the page on it
• The date

Your IP address and your browser’s user-agent are read to work out the last three and are then thrown away. Neither is written down.

To tell one visitor from two, we store a number that is a one-way hash of your address, your browser and the day, mixed with a secret only this server holds. It cannot be reversed, it is never displayed, and because the day is part of it the number you are today is a different number tomorrow. There is no thread to pull.

No cookie is set for any of this. There is no third-party analytics service, no advertising network and no tag from anyone else — the counting is a few lines of our own code writing to our own database. And it is never joined to your account: if you are signed in while you read a page, the counter still does not know who you are, because nothing it stores can say.

Nothing, unless you turn it on. Every account starts private, and a private account is invisible to everybody: it still earns experience and still climbs the ranks, but it is not on the board and cannot be found from it.

If you put yourself on the board, other signed-in people see exactly three things:

• The name you chose for the board, which does not have to be your real one
• Your rank
• Your experience total

Nothing else is shown, ever. Not your weight, not your fasts, not what you eat, not your email address and not your account name. The board is only visible to people who are signed in — it is not a public web page and it is not indexed by search engines.

You can leave at any time from the board itself or from your settings, and you come off it immediately. Leaving does not delete anything you earned.

On one server, in one PostgreSQL database, both run by It's Sal. There is no managed database, no third-party storage bucket, no analytics service and no advertising network. Nothing on any page of this app is loaded from someone else’s server — the typefaces, the icons and the artwork are all served from the same place as the app.

The coach and the two planners are the only features that send anything anywhere. They run on a language model operated by DeepSeek, and to answer you the app has to send it enough about you to be useful.

When you ask the coach a question, we send:

• Your first name and your local time
• Your protocol, eating window, calorie and macro targets
• Your sex, age, height, weight, goal and activity level
• Any health flags you ticked at intake
• Your current fast, today’s food and water, your recent fasts and your latest weigh-in
• The last few messages of your conversation, and the question you just typed

When you ask for a meal week or a training week, we send:

• Your first name
• Your sex, age, height, weight, goal and activity level
• Your protocol, eating window and daily targets
• Any health flags you ticked at intake

Your email address, your password and your full logs are never sent. Nothing is sent unless you press the button that sends it: a person who never opens the coach and never asks for a plan has nothing leave this server at all.

DeepSeek is outside the European Economic Area, so this is an international transfer of your data, and it includes health information. DeepSeek handles what it receives under its own terms, which we do not control — read them at www.deepseek.com/privacy. If you would rather nothing about you left this server, do not use the coach and the two planners. The rest of the app works without them.

Three, all set by this site, none used to track you.

f4u_session

Signs you in and keeps you signed in for thirty days. It holds a signed token with your account id in it and nothing else. The app cannot work without it, so there is no banner asking about it.

f4u_free_strip

Set only if you close the notice about the free period, so it stays closed. It holds the number one.

f4u_theme

Set only if you choose light or dark rather than following your device. It holds that one word.

There are no advertising cookies, no analytics cookies and no third-party cookies, because there are no third parties on the page.

Your data is kept while your account exists. There is no archive, no backup copy held separately for its own sake, and no soft delete.

Delete your account from settings and the account row goes, taking your profile, every program, every fast, every weigh-in, every drink, every food entry, every plan and your whole coach transcript with it in the same operation. It is immediate and it cannot be undone. Questions you have already sent to DeepSeek are outside our reach at that point, and are governed by their retention, not ours.

Under the GDPR and equivalent law you can ask us to:

• Tell you what we hold about you, and give you a copy of it
• Correct anything that is wrong — most of it you can edit yourself in settings
• Delete everything, which you can also do yourself, immediately
• Restrict or object to what we do with it
• Withdraw the consent you gave for your health information

Write to privacy@itssal.com. We answer within thirty days and we do not charge for it. If you are not satisfied with the answer, you can complain to your national data protection authority.

Passwords are stored as bcrypt hashes and never in a form anyone can read, including us. The session cookie is signed, marked httpOnly so no script on the page can read it, and sent only over HTTPS in production. Sign-in attempts are rate limited. Signing out everywhere retires every session token issued to you.

No system is perfect. If you think you have found a way into someone else’s data, write to security@itssal.com before you tell anyone else, and we will fix it and credit you if you want the credit.

It's Sal is for adults. The intake refuses to write a plan for anyone under eighteen, and accounts for children are not permitted. If you believe a child has created an account, write to privacy@itssal.com and we will remove it.

If what we collect or where it goes changes, this page changes with it and the date at the top moves. A change that affects what leaves this server will be shown to you inside the app before it takes effect, not buried here.