Legal
Privacy Policy
On this page
1. Who we are
Élan is operated by Arslan Siddique, a sole proprietor based in Islamabad, Pakistan, trading as Élan (“we”, “us”). We decide how your personal data is used and are responsible for it; in data-protection terms, we are the “controller”.
Address: House No. 2, Street 15, Sector B, DHA 2, Islamabad 45730, Pakistan. Contact for privacy questions: help@élan.app · +92 332 3222368.
2. What this policy covers
This policy covers the website at www.élan.app (“the website”) and the Élan web app at beta.élan.app (“the app”). It doesn't cover our reseller's checkout (see section 8), or other sites we link to.
3. The website
3.1 You can browse the website without giving us anything. It has no forms, accounts, newsletter or analytics, and it sets no cookies.
3.2 Hosting logs. When you visit, two providers receive your IP address, browser and device details, the page or file requested, and the time: our hosting provider, Vercel, and Amazon Web Services in Frankfurt, which stores the website's images and video. They keep these logs for a limited period to deliver the website and keep it secure.
3.3 Your browser's storage. To make the opening film start faster on later visits, the website saves the video file in your browser's storage. It also notes, for the open tab only, that you've seen the opening animation, so it plays once per visit; that note is deleted when you close the tab. Neither contains anything that identifies you, and you can clear both in your browser settings.
3.4 Checkout. When you buy a subscription, our reseller's checkout collects your details as a separate controller under its own privacy notice (section 8). It may use cookies or similar storage needed for payment and fraud prevention.
3.5 Legal basis: our legitimate interests in running a secure, working website (GDPR Art. 6(1)(f)).
4. The app: what we collect
4.1 Information you give us
- Account: your email address, name and password (stored only as a one-way hash), plus your plan and subscription status.
- Google sign-in, if you use it: your name, your email address, whether Google has verified it, your Google account ID and your profile photo. We copy the photo to your Élan profile if you haven't added one, and you can remove it at any time. We don't access anything else in your Google account.
- Profile and body measurements: date of birth, sex, height, weight and body-fat percentage; your goal (direction, pace and target weight); units, time zone and the activity tracker you use; your calorie and macro targets; and a profile photo, if you add one.
- What you log: food and drink, meals, recipes, saved ingredients and planned meals; weigh-ins; active calories, steps, workout times and heart-rate figures read from screenshots you send; and notes and reminders.
- Regimen: the names, doses, times and types of any supplements, vitamins or medication you choose to log, and whether you marked each dose taken or skipped.
- Photos you send: meals, menus, labels, scales and screenshots, and any photos of your body you choose to send, for example to get a rough visual body-fat range. Photos can contain information your camera recorded, such as when the photo was taken and, if location was switched on, where. We currently keep photos as you upload them, including that information.
- Voice notes: sent to Google's Gemini to be turned into text. We don't store the audio; the transcript becomes your chat message.
- Chat: your messages, the AI's replies, and the cards you confirm or dismiss; and technical records of each AI request (what was sent to the AI, its reply and its intermediate reasoning), kept to run Élan and to investigate problems.
- Web lookups: what you ask Élan to look up, and any links you paste.
- Shared foods: foods you share with other members by link.
- Messages you send us.
4.2 Information collected automatically
- Server logs: your IP address, browser and device details, the pages and features requested, and the time. These are kept on our servers in Frankfurt and, for some scheduled tasks, at Vercel.
- Security records: to prevent abuse, we keep short-lived counters linked to your email address, IP address or account ID, for example after failed sign-ins.
- Usage records: for each AI request, the model used, its size, its cost to us and its timing, so that we can measure your allowance.
- Time zone: suggested by your browser, with your OK, so we can work out your local day.
- Cookies and browser storage: see section 12.
4.3 Information from others
- Our reseller, the Merchant of Record: your email address, country, the plan you bought, subscription and transaction identifiers, payment status and billing dates. We never receive your full card number.
- Google, if you use Google sign-in (see 4.1).
5. Health data and your consent
5.1 Much of what you log is health data: weight, body measurements, food, activity, heart rate, body photos, and supplements and medication. Laws such as the GDPR treat it as a special category of personal data, and some US states call it “consumer health data”.
5.2 We process health data only to provide, secure and support Élan for you, and only with your explicit consent, which you give when you create your account.
5.3 You can withdraw consent at any time by asking us to delete your account. Élan can't work without this data, so withdrawing consent means closing your account. It doesn't affect processing that has already happened.
5.4 We never sell health data or use it for advertising. We share it only with the providers in section 9 that help us run Élan.
6. How we use your data, and our legal bases
| Purpose | Data | Legal basis (EU/UK GDPR) |
|---|---|---|
| Provide Élan: your account, logging, AI drafts and replies, lookups, estimates, targets, reminders, sharing | Account, profile, logs, photos, voice notes, chat, lookups | Contract (Art. 6(1)(b)); for health data, explicit consent (Art. 9(2)(a)) |
| Apply your plan and measure your allowance | Plan, subscription status, usage records | Contract |
| Manage your subscription with our reseller and keep billing records | Reseller data (4.3) | Contract; legal obligation (Art. 6(1)(c)) |
| Keep Élan secure, prevent abuse and fix problems | Logs, security records, chat technical records | Legitimate interests (Art. 6(1)(f)); for health data in those records, explicit consent |
| Answer your messages and requests | Email, messages, account | Contract; legitimate interests |
| Tell you about important changes (terms, prices, allowances, security) | Contract; legal obligation | |
| Comply with the law and handle legal claims | As needed | Legal obligation; legitimate interests; Art. 9(2)(f) for health data |
- We don't send marketing emails.
- We don't make decisions with legal or similarly significant effects about you by automated means. Élan's estimates and suggested targets are suggestions you can change.
- We don't use your data to train AI models, and our AI provider doesn't either (section 7).
7. The AI, web lookups and other services that see your data
7.1 Google Gemini. When you use AI features, Élan sends Google your message, any photo or voice note you attach, and the parts of your profile and logs the reply needs: your name, date of birth and age, sex, height, units, time zone, tracking device, goals, current and starting weight and body fat, and the day's log. Your email address isn't included. Google processes this as our processor, under the Gemini API's paid-service terms and its Data Processing Addendum. Under those terms, Google doesn't use your prompts or replies to improve its products, and keeps them for a limited period only to detect abuse (see ai.google.dev/gemini-api/terms).
7.2 Web lookups. When Élan looks up a branded or restaurant food, it sends Google Search, through the Gemini API, only the search text and any link you pasted, never your photos, profile or history. Google keeps this lookup data for 30 days. For packaged foods, Élan may search Open Food Facts, a public food database; it receives the search text from our server, but not who you are. We cache Open Food Facts results for 24 hours, keyed by the search text.
7.3 Pictures and links from other sites. Product pictures in lookup results load directly from the websites that publish them, so those sites see your IP address and browser. Some replies show a search-suggestion button provided by Google; tapping it takes you to Google, under Google's privacy policy.
8. Payments
Lemon Squeezy (Sold through Link, LLC) is our online reseller and Merchant of Record. When you subscribe, it collects your payment details, billing address and tax information, and processes them as a separate controller under its own privacy notice. It shares with us only what is listed in 4.3. We never see your full card number.
10. International transfers
We're based in Pakistan and access Élan's systems from there. Élan's servers and photos are in Germany, and the database is hosted by Supabase. Some providers, such as Google, Vercel and our reseller, may process data in the US, the UK or elsewhere. Where the GDPR or UK GDPR applies, we rely on our providers' data-processing terms, which include the European Commission's Standard Contractual Clauses (and the UK Addendum) where required.
11. How long we keep data
| Data | How long |
|---|---|
| Account, profile, logs, photos, chat and its technical records | While your account exists |
| After a subscription ends | Kept, so you can come back, until you ask us to delete your account |
| After you ask us to delete your account | Deleted within 30 days, photos included |
| Backups | Deleted data drops out of our database provider's backups on its normal schedule |
| Server logs | A limited period, for security and troubleshooting |
| Security counters (email, IP) | About 7 days |
| Password-reset codes | 10 minutes |
| Usage and cost records | Kept after account deletion without your name or email, for accounting |
| Open Food Facts cache | 24 hours, keyed by search text, not linked to you |
| Foods you shared | Copies other members saved stay with them |
| Messages to support | As long as needed to handle your request |
| Our reseller | Keeps transaction records under its own policy |
| AI request logs for a limited period, for abuse detection; web-lookup data for 30 days |
13. Your rights
Wherever you live, you can ask us to tell you what data we hold and send you a copy, correct it, delete it, or stop using it for a purpose.
If the GDPR or UK GDPR applies to you, you also have the right to restrict processing, to object to processing based on legitimate interests, to data portability, to withdraw consent at any time, and to complain to a data-protection authority (in the UK, the Information Commissioner's Office).
How to ask: email help@élan.app from your account's address, with “Privacy request” in the subject. We may ask you to confirm your identity. We reply within 30 days, and we don't charge.
You can see and edit most of your data in the app. If you use Google sign-in, you can remove Élan's access at myaccount.google.com/permissions.
US residents: we don't sell personal data, use it for targeted advertising, or profile you.
14. Children
Élan is for adults aged 18 and over. We don't knowingly collect data from anyone under 18. If we learn that we have, we'll delete the account.
15. Security
- Connections are encrypted (HTTPS).
- Passwords are stored only as bcrypt hashes.
- Photos are stored privately and shown through links that expire after 5 minutes.
- Each account's data is kept separate in our application.
- Access is limited to the operator, who looks at account data only when you ask for help, to keep Élan secure, or when the law requires.
No system is perfectly secure. If a breach affects your data, we'll tell you, and the relevant authorities, as the law requires.
16. Changes to this policy
When this policy changes, the date at the top changes. For material changes, we'll tell you by email or in the app before they take effect.
17. Contact and complaints
Write to help@élan.app, or to Arslan Siddique, House No. 2, Street 15, Sector B, DHA 2, Islamabad 45730, Pakistan. If you're unhappy with our answer, you can complain to your data-protection authority. See also our Terms of Service and Refund Policy. Orders and billing are handled through elan-app.lemonsqueezy.com/billing or the link in your receipt.