Anti-Diet ClubPrivacy Policy
What we collect, why we collect it, how long we keep it, and how you stay in control under the GDPR.
Last updated 30 July 2026
1. Who is responsible for your data
Anti-Diet Club (the controller) operates this website and its member area. For any privacy question or to exercise your rights, write to antidietclub2304@gmail.com. This page is maintained by the Anti-Diet Club team and describes our current practices.
2. Data we process
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account | Email, display name, password hash, sign in provider | Create and secure your account | Contract (Art. 6(1)(b)) |
| Membership | Plan, subscription status, role | Give access to Premium features | Contract |
| Journal and check ins | Free text entries, mood, energy, emotions, photos you upload | Provide the private journal you asked for | Explicit consent (Art. 9(2)(a)) |
| Messages | Messages you exchange with the team | Answer and support you | Contract / consent |
| Technical | IP address, browser type, security and error logs | Keep the service available and secure | Legitimate interest (Art. 6(1)(f)) |
| Cookies | Session and consent preferences | Sign you in, remember your choices | Strictly necessary / consent |
Journal entries, emotions and anything you write about food, your body or your health can reveal health data. We treat that as special category data under Article 9: it is stored for you alone, is never sold, never used for advertising and never used to train external AI models.
3. Children
The service is not intended for people under 16. If we learn that an account belongs to a child under 16 without parental authorisation, we delete it.
4. AI companion
When you use the AI companion, the messages of that conversation are sent to our AI provider to generate a reply. We do not send your journal entries, your email or your account identifiers with them, and we do not use these conversations to train models. The companion is educational support, not clinical care.
5. Processors and transfers
- Hosting and application delivery, for serving the website.
- Managed database, authentication and file storage, for your account and content, hosted in the European Union where the region is configurable.
- AI inference provider, for the AI companion replies only.
- Email delivery, for account emails such as confirmation and password reset.
Each processor acts on our documented instructions under a data processing agreement. Where a transfer outside the EEA is unavoidable, it relies on the European Commission Standard Contractual Clauses.
6. Retention
- Account and membership data: for as long as your account exists, then deleted.
- Journal entries, check ins and uploaded photos: until you delete them or delete your account.
- Messages: up to 3 years after the last exchange.
- Security and error logs: up to 12 months.
7. Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent at any time without affecting past processing. You can also lodge a complaint with your national supervisory authority (in France, the CNIL).
We answer requests within one month. Two of these rights are automated below, so you do not have to wait for us.
8. Security
Access to your data is enforced row by row in the database, so one member can never read another member's journal or messages. Uploaded photos live in a private bucket reachable only through short lived signed links. See our security practices for details, and our cookie policy for tracking choices.
9. Breach notification
If a personal data breach is likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority within 72 hours of becoming aware of it, and we inform affected members without undue delay when the risk is high.
10. Changes
We update this notice when our practices change and always publish the date of the latest version at the top of this page.