Privacy policy

This explains what Tali collects, why, who else handles it and the rights you have. It covers the Tali app (app.tali.fit) and the Tali website (www.tali.fit). Tali is run by Gravita Creative Ltd ("we", "us"). We are the controller of your personal data under the UK GDPR, the Data Protection Act 2018 and, for people in the EU, the EU GDPR.

Who we are

Gravita Creative Ltd, a company registered in England and Wales, company number 08348225. Registered office: 64 Carlton Lane, Rothwell, Leeds, LS26 0SX. Privacy questions and requests: benn@gravita.co.

The short version

  • Tali stores your log on your phone so it works offline. Once you agree, it also syncs to a database in Ireland (EU) that's private to your account.
  • When you scan a barcode, Tali looks the product up on Open Food Facts, a public food database.
  • No ads, no analytics, no tracking cookies, and we never sell your data or share it for marketing.
  • You can export everything or delete your account from the app at any time.

What we collect in the app

Only what you enter, or what is needed to run your account:

  • Account: your email address and a password (stored as a secure hash, which we can't read). If you sign in with Google, we receive your email address, name and profile picture link from Google.
  • Profile: display name, sex, age, height, weight, body fat (if you add it), activity level, goal, pace, diet pattern (such as vegetarian or vegan), training experience, equipment, days per week, cardio preferences, muscle groups to focus on, and any body areas to train around, with a note if you add one.
  • Your log: food and drink, portions, recipes and custom foods, including foods you scan with their barcode and where the numbers came from; body weight; workouts, including exercises, sets, time, effort and how you felt (sleep, stress, energy and soreness, if you answer); workouts you create and weekly training plans, with any notes you add when a plan ends; supplements and reminder times; mood and hunger check-ins and their notes; and your if-then plans.
  • Settings: calorie and macro targets and ranges, weekly workout schedule, display preferences (including Gentle mode), accuracy preferences and hand-portion sizes.
  • On your device only: the list of ingredients you have at home, used for meal suggestions. It is never uploaded.
  • Reminders: if you turn them on, a push subscription (an address and keys issued by your browser) so we can send supplement reminders.
  • Your consent choices: each time you give or withdraw consent, we record which one, the version of the wording you saw, and when.
  • Feedback: if you send feedback from the app, it goes from your own email app to us, with the app version and your browser and device type. Please leave out health details you'd rather keep private.

What we collect on the website

  • Early access: if you join the list, your email address.
  • Technical: like any website, the servers that deliver and run the site and app see your IP address, browser and the time of each request, which our providers keep for a short time under their own retention periods, for security and fault-finding.
  • Bot protection: when a website page with the sign-up form opens, it loads Cloudflare Turnstile, which checks technical signals from your browser to tell people from bots, whether or not you use the form.

Health data

Much of what you log in the app (weight, diet, exercise, injuries, sleep, stress, supplements, mood) can say something about your health, a special category of personal data, and your diet pattern may also reveal beliefs. So before anything is synced, the app asks for your explicit consent to all of it, when you first sign in, and records the date and the version of the wording you saw. If you used Tali before we asked, what you logged then was already synced to your account. If you used Tali before we asked, you can choose "Not now". Everything you log then stays on your phone, and nothing syncs to your account or is backed up there. What was already in your account is kept there, unused, until 28 October 2026, and then deleted unless you've agreed. Your phone keeps its copy, and if you agree later it uploads again from your phone. We ask once more after two weeks. Reminders only run once you've agreed.

You can withdraw that consent at any time in the app (Profile, then Privacy). Withdrawing stops Tali syncing anything you log and deletes your log, profile, settings and reminders from your account, so your log stays only on your phones. It also clears your weigh-ins, check-ins and body details (weight, body fat and any injuries you've noted) from this phone straight away, and from your other phones the next time each one connects. Your account and your consent choices stay, so you can agree again later, and your log then uploads from your phone. To remove everything, delete your account (Profile, then Privacy, then Delete account; this needs a connection). Withdrawing does not affect what happened before.

Why we use it, and our legal basis

  • To provide the app: store and sync your log (only once you've agreed), calculate your targets, ranges and trends, suggest meals and workouts, and send reminders you asked for. Basis: our contract with you, and your explicit consent for health data.
  • To look up a product when you scan its barcode. Basis: our contract with you.
  • To read and answer feedback you send us. Basis: our legitimate interest in improving Tali.
  • To invite you to try Tali early access. Basis: your consent, given when you join the list. We use your email for nothing else, and you can ask to be removed at any time by emailing us.
  • To keep accounts, the app and the site secure and working (sign-in, stopping bots and abuse, fixing faults). Basis: our legitimate interest in running a secure service.
  • To send account emails you need, such as confirming your address or resetting your password. Basis: our contract with you.
  • To keep a record of the consents you give and withdraw, so we can show what you agreed to and when. Basis: legal obligation (the law requires us to be able to show consent). Kept until you delete your account.
  • To answer your requests and meet legal duties. Basis: legal obligation.

Automatic calculations

Tali suggests calorie and macro targets, meals and workout adjustments from what you enter, using standard formulas. They are suggestions you can change at any time. They have no legal or similarly significant effect on you, and nobody makes decisions about you from them.

Who else handles your data

We use a small number of service providers who process data for us, on our instructions:

  • Supabase: the app's database, sign-in, account emails and reminder service. Your account data is stored in the AWS eu-west-1 region (Ireland).
  • GitHub Pages: hosts the app's files and sees technical request data.
  • Webflow: hosts the website and stores early access sign-ups. The site is delivered through Cloudflare, which also runs the bot check, and some of Webflow's page code loads from Amazon CloudFront.
  • Bunny.net: delivers the exercise demo videos, and sees technical request data when you play one.
  • Your browser's push service (Apple, Google or Mozilla, depending on your device): delivers reminders if you turn them on. A reminder carries only the supplement name, and it is encrypted so the push service can't read it.
  • Google Workspace: our email, which receives feedback and requests you send us.
  • Google: only if you choose "Continue with Google". Google handles that sign-in under its own privacy policy.

Open Food Facts is not our service provider. When you scan a barcode, your phone asks Open Food Facts (openfoodfacts.org, a non-profit in France) for that product, so it sees the barcode and your IP address, under its own privacy policy. Nothing else you log is sent to it.

International transfers

Your app account data is stored in the EU. Some of our providers are based in, or may access data from, the United States. Where personal data leaves the UK or EU, we rely on the safeguards the law provides, such as the UK International Data Transfer Addendum, the EU Standard Contractual Clauses or the UK-US and EU-US Data Privacy Framework. Contact us for details of the safeguard for a particular provider.

How long we keep it

  • App account data is kept while you have an account, except as described below. When you delete your account it is removed from our live database straight away. Copies in our database provider's backups, and our providers' security logs, are deleted as they expire on those providers' regular cycles. Early access emails on the website are separate and aren't affected.
  • If you withdraw consent for health data, we delete your log, profile, settings and reminders from your account straight away (or as soon as your phone next connects), and keep your account and your consent choices.
  • If you used Tali before we asked for consent and haven't agreed by 28 October 2026 (whether you chose "Not now" or haven't opened the app since), we delete your log, profile, settings and reminders from your account on that date, and keep your account. What's on your phone stays there.
  • When we delete data from your account for either of these reasons, copies in our database provider's backups are deleted as they expire on its regular cycle.
  • Data on your device stays until you delete it in the app, clear your browser data or remove Tali.
  • Early access emails are kept until we've invited you and early access has ended, or until you ask to be removed, whichever is sooner.
  • Emails you send us are kept only as long as needed to deal with them.

Cookies and storage on your device

The app uses your browser's storage only for things it needs to work, and the website sets one security cookie. We use no advertising or analytics cookies. Our cookie policy lists each one: www.tali.fit/legals/cookie-policy.

Security

Data travels over encrypted connections. Each row in the app's database is locked to its owner, so no other user can read it, and passwords are stored as hashes. If a breach is likely to put your rights at high risk, we will tell you, and we will report breaches to the Information Commissioner's Office as the law requires.

Your rights

You have the right to:

  • access your data and get a copy in a portable format (in the app: Profile, then Back up and restore, then Export);
  • correct it (you can edit everything in the app);
  • have it deleted (in the app: Profile, then Privacy, then Delete account);
  • restrict or object to how we use it;
  • withdraw consent at any time, including leaving the early access list.

To use a right the app doesn't cover, email benn@gravita.co. We reply within one month, and it's free.

If you're unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113) or, in the EU, to your local data protection authority.

Age

Tali is for people aged 18 and over. We don't knowingly collect data from anyone younger. If you think a child has used Tali, contact us and we will delete their data.

Changes

We update this policy when what we do changes, and show the new date at the top. If a change affects what you've consented to, the app will ask you again. The current version is always at www.tali.fit/legals/privacy.