Loxley Labs
Privacy Policy · Loxley Meal & Fasting Planner
Version 1.2 · Effective July 22, 2026
This policy covers the Loxley Meal & Fasting Planner Android application (the "App"), published by Loxley Labs, LLC, a Colorado limited liability company. Questions and requests: support@loxleylabs.net. The loxleylabs.net website has its own privacy policy; this document is the authoritative policy for the App.
1. What we collect: nothing
The App has no accounts, no sign-in, no analytics, no advertising, no crash reporting, no tracking, and no third-party SDKs that profile you or report your activity. It does not collect, transmit, sell, or share your personal data or health data, and we run no server that receives it.
The App does hold the Android INTERNET permission, but it uses it for one purpose only: the
optional barcode lookup described in Section 3, which you must switch on yourself and which sends only a
product's barcode number. Your fasting, water, weight, meal, and settings records never leave your device
except through a backup or export you create yourself (Section 3). We cannot see your data, and we cannot be
compelled to hand over what we never receive.
2. What stays on your device
The App stores the records you create so it can work as a timer and log:
- fasting sessions (start, end, goal, optional mood and note),
- water counts, weight entries, meals and calorie figures, recipes and meal plans,
- your settings, and
- a local log of the health-notice acknowledgments you accept in the App.
These records live in an encrypted database on your device (SQLCipher, with the encryption key protected by the Android Keystore). They are excluded from Android's automatic cloud backup. Deleting them is entirely in your hands: use Settings → Erase all data, or uninstall the App.
3. When data leaves your device
Three features can move data off your device, and every one of them runs only when you choose to use it. The App never sends anything on its own.
- Encrypted backup (.llbackup). Protected by a passphrase you choose, using PBKDF2-HMAC-SHA256 (600,000 iterations) and AES-256-GCM. The passphrase is not stored anywhere. We cannot open, recover, or reset a backup; nobody can without the passphrase.
- CSV export. A plain, unencrypted spreadsheet file, clearly labelled, for your own use.
- Barcode lookup (Open Food Facts). Optional and off by default. You turn it on in Settings; until you do, it makes no network calls. When it is on and you scan a barcode, the App sends only that barcode number to Open Food Facts, a public, community-run food database, over an encrypted connection, and receives back the product name, brand, serving size, and nutrition figures. It sends nothing else: no name, no account, no device identifier, and none of your fasting, water, weight, or meal records. The request identifies the App by name and our support email only, as that database asks callers to do. Open Food Facts is a third party and handles the request under its own privacy policy, not ours. You can use the App fully without ever enabling this, and enter nutrition by hand instead.
The backup and CSV files are saved through the Android system file picker to a location you choose. If you choose a cloud-synced folder (for example a Google Drive folder), that copy is thereafter governed by that service's terms and privacy policy, not by us.
4. Android permissions the App uses
| Permission | Why |
|---|---|
CAMERA (asked at runtime) | Powers the optional barcode scanner (Section 3). Used only while you are actively scanning; no photos or video are taken, stored, or sent. |
INTERNET | Used for one thing only: the opt-in Open Food Facts barcode lookup (Section 3). No other feature makes network connections. |
POST_NOTIFICATIONS (asked at runtime) | Shows the reminders you turn on (goal reached, daily start, water, meal times). Notifications are generated and displayed on-device. |
RECEIVE_BOOT_COMPLETED, WAKE_LOCK, ACCESS_NETWORK_STATE | Pulled in automatically by Android's WorkManager scheduling library so the reminders you turn on survive a restart and schedule reliably. |
The App uses no location, microphone, contacts, storage-wide, or exact-alarm permissions, and it does not integrate with Health Connect or any other health platform.
5. Purchases
Payment is handled by the store you buy from, not by the App:
- Google Play: Google processes the transaction under Google's own terms and privacy policy.
- loxleylabs.net: Lemon Squeezy, as merchant of record, processes payment and any order emails under its own terms and privacy policy.
The App itself receives nothing from checkout. There are no license keys and no activation step: once you have the App, it simply runs. Buying it creates no account and sends nothing to us.
6. Links that leave the App
A few places in the App open your web browser when you tap them: the privacy and terms links on the About screen, and the source links on bundled recipes. What happens in your browser is governed by the sites you visit. The App does not embed web content and receives nothing back from these links.
7. Children
The App is intended for adults and is not directed to children. Our Terms of Use require users to be at least 18. Because the App collects no data from anyone, it also collects no data from children.
8. Your rights
United States privacy laws give consumers rights over personal data that businesses hold about them: access, correction, deletion, portability. Our answer to every such request is the same, and it is a good one: we hold nothing about you. There is no server-side record to access, correct, delete, or port. Your records exist in one place, on your device, under your control:
- Access and portability: use the CSV export or the encrypted backup.
- Deletion: Settings → Erase all data, or uninstall the App.
- Correction: edit any record in the App.
If you contact support@loxleylabs.net, we will receive your email address and the contents of your message, and we use them only to respond to you.
9. Changes to this policy
If this policy changes, the new version will be posted at loxleylabs.net/privacy/planner with an updated version number, date, and a changelog entry below. Because the App collects nothing about you and keeps your records on your device, changes to this policy cannot retroactively expose past data; there is none to expose.
10. Contact
Loxley Labs, LLC (Colorado, USA)
support@loxleylabs.net ·
loxleylabs.net
Changelog
- v1.2 (July 22, 2026): updated for the food-logging release. Documented the optional Open Food Facts barcode lookup (off by default; sends only the barcode number) and the
CAMERAandINTERNETpermissions it uses, and removed the earlier statements that the App has no internet permission and cannot make network connections. Removed references to license-key activation, which the App no longer uses. - v1.1 (July 4, 2026): product renamed to Loxley Meal & Fasting Planner (formerly Loxley Fasting Tracker); no changes to any privacy practice.
- v1.0 (July 4, 2026): first published version.
Google Play and the Google Play logo are trademarks of Google LLC.