Privacy

• We only collect what we need to run Mitta and to invite you to the beta. We never sell your data and we show no ads in the website or the app.
• The website counts visits without cookies and without tracking you. Ad cookies are only used if you say yes. Your signup and messages are stored in the EU.
• In the app, your training, food and body data is stored in the EU (Supabase, Stockholm) and used to plan your training and food. Health data is only processed with your explicit consent.
• The AI coach is optional. When you turn it on, a summary of your data goes to Anthropic in the US, without your name or email address.
• You can download or delete your data at any time. Questions: privacy@digicc.one.

Mitta is made by Digicc One, a sole proprietorship run by Cody de Leeuw. Cody de Leeuw, trading as Digicc One, is responsible for your personal data (the controller). Digicc One is registered with the Dutch Chamber of Commerce (KvK) under number 84260335 and is based in Geldrop, the Netherlands. VAT number: NL003941157B38.

For anything about your data, write to privacy@digicc.one. You’ll get an answer from a person, usually within a few days and always within a month.

Joining the waitlist

When you sign up, we store your email address, your first name if you give it, the page and form you used, the first page you visited, the website that sent you, campaign tags in the link, the language, your personal referral code and whether you confirmed your address. If you answer the optional questions, we also store which phone you use and what you train, and on the pricing page which plan you clicked. We use this to invite you to the beta, to send you the emails you asked for and to see which pages and channels bring people in.

After you sign up, you get an email to confirm your address. Only confirmed signups are on the waitlist. You also get a personal link; when a friend signs up with it and confirms, we store that they came through you, so you move up the list.

Applying as a beta tester

If you apply on the beta page, we store your first name (optional), your email address and your answers: what you train, how long you have trained consistently, how many days a week, what you want most (up to two goals), how you keep track now, what you would use Mitta for, which phone you use and how much feedback you can give, plus an optional free-text answer. We also store that you confirmed you are 18 or older and when you agreed to be contacted. The questions are about your training habits, not your health, and we ask you not to write health details in the free text.

We use your answers to choose who to invite, in small groups with a mix of sports and phones, and to write to you about the beta. An application also puts you on the waitlist, with a confirmation email like any other signup. When we invite you, we pass your name, email address and a short note with your answers to the Mitta app’s tester list.

Where you came from

To know which pages and campaigns work, the website remembers the first page you visited, the website that sent you and any campaign tags in the link (such as utm_source). This is kept in your browser’s session storage and sent along only when you sign up. It disappears when you close the tab. A friend’s referral code from a link is kept the same way.

Contact form

When you send a message, we store your name (optional), email address, the topic and your message, so we can answer you. If your email address matches a waitlist signup, we link the two, so we can follow up on your feedback.

Counting visits, without cookies

To see how the website is used, we count page views ourselves, without cookies and without third parties. Per page view we store the day, the page, the website that sent you (only its domain), campaign tags in the link, the type of device (based on screen width) and whether it was the first page of your visit. We don’t store your IP address, don’t use a cookie and don’t create a profile or fingerprint, so we can’t tell who you are or follow you across visits. If your browser sends Do Not Track or Global Privacy Control, we don’t count your visit at all. To stop spam, your IP address is kept in the server’s memory for about ten minutes to limit the number of requests. It is not written to our database and is gone when the server restarts.

Fonts and scripts

The website loads its font from Google Fonts and a few scripts for animation from cdnjs and unpkg (both served through Cloudflare). Like any website you load, these services see your IP address and browser details when the page loads. We don’t send them anything else.

The website itself sets no cookies. Your choices are kept in your own browser (local storage), only to remember them.

Right now we run no ads. If we start advertising, we may use ad pixels from Meta, Google or TikTok to see which ads bring people to Mitta. These place cookies and send data about your visit to those companies, which may process it outside the EU under their own privacy policies. We then ask first: they only load after you click Accept in a cookie banner. If you click No thanks, nothing is loaded. You can change your choice at any time via Cookie settings at the bottom of every page, and we ask again after 12 months.

Signing up works the same whether you accept or not.

Your account

Your email address and an encrypted password, or, when you sign in with Google or Apple, your account ID, email address and name (with Apple this can be a hidden relay address). With two-step verification also the secret key for your authenticator app, stored encrypted.

Your profile

Name (optional), sex, year of birth, height, goal, experience, training days, equipment, food preferences such as diet, allergies and dislikes, and your settings. If you add a profile photo, it is stored privately in your account.

Training and food

Your plans, workouts, sets, cardio, training blocks, your own exercises and products, your food log, recipes and planned meals.

Health data

Weight, waist, body fat, steps, aches and injuries, pain scores on sets, sleep, energy and soreness from the check-in, and the food you log. Data about your health is special category personal data: Mitta only processes it with your explicit consent, which you give when you start.

Apple Health and Health Connect (Pro, optional)

Only if you connect them. Mitta reads weight, body fat, steps, active energy, workouts with distance and heart rate, sleep, heart rate variability and resting heart rate. Weight, body fat, steps and cardio workouts (with heart rate) are saved to your account; active energy, sleep, heart rate variability and resting heart rate stay on your phone. Mitta writes your finished workouts back, and your weight only if you turn that on. Importing an Apple Health export file is free: the file is read on your phone and not uploaded.

The AI coach (Pro + AI, optional)

Your messages and the coach’s answers, the facts you asked the coach to remember, your thumbs and notes on answers, weekly summaries, and usage data (number of tokens and costs, not the content). Photos of a label, a plate or a recipe are only used while they are read and are not stored.

Safety

If something you write sounds like a crisis or an eating disorder, the app shows a support card instead of advice and does not send your message to the AI. After a signal of an eating disorder, the app stores the date, so the coach stops suggesting weight loss for a while.

Notifications (optional)

If you turn them on in the web app, we store a notification address for your browser and send the notice through your browser maker’s push service (Apple, Google or Mozilla). It contains only the name of your workout.

Product events

To see which parts of the app are used, the app counts simple events (for example that a screen was opened), with the day but without your user ID, name or anything you typed.

On your phone

The app keeps a copy of your data on your phone so it works offline. When you log out, that copy is erased.

• Running your account and the app (signing in, syncing between devices): necessary to provide the service you asked for.
• Personalising your training and food (lift targets, food targets, energy use): based on your explicit consent, because it uses health data.
• The AI coach and reading labels or photos: based on separate consent. Without it, the rest of the app works as normal.
• Beta invites, confirmation emails and the waitlist: based on your request when you sign up.
• Beta tester applications (your answers about how you train): based on your consent, the box you tick on the form. You can withdraw it at any time by emailing us.
• Product updates by email: we don’t send them yet. If we start, we ask first and every email will have an unsubscribe link.
• Answering your messages and requests: necessary to handle your request.
• Keeping the website and app safe and working (limiting spam requests, backups): our legitimate interest.
• Your personal referral link and place on the waitlist: your request when you sign up.
• Loading the font and scripts from Google, cdnjs and unpkg: our legitimate interest in a fast, good-looking website.
• Understanding how the site and app are used (counting visits without cookies, where signups come from, counted product events): our legitimate interest in improving Mitta, done without tracking you.
• Ad cookies: only with your consent in the cookie banner, which you can withdraw at any time.

Mitta makes no decisions about you with legal or similarly significant effects. The coach only suggests; you decide.

We only share data with services that help us run Mitta, under agreements that bind them to protect it. We never sell data.

• Supabase (app database and sign-in): servers in the EU (Stockholm). Supabase Inc. is based in the US; any transfer is covered by standard contractual clauses.
• Anthropic (AI coach, US), only when you turn the coach on. It receives a summary of your profile, aches and injuries, workouts, food and weight from the past weeks, your question or photo, and the facts you asked the coach to remember. With the weekly check written by AI, your weekly totals are sent once a week. No name or email address. Anthropic does not use this data to train its models. It normally deletes it within 30 days; content that its systems flag as abuse can be kept longer. The transfer is covered by standard contractual clauses.
• Hetzner (Germany): hosts this website and the place where signups, applications and messages are stored, on servers in Falkenstein, Germany. Backups are kept with Hetzner too.
• TransIP (the Netherlands): hosts the app files and sends our emails.
• Vercel (hosting of the app files, from the day the app moves there): shows you the app. It sees technical data such as your IP address when you visit, but not what you enter in the app: that goes straight to Supabase. Vercel Inc. is based in the US; any transfer is covered by standard contractual clauses.
• Microsoft (email inbox): our mailbox privacy@digicc.one is hosted by Microsoft 365.
• Strato (Germany): registers the domain getmitta.app and runs its DNS records. It does not see what you do on the site.
• Apple, Google and Mozilla (push services): only if you turn on notifications in the web app. They see that a device gets a notification, not what is in it.
• Google and Apple: only if you sign in with them. They see that you sign in to Mitta.
• Open Food Facts: when you scan a barcode, your device asks Open Food Facts directly, so it sees your IP address. Searches by name go through our server.
• YouTube (privacy-enhanced mode): only when you tap a technique video.
• Google Fonts and Cloudflare: when you load this website, see above.
• Meta, Google and TikTok (ads): only if we run ads and you accept ad cookies, see Cookies.

We only share data with authorities when the law requires it.

• Waitlist signups and beta applications: until the beta is open to everyone or you ask us to remove you. Unconfirmed signups are removed after 30 days, and confirmation links work for 14 days.
• Messages from the contact form: up to 12 months after we’ve answered.
• Counted page views: 13 months.
• Your account, profile, training, food and health data: as long as your account exists.
• Coach conversations: 12 months, then deleted automatically. Weekly summaries: 12 weeks.
• AI usage data, push notification logs and product events: 90 days.
• Email logs: 12 months.
• Backups of the website’s database and uploads: daily copies, kept for 14 days; Hetzner’s own server backups cover about a week.

When you delete your account, your account and everything linked to it are deleted right away. A few things are kept: a record of plan changes tied only to a random ID, without your name or email address, for our statistics; if you were invited as a tester, the invitation (name and email address); and your signup on the website (email address and your answers) until you ask us to remove it. Ask us and we remove these too. At our processors, data disappears on their own schedules.

• See and take your data: in the app, Settings → Download all your data. For the website, email us.
• Correct it: change it in the app, or email us.
• Withdraw consent: turn off the AI coach or a connection in Settings, or delete your account. This doesn’t affect what was done before.
• Delete it: in the app, Settings → Delete account. Without the app, email privacy@digicc.one from your account’s email address; we delete it within 30 days. To leave the waitlist, email us.
• Object or restrict: email us, for example to object to use based on our legitimate interest.
• Complain: you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl). We’d appreciate hearing from you first.

All connections are encrypted. In the app’s database, every user can only reach their own data (row level security), and you can turn on two-step verification. Keys for the AI and the database stay on our servers. If there is a data breach that puts you at risk, we tell you.

Mitta is for people aged 18 and over. We don’t knowingly collect data from younger people; if you think we did, let us know and we’ll delete it.

When we change how we handle your data, we update this page and the date below. For important changes we tell you in the app or by email, and ask for your consent again where needed.

Last updated: 26 October 2026