Privacy policy

Version 2026-10-28 · Last updated: 28 October 2026

Who is responsible

Slowloss is run by Zeshan Ahmed, trading as Slowloss, who is the data controller for the service. Privacy questions: privacy@slowloss.com.

What we collect and why

We collect only what the service needs to work:

Account details: your email address, display name and password (stored as a secure hash by our authentication provider). Used to sign you in and contact you about your account.
Your logs: meals (names, calories, macros, portions, notes, times, whether the figures were estimated, and whether you logged them here or through your assistant), water totals, daily targets and your timezone. This is the product: it exists so you can see it back.
Assistant connections and API tokens: if you connect an assistant, we store which app it is (for example Claude), when you connected it and when it was last used, with hashed sign-in tokens. If you create an API token, we store its name, its first few characters and when it was last used. We never store the tokens themselves.
Technical data: your IP address and browser details. Our authentication provider records them when you sign in, to keep your account secure; our hosting providers keep them briefly in request logs; and we use IP addresses for a couple of minutes to limit repeated requests to the connection and sign-in endpoints assistants use.

The legal basis for your account details is performance of a contract: we process them to provide the service you signed up for. Your logs are different: what you eat and drink can reveal information about your health, so we process your logs only with your explicit consent. We ask for it with a separate tick box when you create your account, and we keep a record of which document versions you accepted and when. You can withdraw consent at any time by deleting your account in Settings, or by emailing privacy@slowloss.com. Without it we cannot provide the service, because the logs are the service. We process technical data because we have a legitimate interest in keeping the service secure and preventing abuse. We do not use your data for advertising, we do not sell it, and we do not share it with anyone except the service providers named below, who process it for us under contract.

Cookies

Slowloss uses only strictly necessary session cookies to keep you signed in. There are no analytics or tracking cookies, which is why there is no cookie banner.

Where your data lives

Your account and everything you log are stored with Supabase in the United Kingdom (London), and Supabase may access it from other countries, for example to provide support. The web app is served by Vercel, which runs it in London. Vercel may process some data in the United States, and visits from outside the UK may be handled by a Vercel location near the visitor. If you connect an assistant, its requests pass through our connection server, which runs with Railway in the Netherlands, holds no database credentials and stores none of your data. Railway may process these requests in the United States. Account emails, such as sign-up confirmations and password resets, are sent by Resend from Ireland, and Resend may process them in the United States. Rate limiting uses Upstash, in the United Kingdom (London), which briefly processes IP addresses and record IDs. Where your data leaves the UK this way, it is protected by each provider’s data processing agreement, which includes the UK’s approved clauses for international transfers; Vercel, Railway and Upstash are also certified under the UK-US data bridge. What you tell Claude or ChatGPT is handled by Anthropic or OpenAI under your own account with them and their privacy policies; Slowloss only receives the requests your assistant sends to log or read your data.

How long we keep it

Until you delete it. Deleting a meal removes it immediately. Deleting your account (in Settings) permanently removes your account and everything logged under it. Our authentication provider keeps sign-in security records, including your email address and IP address, for up to 30 days, after which they are deleted, including after you delete your account. Technical data is kept briefly: rate-limiting records expire within about two minutes, and our providers keep request logs for a limited period set by each of them. Apart from these, there is no retention period, and no backups are kept beyond the providers' short-term operational backups.

Your rights

Under UK GDPR you can ask for access to, correction of, or deletion of your personal data, ask for a copy of it in a portable format, and object to or restrict processing. Most of this is self-service: your data is visible in the app and deletable in Settings. For anything else, email privacy@slowloss.com. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).