Last updated: October 29, 2026
This Privacy Policy explains how Joi & Laff Ltd ("Pact", "we", "us", "our") collects, uses, and protects your information when you use the Pact mobile application ("App") and our website at pactapp.web.app ("Site"). By using the App, you agree to the practices described in this policy.
If you have questions, contact us at hello@joiandlaff.com.
When you create an account, we collect:
When you use our fitness features, we collect:
Health data is never sold, shared with advertisers, or used for purposes other than providing the App's core functionality. You can revoke health data access at any time through your device settings.
We may request access to device features including the camera (for profile photos and stories), photo library, notifications, and Bluetooth (for connected fitness devices). Each permission is requested individually and can be revoked in your device settings.
Subscription payments are processed entirely by Apple (App Store) or Google (Google Play). We do not collect, store, or have access to your payment card details. Subscription status is managed through RevenueCat.
We use your information to:
Your data is stored in Google Firebase (Cloud Firestore and Firebase Authentication), hosted on Google Cloud infrastructure. Data is encrypted in transit (TLS) and at rest. Access to your data is restricted by Firestore security rules — each user can only read and write their own data.
While we take reasonable measures to protect your information, no system is completely secure. We encourage you to use a strong, unique password for your account.
We do not sell your personal data.
We share information only in these limited circumstances:
| Service | Provider | Purpose | Data Shared |
|---|---|---|---|
| Firebase | Google LLC | Authentication, database, push notifications, analytics, crash reporting | Account data, app usage, FCM tokens |
| RevenueCat | RevenueCat Inc. | Subscription management | User ID, subscription status |
| Google Gemini | Google LLC | AI training plan generation | Anonymised workout history, fitness goals (no personally identifiable information) |
| USDA FoodData Central | U.S. Department of Agriculture | Food and nutrition search (primary) | Search queries only (not stored by Pact) |
| Open Food Facts | Open Food Facts (non-profit) | Food and nutrition search (fallback for UK/EU products) | Search queries only (not stored by Pact) |
| ExerciseDB | ExerciseDB | Exercise demonstration images | None (images loaded by URL) |
| Apple HealthKit | Apple Inc. | Health and activity data sync (iOS) | Read/write with user permission only |
| Health Connect | Google LLC | Health and activity data sync (Android) | Read/write with user permission only |
| HeyCatch | HeyCatch, Inc. (Dover, Delaware, USA) | Product analytics for the App and the Site. HeyCatch runs this on PostHog, Inc.'s US cloud, which processes the data on HeyCatch's behalf; HeyCatch may also use AI model providers to generate insights from the analytics events, under terms that bar them from training on it. | App: pseudonymous user ID, screen views, in-app actions (no workout details), device type, OS and app version, and the IP address of the connection. Site (only if you accept the cookie banner): pages visited, clicks, referrer, campaign links, and the IP address of the connection. |
HeyCatch and its analytics infrastructure are in the United States, so analytics data is processed there. HeyCatch is not certified under the EU–US Data Privacy Framework; the safeguards for our data are set out in the data processing agreement we have with HeyCatch.
USDA FoodData Central data is public domain. Open Food Facts data is licensed under the Open Database License (ODbL). Nutritional data is queried in real-time and is not stored or redistributed by Pact.
You have the right to:
If you are in the EU/UK, you also have rights under GDPR including the right to data portability, the right to restrict processing, and the right to lodge a complaint with your local data protection authority.
Pact is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will delete it promptly.
With your permission, we send push notifications for:
You can disable notifications at any time in your device settings.
The App does not use cookies. We use Firebase Analytics and HeyCatch to understand how the App is used. Both receive a pseudonymous user ID, never your name or email. We do not use advertising trackers or share data with ad networks.
The Site asks before it uses analytics. Until you choose Accept in the cookie banner, no analytics run and nothing is stored in your browser except your choice itself: pact_analytics_consent in local storage, and, if you decline, the analytics tool's own record that you said no (__ph_opt_in_out_…). Neither holds an identifier. We keep them so we don't ask on every page.
If you accept, HeyCatch analytics stores a cookie (ph_…_posthog) and items in your browser's local and session storage. They hold a random visitor ID, a session ID, and the page and website that brought you to the Site, and the analytics servers also receive the IP address of your connection. We use them to count visits and to see which links bring people to Pact. They are not used for advertising. If your browser sends a Do Not Track signal, no analytics run even if you accept.
You can change your mind at any time with Cookie settings at the bottom of each page. Choosing Decline stops the analytics and removes the analytics cookie and stored items.
We may update this Privacy Policy from time to time. We will notify you of material changes through the App or by email. Continued use of the App after changes constitutes acceptance of the updated policy. The "Last updated" date at the top reflects the most recent revision.
If you have questions about this Privacy Policy or your data, contact us: