AI Fitness App Privacy: Is Your Data Safe in 2026?

Is my data safe in AI fitness and calorie apps?

It depends on the app, and the privacy policy tells you more than the marketing does. Some calorie apps state plainly that they do not sell your personal data (MacroFactor and Cronometer, for example), while others carry notices that they may sell or share data for ads, in some cases including sensitive data. Before you log your weight, food photos or medication, read the "sell" and "share" sections of the policy, connect only the health data you need, and use a unique password.

Below: what these apps collect, what six policies say (checked October 2026), the 2018 MyFitnessPal breach, regulators by country and a 7-point checklist.

What AI fitness and calorie apps collect about you

An AI fitness app records your body, your eating and your daily routine. Most of it you type in yourself, some arrives through a health sync you approved once and forgot, and AI features add the photos and chat messages you send to a model.

Medication is not a hypothetical. Cal AI's privacy policy (effective May 21, 2026, checked October 2026) lists "Food, drink, and medications you consume (including as submitted via voice and image logging)" among the data it collects. MyFitnessPal and Lose It! now offer GLP-1 medication logging too. If you log medication, keep in mind that the app is not your doctor: questions about doses or side effects go to the person who prescribed them.

What the privacy policies actually say

The short version: policies split into apps that say they do not sell personal data and apps that say some of their sharing may count as a sale under certain laws.

Under some privacy laws, sharing data with ad partners, for example through website cookies, can count as a "sale" or "sharing", so companies add these notices. The wording is still what you agree to.

Sources, all checked October 2026: MacroFactor privacy policy, Cronometer privacy policy, MyFitnessPal privacy policy, Noom privacy policy and the Lose It! privacy policy.

A few details that are easy to miss:

• Cronometer adds that it "has not sold any Personal Information in the preceding twelve (12) months", which is a concrete statement you can hold it to.
• Noom says it "does not sell or share the personal information of children or teens".
• Lose It! also carries "NOTICE: We may sell your sensitive personal data, as defined under and in accordance with Texas law." Its exclusion for Google Fit and Health Connect data is useful if you sync from an Android phone.

None of this makes one app "safe" and another "unsafe". If ad-related sharing bothers you, the apps with a flat "we do not sell" line fit you better; if the food database or price matters more, you may accept the notices.

What the 2018 MyFitnessPal breach showed

Selling is not the only risk, because data can also be stolen: in 2018 MyFitnessPal reported that an unauthorized party had acquired data from about 150 million accounts.

Under Armour, which owned MyFitnessPal at the time, said in its SEC filing of March 29, 2018 that "an unauthorized party acquired data associated with MyFitnessPal user accounts in late February 2018" and that "approximately 150 million user accounts were affected". The data taken included "usernames, email addresses, and hashed passwords". Payment card data was not affected "because it is collected and processed separately". MyFitnessPal's help center still describes the incident today, and all users were required to reset their passwords (both checked October 2026).

Two lessons for any app you use now:

• Your email and a password hash are often the weakest link. If you reuse that password elsewhere, a breach at a fitness app becomes a breach of your other accounts.
• Card data kept separately by a payment provider limits what one leak exposes, so pay through the app store or a known payment provider.

Who regulates your health data where you live

In each of the countries below, health data gets extra protection by law, and you can find the regulator or the law to turn to if an app mishandles it.

Sources: FTC on the updated Health Breach Notification Rule, ICO on special category data, Data Protection Commission, OAIC guide to health privacy, FDPIC on the new FADP, the SDAIA guide to the Saudi PDPL and u.ae on UAE data protection laws.

The Swiss FDPIC's advice on wearables works for any fitness app: check "whether the product allows for privacy-friendly settings; where collected data is stored; and whether the processing of such data is comprehensible overall."

The AI part: photos, chat and an assistant that can act

AI features add two privacy questions that a plain calorie log never raised: what happens to the photos and messages you send, and what the AI is allowed to change in your account.

Food photos and voice logs

A meal photo goes to an AI model that estimates what is on the plate. Frame the plate, not the room: no faces, no mail with your address. If the app keeps a photo history, check whether you can delete it.

Chat with an AI coach

People tell AI coaches about injuries, cycles, stress and sleep. That helps the plan, but it is still personal data the company stores, so share what the plan needs and skip the rest. If you have a medical condition, are pregnant, take GLP-1 medication or have a history of disordered eating, talk to your doctor rather than relying on an app's AI for decisions.

What the AI can do in your account

An assistant that edits plans is handy; one that can also delete your logs is a risk if it misreads a message. Ask what actions the AI has. We wrote about this in an AI assistant that cannot delete your data, which explains why Trainera's TRAI has no delete tools at all.

A 7-point privacy checklist before you sign up

Run through this list before you enter body data, photos or medication into any fitness or calorie app.

1. Find the "sell" and "share" sections of the privacy policy. Search the page for "sell". Note whether the app sells data, shares it for ads, or says it does neither.
2. Check the policy date. A recent policy is more likely to describe the app you actually use.
3. Connect health data selectively. In Apple Health on iPhone or Health Connect on Android, give the app read access only to the categories it needs, such as steps and workouts, and switch off the rest.
4. Use a unique password and sign-in with Apple or Google if offered. The MyFitnessPal case shows why: a leaked password hash does the most harm when the same password opens other accounts.
5. Keep photos clean. Food photos show the plate only; progress photos stay in the app only if you are comfortable with that company holding them.
6. Ask what the AI can change. Can it delete workouts, meals or history? Can you undo its edits?
7. Know your exit. Look for account deletion and data export in the settings before you need them, and note your country's regulator from the table above.

If you train in a women-only setting or care about who sees your photos and videos at home, our guide to women's fitness and privacy in the Gulf covers the modesty side, which is a different question from data protection.

Where Trainera fits

Trainera is one option if you want training and nutrition in one app, and you should apply the same checklist to it.

Wearable sync is optional on every client plan: you choose whether to connect Apple Health (iPhone app), Health Connect (Android app), Fitbit or Polar. If a trainer coaches you in Trainera, your steps, heart rate, sleep, calories and workouts can show up for your coach as well as for you, so connect only what you are happy to share with them.

• TRAI, the in-app AI assistant, can build or change your own training and nutrition plans in chat, but it has no delete tools. It sticks to fitness topics such as training, nutrition, recovery, sleep and the app, declines off-topic questions, and is not a medical service.
• The food photo scan (Premium, up to 20 scans a day) is an AI estimate of foods, grams, calories and macros. You can correct items before anything is logged.
• The Free plan needs no card. It includes workout logging, the diet tracker, 50 exercises, basic analytics, and 1 AI training plan and 1 AI nutrition plan a month.
• Paid plans are Pro at $5.99 a month and Premium at $6.99 a month in the US; prices differ by country on trainera.fit/pricing. TRAI comes with Pro (40 requests a month) and Premium (90 a month).

Read Trainera's privacy policy the same way you read the ones above, and decide on the wording, not on our word. If photo logging is the only thing you want, a dedicated tracker may suit you better; our sister pieces on how accurate AI photo calorie counters are and Noom vs MyFitnessPal help with that choice. For a full overview of client features, see Trainera for clients.

Lock down the app you already use in ten minutes

You do not need to switch apps to protect yourself; most of the gain comes from settings you control.

1. Open your phone's health settings and remove read access for any fitness app you no longer use.
2. Change the password on your fitness and calorie apps if it is used anywhere else.
3. Open the privacy policy of your main app, search for "sell", and decide if you are fine with what it says.
4. Close accounts on apps you stopped using; an abandoned account still holds your data.

Want training plans and nutrition tracking in one app, with an AI assistant on Pro and Premium that has no delete tools? Start free on Trainera for clients, no card needed.