This privacy policy governs your use of the mobile application BMI Calculator (the “Application”, Android package identifier com.flx_apps.bmicalculator), a body-metrics calculator and weight tracker created and published by FLX Apps (Felix Heller), flx.es. It explains what the Application does and does not do with the health-related information you enter, which permissions end up in the installed package and why, and how the optional in-app purchase is handled. Please read it in full before installing or using the Application.
BMI Calculator works out body metrics from measurements you type in: classic BMI with WHO categories, a healthy-weight range, BMI Prime and the Oxford “new BMI”, the Body Roundness Index, the waist-to-height ratio with NICE guidance bands, and a body-fat estimate using the US Navy circumference method together with fat-free mass and FFMI. For children and teenagers between 2 and 20 years it switches to BMI-for-age percentiles and z-scores. It also lets you log your weight over time. The optional premium unlock adds a trend chart and statistics, a weight goal with milestones and a forecast, CSV export and import, a home-screen widget and a pure-black AMOLED theme.
It is a personal, single-device tool. There is no companion account, no cloud we operate, and no way for anyone — including us — to see your figures or your usage. Every calculation runs locally on your device, from the numbers you enter and from reference data bundled in the app package.
The Application provides wellness information, not medical advice.
The information you give the Application is health-adjacent by nature, and it is treated accordingly: it stays on your device.
bmi.db) managed by Room inside the Application’s private sandbox. Your profile values, units, theme and goal live in the Application’s private SharedPreferences. Both are ordinary app-private storage that other apps on the device cannot read.
For a person aged roughly 2 to 20 years, adult BMI categories are not meaningful, so the Application computes a BMI-for-age percentile and z-score instead. It does this from the official CDC growth reference (the LMS parameters of the CDC BMI-for-age table), which is shipped unmodified inside the app package as a resource file (res/raw/cdc_bmi_lms.csv) and read from there.
The consequence for your privacy is the important part: producing a child’s percentile requires no lookup, no request and no connection of any kind. The child’s age, height and weight are used on the device, against a table already present on the device, and the result is displayed on the device. Those figures are stored in the same local, app-private storage as everything else, and are not sent anywhere.
If the Application crashes, it uses ACRA, a self-contained open-source crash-reporting library, in its e-mail configuration. Nothing is sent automatically, silently, or in the background. On the next start a dialog asks whether you want to send a report; if you decline, the report is discarded. If you agree, the Application transmits nothing itself — it hands the report to your own e-mail app as a message with the report attached as a file, addressed to bmicalculator@flx-apps.com. You see that message in your own mail app, you can open the attachment and read exactly what it contains, and you decide whether to send it or throw it away. It is sent from your mailbox, so we receive it as an ordinary e-mail from you and see the address you send it from.
So that you know what you would be sending, a report contains:
Your body data is not part of the report. The crash reporter’s default configuration would have attached the Application’s preferences file — which is where your height, sex, date of birth, circumferences, last weight and goal are stored — so that field is explicitly switched off. Neither your profile values nor your weight history (the entries in bmi.db, their notes, and your logged measurements) appear in a crash report. Should you still prefer not to send one, decline the dialog, or delete the attachment before sending. Reports are used to diagnose the crash and are not combined with anything else, shared with third parties, or used to contact you for any other purpose.
The Application integrates Google Play’s in-app review API (com.google.android.play:review). After you have had the app installed for a few days and used it a number of times, it may ask Google Play to display the standard rating overlay inside the app, at most once every 90 days; Google Play applies its own quota on top and simply does nothing when it is exhausted. You can also open it yourself from the settings screen.
The decision to show the overlay is made on your device from local counters (how long ago you first opened the app, how many meaningful actions you have taken, when you were last asked); those counters are stored in the Application’s own preferences and are not reported anywhere. The overlay itself is drawn and handled by the Google Play Store app, not by the Application: any rating or review you write goes to Google, under the Google Privacy Policy, and the Application is not told whether you rated it or what you said. None of your body data, weight history or profile values is involved.
With premium, you can export your weight history as a CSV file. The Application builds the file in memory (one row per entry: timestamp, weight in kilograms, and the note if you wrote one) and writes it to a location you choose in Android’s own storage picker. It is the system picker that grants access to that single document, which is why the Application needs no storage permission and can see nothing else on your device.
Once the file is written it is an ordinary file under your control, outside the Application’s sandbox and outside this policy’s reach: it is not deleted when you uninstall, and whatever you subsequently do with it — move it, mail it, put it in a cloud drive — is your decision. The export is a local file operation; nothing is uploaded as part of it.
Import works the same way in reverse: you pick one file in the system picker, the Application reads it and merges the rows into your local history, and the picker’s grant covers that document alone. Both directions are ordinary local file access, which is what makes it possible to move your history to another device without any account or sync service existing.
The Application can optionally keep your weight in step with Health Connect, the health data store built into Android (and installable from the Play Store on older versions). This is switched off by default. Nothing is read or written until you enable it in the settings screen and grant the access in Android’s own Health Connect permission screen, and turning the switch back off stops it immediately.
The essential point is where the data goes: Health Connect is a store on your own phone, and the sync is an exchange between two apps on that phone. It is not a cloud service, we do not operate it, and the Application still contains no networking code of its own. Whether the other app subsequently sends its copy to its own servers is governed by that app’s privacy policy, not by this one — if you sync with Garmin Connect, for example, your weight in Garmin’s account is subject to Garmin’s terms exactly as it was before.
When enabled, the sync does two things:
Which app a reading came from is recorded alongside it, so your history can show that a weight arrived from Garmin rather than appearing unexplained. That is the producing app’s package name, kept in the same local database as the weight itself and used only to label the entry.
Records the Application imported are never written back out, and records it wrote are not re-imported, so a single weigh-in cannot multiply between the two stores. While the sync is on, it also runs by itself when you open the app, at most every half hour; it never runs in the background while the app is closed.
Deleting follows the data. Erasing a weigh-in in the Application also withdraws the record it published for it, and Delete all entries withdraws every record it ever published. Health Connect only ever lets an app delete its own records, so this can never remove what Garmin or any other app wrote there. Turning the sync switch off is deliberately not destructive: it stops the exchange but leaves records already published in place, because deleting weights that other apps may now rely on is not something a switch should do silently. To remove those as well, use Delete all entries, or delete them in Android’s Health Connect settings — which also shows every app you have granted access and lets you withdraw it independently of this Application.
You can optionally require your fingerprint or device screen lock before the app will open. This is checked through Android’s own biometric prompt: the Application asks the system whether you authenticated and receives yes or no. It does not see, receive or store a fingerprint, a face, a PIN or a password, and enabling the lock adds no new data of any kind. If you later remove your device’s screen lock, the app opens normally again rather than locking you out of your own history.
For the avoidance of doubt, the Application does not collect or transmit to us any of the following: your name, e-mail address, phone number, or contacts; your precise or approximate location; your device’s advertising identifier or any persistent hardware identifier; the list of apps installed on your device; the photos, files, or health records on your device; your navigation within the Application; or any behavioural or analytics event. Your body measurements, weight history, notes, goal and any child’s growth figures are not collected by us either. There is no analytics SDK and no advertising SDK in the package. The only diagnostic path that exists at all is the crash report described above, which is inert until you choose to send it yourself.
Your data is stored locally, in the Application’s private storage on your device: the weight history in the bmi.db SQLite database, and your profile, units, theme, goal and purchase state in the Application’s private preference files. You remain in full control. You can edit or delete individual weight entries in the history screen, change or clear your goal, overwrite any profile value, and use Delete all entries in the settings screen to erase your logged history. Clearing the Application’s data in Android’s system settings removes everything it has stored, and uninstalling the Application removes its local data from your device. If you enabled the Health Connect sync, copies of your weigh-ins also exist in Health Connect; deleting an entry, or using Delete all entries, withdraws the corresponding records from there too, and anything left can be removed in Android’s Health Connect settings. Note that uninstalling does not withdraw them, since the Application is no longer there to ask.
One qualification about backups. The Application permits Android’s standard system backup (android:allowBackup="true"), and its backup rules include its databases and preference files — with one exclusion, the local cache of whether the optional purchase was made, which is re-checked with Google Play on each launch and would be meaningless on another account. If you have Android’s backup enabled, your weight history and profile values may therefore be copied into your own device backup and restored when you set up a new device, and may likewise be carried across during a direct device-to-device transfer. That mechanism is a system feature operated by Google or your device vendor under their own terms, on your own account; we do not operate it, cannot see its contents, and receive nothing from it. You can turn backup off, or exclude the Application from it, in your device settings.
The Application’s core — the calculators, the weight history, the chart, the widget — needs no permission at all: it performs arithmetic on numbers you type, against a reference table bundled in the package, and stores the result in its own private sandbox, all of which Android allows an app to do unprivileged. Writing a CSV export goes through the system storage picker, which hands over access to the one document you selected and needs no storage permission. Google Play Billing reaches the Play Store app already installed on your device through inter-process communication rather than over a network connection of the Application’s own. If you use none of the optional device features, nothing below is ever requested from you.
Two optional features do declare permissions, and both ask only at the moment you switch them on:
BLUETOOTH_SCAN, BLUETOOTH_CONNECT, and on Android 11 and older BLUETOOTH, BLUETOOTH_ADMIN and ACCESS_FINE_LOCATION). Used solely to find and read a Bluetooth smart scale. The scan is declared neverForLocation, so on Android 12 and newer no location permission is involved at all; on older versions Android itself requires the location permission for any Bluetooth scan, which is why it appears there with a version cap. The Application does not request, use or store your location. Readings travel from the scale to your phone over the local radio link and go nowhere else. Nothing is requested unless you open the scale-pairing screen.
health.READ_WEIGHT, health.WRITE_WEIGHT, health.READ_BODY_FAT, health.WRITE_BODY_FAT, health.READ_HEALTH_DATA_HISTORY, health.READ_STEPS, health.READ_HEIGHT). Used solely for the optional sync described under Health Connect sync, and granted through Health Connect’s own permission screen rather than a general Android prompt. They permit access to the weight, body-fat, step and height entries in the on-device Health Connect store and to nothing else. The last three are optional and refused independently: the history permission only extends reading past the platform’s 30-day window, the steps permission only adds the activity figure beside your statistics, and the height permission only saves you typing your height once — declining any of them leaves the sync fully working. Nothing is requested unless you enable the sync.
Android additionally merges into the installed package the permissions declared by the libraries an application includes, so further entries appear in the shipped manifest that the Application itself does not declare and its own code does not use. In the interest of an accurate description rather than a flattering one, here they are in full. None of them is a runtime permission, so none of them produces a prompt.
com.android.vending.BILLING). Declared by the Google Play Billing library, and used for the optional one-time purchase described below.
android.permission.INTERNET). Declared by com.google.android.datatransport:transport-backend-cct, a Google component that the Google Play Billing library brings in as a dependency. The Application does not declare it and contains no networking code of its own: there is no HTTP client, no endpoint, and no address for it to send anything to. Its presence is confined to the Google Play components covered under Purchases and In-app review, which operate under Google’s own privacy policy. The body data, weight history and profile values you enter are not transmitted by the Application.
WAKE_LOCK, ACCESS_NETWORK_STATE, RECEIVE_BOOT_COMPLETED, FOREGROUND_SERVICE). Declared by AndroidX WorkManager, which arrives as a dependency of the Glance framework the home-screen widget is built with. The Application schedules no background work and runs no background service; these entries are inherited, not used.
com.flx_apps.bmicalculator.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION). Declared by AndroidX Core so that broadcast receivers registered at runtime are not exposed to other applications. It can be held only by the Application itself and grants access to nothing on your device.
The Application offers an optional one-time in-app purchase (the premium unlock, product identifier premium_unlock) that enables the trend chart and statistics, the weight goal with milestones and forecast, CSV export and import, the home-screen widget and the AMOLED theme. This purchase is processed entirely by Google Play Billing. Google handles the transaction and your payment details; we do not see, receive, or store your payment-card information or your billing address. From Google, the Application receives only your purchase / entitlement status — whether the unlock has been bought — which it caches locally so the app and the widget can enable the premium features without waiting. Google’s processing of your payment is subject to the Google Privacy Policy. If you do not make a purchase, no billing transaction takes place.
We do not share information with third parties for their own purposes. The only third party involved in the Application’s operation is Google, in two narrow roles: as the operator of Google Play Billing for the optional purchase above, and as the operator of the Play in-app review overlay described earlier, where a rating you choose to leave goes to Google rather than to us. Neither role involves your body measurements, your weight history or your profile values. The Application contains no advertising SDK and no analytics SDK, and the crash reporter is a local library that sends nothing on its own. The CDC growth reference used for child percentiles is public reference data bundled in the package, not a service the Application contacts.
We would disclose information only where legally compelled to do so — for example to comply with a subpoena or comparable legal process, or where we believe in good faith that disclosure is necessary to comply with the law or to protect our rights or the safety of others. In practice, because the Application stores no personal data on any server we operate, we hold no such user data to disclose.
The Application is a general-audience health and wellness tool, and the child percentile feature deserves a clearer statement than the usual boilerplate, because it is genuinely meant to be used for children.
That feature is designed to be operated by a parent or guardian on their own device: an adult enters a date of birth, a height and a weight, and the app shows the corresponding BMI-for-age percentile. The Application collects no information from children. It has no account, no sign-up, no messaging, no social or content-sharing feature, no advertising and no analytics, so there is nothing through which a child could be identified, contacted or profiled. A child’s figures are handled exactly like an adult’s: entered by you, computed against the bundled CDC reference table on the device, stored in the Application’s private local storage, and not transmitted to us or to anyone else. If you use the Application for a child, you control that data on your device and can erase it at any point by deleting the entries, clearing the app’s data, or uninstalling. A crash report, in the unlikely event you send one, carries no profile values and so cannot carry a child’s figures either — see Crash reports.
Because your data stays on your device and is not stored by us, there is no server-side repository of your information for us to secure or for anyone to breach. On-device data lives in the Application’s private sandbox, protected by Android’s standard application sandboxing — other apps cannot read it — and by whatever device security you have configured, such as a screen lock and full-disk encryption. Three things leave that sandbox only at your initiative and are then yours to look after: a CSV file you export to a location you picked, a crash report you choose to send from your own mail app, and — if you switch the sync on — the weights written into Health Connect, which you manage from Android’s Health Connect settings.
For users in the European Economic Area and the United Kingdom: the Application stores no personal data on our infrastructure, so your ordinary use of it involves no processing of your personal data by us. The measurements you enter — which may constitute health data under Art. 9 GDPR — are processed solely on your own device, under your control, for your own personal purposes. If you choose to send a crash report, you transmit it to us yourself, deliberately and from your own mailbox, and we process its contents on the basis of your consent (Art. 6(1)(a), and Art. 9(2)(a) so far as the profile values it contains are concerned) and of our legitimate interest in diagnosing and fixing faults in the software (Art. 6(1)(f)); you can withhold that consent simply by declining the dialog. Any processing performed by Google in connection with the optional purchase or the in-app review overlay is carried out by Google as an independent controller under its own terms, on the legal basis of contract performance (Art. 6(1)(b) GDPR) for the transaction or the action you initiate.
We may update this privacy policy from time to time, for example to reflect changes in the Application or in legal requirements. The current version is the one published at this URL, and the “Last updated” date above indicates when it last changed. Continued use of the Application after an update constitutes acceptance of the revised policy.
The section above concerns the mobile Application. The website on which this policy is hosted (operated by FLX Apps on the operator’s own first-party server, flx.es) may use a self-hosted, cookieless system to compile anonymous, aggregate visit statistics (such as page views, referring sites, browser/device type and approximate country). No cookies are set, no data is shared with any third party, and your IP address and browser user-agent are never stored — they are used only transiently, with a secret key that changes every day, to derive an anonymous identifier and an approximate two-letter country code. Visits cannot be linked to a person or across days. You can opt out at any time by enabling the “Do Not Track” or “Global Privacy Control” setting in your browser. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly, aggregate statistics).
By using the Application you consent to the terms of this privacy policy as it may be amended from time to time.
If you have any questions about this privacy policy or the Application’s privacy practices, please contact FLX Apps (Felix Heller) at felixheller@mailbox.org.