MyFitnessPal is a calorie- and food-tracking app run by MyFitnessPal, Inc. (Austin, TX), owned by private equity firm Francisco Partners since a $345 million purchase from Under Armour closed in 2020. Its privacy policy (effective March 18, 2025) discloses collection of food, drink, and medication logs, body measurements, physiological conditions, progress photos, and sleep data, plus device identifiers. The free tier is ad-supported: the policy describes targeted advertising, cross-device tracking, and disclosure to social media platforms and third-party ad networks, and concedes certain cookie uses may constitute 'sales' or 'sharing' under state law, while HealthKit and Health Connect data is not used for marketing. In March 2018, under Under Armour, the company disclosed a breach of roughly 150 million accounts; the stolen data later appeared for sale on a dark-web marketplace.
TRACK RECORD
1 BREACH · 1 ENFORCEMENT ACTION
BREACH LEDGER
[2018-02-01] · BREACH
Have I Been Pwned lists a breach record for MyFitnessPal: "MyFitnessPal".
Approximately 143,606,147 accounts affected, per HIBP.
Exposed: Email addresses, IP addresses, Passwords, Usernames.
In an SEC-filed press release dated March 29, 2018, Under Armour disclosed that an unauthorized party had acquired data associated with approximately 150 million MyFitnessPal user accounts in late February 2018 — including usernames, email addresses, and hashed passwords (the majority hashed with bcrypt) — that notification began four days after learning of the issue, and that users would be required to change their passwords; payment card data and government-issued identifiers were not affected.
MyFitnessPal's developer-reported Apple App Store privacy label lists Health & Fitness, Contact Info, User Content, Identifiers, Usage Data, and Diagnostics as data that may be collected and linked to the user's identity.
The MyFitnessPal Privacy Policy (effective March 18, 2025) states that users' voluntarily shared information includes dietary habits; food, drink, and medications consumed (including via voice logging and grocery integrations); calorie counts; body measurements such as height, weight, and BMI; information related to physiological conditions; progress photos; and lifestyle information such as sleep data.
Francisco Partners' own October 30, 2020 announcement of its acquisition of MyFitnessPal from Under Armour states a transaction value of $345 million, inclusive of potential earn-out payments; as a private-equity portfolio company, MyFitnessPal, Inc. is not subject to SEC public-company reporting.
On October 30, 2020, Under Armour, Inc. announced via press release that it had entered into a definitive agreement to sell the MyFitnessPal platform to private equity firm Francisco Partners; the sale was completed in December 2020.
The MyFitnessPal Privacy Policy (effective March 18, 2025) identifies the operating entity as MyFitnessPal, Inc., with a published privacy contact (privacy@myfitnesspal.com) and mailing address at 100 Congress Avenue, Suite 400, Austin, TX 78701.
MyFitnessPal's Apple App Store privacy label lists Third-Party Advertising as a purpose for which identity-linked data — Identifiers, Device ID, Usage Data, and Advertising Data — may be used.
The MyFitnessPal Privacy Policy (effective March 18, 2025) discloses that personal information, including device, browser, activity, and usage information, is disclosed to marketing and advertising partners including social media platforms and third-party advertising networks, and concedes that certain uses of Functional and Targeted Advertising Cookies may constitute 'sales' or 'sharing' of personal information under state privacy laws, while stating that MyFitnessPal 'does not expressly “sell” information to others.'
Have I Been Pwned's breach catalog lists the "MyFitnessPal" incident (myfitnesspal.com), breach date 2018-02-01, affecting approximately 143,606,147 accounts. Data classes exposed per HIBP: Email addresses, IP addresses, Passwords, Usernames. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
In an SEC-filed press release dated March 29, 2018, Under Armour disclosed that an unauthorized party had acquired data associated with approximately 150 million MyFitnessPal user accounts in late February 2018 — including usernames, email addresses, and hashed passwords (the majority hashed with bcrypt) — that notification began four days after learning of the issue, and that users would be required to change their passwords; payment card data and government-issued identifiers were not affected.
Wired's March 30, 2018 analysis of the MyFitnessPal breach characterized Under Armour's public disclosure in under a week as laudably fast, while reporting that the portion of exposed passwords not protected with bcrypt had been hashed with the weaker SHA-1 function.
The Register reported on February 11, 2019 that a dark-web seller listed 150,633,038 MyFitnessPal account records — taken in the February 2018 breach — for sale on the Dream Market marketplace, with each record containing a user ID, username, email address, SHA1-hashed password, and IP address.
MyFitnessPal's Apple App Store privacy label carries Apple's 'Data Used to Track You' designation, declaring that Identifiers and Usage Data may be used to track users across apps and websites owned by other companies.
The MyFitnessPal Privacy Policy (effective March 18, 2025) states that the company engages in targeted advertising and cross-device tracking, and that automatically collected Device Data includes cookie identifiers, IP address, and mobile advertising identifier.