MyFitnessPal

Is MyFitnessPal safe?

MyFitnessPal is safe enough for logging meals, but it is an ad-supported app that holds sensitive data and has a large breach behind it. In 2018 an attacker took the usernames, email addresses and hashed passwords of about 150 million accounts. Today the app tracks you across other companies' apps for advertising, and on Android it shares precise location with ad partners. In its favour, your weight and food diary are private by default, and it pays outside researchers to find security bugs. We score it 57/100, close to Strava at 59 and well behind Garmin Connect at 70.

The 2018 breach

Under Armour, which owned MyFitnessPal at the time, told investors on 29 March 2018 that an unauthorised party had taken account data in late February. The team found out on 25 March and began emailing users four days later. The data was usernames, email addresses and hashed passwords, mostly protected with bcrypt, a slow hashing method that makes cracking much harder. No payment cards or government ID numbers were involved.

Every user was made to reset their password, so the stolen list no longer works on MyFitnessPal itself. The company's help centre says the list later circulated publicly and set off alerts from breach-monitoring services. The risk that remains is reuse: if you used your 2018 MyFitnessPal password anywhere else, change it there.

We found no fine or order from any regulator over the breach. It falls inside our 10-year window, so it still lowers the security score until 2028.

What MyFitnessPal collects and shares

The food diary is more revealing than it looks. The privacy policy, effective March 2025, lists dietary habits, food, drink and medications you log, body measurements, sleep, information about physical conditions and progress photos, and says this can count as sensitive data when it points to a health condition.

Advertising is built in. Apple's privacy label has a "Data Used to Track You" section covering identifiers and usage data, and lists device IDs and advertising data used for third-party advertising. Google Play says precise location is shared with other companies for analytics and advertising, and user IDs for advertising and personalisation. The policy describes targeted advertising and cross-device tracking, and says ad cookies on its website may count as a "sale" or "sharing" under some state laws.

One firm line: data you send in from Apple Health, Google Health Connect or Samsung Health is not used for marketing or passed to third parties for advertising.

Security today

Since March 2022 MyFitnessPal has run a managed bug bounty on Bugcrowd that pays researchers for valid findings. We found no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login in the help centre, which is a gap for an account full of health details. Signing in with Google is the closest substitute. The help centre also warns about phishing sites on look-alike domains such as "myfitnasspal.com".

Ownership has changed too. Francisco Partners bought the app from Under Armour in December 2020 in a deal worth up to $345 million. MyFitnessPal itself now owns Cal AI, a photo calorie-counting app with more than 15 million downloads: the deal closed in December 2025 and was announced in March 2026, TechCrunch reported. Cal AI stays a separate app with its own policy and record, so we score it on its own page.

How to use MyFitnessPal more safely

1. Use a unique password, or sign in with Google so your Google two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary protects the account.
2. Check diary sharing in Settings. Private is the default, but a setting you changed years ago stays in place.
3. On iPhone, refuse the tracking prompt, and on Android delete or reset your advertising ID to limit ad profiling.
4. Leave notes and progress photos out if you would not want them in a future breach.
5. If calorie tracking starts to feel compulsive, the help centre links to a free eating disorder screening and support services.

How we scored it

Regulatory record (87) is MyFitnessPal's best factor, with no fine or order found even after the 2018 breach. Scams and harmful content (68) and transparency and control (66) sit in the middle: private diary defaults and in-app deletion, but export only for paying users. Privacy (46) is the weakest, because the app tracks you for ads and shares precise location on Android, followed closely by security (48) after a breach of about 150 million accounts and no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login.