Allows users to hide their check-ins from other users

app/routes/api.py

@@ -1,7 +1,7 @@
-from flask import Blueprint, jsonify
+from flask import Blueprint, jsonify, session
 from app import SYDNEY_TZ
 from app.auth import login_required
-from app.db import query
+from app.db import query, query_one
 from datetime import timezone
 
 bp = Blueprint("api", __name__, url_prefix="/api")
@@ -11,6 +11,12 @@ bp = Blueprint("api", __name__, url_prefix="/api")
 @login_required
 def chart_data(user_id):
     """Return weight & BMI over time for Chart.js."""
+    # Privacy guard: don't expose private user data to others
+    if user_id != session.get("user_id"):
+        target = query_one("SELECT is_private FROM users WHERE id = %s", (user_id,))
+        if target and target["is_private"]:
+            return jsonify({"labels": [], "weights": [], "bmis": []})
+
     checkins = query(
         """SELECT weight_kg, bmi, checked_in_at
            FROM checkins WHERE user_id = %s
@@ -43,6 +49,7 @@ def comparison():
             (SELECT weight_kg FROM checkins WHERE user_id = u.id ORDER BY checked_in_at DESC LIMIT 1) as current_weight
         FROM users u
         WHERE (SELECT COUNT(*) FROM checkins WHERE user_id = u.id) > 0
+          AND u.is_private = FALSE
         ORDER BY u.display_name
     """)
 
@@ -74,6 +81,12 @@ def comparison():
 @login_required
 def weekly_change(user_id):
     """Return weekly weight changes for bar chart."""
+    # Privacy guard: don't expose private user data to others
+    if user_id != session.get("user_id"):
+        target = query_one("SELECT is_private FROM users WHERE id = %s", (user_id,))
+        if target and target["is_private"]:
+            return jsonify({"labels": [], "changes": []})
+
     checkins = query(
         """SELECT weight_kg, checked_in_at
            FROM checkins WHERE user_id = %s