Privacy Policy

BodyfatAI LLC ("BodyfatAI," "we," "us," or "our") provides a mobile application that estimates body-fat percentage and related fitness metrics from user-submitted photos and measurements. This Privacy Policy explains what data we collect, how we use it, how we protect it, and the choices you have. If you do not agree with this policy, please do not use the app.

1. Who We Are & How to Contact Us

2. What We Collect

Personal Information (you provide)

• Account Data: Email, first and last name; phone number (optional).
• Preferences: Measurement units (imperial/metric), notification settings.
• Body Measurements: Height, weight, gender, goals (goal weight, goal body-fat %).
• Profile Photos: Not collected (no user avatars).

Sensitive/Health-Related Data (you provide)

• Body Photos: Up to 4 photos per scan for AI analysis.
• Derived Health Metrics: Estimated body-fat %, BMI, and muscle-mass estimates (computed and retained).

Legal note: In some regions, photos and derived metrics may be considered special category (health) data. We apply enhanced safeguards (see Security).

Sensitive Body Scan Data

When you use bodyfatAI, you may upload body scan photos that reveal your physique, body shape, approximate body composition, and other sensitive body characteristics. We treat scan photos and derived body metrics as sensitive information and apply additional safeguards, including encryption, access restrictions, and limited retention.

Do not upload nude photos, sexually explicit photos, photos of minors, photos of other people, or photos you do not have the right to upload.

Technical & Usage Data (automatically)

• Device & App: Device model, OS version, app version.
• Diagnostics: Essential app logs necessary to operate and secure the service.
• IP Address: Used for security, fraud prevention, and approximate location (country/region).
• Location Data: We do not collect precise location. However, image metadata (EXIF) supplied by your device may contain location; see Section 4.
• Analytics Data: Usage patterns and performance metrics collected via PostHog (see Section 8 for details).

3. How We Use Your Data

• Core Service: Perform AI body-fat analysis and display progress over time.
• Personalization: Provide insights, ranges, trends, and recommendations.
• Account & Support: Create/manage your account, respond to requests, send service messages.
• Improvement & Safety: Debug, ensure availability, prevent fraud/abuse, and secure our services.
• Analytics: Understand how users interact with the app to improve features and user experience.
• Legal Compliance: Meet legal, tax, and regulatory obligations.

Legal bases (if GDPR/UK GDPR applies)

• Contract: To provide the app and core features you request.
• Consent: Processing photos for analysis and any optional marketing. You can withdraw consent at any time.
• Legitimate Interests: Service improvement, analytics, and security (balanced with your rights).
• Legal Obligation: Compliance with applicable laws.

4. Photos, Camera & Media Permissions

• Camera Permission: Required to take analysis photos.
• Photo Library Permission: Optional to import existing photos.
• Processing: Photos are transmitted securely to our servers and processed by our AI system to generate estimates.
• Storage & Deletion: Scan photos are stored encrypted in our cloud storage so you can view your scan history and track progress. If you delete an individual scan or photo in the app, it is immediately removed from your active account view and marked as deleted. Deleted scans are not used for analysis or progress tracking after deletion, but may remain temporarily in backup, archival, or operational systems until our deletion cycle is complete.
• Account Deletion: When you delete your account, we immediately remove your account from active use and erase personal account data from active account systems. Scan photos and scan records are soft deleted immediately and scheduled for permanent deletion from production and backup systems within 30 days. We retain only anonymized or de-identified transaction records that are no longer linked to your account, photos, body measurements, or scan results.
• Image Metadata (EXIF): Your device may embed metadata (e.g., timestamp, camera info, possibly GPS). We do not use precise GPS for features; if present in EXIF, it may be received as part of the file. We do not use EXIF location for personalization or tracking and strip or discard it during processing where feasible.
• Sharing: You can enable sharing of results or photos via links/social features; sharing is off by default and entirely user-initiated.

Limited Human Access to Scan Photos

bodyfatAI is primarily an automated AI analysis service. However, authorized personnel may access scan photos and related account data only when reasonably necessary to provide support, troubleshoot technical issues, investigate abuse or security incidents, comply with law, enforce our Terms, verify leaderboard submissions, or improve safety and reliability. We do not permit casual browsing of user scan photos. Access is restricted to authorized personnel, limited by role, and logged where technically feasible.

We will not manually review your scan photos for product improvement or model training unless you separately consent or the review is necessary for support, safety, security, legal compliance, or Terms enforcement. However, if you opt in to the leaderboard feature, your scan photos will be reviewed by bodyfatAI staff for verification purposes as described in the "Leaderboard and Public Verification" section below.

5. Subscriptions & Payments

• Payment Processors: Apple App Store and Google Play manage billing; we do not receive your full card details.
• Subscription Management: We use RevenueCat to validate receipts and manage access (entitlements).
• Data Received from Stores/RevenueCat: Product IDs, purchase history, renewal status, platform identifiers—only what's necessary to grant and maintain your subscription.

6. Third-Party Services

We share only what is necessary for each provider to perform services for us, bound by contracts and safeguards.

• RevenueCat (subscriptions): Limited purchase and entitlement data to verify premium access.
• PostHog (analytics): Usage patterns, device info, and performance data to improve the app. We send only anonymized user IDs; no photos, measurements, email, or personal information. See Section 8 for details.
• Cloud Hosting: Google Cloud (Cloud Run / Cloud SQL) in US regions for hosting and storage.
• AI/ML Inference: We use AI/ML infrastructure providers to process scan photos and generate body-composition estimates. These providers process scan photos only to provide services to bodyfatAI, under contractual restrictions and security safeguards, and are not permitted to use your scan photos to train their general-purpose models unless we disclose that use and obtain any required consent.

7. AI Training and Product Improvement

We do not use your scan photos to train AI models or improve body-composition models unless you separately opt in. We may use de-identified, aggregated, or non-photo usage data to improve app performance, reliability, safety, and user experience.

We do not sell scan photos, body measurements, or derived body metrics. We do not use scan photos or derived body metrics for third-party advertising or cross-context behavioral advertising.

8. Leaderboard and Public Verification

bodyfatAI offers an optional leaderboard feature where users can choose to have their body-composition metrics and verified scan photo displayed publicly. Opting in to the leaderboard is entirely voluntary; you can opt in or opt out at any time.

Mandatory Verification: All leaderboard entries are subject to mandatory verification by bodyfatAI staff members to ensure authenticity and accuracy. We will review your submitted scan photo to verify:

• It depicts a real person (not AI-generated, altered, or fraudulent)
• The body measurements and estimates are realistic

Verification Outcomes:

• Accepted: Your verified scan photo and metrics are displayed on the public leaderboard and retained indefinitely while your leaderboard entry is active. This is an exception to the standard 30-day soft-delete policy for personal account photos.
• Rejected: Your scan photo and leaderboard listing are removed, and you are automatically opted out of the leaderboard feature. You may submit a different scan photo to be re-evaluated.

Once a leaderboard entry is created and verified, your photo and metrics become part of the public leaderboard record and may be cached or archived by third parties beyond our control. You can voluntarily remove your leaderboard entry at any time, which removes the public metrics and photo from the leaderboard, but cached copies may persist externally.

Account Deletion and Leaderboard: If you delete your account, your leaderboard entry is automatically removed and cannot be recovered. Your verified scan photo is deleted per the account deletion policy.

9. Analytics and Tracking

We use PostHog, a product analytics platform, to understand how you use our app and improve your experience. PostHog collects:

• Usage Patterns: Which features you use, screens you visit, and buttons you click.
• Device Information: Device type, operating system version, and app version.
• Performance Data: How the app performs on your device.

What PostHog does NOT collect:

• Your photos or body measurements.
• Your email address or name (we send only an anonymized user ID).
• Text you enter in forms (autocapture is disabled).
• Payment information.
• Session recordings (disabled).

PostHog data is used solely to improve our app's features and user experience. We do not sell this data to third parties. PostHog is hosted in the US and complies with SOC 2 standards. For more information about PostHog's privacy practices, visit PostHog's Privacy Policy.

You can opt out of analytics tracking by contacting us at support@bodyfatai.app.

10. Data Security

• Encryption: TLS in transit; encryption at rest for stored data.
• Access Controls: Role-based, least-privilege, with audit trails.
• Secure Development: Dependency patching and periodic security reviews.
• Incident Response: If a data breach occurs, we will notify affected users and regulators as required.

11. Data Retention

• Account Data: Kept while your account is active. When you delete your account, account data is erased from active account systems immediately, subject to limited legal, security, or operational exceptions described below.
• Scan Photos and Scan Records: Stored encrypted while your account is active so you can view scan history and progress. When you delete a scan, it is soft deleted immediately and removed from active use. Soft-deleted scans may remain temporarily in backup, archival, or operational systems until our deletion cycle is complete. Verified leaderboard photos and metrics are retained indefinitely while the leaderboard entry is active (see Leaderboard and Public Verification section). When you remove your leaderboard entry or delete your account, the verified leaderboard photo is deleted per the account deletion process.
• Derived Metrics: Body-fat estimates, BMI, FFMI, muscle-mass estimates, progress history, and related metrics are retained while your account is active and deleted from active account systems when you delete your account.
• Transaction Records: We may retain anonymized or de-identified transaction records for accounting, tax, subscription auditing, fraud prevention, and business analytics. These records are not linked to your account, scan photos, body measurements, or scan results.
• Operational Logs: Security and diagnostic logs may be retained for a limited period (up to 24 months) to maintain service integrity, investigate abuse, prevent fraud, and comply with legal obligations. Logs are deleted or de-identified according to our retention schedule.
• Legal Preservation: If we are required to preserve information due to law, legal process, security incidents, suspected abuse, or suspected illegal content, we may retain limited information for as long as required or permitted by law.

Our standard deletion cycle for soft-deleted scans and backups is completed within 30 days of account deletion, unless a longer period is required for legal, security, fraud-prevention, or abuse-prevention reasons.

For detailed instructions on how to delete your account and information about what data is removed, please visit our Account Deletion page.

12. Your Privacy Rights

Depending on your location, you may have the right to:

• Access and obtain a copy of your data.
• Correct inaccurate data.
• Delete your data and account (see deletion instructions).
• Restrict or object to certain processing.
• Data portability (portable copy).
• Withdraw consent (where processing is based on consent).
• Opt out of analytics tracking.

How to exercise your rights: Use in-app controls (where available) or email support@bodyfatai.app. We may need to verify your request and will respond within applicable timelines.

California (CCPA/CPRA)

• We do not sell or share personal information for cross-context behavioral advertising.
• You may request access, correction, or deletion, and can limit use of sensitive personal information where applicable.

13. Children's Privacy and Underage Content

bodyfatAI is intended only for users who are at least 18 years old. We do not knowingly collect personal information from children or permit minors to use the Service. You may not upload photos of minors or photos that you believe may depict a person under 18.

If we learn that a minor has created an account or uploaded photos, we may delete the account and related data. If we become aware of content that may involve child sexual abuse material, exploitation, or illegal underage imagery, we may preserve and report the content and related information to law enforcement, NCMEC, or other appropriate authorities as required or permitted by law.

14. International Transfers

We process data in the United States and may process in other countries. For EEA/UK users, where applicable, we rely on appropriate transfer mechanisms (e.g., Standard Contractual Clauses) and implement additional safeguards.

15. Communications & Marketing

• Service Messages: Transactional emails/push (e.g., account, security, subscription updates).
• Marketing: Only with your consent; you can opt out via email footer or device settings.
• SMS: Not used unless you explicitly opt in (currently no SMS).

16. Cookies & Tracking (Website)

• Essential Cookies Only: The website may set strictly necessary cookies for login and authentication. We do not use cookies for advertising or analytics.
• Cookie Notice: For details, see our Cookie Notice.

17. Data Sharing & Disclosures

• No Sale: We do not sell personal information, scan photos, body measurements, or derived body metrics. Leaderboard data (metrics and verified photos) is displayed publicly but not sold. Users retain control over whether they participate in the leaderboard.
• Service Providers: We share with trusted vendors under contracts and only as needed.
• Legal Requirements: We may disclose information to comply with law, protect rights, or respond to lawful requests.
• Business Transfers: If we undergo a merger, acquisition, or asset sale, your data may transfer as part of the transaction and remain subject to this policy (or a successor policy of equal or greater protection).

18. Changes to This Policy

We may update this policy to reflect changes in our practices. We will post updates with a new effective date and, where required, notify you in-app or by email. Your continued use means you accept the updated policy.

19. Contact

Questions or requests about privacy? support@bodyfatai.app