Privacy Policy

1. Data you provide

• Account: email address and a password (handled by Supabase Auth).
• Profile and targets: height, weight, goal weight, cooking skill, calorie and macro targets.
• Daily use: meal plans, recipes, food logs, weigh-ins, evening check-ins, pantry inventory, grocery lists, notification preferences, food and label search history, purchase or checkout status you choose to record, private provisional supplement-label observations, and (if enabled) messages you send to the in-app assistant. BodyOS does not collect payment-card details.
• Optional social use: your display name, friendships and invites, challenge and league participation, reactions, achievements, and other interactions needed to show the social features you use.
• Optional personal media: progress photos, food and package photos, supplement photos, and recipe-ingredient photos. BodyOS removes embedded metadata, re-encodes accepted images, and keeps stored personal media in private, owner-scoped storage.

2. Connected health and device data (optional)

If you choose to connect WHOOP, Withings, or Apple Health, BodyOS imports only the health and fitness categories you authorize, such as recovery, sleep, weight, heart rate, workouts, and associated workout-route location. This information displays your metrics and personalizes planning and coaching (for example, “low recovery today”). Specifically:

• OAuth access and refresh tokens are encrypted at the application layer (AES-256-GCM) before storage and are never sent to the browser.
• WHOOP data is never sold, shared, or disclosed to anyone else.
• Burned calories from WHOOP are never converted into permission to eat more, and low recovery never triggers automatic calorie cuts.
• Disconnecting a provider (in Settings, or by revoking access at that provider) deletes stored credentials and stops syncing. You may also request deletion of previously imported data at the contact address below, or remove it by deleting your account.

3. How data is stored and processed

Data is stored in a Supabase project (Postgres) with row-level security, so only your authenticated account can read your rows. Third-party processors used to run the Service:

• Supabase — database, authentication, and hosting of your data.
• Railway — application hosting.
• USDA FoodData Central — food searches are sent to the USDA API; your search terms are the only data shared.
• Anthropic — if the optional assistant is enabled, your assistant messages, label-search terms, relevant plan context, and images you explicitly submit for meal analysis, onboarding body scans, or supplement-label transcription are processed to generate the requested result. BodyOS does not persist the provider-bound analysis copy of those images after the request. AI label results remain private provisional observations unless separately reviewed for catalog promotion.
• ElevenLabs, with OpenAI as an optional fallback — narration text for a daily brief or voice preview is sent to synthesize audio. Daily-brief text can contain health and plan context; generated audio is retained privately only as part of that brief or preview workflow.
• Apple — optional HealthKit, speech recognition, push notification, and App Store services authorized on your device.

These processors act on the Service’s behalf; none of them receive your data for advertising or resale. Any processor-side retention follows the provider agreement configured for BodyOS; we do not describe it as zero-retention unless that protection is contractually enabled for the request.

BodyOS also records an account-linked device identifier for push delivery, product interactions used to operate and improve the experience, and crash or diagnostic information used to find failures. Precise location is used only when an authorized workout includes route data. This information is not used for advertising or cross-company tracking.

4. What is never done with your data

• No selling or renting of personal data — to anyone, ever.
• No advertising, ad tracking, or third-party analytics.
• No medical conclusions: targets and suggestions are planning recommendations, not a diagnosis, treatment, or a substitute for professional care.

5. Retention and deletion

Account-linked product data is kept only while your account exists. Limited security, release, and provider-cost records may remain after deletion with direct account identifiers replaced by a dedicated cryptographic pseudonym and personal content removed. Deleting your account first blocks new personal-media writes, completes connected-provider revocation, removes and verifies private Storage objects (including recipe-derived paths), deletes owned database records, and only then removes the authentication account. If any step cannot be verified, deletion remains pending and can be retried rather than being reported as complete. You can also request deletion or an export of your data by email at any time.

6. Cookies

The Service uses only the session cookies required to keep you signed in. There are no tracking or advertising cookies.

7. Changes to this policy

If this policy changes, the effective date above will be updated. Material changes affecting connected services (such as WHOOP) will be noted in the app.

8. Contact

Privacy questions, data export, or deletion requests: philwilson244@gmail.com.