Privacy Policy

1.Introduction

BodyDex ("the App") is operated by Daniel Bobunov ("we," "us," or "our"), an individual developer. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the App.

We are committed to protecting your privacy. BodyDex is built on a local-first architecture — the vast majority of your personal data is stored exclusively on your device and is never transmitted to our servers. We only process data remotely when you explicitly use features that require it (such as AI food scanning or the Bodydex Assistant).

This policy describes how the App handles your information. Where we rely on your consent — for the Bodydex Assistant, for document import (Section 6.7), for Apple Health / Health Connect access, and for the consumer health data described in Section 13 — we ask for it separately in the App, before the feature is used, and you can withdraw it as described in Section 11.7. Using the App is not itself consent to any of those features.

2.Local-First Architecture

The following data is stored exclusively on your device. Except for the limited, consented AI-feature payloads described in Section 6, it is never transmitted to our servers:

• User profile information (name, email, physical attributes, goals)
• All food logs, meal entries, and daily nutritional summaries
• Weight logs, body measurements, and progress photos
• Lab results — both the ones you enter yourself and the ones read from your own report that you chose to import, whether you photographed it or chose its PDF (Section 6.7) — with their dates, the lab, and the reference range printed on that report
• Medication, supplement, and peptide schedules and adherence history
• Recipes and custom food items
• Exercise and workout logs
• Dashboard layout preferences and app settings
• Bodydex Assistant conversation history and memory
• Notification preferences and schedules
• Behavioral analytics data (food input patterns, feature usage frequency)

Note: As BodyDex evolves, we may introduce optional cloud backup and social features in the future. If and when such features are introduced, this Privacy Policy will be updated accordingly, and any cloud data storage will require your explicit opt-in consent.

3.Data We Collect

3.1 Data You Provide

When you use the App, you may voluntarily provide the following information, which is stored locally on your device:

• Account Information: Name, email address (via Apple or Google Sign-In)
• Physical Profile: Height, weight, age/date of birth, biological sex, activity level
• Health Goals: Target weight, dietary goals, goal speed, diet type, motivations, obstacles, cooking frequency
• Food Data: Food log entries, meal photos (for AI scanning only), recipes, custom food items
• Health Tracking: Weight logs, body measurements, progress photos
• Lab Results: Marker names, values, units, the date on the report, the lab, and the reference range it printed — typed in by you, or read from your own report that you chose to import as a photo or as a PDF, and then reviewed and saved yourself (Section 6.7)
• Protocol Data: Medications (including optional prescribing doctor name), supplements, peptides, dosage schedules, adherence logs
• User Content: Notes, recipe descriptions, coach conversation messages
• Preferences: App theme, notification settings, dashboard layout, preferred units
• Feedback: Feature requests, bug reports, and app satisfaction surveys (when voluntarily submitted)

Third-Party PII: The App allows you to optionally enter a prescribing doctor's name for medication records. This information is entered voluntarily, stored only on your device, and never transmitted to any server. We are not responsible for the accuracy of third-party information entered by users.

3.2 Data Collected Automatically

• Device Identifier: A stable, app-scoped device identifier (iOS Vendor ID or a generated UUID) kept on your device. The App uses it to anchor your local profile and for abuse prevention, which is why it survives Delete All Data (Section 9); it is not sent to our servers as is. It is different from the pseudonymized device hash described in Section 3.3 — a one-way hash that accompanies feedback and support submissions, used for anti-spam limits and to associate support tickets with this installation. Both are pseudonymous — not intended to directly identify you — and neither is used to track you across other companies' apps or websites.
• Subscription Status: Your subscription tier (Free or Premium, including trial status) is verified through RevenueCat to determine feature access. We store a cached status locally; the server verifies it periodically.
• IP Address: Cloudflare and our server infrastructure process your IP address and ordinary request metadata for delivery, security, abuse prevention, and operational logging, under their retention controls. We do not attach your IP address to your tracking data.
• Pseudonymized Service Usage: When you use AI-powered features (food scanning, voice logging, the Bodydex Assistant, food search, recipe import), we record a pseudonymized event noting which feature was used and whether the request succeeded, errored, or hit a rate limit. For recipe imports that fail, the event additionally notes the source platform (e.g. TikTok, Instagram, YouTube) and a technical failure reason so we can detect and fix import breakages; the shared link itself is not stored in these events. The event is indexed by a one-way SHA-256 hash of your account identifier so we can compute aggregate metrics (daily active users, error rates, cost forecasts) without storing your raw identifier. These events do not contain food data, photos, message contents, or voice transcripts, and use a hashed account identifier instead of the raw identifier. The identifier is pseudonymous: it can link events from the same account and may remain personal data.

3.3 Feedback & Support Submissions

When you submit a bug report, feature request, comment, or support request in the app (including replies in a support conversation), we collect:

• The text you typed (title and description)
• Any screenshots you chose to attach (optional)
• Any photos of a product label you chose to attach to a report of incorrect food data (optional). They are stored with the report on our backend and in our internal support tooling so we can check the correction against the label. The backend copy follows the 180-day limit below; copies in our internal support tooling are kept as long as needed to resolve the report
• Your email address, only if you typed one (optional, used for follow-up)
• App version, platform, operating system, and OS version (auto-attached for diagnostics)
• Your subscription status and the store it was purchased through (auto-attached, so we can prioritize and troubleshoot billing issues)
• A pseudonymized device hash (one-way SHA-256, used for anti-spam and to securely associate support tickets with this installation)
• Your account identifier, only if you are signed in (so we can match feedback to your account if you ask us to)
• A push notification token, only if you have granted notification permission (used solely to notify you when we reply to your submission; the notification is relayed through Expo's push notification service to Apple or Google for delivery)

Submissions are stored on our backend (Supabase, US region); that copy is scheduled for automatic deletion after 180 days. So that reports actually get seen and fixed, submissions (including any screenshots you attach) are also delivered to the developer through an operator notification service (Telegram Bot API, encrypted in transit) and retained in our internal support tooling for as long as reasonably necessary for support, security, or legal purposes. If you granted notification permission, we use your push token to notify you when we reply. Feedback is used solely to improve BodyDex — it is never sold, never used for marketing, and never shared beyond the delivery services named here.

3.4 Data from Third Parties

• Apple / Google Sign-In: Your name and email address as provided during authentication, delivered to us as identity tokens and profile claims — we never receive or store your Apple or Google password. A stable app account identifier is created from this sign-in and linked to your subscription status. Apple's "Hide My Email" feature is supported.
• Apple HealthKit / Google Health Connect: If you grant permission, we may read and/or write health data as described in Section 5.
• Age group from your app store: Where the law requires it, the App Store or Google Play tells the app the age group of the account on your device. It is used only to apply legally required age limits to protocol tracking, the research library and Community Stats sharing, and, if it shows an account under 13, to switch on the local-only mode described in Section 12. The age group itself is kept in memory only while the app is running, and is never stored, sent to our servers or shared; the one thing stored is the yes/no local-only setting described in Section 12.
• Apple Ads attribution (iOS): If an installation followed an Apple Ads (App Store search) ad, Apple returns that ad's campaign, ad group and keyword to our subscription processor RevenueCat, as described in Section 8.1.

4.How We Use Your Data

We use the data described above to:

• Calculate personalized calorie and macronutrient targets
• Track food intake, nutrition, and dietary adherence
• Manage medication, supplement, and protocol schedules with reminders
• Provide AI-powered food photo analysis and nutritional estimation
• Deliver AI nutrition coaching responses (when initiated by you)
• Sync nutrition and fitness data with Apple HealthKit or Google Health Connect (with your permission)
• Deliver push notification reminders (meal logging, medications, etc.)
• Verify subscription status and enforce tier-based feature limits
• Prevent abuse of free-tier rate limits via anonymous device identifiers
• Monitor service quality and forecast infrastructure costs via pseudonymized, aggregate usage metrics (see Section 3.2)

We do not sell or rent your personal data. We disclose no personal data to advertisers, data brokers, or other third parties for marketing purposes, except the limited install event sent to Meta for advertising measurement described in Section 8.1. Our sole revenue model is subscription fees.

5.Apple HealthKit & Google Health Connect

5.1 What We Read (with your permission)

Read into your logs. These become ordinary rows in the App's own database — a weigh-in in your weight log, a drink in your water log — and from that point the App treats them like anything you typed in yourself:

• Body weight and height
• Water intake
• Biological sex and date of birth (iOS only, for profile auto-fill during onboarding)

Read on demand, not stored: daily step count and active energy burned (calories). The App reads today's totals (and, for Trends, the days a chart covers) when a screen shows them; they are not written into your logs or the App's database. The only copy kept is today's two totals for the home-screen widget, on your device, replaced each time it refreshes and cleared when you turn the read off.

Read as a summary for muscle recovery. Workout and exercise sessions recorded by your other apps — a watch, a running app, another gym app — are read so the App can tell how recently each muscle group was worked. What is stored is a summary of each session: when it started and ended, how long it lasted, the activity type, the muscle groups it maps to, a workload estimate, the name of the app that recorded it, and an energy figure where the platform supplies one. These summaries are not entries in your workout history — your workout history holds the workouts you logged in Bodydex. They appear in the muscle-recovery view and as a count on the fitness dashboard, and you can turn the whole thing off at Profile › Apple Health / Health Connect › Workouts.

Read on demand to chart a vital against your doses. Each of these is requested on its own, at the moment you add that chart, and is read only for the dates being charted or asked about. They are not written into your logs:

• Resting heart rate
• Heart rate
• Heart rate variability
• Blood pressure (systolic and diastolic)
• Blood glucose
• Blood oxygen saturation
• Respiratory rate
• Sleep sessions (nightly total)
• Body fat percentage
• Lean body mass

The full list of the vitals charts you have enabled is in the App at Profile › Apple Health / Health Connect › Vitals for protocols. Sending any of these readings to the Bodydex Assistant additionally requires the separate Health vitals tick described in Section 5.3.

Heart rate in particular is read on demand only: for the Trends heart-rate chart and for a vitals chart, for the dates that chart covers. It is never written into your logs or the App's database. When the Bodydex Assistant draws a vitals chart for you, the App keeps the last few of those charts' readings in its memory, never in storage, so the chart can be shown again; they are gone when the App is closed. Separately, when a workout is saved to Apple Health through the App's older save method and Apple Health already allows Bodydex to write heart rate, the App attaches a copy of the heart-rate samples Apple Health holds for that workout's time to the workout; those copies stay inside Apple Health.

5.2 What We Write (with your permission)

• Dietary energy consumed (calories)
• Dietary macronutrients (protein, carbohydrates, fat, fiber — and, where the platform supports them, sugar, sodium, and cholesterol)
• Body weight measurements
• Water intake
• Workouts you finish in Bodydex, on both Apple Health and Google Health Connect: the session with its name, start and end time and activity type; the active calories the App estimated for it, when it has an estimate; and, for a strength workout you logged live, each completed set as a segment of that workout (on Apple Health with the exercise name, reps, weight and set type; on Health Connect with the kind of exercise and the reps)

5.3 Health Data Commitments

We make the following commitments regarding your Apple HealthKit and Google Health Connect data:

• We run no health-record database of our own. We operate no account database, and we hold no health record of yours on our servers for us to look at — with one transient exception: if you use the Bodydex Assistant, a reply that pauses mid-answer leaves a working copy on our proxy on the criteria described in Section 6.2, and that copy can contain records you consented to send. What the App reads from a health platform either goes into its own database on your device or is not stored at all — Section 5.1 says which, per record type. When you use the Bodydex Assistant with your explicit consent, the records and summaries listed in Section 6.2 are sent to OpenAI through our proxy, and what our own server keeps while doing that is described there. Some of those values were imported from a health platform (see the callout above and Section 5.1) and are sent as the ordinary log rows they became, under the ordinary data-access categories you grant in Profile › Bodydex Assistant › What the assistant can see.
• Dedicated vitals reads are a separate opt-in. Reading the vitals listed in Section 5.1 as readings — resting heart rate, heart rate, heart rate variability, blood pressure, blood glucose, blood oxygen, respiratory rate, sleep, body fat, lean body mass, and the daily steps and active energy read from your health app — and sending them to OpenAI requires the "Health vitals" category, which is off unless you tick it yourself and which no preset ever turns on. While it is off, the Assistant performs no dedicated read of your health app and no such reading is sent.
• Imported values are not covered by that tick, and we do not claim they are. A weight or water entry that came from Apple Health or Health Connect is a row in your own log from the moment it is imported, and the Assistant reads it under the matching ordinary category — body or nutrition — which the App's default data-access answer turns on. So with "Health vitals" off, the Assistant can still be sent a weigh-in that originated in your health app, because it reads it as your weight log and not as a health-platform reading. A workout recorded by another app is not a log row and is never sent as one; what it can reach the Assistant as is the per-muscle recovery percentage described in the callout, under the fitness category. If you do not want any of that, switch the relevant category off in Profile › Bodydex Assistant › What the assistant can see.
• Readings and imported values alike are never sold, never used for advertising, and never shared with anyone beyond the recipients named for the feature you are using.
• Health data is NOT used for advertising or marketing of any kind
• We do not sell health data or disclose it to data brokers. The online features described in this policy disclose specified health data to the recipients identified for those features
• Health data is NOT shared with third parties for purposes unrelated to providing core health functionality within the App
• Health data is NOT used for any purpose other than providing health and fitness functionality directly to you within the App
• What these commitments cover: they are about data read from Apple HealthKit or Google Health Connect. That data is never sent to an AI provider for model improvement: it can reach an AI provider only through the Bodydex Assistant, on the terms in Section 6.2. Other health-related content you submit yourself — a food photo, a voice note, a document you import — follows the AI-provider terms described in Sections 6 and 6.6, which differ by feature.
• You can revoke health data permissions at any time through your device's Settings

6.AI Feature Data Processing

Certain features use AI services that require transmitting limited data to our secure server infrastructure (Cloudflare Workers) for processing. Beyond auto-expiring rate-limiting counters (most within 48 hours; see Section 9 for the exact retention tiers), our servers keep only short-lived operational records: the status record for a video import you started (kept up to 7 days so the result can be delivered to your device — see Section 6.4), the opt-in scan-accuracy report photos described in Section 6.1, an anonymized shared recipe cache (Section 6.4), the install-measurement records described in Section 8.1, the pseudonymized usage events described in Section 3.2, and the two Assistant records described in Section 6.2 (a working copy of a reply that paused mid-answer, whose content we attempt to replace with a contentless record as soon as the reply finishes and which — then, or if that attempt does not succeed — we attempt to remove on the criteria set out in that section, where a failed attempt can leave it in place longer, and a cache of answers to standard Research Library questions that contains no personal context). AI requests are keyed to a pseudonymous account identifier (used for authentication and rate limiting); your profile name and email address are not attached automatically, but content you submit may itself identify you.

6.1 AI Food Photo Scanner

• Data sent: Food photo (image data), scan mode type, and your pseudonymous account identifier
• Data NOT sent: Your name, email address, or profile details
• Storage: We do not intentionally retain ordinary scan payloads after processing, with one exception: if you rate a scan result as inaccurate and explicitly choose "Send with photo," that single photo is stored (with no account identifier attached) so we can reproduce and fix the failure. Opt-in report photos are stored for troubleshooting; the 90-day automatic deletion control is not yet operationally verified. What our AI providers may retain is described in Section 6.6.

6.2 Bodydex Assistant

The Bodydex Assistant is an automated AI system. It is off until you turn it on, and it only runs after you give explicit consent in the App to the processing described here, including health data. The provider is OpenAI (OpenAI OpCo, LLC, United States), reached through our server proxy.

• Data sent with every message: your message text (limited to 300 characters); your earlier messages in the current conversation, which the App sends to our proxy up to the 50 most recent and of which our proxy forwards only the 5 most recent to OpenAI as context; your profile and setup details (age, sex, height, weight, goal and goal pace, activity level, diet type, cooking frequency, focus areas, obstacles, motivations, whether you work with a human coach, any coach or motivation note you entered, and your preferred day window if you set one); a nutrition summary (today's totals, targets, per-meal calories and water, and 7-day averages); your recent weight readings (the last few you logged) and goal estimate; the names of your active supplements, medications, and peptides with the doses you recorded; and your saved Assistant notes and the details it remembered from earlier chats.
• Data sent for some questions: at the Assistant's request during a chat, the App may read from your device and send: dated nutrition, water, and per-meal totals for up to the last 30 days; dated weight measurements for any period you ask about, up to your whole recorded history, with your goal estimate; your body measurements, and the recipes you have saved with their ingredients, macros, and how often you cook them; a protocol overview (each active medication, supplement, and peptide with the dose you recorded, its schedule summary, 7- and 30-day adherence, supply level, and the next dose and time slot recorded in your schedule); dose history for up to 30 days (counts of taken, skipped, and missed doses, injection sites used, and the last taken date, for one protocol or all); workouts (sessions with dates, names, duration, volume, calories, and streak); reminder settings (notification preferences, permission status, and how many protocols have reminders); your logging streak and badges (names, earned status and dates, progress); and the full record of one protocol, workout, or routine you ask about. Opening the Assistant from a Research Library entry or a protocol page also sends that entry's topic and a short summary of the selected protocol (name, recorded dose, schedule, 7-day adherence, supply level). With the separate "Health vitals" opt-in turned on, the App may also read and send readings from Apple Health or Health Connect — resting heart rate, heart rate, heart rate variability, blood pressure, blood glucose, blood oxygen, respiratory rate, sleep duration, body fat, lean body mass, and daily steps and active energy — for the dates your question is about, and only the readings that question needs; where a reading is missing, the App may also send the reason (for example, that the permission was not granted or the health app has no data for those dates) so the Assistant can tell you how to fix it. With the separate "Lab results" opt-in turned on, the App may also read and send the lab results you recorded — the values, their dates, the lab, and the reference range from your own report, whether you entered them yourself or imported them from that report, as a photo or as a PDF (Section 6.7) — for the question you asked and no other; apart from the working copy described below, none of it is stored on our servers, and Bodydex does not interpret them. Some of the other values above may also be derived from Apple Health or Health Connect if you connected them.
• Data NOT added automatically: your profile name and email address are not attached to Assistant requests; a pseudonymous account identifier is used instead. Messages and notes you write may themselves contain identifying information — do not include details you wish to keep private.
• Abuse-monitoring identifier sent to OpenAI: each Assistant request to OpenAI carries a keyed pseudonymous identifier derived from your account identifier, sent only so that OpenAI can detect abuse of its service under its usage policies. It is not your name or email address, and it is derived with a secret key, so it differs from the identifier our analytics use.
• What the Assistant may read: seven categories — nutrition and calories, protocols and dose logs, workouts and fitness, body weight and measurements, health vitals, lab results, and memory — each of which you turn on or off in Profile › Bodydex Assistant › What the assistant can see. "Health vitals" and "Lab results" are each off unless you tick them yourself, and no preset turns either on. Your setup answers (age, sex, height, activity level, units and the goal you chose) ride with every message while at least one category is on; allow nothing there and the Assistant answers from your messages only.
• Storage on our servers: your conversation history and Assistant memory are stored on your device, not on our servers. Two server-side records exist. First, when a reply pauses mid-answer to look something up in the App, our Cloudflare proxy holds a working copy of that reply — which can include AI text, the pending requests for your data, the data returned, and personal information. We attempt to replace the content of that working copy with a record that carries no message text as soon as the reply finishes — an opaque turn reference kept only so a repeated request can be told it has already been handled. We do that on every completed reply, normally within seconds of the reply landing; we cannot promise every attempt succeeds, and where one does not the content is not removed at completion but stays subject to the criteria below. If a paused reply is never finished and never resumed — you close the App, your phone locks, the network drops — we cannot give you a measured maximum, so here are the criteria instead, as data-protection law allows where a period cannot be given: the pause stops being resumable after 3 minutes, the record becomes eligible for deletion 10 minutes after that, and a deletion scheduled at the moment of the pause then attempts to remove it once it is eligible, rather than waiting for a later request to trigger a sweep. Those two figures describe when the record becomes eligible for deletion, not when deletion succeeds: the delivery of a scheduled deletion is retried by the platform, an attempt can still fail, and where one does the copy stays in place until a later attempt succeeds. So we cannot bound how long an abandoned working copy persists. Second, answers to standard Research Library questions, which are sent without any of your personal context, are cached for up to 7 days so they need not be regenerated.
• Retention by OpenAI: OpenAI states that content sent through its API is not used to train its models unless the customer opts in, and that it keeps abuse-monitoring logs for up to 30 days unless a longer period is required by law or reasonably necessary to protect its services or any third party from harm. We use OpenAI's standard API terms and have not arranged zero-data-retention, so you should assume OpenAI may hold Assistant content for up to 30 days under its own terms, and longer where those exceptions apply.
• Narrowing what the Assistant may read: if you switch a category off — including unticking "Health vitals" or "Lab results" — the Assistant starts a fresh conversation. The earlier conversation is never sent again, including anything the Assistant had remembered from it, so data covered by a permission you withdrew cannot be replayed to OpenAI by a later message. The turns the App removed from the live thread are kept on your device as a read-only transcript you can open and delete, and it cannot be sent: nothing in the App reads it back into a request. It is kept for that single reason — so that tightening a permission does not silently destroy your own history — and Delete transcript removes it, including while your consent is withdrawn. Only the 200 most recent messages are kept in a conversation; older ones are dropped.
• Withdrawing consent: see Section 11.7. Withdrawing consent stops the sending: new Assistant requests stop at once, including further requests from a reply already in progress, and nothing from your conversations, memory or notes is sent to OpenAI afterwards. It does not erase them. They stay in the App's database on your device — your live thread, any archived or read-only transcript, your notes, and the facts the Assistant saved — and so, in one narrow case, does a conversation the App was unable to read back: rather than overwrite or destroy your history, the App sets those bytes aside untouched, and nothing parses, sends or replays them. We are not relying on the consent you withdrew to keep any of this, and we keep none of it for a purpose of our own. It is on your device, we have no access to it, and it is yours to delete: Delete transcript for an archived or read-only conversation, New Chat or Clear everything for the current one, per-note delete and Reset Assistant Memory for notes and remembered facts, Redo Assistant Setup to clear every one of them at once, or Delete All Data for the whole App. Withdrawal cannot recall information already received by our providers, which remains subject to OpenAI's retention described above.

6.3 Voice-Assisted Food Logging & Voice Corrections

• Data sent: A short audio clip of your voice command (up to approximately 25 seconds), which our servers transcribe to text using a speech-to-text AI service (currently Cloudflare Workers AI, with Groq as a fallback); optional vocabulary hints derived from your tracked item names, to improve recognition; and/or a text transcript produced on your device (limited to 2,000 characters). The resulting transcript text is then sent to OpenAI to be parsed into food entries.
• Data NOT sent: Your name, email address, or profile details
• Storage: We do not retain audio clips or transcripts after processing; our speech-to-text providers may retain limited data under their own terms.

6.4 Video Recipe Import

• Data sent: The video link you share, and the video's audio track and captions retrieved from that link (via a content-retrieval service) for transcription and recipe extraction
• Data NOT sent: Your name, email address, or profile details
• Storage: A status record for your import (including the shared link and the resulting recipe) is kept for up to 7 days so the result can be delivered to your device, then automatically deleted. An anonymized result cache keyed to the video link (not to you) is retained for up to 30 days to avoid re-processing the same public video.

For ordinary web recipe pages (non-video links), your device fetches the page directly: the destination website receives the URL request and ordinary network metadata (including your IP address) under its own policies, and the parsed recipe is stored only on your device.

6.5 AI Transparency

When you use the features described in this section, you are interacting with an automated artificial-intelligence system, not a human. The outputs these features produce — nutritional estimates, Assistant responses, and analysis results — are AI-generated content, and the App identifies these features as AI-powered at the point of use: the Assistant announces itself as an AI system when you set it up, and its chat screen carries a persistent notice that you are talking to an AI that can make mistakes. If you ask the Assistant whether it is a human or an AI, it should tell you that it is an AI. This disclosure is provided in line with applicable AI transparency laws, including Article 50 of the EU Artificial Intelligence Act. The Assistant is a tracking and general-information tool; it is not designed to provide companionship, therapy, counselling, or crisis support.

6.6 AI Training Data Usage

6.7 Document Import (Lab Reports & Product Labels)

The App can read a document you photograph, or choose from your photo library, so that what is printed on it can be filled in for you instead of typed: a lab report, or the label on a medication, supplement or peptide. A lab report can also be imported as a PDF — the file your lab sent you — which you open from your files rather than photograph; a product label is photographed only. This is off until you turn it on. The first time you use it, the App asks for your separate, explicit consent to send the file — it is never bundled into accepting the Terms, into onboarding, or into a subscription — and every import after that shows a notice before anything leaves your device. You can withdraw the consent at any time at Profile › Legal & Data › Document import, which stops both report reading and label reading (Section 11.7).

• Data sent: Only what you chose — one or more photos of the document, or, for a lab report, its PDF — and nothing else from your records. The request goes through our server proxy to a third-party AI provider, for that one request, and is authenticated to your account with a session token.
• Data NOT sent: We do not add profile identifiers or other logs to the request; the selected document itself may contain identifying information. Your photo library is not read — only the images you selected. Choosing a PDF is the same in scope: the system file picker hands the App that one file and nothing else on your device is read (Section 7.3).
• What it does: It transcribes what is printed. For a report: the marker names, the values, the units, and the reference range your lab printed. For a label: the name, the strength, the amount, and the directions. Bodydex does not interpret results, states nothing about any value, gives no medical advice, and never suggests a dose or a schedule from a label.
• The identifiers printed on the page: A report or a label usually carries your name, date of birth, address, a record or prescription number, or a prescriber's name. The extractor is instructed never to return any of them, and because an instruction is not a control, our server then rebuilds the result from a fixed list of fields and copies nothing else across. We restrict returned fields and instruct the model to omit identifiers; these measures cannot guarantee removal — an identifier placed inside a permitted field, such as the lab's name, can still come through, which is one more reason to check what is shown before you save it.
• Storage on our servers: none. We store neither the file nor what is read from it. No part of the document is written to a log, to our key-value store, or to any other store of ours. This is a statement about our servers; what the AI provider may retain under its own terms is Section 6.6.
• On your device: To send it, a working copy is made in the App's own storage and deleted as soon as the file has been prepared. The two paths differ in who makes that copy and the difference is stated rather than assumed: for a photo the App makes it; for a PDF the system file picker copies the file into the App's cache when you choose it, and the App deletes that copy once it has read the file — before the request is sent, because what is sent is the data it read and not the file on disk. Your own photo or PDF is left where it is; the App neither moves it nor deletes it.
• Nothing is saved until you save it: What was read is shown to you to check first. You are responsible for checking every value against your own report before you save it, and nothing reaches your records until you do. From that point it is a record on your device like any other, and you can correct or delete it.

A lab report you import — photographed, or the PDF your lab sent you — is health data, and, where the GDPR or UK GDPR applies, special-category data under Article 9. That is why the consent is separate and explicit, why it is recorded with the version of the disclosure you actually read, and why changing that disclosure asks you again rather than relying on a tick from months ago (Sections 11.6 and 11.7). For residents of Washington, Nevada and Connecticut it is also consumer health data — see our Consumer Health Data Privacy Policy.

7.Progress Photos, Camera & Microphone

7.1 Progress Photos

The App allows you to take and store body progress photos for personal tracking. These photos are:

• Stored exclusively on your device, in the App's local files, referenced by its database
• Never uploaded to our servers or any cloud service
• Never shared with any third party
• Permanently deleted when you use the "Delete All Data" feature

7.2 Camera Access

The App requests camera access to enable AI food scanning, barcode scanning, nutrition label scanning, photographing a lab report or a product label to import it (Section 6.7), and progress photos. The camera is only activated when you explicitly open a scanning or photo feature. Food photos captured for AI analysis are transmitted for processing and then discarded from our servers (except the optional scan-accuracy reports described in Section 6.1). On your device, a copy of each scan photo is kept temporarily for your scan history and is automatically cleaned up on a schedule of roughly 30 to 90 days depending on subscription tier and scan status.

Photos you take of a lab report or a product label to import — one or more per import — are handled differently from a scan photo: they are sent for that one request, we keep neither them nor what is read from them, and the App does not keep a copy of them alongside the record it creates — only the working copy it makes in order to send them, which it deletes as soon as they have been prepared (Section 6.7). Importing a lab report as a PDF instead uses no camera access at all (Section 7.3).

7.3 Photo Library and File Access

The App may request access to your photo library to allow you to select an existing food photo for AI analysis, or an existing photo of a lab report or product label to import (Section 6.7). Only the images you select are read; selected photos are processed identically to camera captures, and are left in your library where they are.

Importing a lab report as a PDF uses your device's own file picker instead, and asks for no photo-library or storage permission: choosing the file is what grants access to it, the App reads only that one file, and nothing else in your files is read or listed. The file you chose stays where it is (Section 6.7).

7.4 Microphone Access

The App may request microphone access for voice-assisted food logging and voice corrections. When you use these features, a short audio clip of your speech (up to approximately 25 seconds) is transmitted to our server infrastructure and transcribed to text by a speech-to-text AI service (see Section 6.3); your device may also produce a local transcript used as a fallback. Audio is recorded only while you are actively using a voice feature, is processed transiently, and is not retained after transcription.

8.Third-Party Services

The App integrates with the following third-party services. Each service has its own privacy policy governing their handling of data:

We encourage you to review the privacy policies of these third-party services. Providers have their own terms; our responsibilities under applicable law remain unchanged.

8.1 Ad Install Measurement (No Tracking)

When BodyDex is first installed, our own server sends a single "the app was installed" event to our advertising platform (e.g., Meta) so we can tell whether our ads work; only installs that followed one of our own ads are counted toward a campaign. The event carries a random, app-scoped install identifier (retained by us for up to 90 days for de-duplication), your platform and app version, and on Android the store referrer when present. It is sent by our own server — BodyDex contains no advertising or tracking SDKs — and contains no name, no email, no health data, and no advertising identifier. It is not linked to any data you enter in the app, and that event is sent once per installation; it is not sent while an installation is in local-only mode (Section 12). On iOS, install counting additionally uses Apple's privacy-preserving SKAdNetwork / AdAttributionKit framework, which reports only aggregated campaign-level counts. Also on iOS, the app asks Apple's AdServices framework for an attribution token once per installation and passes it to our subscription processor RevenueCat, which exchanges it with Apple. If the installation followed an Apple Ads (App Store search) ad, Apple returns the campaign, ad group and keyword of that ad; otherwise it returns that no ad was involved. The token contains no advertising identifier, needs no tracking permission, and is not used to track you across other companies' apps or websites. The install event described above is sent to Meta for advertising measurement. We do not use it for profiling or retargeting, and it carries nothing about you beyond what is listed here.

9.Data Retention

• Local data: Stored on your device indefinitely until you choose to delete it (via "Delete All Data" or by uninstalling the App). Because this data exists only on your device, we cannot recover it if the App is uninstalled or your device is lost, reset, or damaged. Profile → Export Data produces a portable copy of your records (JSON/CSV — a data copy, not a restorable in-app backup; image files and certain settings are not included).
• Rate-limiting counters: Anonymous counters stored in our server infrastructure automatically expire and are deleted on a tiered schedule: daily usage counters within 48 hours, monthly usage counters within approximately 40 days, and lifetime free-tier anti-abuse counters (video recipe imports) within 365 days.
• Trial records: While you are on a free trial we also keep the start and end dates of your trial period, stored against your account ID, together with the usage tallies described next.
• Usage-limit tallies: Per-account usage tallies for Premium weekly and daily limits stop counting about 40 days after their last use. Usage tallies for a free trial's allowances are kept for at most 401 days after the trial started, or 40 days after their last use if that is later. Tallies that have stopped counting are removed during routine maintenance of your account's usage records, not on a fixed schedule.
• Anti-abuse device identifier: A minimal, app-scoped device identifier is retained for fraud and abuse prevention and intentionally survives "Delete All Data" (see Section 11.2). It is pseudonymous and not intended to directly identify you.
• AI-processed data: Food photos, a lab report you import as a photo or as a PDF, and the photo of a product label you import (Section 6.7), text messages, voice audio, and transcripts submitted for AI processing are NOT stored on our servers — they are processed transiently and discarded — with three scoped exceptions, none of which is a document import: opt-in scan-accuracy report photos (stored for troubleshooting; the 90-day automatic deletion control is not yet operationally verified — see Section 6.1), video-import status records (deleted within 7 days; see Section 6.4), and the working copy of an Assistant reply that paused mid-answer, whose content we attempt to replace with a contentless record as soon as the reply finishes and which — then, or if that attempt does not succeed — we attempt to remove on the criteria stated in Section 6.2, where a failed attempt can leave it in place longer — read that section for the criteria and its limits.
• Retention by AI providers: Our providers may retain submitted content under their own terms after we have discarded it. For the Bodydex Assistant, OpenAI states a default abuse-monitoring retention of up to 30 days (longer where required by law); we have not arranged zero-data-retention (see Section 6.2). Other providers' retention is governed by their published terms (see Section 8).
• Feedback submissions: Feedback rows are scheduled for deletion after 180 days; automatic deletion of every attachment is not yet operationally verified. Copies delivered to our internal support tooling are retained as long as needed to investigate and resolve the issue (see Section 3.3).
• Subscription data: Managed by RevenueCat per their data retention policy. Cached subscription status on our server expires within 5 minutes.

10.Data Security

We take reasonable measures to protect your information:

• Local encryption: Data on your device is stored in a local database protected by your operating system's built-in encryption at rest (iOS Data Protection / Android File-Based Encryption)
• Transport encryption: All data transmitted between the App and our servers uses HTTPS/TLS encryption in transit
• Secure proxy: AI service requests are routed through our secure server infrastructure — API keys are never exposed on your device
• Server-side verification: Subscription status and rate limits are verified server-side to prevent tampering
• Credential separation: The App includes only the public client credentials needed to access certain services; credentials capable of privileged access are kept server-side

While we implement commercially reasonable security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. If a security breach affects your personal information, we will provide notification as required by applicable law.

11.Your Rights

Because your data is stored locally on your device, you have direct, immediate control over your information at all times:

11.1 Right to Access

Your tracking records are accessible to you directly within the App at any time; Profile → Export Data produces a copy of them, which excludes images and some settings (Section 9). Contact us about server-side records.

11.2 Right to Delete

You can permanently delete all data stored on your device through the App (Profile → Delete All Data). This action is irreversible and removes all personal data from the local database and signs you out. Feedback reports you may have submitted are retained as described in Section 3.3 (feedback rows are scheduled for deletion after 180 days; automatic deletion of every attachment is not yet operationally verified); subscription and billing records are managed by Apple, Google, and RevenueCat under their own policies. The minimal device identifier kept for abuse prevention is preserved on your device (Section 9); it is pseudonymous — not intended to directly identify you — and may still be personal data. Deleting local data does not delete exported files, device backups, records you wrote to Apple Health or Health Connect, or content already processed by our AI providers under their retention terms (Section 9). Uninstalling or reinstalling the App should not be relied on as a way to erase every copy.

11.3 Right to Export (Data Portability)

You can export your data at any time through the App (Profile → Export Data). Data is exported in portable formats (JSON and CSV) that you can save, transfer, or use as you see fit.

11.4 Right to Revoke Permissions

You can revoke health data, camera, microphone, notification, and photo library permissions at any time through your device's Settings. Revoking permissions may disable certain features but will not affect your existing data. On Android, the App may also ask for the "Alarms & reminders" permission, which it asks for only so the rest timer's alert rings on time; no data is collected through it, and the timer still works without it.

11.5 California Residents (CCPA)

If you are a California resident, you have the right to: know what personal information is collected, request deletion of your personal information, and opt out of the sale or sharing of your personal information. We do not sell your personal information or disclose it for cross-context behavioral advertising ("sharing" under California law). Section 8.1 describes our limited install-measurement disclosure to Meta. You can exercise your rights using the Delete All Data and Export Data features within the App, or by contacting us at Click to reveal email.

Why that is not just about who pays whom. California defines a sale by reference to valuable consideration, not only money, so the fact that we pay our AI providers rather than the reverse does not by itself settle the question. What settles it for us is the terms and the use. We disclose your data to a provider only in order to perform the feature you asked for. What each provider is then permitted to do with it is set by that provider's own terms and differs between them: Section 6.6 states which ones may use submitted content to improve their models, and we do not claim that every provider is contractually limited to our purpose. For the Bodydex Assistant, OpenAI's Data Processing Addendum records that OpenAI will not provide us with monetary or other valuable consideration in exchange for your data, that we have therefore not "sold" it, that OpenAI will not "sell" or "share" it, and that OpenAI will not process it outside our direct business relationship or combine it with data it holds about you from anywhere else. We run no advertising or tracking SDKs, and the install-measurement event in Section 8.1 carries no name, email, health data or advertising identifier.

11.6 European Users (GDPR)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including the rights of access, rectification, erasure, restriction, data portability, and objection. Since your data is stored locally on your device, you can exercise most of these rights directly. For any requests you cannot fulfill through the App — including requests concerning the limited server-side records described in this policy — contact us at Click to reveal email (or Click to reveal email) and we will respond within the timeframe required by applicable law — ordinarily within one month of receipt for GDPR and UK GDPR rights requests, extendable where the law allows. You also have the right to lodge a complaint with your local supervisory authority. UK users: we acknowledge data-protection complaints within 30 days, investigate them, and tell you the outcome.

Legal bases. Where the GDPR or UK GDPR applies, we process: Bodydex Assistant messages and context, including health data, on the basis of your explicit consent (Articles 6(1)(a) and 9(2)(a)); the lab report you choose to import, as a photo or as a PDF, and the photo of a product label you choose to import, and what is read from either, also on the basis of your explicit consent (Articles 6(1)(a) and 9(2)(a) — a separate consent, asked before the first import and recorded against the version of the disclosure you read, Section 6.7); Apple Health / Health Connect data on the basis of the permission you grant on your device; subscription verification and delivery of the features you use on the basis of our contract with you (Article 6(1)(b)); rate limiting, abuse prevention, service monitoring, and install measurement on the basis of our legitimate interest in operating a secure, affordable service (Article 6(1)(f)); and feedback you choose to submit on the basis of your consent.

Your records that stay on your device. The App's purpose is to hold your records for you, and it holds them in a database on your device: we have no access to that database, it is not synced to us, and nothing in it is sent anywhere except as this policy describes. Where the GDPR or UK GDPR applies, our basis for providing that storage is the performance of our contract with you (Article 6(1)(b)) — it is the service you chose — and what goes into it is what you enter, import or ask the App to keep. When you withdraw a consent, that withdrawal ends the basis for the processing it covered: we stop sending. We do not treat a withdrawn consent as permission to keep anything, and we do not rely on it as a basis for the records that remain on your device. Those remain because deleting your own history without your asking would be a loss you did not choose — they are readable and deletable by you, and Section 11.2 and Section 6.2 name the controls. If you would rather they were gone, use them; Delete All Data removes the records the App holds on your device, apart from the minimal anti-abuse identifier described in Section 9, and does not reach copies outside the App (Section 11.2).

International transfers. Data processed by our online features is transmitted to infrastructure operated by our service providers primarily in the United States and, where our edge network operates, in other countries. Bodydex is operated by Daniel Bobunov, a sole trader established in New Jersey, United States, who is the controller for the processing described in this policy and the customer under each of the provider agreements below. Where the GDPR or UK GDPR applies, these are the safeguards we rely on for transfers to the providers named in this list, and we do not rely on your consent as the transfer mechanism for any of them:

• OpenAI (Bodydex Assistant; parsing voice-log transcripts). We use OpenAI's published, non-negotiated terms. Its Services Agreement provides at Section 5.3 that if the customer uses the services to process personal data, OpenAI and the customer will comply with OpenAI's Data Processing Addendum, "which is incorporated by this reference into the Agreement" — so the Addendum governs our account without a separate signature. Under that Addendum, EEA and Swiss data is processed by OpenAI Ireland Limited, and onward transfers out of the EEA or Switzerland are made on the basis of agreements containing the EU Standard Contractual Clauses or an adequacy decision under Article 45 GDPR; UK data is processed by OpenAI OpCo, LLC under the EU Standard Contractual Clauses as amended by the UK International Data Transfer Addendum, which the Addendum deems entered into between us as data exporter and OpenAI OpCo, LLC as data importer, with the Information Commissioner's Office as the competent supervisory authority. Read them at openai.com/policies/services-agreement and openai.com/policies/data-processing-addendum.
• Cloudflare (the server proxy every AI request passes through, the rate-limiting counters, and the speech-to-text service used for voice features). Cloudflare's Self-Serve Subscription Agreement states that where customer content includes personal data of European data subjects, Cloudflare acts as processor or sub-processor and will handle it in compliance with Cloudflare's Data Processing Addendum, "which is hereby incorporated by reference into this Agreement." That Addendum applies the EU Standard Contractual Clauses to restricted transfers to Cloudflare, Inc. (United States) and deems the UK International Data Transfer Addendum executed between us and Cloudflare for UK transfers. Read them at cloudflare.com/terms and cloudflare.com/cloudflare-customer-dpa.
• Apify (retrieving a video you share for recipe import). Apify's Data Processing Addendum is incorporated into its agreement so that "no separate signature is required," and incorporates the EU Standard Contractual Clauses and, for UK transfers, the UK Addendum. Read it at docs.apify.com/legal/data-processing-addendum.

The other providers named in Section 8 receive the content described for each feature in Section 6, and Section 6.6 states how each of them may use it under its own terms. Section 8 is the full list of recipients. If you want a copy of the agreement or transfer clauses we rely on for a particular provider, ask us at Click to reveal email and we will send you the version that applies to our account. Your consent is a lawful basis for the processing, not a transfer tool. The Bodydex Assistant sends health data only after your explicit consent, and that consent is given in the knowledge that the data will be processed in the United States; it does not replace the safeguards above, and withdrawing it stops further sending (Section 11.7).

11.7 Right to Withdraw Consent

You can withdraw any consent you gave in the App as easily as you gave it, from the same device: Bodydex Assistant — Profile → Bodydex Assistant → Withdraw consent stops new Assistant requests at once, including further requests from a reply already in progress, and the Assistant stays off until you consent again. Withdrawing does not delete anything: your setup, conversations, memory, and notes stay on your device. Redo Assistant Setup is a separate, destructive option that also clears those. Document import — Profile › Legal & Data › Document import turns off both report reading and label reading; no document is sent after that, and the lab results you already reviewed and saved stay on your device as your own records, yours to keep, correct or delete. Health platforms — revoke access in your device's Settings; Everything — Profile → Delete All Data. Withdrawal does not affect the lawfulness of processing before withdrawal and cannot recall information already received by a provider, which remains subject to that provider's retention (Section 9). You can also contact us at Click to reveal email.

11.8 Connecticut Residents

Since July 1, 2026, the Connecticut Data Privacy Act applies to any person that controls or processes consumers' sensitive data, without a volume threshold (Conn. Gen. Stat. § 42-516(2), as amended by P.A. 25-113, § 6). We process exactly that, so the Act applies to us in full and we claim no exemption. Our Consumer Health Data Privacy Policy sets out the applicability reasoning, the categories, the recipients, the 45-day response deadline and the 60-day appeal deadline.

As a Connecticut resident you may confirm whether we process your personal data and access it, correct inaccuracies in it, delete it, obtain a portable copy of it, and opt out of targeted advertising, the sale of your personal data, and profiling in furtherance of automated decisions that produce a legal or similarly significant effect (Conn. Gen. Stat. § 42-518(a)). Access, export and deletion are direct in the App (Sections 11.1–11.3), and you correct a record by editing it where you entered it. For anything else, or to appeal a refusal, email Click to reveal email — put "health data appeal" in the subject for an appeal; we answer an appeal in writing, with reasons, within 60 days, and if we deny it we tell you how to complain to the Connecticut Attorney General.

The three opt-outs are empty for us, and we say so rather than offering a control that would do nothing: we do not sell personal data, so the list of third parties it has been sold to is empty; we display no advertising in the App and do no targeted advertising; and we do not profile you in furtherance of automated decisions that produce a legal or similarly significant effect. We do not collect, use or sell personal data for the purpose of training large language models (Section 6.6). If any of that changes, this section changes with it and we will tell you before it takes effect (Section 15).

12.Children's Privacy

BodyDex is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13: when the App Store or Google Play tells the App that the account on a device belongs to someone under 13, the App switches that installation to local-only mode, described below. If you believe a child under 13 has provided us with personal information, please contact us at Click to reveal email and we will take steps to delete such information.

Local-only mode. From the moment the store reports an account under 13, the App stops all communication off the device for that installation: it sends nothing to our servers, our AI providers, our subscription processor or any other online service, with the one exception set out at the end of this paragraph. It keeps working on the device, and nothing is deleted: everything already recorded stays where it is and can still be used, while the features that need the internet — scanning, the Bodydex Assistant, online food search, imports, backup, sign-in, purchases and support messages — are off. Links you tap to our website or to the store still open in your browser. Of the store's answer, the App remembers on the device only that local-only mode is on — a yes/no setting, never the age or the age group — so that the mode holds from the next launch, and it turns the mode off by itself when the store later reports an older age group. So that paid features you already have stay available without contacting the store, the App keeps on the device a copy of the last subscription status the store confirmed (every installation keeps this copy, and the App never sends it anywhere) and uses that copy while the mode is on. The one exception: if the mode starts while the App is already open, the subscription service started earlier in that session (RevenueCat) may still check your subscription with the store until the App is closed; it is not started again after that. Anything sent before the store reported the age group is covered by the rest of this policy and by the deletion request above.

Users between the ages of 13 and 18 may use the App only with the consent and supervision of a parent or legal guardian.

13.Consumer Health Data Privacy Policy

Our Consumer Health Data Privacy Policy explains the consumer health data we process, its sources and purposes, the recipients it is shared with, and how to exercise your applicable rights, for the purposes of the Washington My Health My Data Act, Nevada SB 370, and the Connecticut Data Privacy Act. It is published at its own address and linked from every page of this site. In short: consumer health data is stored on your device for tracking; selected records and summaries are processed through the online features described in Section 6, with your explicit consent for the Bodydex Assistant and for document import; we do not sell it, do not share it with advertisers or data brokers, and do not use geofencing.

14.Website Privacy

The BodyDex marketing website (bodydex.app) uses Cloudflare Web Analytics to measure page traffic and understand which pages visitors reach. It is privacy-first by design: it uses no cookies, no tracking pixels, and no fingerprinting, and it does not track you across other websites. It records only aggregate, non-identifying information such as page views, referrer, country, and device type.

Cloudflare processes website request metadata; we count store clicks and QR redemptions using same-origin beacons without adding cookies or user identifiers. The site's fonts are served from our own domain. We do not sell any data. The website is a static informational site hosted on Cloudflare Pages.

15.Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last Updated" date at the top of this page. It is your responsibility to review this Privacy Policy periodically for changes.

We will notify you of material changes and obtain fresh consent before changed processing where the law requires it. Continued use alone does not provide that consent.

If we make material changes to the way we handle your data, we will make reasonable efforts to provide notice through the App or our website.