Privacy Policy

Overview and contact

Boddy is a fitness and nutrition app for workout tracking, camera-based form coaching, meal logging, and progress tracking. Boddy is operated by the App Store seller shown on the product page.

Privacy questions can be sent to hello@boddy.app. You can also visit the Boddy support page.

Information you provide

You may provide your name, email address, age or birth date, sex, height, weight, goals, experience level, injuries, equipment, diet preferences, allergies, workouts, routines, meals, water logs, body-weight logs, progress photos, and coaching results.

Most of this information is stored on your device. If you sign in, app records can sync through Supabase so you can restore them on another device. Progress photo files are stored locally and do not sync in the current version.

Accounts and authentication

Boddy supports email/password sign-in, Sign in with Apple, and Google sign-in. Supabase may process your email address, account identifier, authentication tokens, and provider information for sign-in, sync, restore, and deletion. Delete Account removes the Supabase account, synced account records, and local app data from the device.

Apple Health

With your permission, Boddy can read body mass, height, step count, heart rate, active energy, date of birth, and biological sex, and can write workouts, active energy, dietary energy, protein, carbohydrates, fat, water, and body mass. HealthKit-derived data is not used for advertising or analytics.

Camera, photos, and food lookup

Live form coaching processes camera frames on device with Apple Vision. Boddy does not upload live coaching video frames. When you choose meal-photo logging, a reduced JPEG is sent through the Boddy proxy to OpenAI for food recognition and may use FatSecret for nutrition lookup. Barcode lookup may send a barcode to OpenFoodFacts. These requests are used to provide the feature you requested.

Analytics and optional movement data

Boddy sends limited product analytics to PostHog using a random analytics ID stored in the iOS Keychain. Events are designed not to include names, email, free text, HealthKit values, exact weight or nutrition values, photos, or video. Analytics can be disabled or reset in Profile → Preferences → Privacy.

If you separately opt in, Boddy may upload stick-figure joint positions and confidence values from unusual coached sets to improve form coaching. This sharing is off by default and never includes camera pixels, video, photos, audio, names, email, or account IDs.

Subscriptions

Purchases are processed by Apple through the App Store. RevenueCat processes an app-generated subscriber identifier, product identifiers, entitlement status, and purchase history so Boddy can unlock premium access and restore purchases. Boddy does not receive your full payment-card details.

Service providers

• Supabase — authentication and optional account sync
• Railway — hosting for the Boddy proxy
• OpenAI — meal-photo recognition
• FatSecret — nutrition lookup for recognized foods
• OpenFoodFacts — packaged-food barcode lookup
• PostHog — product analytics
• RevenueCat and Apple — subscription processing and entitlement status
• Apple Health / HealthKit — optional health-data read and write

These providers process information only as needed for the features described in this policy and are expected to protect it consistently with this policy.

Retention and your choices

Local data remains until you delete it or uninstall the app. Synced records remain until account deletion. Analytics retention follows the Boddy PostHog project settings. Meal-photo uploads are used to service recognition requests.

• Disable or reset analytics in Profile → Preferences → Privacy.
• Disable movement-data sharing in Profile → Preferences → Privacy.
• Manage Health, camera, photo, and notification permissions in iOS Settings.
• Delete your account from Profile.
• Email hello@boddy.app for privacy help.

Children and policy changes

Boddy is not directed to children under 13. If this policy changes, the updated version will be posted on this page with a new effective date.