Privacy Policy

2.1 Information You Provide

• • Account information: name, email address, and how you sign in (email code, Google or Apple)
• • Health and fitness data: height, weight, age, biological sex, activity level, body fat percentage, waist circumference, fitness goals, and target body areas
• • Activity and nutrition data: workout logs (exercises, sets, reps, and weights), food and nutrition logs, body measurements, and daily step counts
• • Physique photos: front- and side-view photos you choose to submit for AI body analysis (see Section 2.4)
• • Referral information: if you sign up or subscribe using a referral or discount code, we record the code used and which partner referred you

2.2 Information Collected Automatically

• • Device and connection information (such as IP address and device type), processed by our infrastructure providers to operate the service, secure accounts, and prevent abuse
• • Purchase and subscription transaction data when you subscribe: product purchased, price, currency, country, and transaction identifiers
• • Service logs: timestamps of certain requests (such as AI analyses and data-export requests), kept for rate limiting and abuse prevention

We do not use third-party advertising or analytics SDKs in the App, and we do not track you across other companies' apps or websites.

2.3 Sensitive Health Data

Health and fitness information (weight, body fat %, waist circumference, fitness goals, physique photos) is classified as sensitive personal data. We collect this solely to provide and improve your personalized experience within the App. We do not sell or rent your health data to third parties, and we never use it for advertising.

2.4 AI Body Analysis Photos

When you use the AI body analysis feature, the photos you submit — together with measurements you provide (such as waist, height, weight, and biological sex) — are transmitted securely to our AI service provider (OpenAI) to generate a body fat estimate. These photos are processed for this sole purpose and are not stored on our servers, and under our provider's API terms they are not used to train AI models. Our provider may keep what it receives for up to 30 days to monitor for abuse, after which it is deleted. Only the resulting estimate is saved to your profile. We also keep a one-way fingerprint (a hash) of the submitted photos alongside that estimate, so that sending the same photos twice returns the saved estimate instead of a second analysis; the fingerprint cannot be turned back into the photos. AI-generated estimates are approximations, not clinical measurements.

2.5 Apple Health (iOS)

If you choose to connect Apple Health, the App reads your step count and weight, only with the permissions you grant through iOS. The App does not write any data to Apple Health. Data obtained from Apple Health is used solely to provide App features (such as step tracking and weight trends) and is stored alongside your other fitness data. We never use Apple Health data for advertising or marketing, never sell it, and never share it with third parties except as needed to provide the service. You can disconnect Apple Health at any time in the App or in iOS Settings.

2.6 Website Mailing List

If you enter your email address into the mailing list form on figurabody.com, we store that address so we can tell you when the App becomes available. The form collects nothing else. That address is held by us and by Resend, our email provider, and is used only for launch and App news announcements; it is never sold, rented, or shared with anyone else, and it is not linked to any App account. Every email we send includes an unsubscribe link, and you can ask us to delete your address at any time by emailing privacy@figurabody.com. We also record a one-way hash of your IP address alongside the signup, solely to stop automated abuse of the form. We do not store the IP address itself.

2.7 Website Analytics

Our website, figurabody.com, uses a basic analytics tool provided by our website host to count page views and measure page performance. It records a session identifier stored in a cookie in your browser, the pages you visit, the site that referred you, your approximate country (derived from your browser's time zone), and technical performance measurements such as page load speed. This information is not used for advertising, is never linked to any App account, and is not sold or shared for any other purpose. You can block it by refusing cookies in your browser. The Figura Body App itself contains no analytics or advertising SDKs of any kind.

2.8 Signing In with Google or Apple

Signing in with Google

What we access: If you choose "Continue with Google", we request only the basic sign-in scopes (openid, email and profile). Through these, Google gives us your name, your email address, your profile picture link, and your Google account identifier. We request no other Google API scopes, and we do not access your Gmail, contacts, calendar, Drive, photos, tasks, or any other Google user data.

How we use it: We use this information only to create your Figura Body account, to sign you in on future visits, and to send you service messages about your account, such as security and billing notices. We do not use it for advertising or profiling, we do not add you to a marketing list on the basis of it, and we do not use it to train AI models.

How we store and protect it: Your name, email address, profile picture link and Google account identifier are stored in our account database, which is operated for us by Supabase. The data is encrypted in transit using TLS/HTTPS and at rest using AES-256, and row-level security policies restrict it so that it can be read only by your own account.

How we share it: We do not sell, rent, or trade this information, and we never transfer it to third parties for their own purposes or for advertising. We disclose it only to the service providers that operate our sign-in and store our data (Supabase), acting on our instructions and only as needed to run the App, and where we are legally required to do so.

How long we keep it, and how to delete it: We keep this information for as long as your account exists. You can delete your account at any time from within the App, at Profile → Delete Account. Your account is deactivated immediately and permanently erased after a 14-day recovery period, and that erasure removes the information Google provided from our systems.

Figura Body's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Signing in with Apple

If you choose "Continue with Apple", Apple shares your name (the first time you sign in only) and either your email address or a private relay address, if you choose to hide your email. We access, use, store, protect, share and delete that information on exactly the same terms as the Google information described above: it is used only to create your account, sign you in and contact you about your account; it is stored in the same encrypted database; it is never sold or used for advertising; and it is erased when your account is deleted. Emails we send to a relay address are forwarded to you by Apple. When you delete your account, we also revoke Figura Body's access to your Apple ID.

2.9 Exercise Videos (YouTube)

The App uses YouTube API Services to show exercise demonstration videos. The videos are made by independent creators, who are credited in the App, and they play inside YouTube's own embedded player. When you play one, YouTube (Google) and the providers that deliver the video player receive information from your device, such as your IP address, device and browser details, and which video you watched, and YouTube may store and read cookies or similar data on your device. We do not send YouTube your name, email address, account information, or any of your health or fitness data. YouTube's handling of that information is governed by the Google Privacy Policy (https://policies.google.com/privacy), and use of the videos is subject to the YouTube Terms of Service (https://www.youtube.com/t/terms). If you prefer, you can skip the videos; the rest of the App works without them.

5.1 Service Providers

We share data with trusted third-party service providers who assist in operating the App, and only the data each provider needs to perform its function:

• • Supabase (database and authentication)
• • OpenAI (AI body analysis — processes the photos and measurements you submit, as described in Section 2.4)
• • Resend (email delivery, including your data exports)
• • RevenueCat (subscription and payment management)
• • Apple App Store / Google Play (payment processing)
• • Google and Apple (sign-in, only if you choose to use them)
• • Google (YouTube) (exercise videos, as described in Section 2.9)

If you signed up through a referral partner, that partner may see aggregate referral statistics (such as the number of sign-ups and commission totals). Partners never receive your name, email, health data, or photos.

5.2 Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your data may be transferred to the acquiring entity. We will notify you via email or in-app notice of any such change and any choices you may have.

5.4 No Sale of Personal Data

We do not sell, trade, or rent your personal information to third parties for their marketing purposes.

9.1 Access and Correction

You may access and update most of your personal information directly within your account settings.

9.2 Deletion

You can delete your account and all associated data at any time directly in the App: go to Profile → Delete Account. Your account is deactivated immediately and permanently erased 14 days later, as described in Section 6. During those 14 days you can reverse the deletion by signing in and choosing "Restore My Account"; after that it cannot be recovered. This is the primary way to exercise this right, and it does not require you to contact us or wait for us to act.

If you need your data erased sooner than the 14-day period allows, contact us at privacy@figurabody.com and we will action it.

If you cannot use that screen — for example you are unable to sign in, or the deletion does not complete — you may instead request deletion by contacting us at privacy@figurabody.com; we will process such requests within 30 days, subject to legal retention obligations (see Section 6).

9.3 Data Portability

You can download a complete copy of your data at any time directly in the App: go to Profile → Privacy & Security → "Request My Data", and a machine-readable export will be emailed to your account email address.

9.4 Opt-Out of Marketing

You may opt out of marketing communications at any time by using the unsubscribe link in our emails or adjusting notification settings within the App.

9.5 California Residents (CCPA)

If you are a California resident, you have the right to:

• • Know what personal information we collect and how it is used
• • Request deletion of your personal information
• • Opt out of the sale of your personal information (we do not sell personal data)
• • Non-discrimination for exercising your rights

To exercise these rights, contact us at privacy@figurabody.com.