Privacy Policy

Last updated: September 17, 2026

TruFitAI ("we", "our", "us") is committed to protecting your privacy. This policy explains how we collect, use, disclose, retain, and protect information when you use the TruFitAI mobile application and website, and how to exercise your privacy choices and rights.

1. Information We Collect

Account Information

Email address and name (via Supabase authentication)
Fitness goals, experience level, dietary preferences
Physical attributes (weight, height, age)

Health & Fitness Data

Workout logs and exercise data (exercises, sets, reps, weights)
Food and nutrition logs (meals, calories, macronutrients, including photos for AI analysis) and recipe content
Health and fitness information you enter yourself (workouts, sets, reps, weights, meals, calories, macros, steps, and body metrics such as height and weight), plus the specific Apple Health or Google Health Connect categories you separately authorize and consent to upload. Platform permission, TruFitAI upload, and derived-data AI coaching use are separate, revocable choices.
Check-in responses and progress metrics (body measurements, mood, energy levels)
Progress/body photos you choose to upload to track physique changes over time (stored in our storage infrastructure — see Sections 3, 7, and 8)
Supplement tracking data

Usage Data

App interaction analytics (screens viewed, features used)
Device type, operating system, app version, timezone
Push notification tokens (for sending reminders and alerts)

Billing Data

Subscription status and tier (managed by RevenueCat via the Apple App Store or Google Play)
We do NOT directly collect or store credit card numbers or payment credentials

2. How We Use Your Information

AI Personalization: Send relevant fitness data to OpenAI's API to generate plans, recommendations, and coaching responses after you consent to the required processing.
Food Photo Analysis: Send a food photo to OpenAI for nutritional analysis; TruFitAI does not save the source photo to your account.
Progress Photo Analysis: Store progress/body photos you upload and send a photo to OpenAI only when you request AI analysis.
Progress Tracking: Store logs and metrics to display and evaluate your fitness journey.
User-directed Recipe Sharing: After a separate per-recipe disclosure and affirmative choice, publish specified recipe fields through a public share link, and stop future link access when you unshare it. This consent is separate from consent to share data with OpenAI.
Notifications: Send reminders, streak alerts, and plan updates according to your app and device choices.
Billing: Manage subscription status through RevenueCat and the Apple App Store or Google Play.
Service, security, and support: Operate, secure, troubleshoot, improve, and support the Service.

3. AI Data Processing Disclosure

TruFitAI uses OpenAI's API to power its AI features. When you use AI-powered features, the following data may be sent to OpenAI for processing:

Workout Plan Generation: Your fitness goals, experience level, available equipment, and physical attributes.
Food Photo Analysis: Your food photos are sent to OpenAI's vision model. Food photos are processed in real time and are not stored by TruFitAI after analysis. OpenAI processes them under its API Data Usage Policy (see below); we do not control OpenAI's retention.
Progress/Body Photo Analysis: Progress photos you upload for body-composition analysis are stored by TruFitAI (in Supabase Storage) and are sent to OpenAI's vision model. OpenAI processes them under its API Data Usage Policy (see below); we do not control OpenAI's retention.
Nutrition Recommendations: Your dietary preferences, calorie targets, and macronutrient goals.
Supplement Suggestions: Your fitness goals and dietary profile.
AI Coaching: Your conversation messages and relevant fitness context.

OpenAI processes this data under their API Data Usage Policy. As of our last review, OpenAI does not use data submitted via their API to train their models. We recommend reviewing OpenAI's policies directly for the most current information.

We share specific data with third-party services to provide the Service. Below is an itemized breakdown:

Supabase: User data (account info, workout logs, nutrition data, progress metrics) is stored in our Supabase database with row-level security, and the progress/body photos you upload are stored in Supabase Storage. A recipe you explicitly share is the limited exception: its recipe content and nutrition-per-serving information can be viewed through its public share link until you unshare it. Supabase acts as our data processor.
OpenAI: Fitness profile data, food photos, progress/body photos, conversation messages, and relevant context for AI features (see Section 3 above). No persistent personal identifiers are shared beyond what is necessary for AI processing.
RevenueCat: Anonymous user identifier and subscription status for in-app purchase management. RevenueCat does not receive your fitness or health data.

User-directed public sharing: Separately from these service providers, if you choose “Make public & share” after the per-recipe disclosure, the recipe fields listed in Section 7 are available without login to anyone with the public link until you unshare it. Recipients may save or redistribute the recipe; Unshare stops future access through TruFitAI but cannot recall copies already saved or redistributed.

We do not sell personal data for money or share personal data for cross-context behavioral advertising. We do not disclose health or fitness data to advertisers.

5. Advertising and Cross-Context Tracking

TruFitAI is a paid subscription service. The app does not display advertising, include an advertising SDK, request an advertising identifier, or use personal information for cross-context behavioral advertising.

6. Cookies and Tracking Technologies

The TruFitAI mobile app does not use browser cookies. Our web services may use the following:

Session Tokens: Authentication tokens stored securely on your device to keep you logged in.
Local Storage: App preferences, cached data, and offline functionality stored locally on your device.
Analytics: Basic, anonymized usage analytics to understand feature adoption and app performance. No third-party tracking pixels or cookies are used on our website.

We do not use cross-site tracking cookies, advertising identifiers, fingerprinting, or other persistent cross-context tracking technologies.

7. Health Data Handling

We treat all health and fitness data with the highest level of care:

Health & Fitness Data You Enter: The workout, nutrition, step, and body-metric data you log is used solely to power your plans, display your metrics in the app, and inform AI-powered recommendations. It is never used for advertising and never sold. It is disclosed only to the service providers described in this policy as needed to operate requested features, except for recipe content and nutrition-per-serving information that you explicitly choose to make available through the recipe Share feature.
Workout and Nutrition Data: Your workout logs, food logs, targets, and other personal nutrition tracking are stored securely with row-level security in Supabase and are accessible only by you and our service/AI processing pipeline. If you affirmatively choose “Make public & share” after the separate disclosure, that recipe's title, description, image, ingredients, instructions, servings, timing, tags, and nutrition-per-serving information are accessible without login to anyone with the public link until you unshare it. Sharing a recipe does not expose your workout logs, food logs, nutrition targets, account identity, or other private health data.
Progress/Body Photos: Photos you upload to track physique changes are stored in Supabase Storage and are sent to OpenAI's vision model only when you request a body-composition analysis. They are retained while your account is active and are deleted when you delete your account (see Section 8).

8. Data Retention & Deletion

We retain each category of data for the period, or according to the criteria, described below. "While your account is active" means we do not delete this data on a fixed schedule while you keep your account; you can delete it at any time as described at the end of this section. We do not currently delete data automatically after a period of inactivity; if we introduce inactivity-based deletion, we will update this schedule.

Category	Retention period / criteria
Account & profile data (email, name, goals, physical attributes)	While your account is active; permanently deleted within 30 days of account deletion.
Workout & nutrition logs	While your account is active; permanently deleted within 30 days of account deletion.
Progress / body photos	While your account is active; permanently deleted (including from Supabase Storage) within 30 days of account deletion.
Chat transcripts & coaching memory	While your account is active; permanently deleted within 30 days of account deletion.
Check-in metrics (mood, energy, body measurements)	While your account is active; permanently deleted within 30 days of account deletion.
Push notification tokens	Retained while valid; removed on logout or token invalidation, and within 30 days of account deletion.
Analytics events	Retained only on an aggregated, de-identified basis that cannot be linked back to you; because it is no longer personal data, it is not deleted with your account.
Billing records	Retained as required by applicable tax and accounting law (typically for the statutory retention period), then deleted.
Consent & transaction records (including auto-renewal and public-recipe sharing consent/withdrawal)	Retained as required or permitted by law as evidence of the consent or withdrawal. California auto-renewal consent records are retained for at least three years or one year after termination, whichever period is longer. Other consent records are retained only for the applicable evidence period approved for that record type. These records may survive account deletion and are deleted once the applicable period ends.

You may request deletion of your account and associated data at any time through the app settings or by contacting us. Upon deletion, account content and consumer health data (including any progress/body photos you uploaded) are permanently removed within 30 days. Limited consent/withdrawal, transaction, billing, and qualifying safety records may be retained only for an applicable legal or evidentiary period; public-recipe consent evidence keeps an opaque recipe id but no copy of recipe content. Anonymized, aggregated data may be retained, and data already processed by third-party APIs (e.g., OpenAI) is subject to those services' data retention policies, which we do not control.

9. Data Security

All data is encrypted in transit (TLS/HTTPS) and at rest
Row-level security policies restrict private account data to account owners; recipes explicitly shared by their owner are exposed only through the curated public share-link API until unshared
API endpoints are rate-limited and input-validated
Admin secrets use timing-safe comparison
Food photos are ephemeral — analyzed and immediately discarded
Authentication is managed via Supabase Auth with secure session handling

10. International Data Transfers

TruFitAI is operated from the United States. Your data may be processed in the United States and other countries where our service providers operate, which may have different data protection laws than your country of residence.

Where applicable law requires a transfer safeguard, we use the contractual or statutory mechanism applicable to the recipient and country. The supporting vendor contracts and transfer assessments are a release prerequisite. TruFitAI is not offered in the EEA or United Kingdom.

11. Your Privacy Rights

General Rights

You can exercise the most common rights yourself in the app under Settings → Privacy Choices & Data. For anything else, email us; we will verify your identity where required and respond within the time applicable law provides.

Deletion (self-serve): You can permanently delete your account and all associated data yourself, in the app under Settings → Delete Account, or by emailing us.
Access: Download a copy of your personal data in Settings → Privacy Choices & Data → Download my data, or email [email protected].
Portability: The download is a complete, machine-readable file (JSON), and your activity logs are also available as CSV, so you can reuse or move your data.
Rectification: Update or correct your information — much of it directly in the app; otherwise by emailing us.
Restriction: Request that we limit how we process your data (by email).
Objection: Object to data processing based on legitimate interests (by email).
Opt-out: Withdraw health-data collection, disable push notifications, or opt out of ad sharing and personalization in the app or device settings.
Withdraw consent: Withdraw health-data processing or AI-sharing consent at any time in Settings → Privacy Choices & Data. Account and basic settings remain available; dependent personalized AI features pause. Public-recipe consent is separate: open the recipe in Recipe Book and choose Unshare to stop future access through its public link.

CCPA-Specific Rights (California Residents)

Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you. The in-app download (Settings → Privacy Choices & Data → Download my data) provides the specific pieces; you can also make the request by email after identity verification.
Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
Authorized Agent: You may designate an authorized agent to submit requests on your behalf.

To exercise a right, authorize an agent, or appeal a denied request, use the in-app controls or email [email protected]. We will explain any verification needed, respond within the time applicable to your region, and provide regulator complaint information when required.

12. Do Not Sell or Share My Personal Information

TruFitAI does not sell personal information for money or share personal information for cross-context behavioral advertising. We also do not sell or share health or fitness data for advertising.

Because we do not engage in those practices, there is no advertising-sharing preference to enable. We still recognize privacy-rights requests and browser Global Privacy Control signals. Contact us if you believe a covered sale or sharing practice occurred.

If you are a California resident and wish to exercise your rights under the CCPA, or if you have questions about our data practices, contact [email protected].

13. App Store Privacy Disclosures

Apple App Privacy Labels

In accordance with Apple's App Store requirements, we disclose the following data collection practices through Apple's App Privacy Labels on our App Store listing. The privacy labels reflect the data types described in this policy, including:

Data Used to Track You: None. TruFitAI does not use collected data to track users across other companies' apps or websites.
Data Linked to You: Contact info (email, name), health & fitness data, usage data, identifiers.
Data Not Linked to You: Diagnostics, anonymized analytics.

For the most current details, see our App Privacy Labels on the App Store.

Google Play Data Safety

In accordance with Google Play's Data Safety Section requirements, we disclose the following:

Data Collected: Name, email address, health and fitness data you enter (workouts, nutrition, body measurements, progress/body photos), app activity, and account identifiers.
Data Shared: Fitness profile data, food photos, and progress/body photos shared with OpenAI for requested AI features. Account identifiers and purchase information shared with RevenueCat for billing. Recipe content and nutrition-per-serving information are publicly accessible only when you explicitly create a share link and until you unshare it.
Health-data limits: Health and fitness data is disclosed only to the service providers identified in Sections 3 and 4 to provide requested app features, except for a recipe you explicitly share as described in Section 7; it is never shared with advertisers or used for advertising.
Security: Data is encrypted in transit and at rest.
Deletion: Users can request data deletion through the app or by contacting support.

For the most current details, see our Data Safety section on the Google Play Store.

14. Children's Privacy

TruFitAI requires users to meet the minimum age for their location: 13 in most supported locations, 14 in Quebec and South Korea, and 18 in India. We do not operate a parental-consent account flow or display advertising. If you believe an ineligible child provided personal data, email [email protected].

15. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via the app, push notification, or email at least 30 days before the changes take effect. The "Last updated" date at the top of this policy will be revised accordingly. Your continued use of the Service after any changes constitutes your acceptance of the revised policy.

16. Contact Us & Data Controller

The data controller responsible for your personal data is:

Entity: TruFitAI App Co.
Postal address: 131 Continental Drive, STE 305, Newark, DE 19713, USA
Email: [email protected]
Website: trufitai.io

If you have questions about this privacy policy, your data, or wish to exercise your privacy rights, contact us using the details above.

European Economic Area and United Kingdom

TruFitAI is not offered to, and does not monitor the behavior of, individuals in the European Economic Area or the United Kingdom. The TruFitAI app is not available in EEA or UK app stores, and we do not accept account registrations from those regions. Accordingly, no representative under Article 27 of the GDPR or Article 27 of the UK GDPR has been appointed. If we make TruFitAI available in these regions in the future, we will update this policy and appoint representatives as required.