Privacy Policy

Last updated: October 16, 2026

TruFitAI ("we", "our", "us") is committed to protecting your privacy. This policy explains how we collect, use, disclose, retain, and protect information when you use the TruFitAI mobile application and website, and how to exercise your privacy choices and rights.

1. Information We Collect

Account Information

• Email address and name (via Supabase authentication)
• Phone number, if you add one to your profile or sign in with it
• Profile and coach photos you choose to upload
• Messages you send to the AI Coach, and voice-log transcripts (your speech is turned into text on your phone; we never receive the audio)
• Fitness goals, experience level, dietary preferences
• Physical attributes (weight, height, age)
• Support requests you choose to send in the app (subject and messages)

Athlete Program (only if you join it)

• Your legal name, phone number, and social media handles
• Your contract terms, your electronic signature record (your typed name, the agreement version, and the date and time you signed), and your monthly pay statements
• Your public posts for the program and their view counts, as reported by SideShift
• The free-access codes we send you

When anyone opens an athlete's tracking link (trufitai.io/a/...), we count the click using a one-way code that changes every day. We do not store the visitor's IP address, browser details, or any device identifier, and the count is only used to show athletes and our team how much traffic a link sends.

Text Invites (iPhone)

When you text an invite from the TruFitAI app on iPhone, the names and phone numbers you pick stay on your device, and the text is sent from your own phone. So that each person counts only once, your device sends us a scrambled code made from each phone number. We never receive or store the phone number or the name. We use these codes only to count bonus days, and we delete them when you delete your account. We also keep how many people you invited and the bonus days you earned and used.

Health & Fitness Data

• Workout logs and exercise data (exercises, sets, reps, weights)
• Food and nutrition logs (meals, calories, macronutrients, including photos for AI analysis) and recipe content
• Health and fitness information you enter yourself (workouts, sets, reps, weights, meals, calories, macros, steps, and body metrics such as height and weight), plus the specific Apple Health or Google Health Connect categories you separately authorize and consent to upload. Platform permission, TruFitAI upload, and derived-data AI coaching use are separate, revocable choices.
• Check-in responses and progress metrics (body measurements, mood, energy levels)
• Progress/body photos you choose to upload to track physique changes over time (stored in our storage infrastructure — see Sections 3, 7, and 8)
• Supplement tracking data

Friends, Cheers, and Leaderboards

• Your username, display name, and profile photo (if you add one), as other members see them on friend lists, leaderboards, Activity, and friend suggestions
• Your friends, friend requests, and the members you block or report
• Your wins: personal records (PRs) from workouts you log, streak milestones, level-ups, achievements, and, only if you say yes, reaching your goal weight
• Cheers you give and receive, including the emoji chosen, and waves you send and receive
• Your leaderboard places and the totals behind them: Fitness Points, cheers received and the emoji you receive most, active and longest streak, workouts this week, PRs this month, and your best lifts
• Friend suggestions we make for you from mutual friends
• Your sharing choices: whether you show on your friends' leaderboards and on the world leaderboard, whether friends can find you by username, whether friends see when you finish a workout or reach your goal weight, and whether you get social notifications

PR Proof Photos and Videos

• A photo or video you choose to add to a PR (a lift video of 3 to 60 seconds, which keeps its sound, a lift photo, or a physique photo) and the audience you pick for it
• Details of the file: its size, length, width and height, and a checksum we use to confirm the upload
• A cover image and, for a video, 4 still frames taken from it, used for previews and safety checks
• The results of our automatic safety checks, any human review, and any reports about it

Before anyone else can see your proof, we remove the location and device details stored inside the file. When you put a photo or video on a share card, a video card is made on your device and a photo is sent to us only to draw the card and is not stored.

Usage Data

• App interaction analytics (screens viewed, features used)
• Device type, operating system, app version, timezone
• Push notification tokens (for sending reminders and alerts)
• An app install ID, used to block fake or automated sign-ups
• Crash reports: an error code, the screen, the app version and platform, and a scrambled account ID (never the error message or your content)
• Performance measurements: how long AI Coach replies take to appear, in milliseconds (never the message content)

Billing Data

• Subscription status and tier (managed by RevenueCat via the Apple App Store or Google Play)
• We do NOT directly collect or store credit card numbers or payment credentials

2. How We Use Your Information

• AI Personalization: Send relevant fitness data to OpenAI's API to generate plans, recommendations, and coaching responses after you consent to the required processing.
• Food Photo Analysis: Send a food photo to OpenAI for nutritional analysis; TruFitAI does not save the source photo to your account.
• Progress Photo Analysis: Store progress/body photos you upload and send a photo to OpenAI only when you request AI analysis.
• Progress Tracking: Store logs and metrics to display and evaluate your fitness journey.
• Device Health Imports: With your separate consent, use the Apple Health or Google Health Connect categories you authorize to show activity, recovery, and progress, and use imported body weight, together with weight you log in the app, to review and adjust your weekly calorie and nutrition targets. We do not add imported active calories to your food targets.
• User-directed Recipe Sharing: After a separate per-recipe disclosure and affirmative choice, publish specified recipe fields through a public share link, and stop future link access when you unshare it. This consent is separate from consent to share data with OpenAI.
• Friends, Cheers, and Leaderboards: Show your wins, cheers, waves, and leaderboard places to the members your settings allow (see Section 4), suggest friends from mutual friends, and group cheers and waves into social notifications.
• PR Proof: Show your proof to the audience you choose, and check it for safety before anyone else can see it (see Sections 3 and 4).
• Notifications: Send reminders, streak alerts, plan updates, and social notifications according to your app and device choices.
• Community safety and legal duties: Review reports, enforce our Terms of Service, protect members, and report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) as US law requires.
• Billing: Manage subscription status through RevenueCat and the Apple App Store or Google Play.
• Service, security, and support: Operate, secure, troubleshoot, improve, and support the Service.

3. AI Data Processing Disclosure

TruFitAI uses OpenAI's API to power its AI features. When you use AI-powered features, the following data may be sent to OpenAI for processing:

• Workout Plan Generation: Your fitness goals, experience level, available equipment, and physical attributes.
• Food Photo Analysis: Your food photos are sent to OpenAI's vision model. Food photos are processed in real time and are not stored by TruFitAI after analysis. OpenAI processes them under its API Data Usage Policy (see below); we do not control OpenAI's retention.
• Progress/Body Photo Analysis: Progress photos you upload for body-composition analysis are stored by TruFitAI (in Supabase Storage) and are sent to OpenAI's vision model. OpenAI processes them under its API Data Usage Policy (see below); we do not control OpenAI's retention.
• Nutrition Recommendations: Your dietary preferences, calorie targets, and macronutrient goals.
• Supplement Suggestions: Your fitness goals and dietary profile.
• AI Coaching: Your conversation messages and relevant fitness context.
• PR Proof Safety Checks: Still images from each PR proof you add (a cover image and, for a video, 4 frames; never the whole video or its sound) are sent to OpenAI's moderation model, which scores them for sexual content, violence, and self-harm. This check is part of posting proof, runs on every proof, and does not depend on your choice about sharing health data with OpenAI for AI coaching. The scores decide whether your proof goes live or waits for a person to review it; they never remove proof on their own.

OpenAI processes this data under their API Data Usage Policy. As of our last review, OpenAI does not use data submitted via their API to train their models. We recommend reviewing OpenAI's policies directly for the most current information.

4. Data Shared with Third Parties

We share specific data with third-party services to provide the Service. Below is an itemized breakdown:

• Supabase: User data (account info, workout logs, nutrition data, progress metrics) is stored in our Supabase database with row-level security, and the progress/body photos you upload are stored in Supabase Storage. A recipe you explicitly share is the limited exception: its recipe content and nutrition-per-serving information can be viewed through its public share link until you unshare it. Supabase acts as our data processor.
• OpenAI: Fitness profile data, food photos, progress/body photos, conversation messages, and relevant context for AI features, and still images from PR proof for safety checks (see Section 3 above). No persistent personal identifiers are shared beyond what is necessary for AI processing.
• Microsoft (PhotoDNA): Once we turn this check on, still images from PR proof are sent to Microsoft's PhotoDNA service, which compares them with known child sexual abuse images. Microsoft does not receive your account details and acts as our service provider for this check.
• RevenueCat: Anonymous user identifier and subscription status for in-app purchase management. RevenueCat does not receive your fitness or health data.
• SideShift (athletes only): If you join the Athlete Program, SideShift receives your name, social handles, contract terms, and the agreement you signed, and it verifies your post views, collects your tax forms, and pays you. SideShift does not receive your fitness or health data.

User-directed public sharing: Separately from these service providers, if you choose “Make public & share” after the per-recipe disclosure, the recipe fields listed in Section 7 are available without login to anyone with the public link until you unshare it. Recipients may save or redistribute the recipe; Unshare stops future access through TruFitAI but cannot recall copies already saved or redistributed.

What Other Members See

Some features show your information to other TruFitAI members. Your settings decide who:

• Your accepted friends see your username, display name, and profile photo; your PR, streak, level-up, and achievement wins (for a PR, the exercise, weight, and reps) and who cheered them; and your places on the Friends leaderboards. You show on your friends' leaderboards unless you turn off "Show me on my friends' leaderboard" in Settings. Friends still see your wins when that switch is off; to stop one person seeing them, remove or block that person.
• Only after you say yes, friends also see when you finish a workout (that you trained and when, never your exercises, sets, or weights) and when you reach your goal weight (never your weight or goal number). You can turn either off at any time.
• Any signed-in member can see you on the world leaderboard only if you turn on "Show me on the world leaderboard". Members aged 13 to 15 cannot turn it on.
• Friends of your friends may see you as a suggested friend, with your number of mutual friends, only if you let friends find you by username.
• Cheers and waves you send are shown, with your username, to the member who gets them, and cheers are shown to others who can see that win.

Members you block, and members who block you, do not see each other on these features.

PR proof: You choose who sees each PR proof: Only me, Friends, or Everyone (anyone signed in to TruFitAI). Everyone is open to adults and, for lift proof only, to members aged 16 and 17. Physique photos of members under 18 can never be shown to Everyone. The first time you choose Everyone, we ask for your agreement. Proof shown to Everyone appears with your username and the PR, and a lift video can appear on the world leaderboard with your PR, marked as video proof. Members who can see your proof can play it, cheer it, and report it. You can change who sees it or delete it at any time. We do not publish proof outside the app; you can choose to put it on a share card and share that card yourself.

Legal reports: If we find apparent child sexual abuse material, we remove it, keep it as evidence under legal hold, and report it, with information about the account that posted it, to NCMEC as 18 U.S.C. 2258A requires. NCMEC may share reports with law enforcement. We may also disclose information when the law requires it, such as to respond to a valid legal order.

We do not sell personal data for money or share personal data for cross-context behavioral advertising. We do not disclose health or fitness data to advertisers.

5. Advertising and Cross-Context Tracking

TruFitAI is a paid subscription service. The app does not display advertising, include an advertising SDK, request an advertising identifier, or use personal information for cross-context behavioral advertising.

6. Cookies and Tracking Technologies

The TruFitAI mobile app does not use browser cookies. Our web services may use the following:

• Session Tokens: Authentication tokens stored securely on your device to keep you logged in.
• Local Storage: App preferences, cached data, and offline functionality stored locally on your device.
• Analytics: Basic usage analytics (which screens and features are used, and whether onboarding and purchases complete) to understand feature adoption and app performance. These analytics are kept on our own servers and are never shared with analytics or advertising companies. No third-party tracking pixels or cookies are used on our website.

We do not use cross-site tracking cookies, advertising identifiers, fingerprinting, or other persistent cross-context tracking technologies.

7. Health Data Handling

We treat all health and fitness data with the highest level of care:

• Health & Fitness Data You Enter: The workout, nutrition, step, and body-metric data you log is used solely to power your plans, display your metrics in the app, and inform AI-powered recommendations. It is never used for advertising and never sold. It is disclosed only to the service providers described in this policy as needed to operate requested features, except for recipe content and nutrition-per-serving information that you explicitly choose to make available through the recipe Share feature, and the workout results other members see as described in Section 4.
• Workout and Nutrition Data: Your workout logs, food logs, targets, and other personal nutrition tracking are stored securely with row-level security in Supabase and are accessible only by you and our service/AI processing pipeline, except the workout results shown to other members as described in Section 4 (your PRs, streaks, workout counts, and leaderboard places). If you affirmatively choose “Make public & share” after the separate disclosure, that recipe's title, description, image, ingredients, instructions, servings, timing, tags, and nutrition-per-serving information are accessible without login to anyone with the public link until you unshare it. Sharing a recipe does not expose your workout logs, food logs, nutrition targets, account identity, or other private health data.
• Imported Device Health Data: Apple Health or Google Health Connect records you separately authorize and consent to upload are used to show activity, recovery, and progress, and imported body weight is used in your weekly calorie and nutrition target review. They are never used for advertising, never sold, and you can disconnect or delete them in Settings.
• Progress/Body Photos: Photos you upload to track physique changes are stored in Supabase Storage and are sent to OpenAI's vision model only when you request a body-composition analysis. They are retained while your account is active and are deleted when you delete your account (see Section 8).
• Social Sharing of Fitness Data: Goal weight wins and finished workouts are shown to friends only after your separate yes. PR proof physique photos are body photos: they are shown only to the audience you choose, checked as described in Section 3, and never used for body-composition analysis unless you upload them separately as progress photos.

8. Data Retention & Deletion

We retain each category of data for the period, or according to the criteria, described below. "While your account is active" means we do not delete this data on a fixed schedule while you keep your account; you can delete it at any time as described at the end of this section. We do not currently delete data automatically after a period of inactivity; if we introduce inactivity-based deletion, we will update this schedule.

You may request deletion of your account and associated data at any time through the app settings or by contacting us. Upon deletion, account content and consumer health data (including any progress/body photos you uploaded) are permanently removed within 30 days. Limited consent/withdrawal, transaction, billing, and qualifying safety records may be retained only for an applicable legal or evidentiary period; public-recipe consent evidence keeps an opaque recipe id but no copy of recipe content. Anonymized, aggregated data may be retained, and data already processed by third-party APIs (e.g., OpenAI) is subject to those services' data retention policies, which we do not control.

9. Data Security

• All data is encrypted in transit (TLS/HTTPS) and at rest
• Row-level security policies restrict private account data to account owners; recipes explicitly shared by their owner are exposed only through the curated public share-link API until unshared; other members see your social information and PR proof only after our servers check friendship, blocks, age, and your settings
• API endpoints are rate-limited and input-validated
• Admin secrets use timing-safe comparison
• Food photos are ephemeral — analyzed and immediately discarded
• Authentication is managed via Supabase Auth with secure session handling

10. International Data Transfers

TruFitAI is operated from the United States. Your data may be processed in the United States and other countries where our service providers operate, which may have different data protection laws than your country of residence.

Where applicable law requires a transfer safeguard, we use the contractual or statutory mechanism applicable to the recipient and country. The supporting vendor contracts and transfer assessments are a release prerequisite. TruFitAI is not offered in the EEA or United Kingdom.

11. Your Privacy Rights

General Rights

You can exercise the most common rights yourself in the app under Settings → Privacy Choices & Data. For anything else, email us; we will verify your identity where required and respond within the time applicable law provides.

• Deletion (self-serve): You can permanently delete your account and all associated data yourself, in the app under Settings → Delete Account, or by emailing us.
• Access: Download a copy of your personal data in Settings → Privacy Choices & Data → Download my data, or email [email protected]. The download includes your PR proof files as links.
• Portability: The download is a complete, machine-readable file (JSON), and your activity logs are also available as CSV, so you can reuse or move your data.
• Rectification: Update or correct your information — much of it directly in the app; otherwise by emailing us.
• Restriction: Request that we limit how we process your data (by email).
• Objection: Object to data processing based on legitimate interests (by email).
• Opt-out: Withdraw health-data collection, disable push notifications (including social notifications), hide from the Friends or world leaderboards, or opt out of ad sharing and personalization in the app or device settings.
• Withdraw consent: Withdraw health-data processing or AI-sharing consent at any time in Settings → Privacy Choices & Data. Account and basic settings remain available; dependent personalized AI features pause. Public-recipe consent is separate: open the recipe in Recipe Book and choose Unshare to stop future access through its public link. Workout sharing and goal weight sharing with friends can be turned off in Settings, and you can change who sees a PR proof, or delete it, on the PR.

CCPA-Specific Rights (California Residents)

• Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you. The in-app download (Settings → Privacy Choices & Data → Download my data) provides the specific pieces; you can also make the request by email after identity verification.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• Authorized Agent: You may designate an authorized agent to submit requests on your behalf.

To exercise a right, authorize an agent, or appeal a denied request, use the in-app controls or email [email protected]. We will explain any verification needed, respond within the time applicable to your region, and provide regulator complaint information when required.

12. Do Not Sell or Share My Personal Information

TruFitAI does not sell personal information for money or share personal information for cross-context behavioral advertising. We also do not sell or share health or fitness data for advertising.

Because we do not engage in those practices, there is no advertising-sharing preference to enable. We still recognize privacy-rights requests and browser Global Privacy Control signals. Contact us if you believe a covered sale or sharing practice occurred.

If you are a California resident and wish to exercise your rights under the CCPA, or if you have questions about our data practices, contact [email protected].

13. App Store Privacy Disclosures

Apple App Privacy Labels

In accordance with Apple's App Store requirements, we disclose the following data collection practices through Apple's App Privacy Labels on our App Store listing. The privacy labels reflect the data types described in this policy, including:

• Data Used to Track You: None. TruFitAI does not use collected data to track users across other companies' apps or websites.
• Data Linked to You: Contact info (name, email, phone number); health and fitness; photos or videos (progress photos and PR proof); other user content (AI Coach messages, voice-log transcripts, recipes, cheers, and waves); customer support messages; contacts (text invite codes, iPhone); purchases (subscription history); identifiers (account ID, app install ID); usage data (app activity); and diagnostics (crash reports and performance data).
• Data Not Linked to You: None.

For the most current details, see our App Privacy Labels on the App Store.

Google Play Data Safety

In accordance with Google Play's Data Safety Section requirements, we disclose the following:

• Data Collected: Name, email address, health and fitness data you enter (workouts, nutrition, body measurements, progress/body photos), photos and videos you add as PR proof, cheers and waves, Health Connect data you separately authorize and consent to upload (such as steps, workouts, sleep, heart rate, and weight), app activity, and account identifiers.
• Data Shared: Fitness profile data, food photos, and progress/body photos shared with OpenAI for requested AI features. Still images from PR proof checked by OpenAI and, once enabled, Microsoft PhotoDNA for safety. Account identifiers and purchase information shared with RevenueCat for billing. Recipe content and nutrition-per-serving information are publicly accessible only when you explicitly create a share link and until you unshare it.
• Health-data limits: Health and fitness data is disclosed only to the service providers identified in Sections 3 and 4 to provide requested app features, except for a recipe you explicitly share as described in Section 7 and the workout results other members see as described in Section 4; it is never shared with advertisers or used for advertising.
• Security: Data is encrypted in transit and at rest.
• Deletion: Users can request data deletion through the app or by contacting support.

For the most current details, see our Data Safety section on the Google Play Store.

14. Children's Privacy

TruFitAI requires users to meet the minimum age for their location: 13 in most supported locations, 14 in Quebec and South Korea, and 18 in India. We do not operate a parental-consent account flow or display advertising. If you believe an ineligible child provided personal data, email [email protected].

Members under 18 get stricter social settings. They start hidden from username search and friend suggestions, can never show physique photos to Everyone, and get no social notifications between 10 PM and 7 AM in their time zone. Members aged 13 to 15 never appear on the world leaderboard and cannot show PR proof to Everyone. Members aged 16 and 17 can do both only if they choose to; it is never preselected for them. Like adults, members under 18 show on their accepted friends' leaderboards unless they turn it off.

15. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via the app, push notification, or email at least 30 days before the changes take effect. The "Last updated" date at the top of this policy will be revised accordingly. Your continued use of the Service after any changes constitutes your acceptance of the revised policy.

16. Contact Us & Data Controller

The data controller responsible for your personal data is:

• Entity: TruFitAI App Co.
• Postal address: 131 Continental Drive, STE 305, Newark, DE 19713, USA
• Email: [email protected]
• Website: trufitai.io

If you have questions about this privacy policy, your data, or wish to exercise your privacy rights, contact us using the details above.

European Economic Area and United Kingdom

TruFitAI is not offered to, and does not monitor the behavior of, individuals in the European Economic Area or the United Kingdom. The TruFitAI app is not available in EEA or UK app stores, and we do not accept account registrations from those regions. Accordingly, no representative under Article 27 of the GDPR or Article 27 of the UK GDPR has been appointed. If we make TruFitAI available in these regions in the future, we will update this policy and appoint representatives as required.