Privacy Policy

This Privacy Policy describes how TransformAI (“we”, “us”, or “the app”) collects, uses, stores, and protects your personal information when you use our mobile applications, this website and related services. The iPhone app is currently distributed as a TestFlight beta and the Android app is in development; this policy applies to both.

1. Information we collect

Account information. You can use the app as a guest, in which case we create an account tied to an identifier for your device. If you sign in with Apple (or with Google on Android), we receive a stable identifier from that provider and, where the provider shares them, your name and email address. We never receive your Apple or Google password.

Profile & body data. Information you choose to provide: gender, date of birth, height, weight, goal, tape and caliper measurements, and the body-composition results the app produces for you.

Scan photos. When you run an AI body scan, the app blurs faces in the photos on your device and then uploads the blurred copies to our server, which passes them to our AI provider to produce the estimate (see Section 4). The original, unblurred photos stay on your device.

Progress photos. The photos in your timeline are stored locally on your device. They are uploaded to our storage only if you choose to use cloud backup.

Form-check recordings. When you record a set for a form check, the video is analysed on your device and stays on your device. Only numeric pose measurements — such as joint angles and repetition timing — together with the exercise name are sent to our server to generate feedback. Progress reels are generated on your device and are not uploaded.

Coach conversations. What you say or type to the AI coach is sent to our server as text, along with relevant profile and training data, to generate a reply or a workout. Voice input is converted to text using your device's speech recognition, which is provided by Apple or Google and is subject to their terms.

Apple Health and Health Connect data. With your explicit permission, the iPhone app reads steps, sleep, weight and body fat from Apple Health and writes your workouts, weight and body fat to it; the Android app uses Health Connect for the same purpose. This includes readings written by smart-scale apps. Health data is used to provide the app's features — for example, to blend a scale reading into a body-fat estimate — and is never used for advertising or sold.

Habit and training logs. Your habits, habit completions, workout plans, sessions, and skill and strength goals.

Purchase data. Subscription and purchase status from Apple (or Google Play on Android), which our server verifies with the store. We do not see your payment card details; the store handles all billing.

Usage analytics. The app uses Firebase Analytics (Google) to record events such as screens viewed and features used, together with basic device information such as model and operating-system version. This website uses Google Analytics. We do not send your photos, measurements or body-composition results to these analytics services.

2. How we use your information

• To provide the app's features: AI body scans, smart-scale fusion, workout plans, the AI coach, form checks, progress tracking and habit tracking.
• To enforce the free-tier scan allowance and verify Pro purchases.
• To back up and restore your data when you use cloud backup.
• To understand how the app is used and improve it.
• To detect and prevent fraud, abuse, and violations of our Terms.
• To comply with legal obligations.

We do not sell your personal information, and the app and this website contain no advertising.

3. Legal bases (EU/EEA users)

For users in the EU/EEA, we process your data under the following GDPR legal bases: (a) performance of a contract (to deliver the app you requested); (b) consent (for Apple Health / Health Connect access, analytics where required, and optional cloud backup); (c) legitimate interest (security, fraud prevention); and (d) legal obligation (record keeping).

4. Third parties & data processors

We work with a small number of service providers needed to operate the app:

• OpenAI: Our server acts as a proxy to OpenAI's models. For a body scan it sends your face-blurred photos with body data such as height, weight, age, gender and measurements. For the coach, workout plans and form checks it sends text and numbers (for example your request, goals, and pose measurements). We do not send your name, email address or account identifier with these requests.
• Google (Firebase Analytics and Google Analytics): Usage analytics for the app and this website, as described in Section 1. On Android, Google Sign-In, Google Play billing and Health Connect.
• Railway (hosting): Runs our API server and database. Connections are encrypted in transit with TLS.
• Cloudflare: Hosts this website, and stores photos you have chosen to back up (Cloudflare R2).
• Apple: TestFlight and App Store distribution, in-app purchase billing, Sign in with Apple, Apple Health and on-device speech recognition.

We do not share your data with third parties for advertising or marketing.

5. Data retention

We retain your account data for as long as your account is active. When you delete your account (from Settings in the app, or by emailing us), we delete:

• Your progress entries, habits, habit logs and scan-usage records from our database.
• Your user profile record.
• The data the app stored locally on your device.

Analytics data held by our analytics provider is retained according to that provider's retention settings. If you used cloud backup, email us when you delete your account and we will also remove your backed-up photos from our storage. If you cannot access the app, email us and we will delete your account for you.

6. Your rights

Regardless of where you live, you can at any time:

• Access your data (Settings → Export Data).
• Correct your data (Settings → your profile).
• Delete your data (Settings → Delete Account).
• Withdraw consent to Apple Health, Health Connect, camera, microphone or speech recognition access at any time in your device settings.
• Object or restrict processing by contacting us.
• Portability — request an export in a machine-readable format.

To exercise any right, email support@transformai.fit. We respond within 30 days.

7. Children

TransformAI is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe we have, contact us and we will delete it.

8. Security

Data sent between the app and our server is encrypted in transit with TLS. Access to our servers and storage is restricted, requests to the API are authenticated, and purchases are verified with the store rather than trusted from the device. No system is perfectly secure; if we discover a breach affecting your personal data we will notify affected users and the relevant authorities as required by law.

9. International transfers

Our servers are located in the United States. If you access the app from outside the U.S., your data will be transferred to the U.S. under the European Commission's Standard Contractual Clauses and equivalent safeguards where applicable.

10. Changes

We may update this Privacy Policy from time to time. Material changes will be announced in-app and via the email associated with your account. Continued use after the effective date constitutes acceptance.

11. Contact

Questions, complaints, or data requests: support@transformai.fit.