Flexx AI

Privacy Policy

Effective Date: April 16, 2026 | Last Updated: August 7, 2026

Quick Summary: Flexx AI is a fitness and nutrition app. We collect only the data needed to provide personalized fitness and nutrition guidance. Your data is stored on secure EU servers (Frankfurt, Germany). We never sell your data. We do not serve ads. You can delete your account and all associated data at any time.

1. Introduction

This Privacy Policy explains how Flexx AI ("we," "us," or "our") collects, uses, stores, and protects your personal information when you use the Flexx AI mobile application ("App") and related services ("Services").

Flexx AI is developed and operated by an independent developer. By using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the App.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

Email address — used for authentication and account communications
Name — used to personalize your experience
Password — securely hashed; we never store or have access to your plaintext password
Authentication provider data — if you sign in with Google or Apple, we receive your name and email from the provider (we never receive your Google or Apple password)

2.2 Body and Physical Data

To provide personalized fitness and nutrition guidance, we collect:

Height, weight, age, and gender
Body measurements (e.g., waist, chest, arms)
Goal weight and fitness goals
Activity level and lifestyle information

2.3 Health Data (Apple Health / Google Health Connect)

With your explicit permission, we may read the following data from Apple Health or Google Health Connect:

Steps and distance walked/run
Active calories burned
Heart rate and resting heart rate
Sleep duration and stages
Blood oxygen saturation (SpO2)
Body fat percentage

Important: Health data access is entirely optional. You can connect or disconnect health data at any time in Settings. We only read health data — we never write to your Apple Health or Google Health Connect account. Health data is used solely to personalize your fitness insights and AI coaching. We never share health data with third parties for advertising, data brokering, or any purpose unrelated to providing our Services.

2.4 Nutrition and Food Data

Food logs — meals, snacks, and beverages you log manually or via barcode scanning
Meal photos — photos you take for AI-powered calorie analysis (stored securely in our database)
Nutrition tracking data — calories, macronutrients (protein, carbohydrates, fat), and daily summaries

2.5 Workout and Exercise Data

Exercise logs and workout history
Workout plans and programs
Progress tracking data (sets, reps, weights)

2.6 Photos

Progress photos — body photos you upload to track physical changes over time
Meal photos — food images submitted for AI calorie analysis

Photos are stored in our secure database (Supabase Storage, EU). Meal and body photos are temporarily processed by our AI providers (see Section 4) and are not retained by those providers after processing.

2.7 AI Conversation Data

Conversations with Coach Flexx (our AI fitness coach) are stored to provide continuity and personalized coaching. Your AI chat history is associated with your account and is not shared with other users.

2.8 Device and Crash Data

We collect anonymous crash reports and performance data through Sentry to improve app stability. This data does not include personally identifiable information (PII). It may include device model, operating system version, and app state at the time of a crash.

2.9 Subscription Data

Subscription purchases are processed by Apple (App Store) or Google (Google Play). We use RevenueCat to manage subscription status. We receive purchase confirmation events (subscription type, status, and expiration date) but do not receive or store your payment card details, billing address, or other financial information.

3. How We Use Your Information

We use the information we collect for the following purposes:

Purpose	Data Used
Account creation and authentication	Email, name, password, SSO provider data
Personalized fitness and nutrition plans	Body data, goals, activity level, workout history
AI-powered meal analysis	Meal photos, food logs
AI-powered progress insights and coaching	Body photos, body data
AI Coach (Coach Flexx) personalization	Profile, nutrition, workout, health, and conversation data
Health insights and progress tracking	Health data (steps, heart rate, sleep, etc.)
Food database and barcode lookup	Search queries, barcode scans
Subscription management	Purchase events, subscription status
App stability and bug fixing	Anonymous crash reports (no PII)

We do not use your data for advertising. We do not sell your data. We do not build advertising profiles.

4. Third-Party Services

We use the following third-party services to operate the App. Each service receives only the minimum data necessary for its function:

Service	Purpose	Data Shared	Data Retention by Provider
Supabase (EU — Frankfurt, Germany)	Database, authentication, file storage	All user data (stored here)	Until you delete your account
OpenAI	AI meal analysis, AI coaching, voice transcription (Whisper)	Meal photos, profile context, chat messages, voice recordings	Not retained (API data usage policy: data sent via API is not used for training and is not stored beyond processing)
Tavily	Web search used by Coach Flexx to answer questions needing current information	The search query derived from your question (no profile or health data)	Per Tavily's privacy policy
Google Firebase Cloud Messaging	Delivery of push notifications (reminders, coach follow-ups)	Device push token	Until you sign out, disable notifications, or delete your account
USDA FoodData Central	Public nutrition database lookups for food search and barcode scanning	The food name or barcode searched (no account identifiers)	Not retained — public reference lookup
RevenueCat	Subscription management	Anonymous user ID, purchase events	Per RevenueCat's privacy policy
Sentry	Crash reporting and error tracking	Anonymous device info, crash logs (no PII)	90 days
Google Sign-In	Authentication	Email, name (provided by Google)	Per Google's privacy policy
Apple Sign-In	Authentication	Email, name (provided by Apple)	Per Apple's privacy policy
FatSecret API	Food database lookups	Food search queries	Per FatSecret's privacy policy
USDA FoodData Central	Nutrition data validation	Food item queries	Public API; no user data stored

We do not share your data with any other third parties. We do not use analytics SDKs, advertising networks, or data brokers.

5. Health Data — Special Protections

We treat health and body data with the highest level of care:

Health data from Apple Health and Google Health Connect is never shared with third parties for advertising, marketing, or data brokering.
Health data is used solely to provide fitness insights and personalized AI coaching within the App.
Health data access requires your explicit opt-in permission and can be revoked at any time.
We comply with Apple's Health data usage requirements and Google's Health Connect permissions policy.
We do not use health data to make eligibility determinations for insurance, employment, or lending.

6. Data Storage and Security

All user data is stored on Supabase servers located in Frankfurt, Germany (EU). This ensures compliance with GDPR data residency expectations for European users.

Security measures include:

Row Level Security (RLS) — enforced at the database level so that each user can only access their own data
Encrypted connections — all data transmitted between the App and our servers uses TLS/HTTPS encryption
Password hashing — passwords are hashed using industry-standard algorithms (bcrypt); we never store plaintext passwords
Secure file storage — photos are stored in authenticated Supabase Storage buckets with per-user access controls
API key protection — server-side operations use service role keys that are never exposed to the client

7. Data Retention

Active account: Your data is retained for as long as your account is active.
Account deletion: When you delete your account, all data is permanently deleted from all database tables (30+ tables), all stored photos are removed, and your authentication record is erased. This process is irreversible.
Crash reports: Anonymous crash data in Sentry is retained for 90 days.
AI processing: Data sent to OpenAI or Tavily for processing is not retained by those providers after the request is completed.
Subscription records: RevenueCat may retain purchase event data per their own retention policy, but this data does not include personal health or fitness information.

8. Your Rights

You have the following rights regarding your personal data:

8.1 Right to Access

You can view all your data within the App at any time (profile, workout history, nutrition logs, progress photos, etc.).

8.2 Right to Data Portability (Export)

You can request a complete copy of all your data in a portable, machine-readable format (JSON) by emailing flexxaiapp@gmail.com from the email address associated with your account. The export includes profile information, body data, workout history, nutrition logs, AI chat history and a list of your stored photos. We respond to portability requests within 30 days. This fulfills GDPR Article 20 (Right to Data Portability).

8.3 Right to Deletion

You can delete your account and all associated data at any time from the App's Settings. Account deletion removes:

All personal information (name, email, body data)
All workout and nutrition data
All photos (meal photos, progress photos, body photos)
All AI conversation history
All health data synced from Apple Health / Google Health Connect
Your authentication record

This action is permanent and cannot be undone.

8.4 Right to Withdraw Consent

You can withdraw your consent to AI processing at any time in Settings → Privacy. While AI consent is off, your data is no longer sent to our AI providers and AI features (Coach Flexx, meal photo and label scanning) stop working; the rest of the App continues to function normally. You can disconnect Apple Health or Google Health Connect at any time. Because the App cannot deliver its core service without processing your fitness data, withdrawing consent to that processing entirely means deleting your account (see Section 8.3), which erases all of it.

8.5 Right to Rectification

You can edit your profile information, body data, and other personal details at any time within the App.

8.6 Right to Restriction of Processing

You can disable specific data processing features (e.g., health data sync, AI features) while keeping your account active.

8.7 Right to Lodge a Complaint

If you are in the EU/EEA, you have the right to lodge a complaint with your local data protection authority (supervisory authority) if you believe your data is being processed unlawfully.

9. GDPR Compliance (EU/EEA Users)

For users in the European Union and European Economic Area:

Legal basis for processing: We process your data based on (a) your consent (health data, AI features), (b) contractual necessity (account creation, service delivery), and (c) legitimate interest (crash reporting, app improvement).
Data location: All primary data is stored in the EU (Frankfurt, Germany).
International transfers: When data is processed by OpenAI, Tavily, Google, or RevenueCat (US-based services), these transfers are conducted under Standard Contractual Clauses (SCCs) or equivalent safeguards as required by GDPR.
Data Protection Officer: As a solo-developer operation, we do not have a formal DPO but respond to all data protection inquiries at flexxaiapp@gmail.com.

10. Children's Privacy (COPPA)

Flexx AI is intended for users aged 13 and older. We do not knowingly collect personal information from children under the age of 13.

If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at flexxaiapp@gmail.com. We will promptly delete such information from our systems.

Users between the ages of 13 and 17 should have parental or guardian consent before using the App.

11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Right to know what personal information we collect (detailed in Section 2).
Right to delete your personal information (available via account deletion).
Right to opt-out of sale: We do not sell your personal information. Ever.
Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

12. Cookies and Tracking

The Flexx AI mobile app does not use cookies, web beacons, or tracking pixels. We do not use any advertising SDKs or analytics tracking beyond anonymous crash reporting (Sentry).

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last Updated" date at the top of this page. For significant changes, we will notify you through the App or via email.

Your continued use of the App after changes are posted constitutes acceptance of the updated Privacy Policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Flexx AI

Email: flexxaiapp@gmail.com

Response time: We aim to respond to all privacy-related inquiries within 30 days.