DRAFT ÔÇö not legal advice. This is a working draft assembled from the app's actual data flows, meant as a starting point for legal review before publishing. Replace all TODO placeholders (company name, legal entity, address, contact email, jurisdiction) and have it reviewed before this page goes live or is linked from the app.

Privacy Policy ÔÇö My Journey

Last updated: TODO date of publication

This Privacy Policy explains what personal data TODO ÔÇö legal entity name ("we", "us") collects through the My Journey mobile app ("the App"), why we collect it, who we share it with, and what rights you have over it.

1. Who we are

Data controller: TODO ÔÇö company/individual name, address, country.
Contact for privacy questions: TODO ÔÇö contact email.

2. Data we collect

The App is a fitness and health-tracking product. Some of the data below is special category data under GDPR Art. 9 (health data), which we only process with your explicit consent, given when you enable the relevant feature.

Category	Examples	Special category?
Account data	Email, full name, avatar, timezone, sex, age, height	No
Body metrics	Weight, body measurements (chest/waist/hips/arms/neck/thighs/calves), progress photos	Yes ÔÇö health data
Vitals (via Apple Health / Health Connect, optional)	Resting heart rate, sleep sessions, step count	Yes ÔÇö health data
Menstrual cycle tracking (optional feature)	Last period date, cycle length, period length	Yes ÔÇö health data
Injuries / limitations	Body part, severity, exercises to avoid	Yes ÔÇö health data
Training & nutrition activity	Workout logs, sets/reps/weight, cardio sessions, meal logs, sleep/energy/mood notes, AI coach chat history	Partially ÔÇö treated as health-adjacent
Subscription status	Plan tier, active/trial/expired (via RevenueCat) ÔÇö no card numbers	No
Device & push notification token	Expo push token, reminder preferences	No
Crash & performance diagnostics	Error stack traces, performance spans (via Sentry)	No

3. How we use your data

Provide the core service: generate and adapt your training/nutrition plan, track progress, send reminders.
AI-powered features: your fitness data, injury notes, chat messages, and (when you request analysis) meal or body-composition photos are sent to our AI provider to generate coaching feedback, meal analysis, or body assessments.
Account & billing: manage your subscription status.
Reliability: diagnose crashes and performance issues.
Communications: transactional emails (e.g. milestone notifications) and push notifications you've opted into.

4. Legal basis for processing (GDPR)

Contract (Art. 6(1)(b)) ÔÇö core app functionality you sign up for.
Explicit consent (Art. 9(2)(a)) ÔÇö health data: weight, heart rate, sleep, menstrual cycle, injuries, body photos. You can withdraw consent at any time by disabling the feature or deleting your account.
Legitimate interest (Art. 6(1)(f)) ÔÇö crash reporting and abuse prevention.

5. Who we share data with (processors)

Processor	Purpose	Data involved
Supabase	Database, authentication, backend functions	All app data
Anthropic (Claude API)	AI coaching, plan generation, meal/body-photo analysis	Fitness data, chat messages, photos (when analysis is requested)
Cloudflare R2	Photo storage	Progress/body photos
RevenueCat	Subscription management	Subscription status (no payment card data)
Resend	Transactional email	Email address, milestone content
Sentry	Crash/error reporting	Error traces, device/app metadata
Expo (push notifications)	Push delivery	Push token
Apple Health / Google Health Connect	Optional vitals sync, on-device only unless you opt in	Weight, heart rate, sleep, steps

We do not sell your personal data. TODO ÔÇö confirm international transfer safeguards (SCCs) for Anthropic/Sentry/etc. if you are in the EU/UK.

6. Data retention

We retain your data for as long as your account is active. We do not currently run automatic deletion of old logs ÔÇö data is kept until you delete your account, at which point (see below) it is permanently removed.

7. Your rights

Access ÔÇö request a copy of the data we hold about you.
Erasure ÔÇö delete your account and all associated data at any time from Settings Ôćĺ Delete Account. This immediately and permanently deletes your profile, logs, photos, and chat history, and cannot be undone.
Rectification ÔÇö correct inaccurate data via the app's profile/settings screens.
Portability & objection/restriction ÔÇö contact us at TODO ÔÇö contact email.

8. Children

The App is not directed at children under TODO ÔÇö age, e.g. 16. We do not knowingly collect data from children below this age.

9. Changes to this policy

We may update this policy as the App evolves. Material changes will be communicated in-app.

10. Contact

TODO ÔÇö contact email/address