Privacy & Data Handling

What we collect.

Transform is a measurement instrument. To work, it needs measurements. We collect only the minimum required to render your mission and only with your explicit permission for each category.

• BodyWeight, body composition, progress photos, sleep, HRV, resting heart rate (HealthKit and manual entry).
• TrainingExercises, sets, reps, weights, RPE, rest timers.
• NutritionMeals you log, supplements, macros computed against our food database.
• BloodworkLab panels you upload manually as PDF or enter by hand.
• AccountApple Sign In identifier, optional email, billing handled entirely by Apple via in-app purchase.
• DeviceiOS version, app version. Also attribution identifiers sent to AppsFlyer (see Analytics/Sharing below) — your device's advertising identifier only if you allow the iOS tracking prompt. We don't enable crash reporting — no crash report ever leaves your device.
• AnalyticsApp-usage events (app opened/backgrounded, which onboarding step you're on, how long each screen was viewed, whether you started a subscription, and the onboarding answers you pick — goal, dietary pattern such as vegan or keto (never allergens), training split and days, food-logging preference, gender, activity level) via PostHog. During onboarding only, we also record a screen replay — never of your weight, allergens, bloodwork, the body-scan camera, or your sign-up credentials, and never of anything after onboarding (Home, Food, Gym, Coach, Progress). PostHog sees your device's IP address in transit, but we've switched off its location lookup, so we never know where you are.

How we use it.

Your data drives exactly two things: (1) the readouts and visualizations inside the app, (2) the Coach insights generated from your own trends. That's the entire list.

What we never do. We do not sell data. We do not show ads in the app. We do measure our own ads: AppsFlyer tells us which campaign brought an install, and which subscription and app-funnel events followed that install (only using your device's advertising identifier if you allow the iOS tracking prompt) — it never sees your training or health data, and we never use analytics to target you with anyone else's ads. We do not train external AI models on your data. We do not share your bloodwork, training, or bodyweight data with anyone — ever — outside what's listed in the next section.

Who sees your data.

• YouAlways. Export available in Settings → Account → Export.
• SupabaseOur database provider hosts the encrypted tables. They cannot read your data without our keys.
• OpenAIAll AI features (Coach replies, meal text and photo parsing, bloodwork insights, supplement recommendations, and — only if you complete the optional body scan and subscribe — a one-time physique estimate from your scan photo, which is processed once and never stored or linked to you) send only the input each feature needs — an anonymized prompt or the meal image, never your name or email — to OpenAI. Under our signed Data Processing Agreement, OpenAI does not use your inputs or outputs to train, fine-tune, or improve its models; it retains them for at most 30 days for abuse monitoring and then deletes them.
• AppleSubscription billing is handled entirely by Apple via in-app purchase. We never see your card, address, or full Apple ID.
• PostHogOur product-analytics provider. Sees app-usage events, app-lifecycle events, your app-generated user ID, standard device and environment context (app version, OS name and version, device model and type, language, time zone, network type), and (during onboarding only, with the exclusions above) a screen replay. Never your health data, meal data, progress photos, bloodwork, or Coach messages.
• AppsFlyerOur attribution and conversion-measurement provider. Sees device identifiers (the advertising identifier only if you allow the iOS tracking prompt), install and session timestamps, IP address, device model and OS version, your app-generated user ID, subscription and purchase events (product identifier, trial status, price, currency, transaction identifier), and app-funnel events (registration, login, onboarding completion, paywall view). If you decline the prompt, attribution falls back to Apple's privacy-preserving SKAdNetwork — aggregate numbers, nothing about you. Exists to answer two questions — which ad brought you here, and whether you subscribed afterwards. Never your health data, meals, bloodwork, or Coach messages. You may opt out at any time in Settings → Privacy → Share Usage Data. Doing so immediately stops all analytics collection, session replay, and in-app attribution reporting. Because our subscription processor, RevenueCat (next entry below), cannot retroactively unset an attribution identifier once it has been assigned, subscription events processed through RevenueCat may remain linked to attribution data after you opt out; on request, we will submit a deletion request to AppsFlyer for attribution data collected from your device.
• RevenueCatOur subscription-management provider, RevenueCat, Inc. Handles subscription management, purchase validation, and entitlement state, and forwards purchase events to AppsFlyer for advertising measurement on our behalf. Sees purchase and transaction data (product identifier, price, currency, trial and renewal status), your app-generated user ID, and the AppsFlyer device identifier. Never your health data, meals, bloodwork, or Coach messages.

Where it lives.

Encrypted at rest and encrypted in transit with TLS. Primary storage is in us-east-1 on Supabase. We do not yet operate an EU region; if you're in the EU/UK, please review this before signing up.

We retain your data for the duration of your subscription plus 30 days after cancellation. After that, it is purged from primary storage; database backups roll off within 90 days.

What you can do.

• ExportDownload a JSON copy of every record we have on you, in-app, at any time.
• DeleteWipe your account from Settings → Account → Delete. Honored within 7 days; backups within 90.
• CorrectEdit any logged value at any time. The local history stays for audit, but you control it.
• WithdrawCancel your subscription in Settings → Subscription (handled by Apple). Your data is retained per the policy above unless you also choose Delete.

How we defend it.

TLS in transit, encryption at rest at the database level (Supabase managed Postgres). Sign in with Apple — we never store or see your password. Production database access is limited to a small set of administrators.

We're a small, pre-launch team. We don't claim formal certifications we don't have. If you find a security issue, please email [email protected] — we'll acknowledge within 72 hours.

If we ever experience a breach affecting your data, we will notify you within 72 hours of confirming it, in plain language, with a list of exactly what was exposed.

Terms of service.

Not medical advice. Transform is a measurement and tracking tool. Coach insights are statistical observations, not medical prescriptions. Always consult a licensed physician before changing diet, training, or supplementation — especially when bloodwork is involved.

Subscriptions. Billing is handled by Apple via in-app purchase. Subscriptions auto-renew until cancelled. Cancel anytime in your iOS Settings → Apple ID → Subscriptions; refunds are handled by Apple per their standard policy.

Acceptable use. Transform is for personal use. Don't reverse-engineer, scrape, or use the service to build a competing product. We may suspend accounts that abuse the API or attempt to access other users' data.

Talk to a human.

Privacy questions, data requests, or anything that doesn't sit right: [email protected]. We answer within 48 hours, and a real person — not a ticketing bot — handles it.

General questions: [email protected]. Security disclosures: [email protected].