Privacy Policy

Effective September 13, 2026 · Last updated September 13, 2026

This policy explains how SweatBud handles information when you use our iPhone app, website, and support services. Questions or privacy requests can be sent to support@sweatbud.app.

1. Information you provide

SweatBud uses information you enter to personalize your experience, including your goals, age or birth year, height, weight, fitness experience, available equipment, workout preferences, and any injuries or special concerns you choose to share. We also process your AI chat messages, workout plans, saved routines, favorites, workout history, and progress records.

You can begin with a guest account. Firebase creates an anonymous account identifier for this experience. If you choose Sign in with Apple, we process the account identifier and any name or email Apple shares with your permission. Information you include in a support email is used to respond to your request.

2. AI features and body scans

When you request an AI workout plan or chat with the planner, relevant profile information, instructions, and conversation context are sent through our backend and OpenRouter to an AI model provider to generate a response. Only share information you want processed for that request.

If you use body scanning, the photos you select or capture are compressed and their embedded metadata is removed before they are sent securely through our backend to an AI provider for analysis. Photos are therefore processed outside your device during analysis. Scan results may include estimated body measurements, body composition, and suggested training focus.

Our body-scan service does not save raw photos to backend storage. Draft structured results are held on our backend to support saving, discarding, and retrying a scan. They do not have a fixed automatic expiration in the current implementation; see the retention details below. If you save a scan, its photos are stored locally on your device with file protection and excluded from device backup; structured results are saved to your account. The scan service requests provider routing that disallows data collection and requires zero data retention. Provider handling remains subject to the applicable service terms. Other AI features may use different provider settings. Agreeing to our Terms of Use or this policy alone is not a substitute for any separate explicit permission required before sharing personal data with third-party AI services.

3. Apple Health

Apple Health access is optional and controlled by your permissions. Supported features can read workout, active energy, height, and weight information, and save completed workouts and active energy to Apple Health. You can change these permissions in your device’s Health or Settings app. We do not sell Apple Health data or use it for advertising. Disabling access may limit connected features.

4. How we use information

• Provide and personalize workouts, exercise guidance, AI responses, and progress tracking.
• Save your preferences and maintain or synchronize account data where supported.
• Operate, secure, and troubleshoot the service, prevent abuse, and respond to support requests.
• Meet applicable legal obligations and enforce our terms.

Where applicable law requires a legal basis, we process information to provide the service you request, with your consent where required, for legitimate operational and security interests, or to meet legal obligations. Optional permissions can be withdrawn through the relevant controls.

5. Service providers and sharing

We use Google Firebase for authentication, backend processing, account storage, and website hosting; OpenRouter and its selected model providers for AI requests; and exercise-media providers, including YMove, to deliver exercise content. These providers may process the information needed for their functions, including technical request data. Apple handles Sign in with Apple, Health permissions, and any App Store payments.

We do not sell your personal information or share it for targeted advertising. We may disclose information when required by law, to protect rights and safety, or as part of a business transfer subject to appropriate privacy protections. Service providers may process data in countries other than yours, where public authorities may have lawful access under local law. Our requirement for providers that process information on our behalf is protection at least equivalent to the commitments in this policy and Apple’s applicable privacy requirements, with use limited to authorized purposes. We remain responsible for obligations that applicable law assigns to us; a provider’s separate privacy policy does not override those obligations.

Learn more in the Firebase privacy information, OpenRouter Privacy Policy, and Apple Privacy Policy.

6. Website and technical information

This website does not use advertising trackers, analytics scripts, or tracking cookies. Our hosting provider may process operational information such as IP addresses, browser details, requested pages, and timestamps to deliver and secure the website. The app and backend may also process diagnostic and request information needed for reliable operation. Following an external link brings you to a service with its own privacy practices.

7. Storage, retention, and security

We use encrypted network connections, account access controls, and device file protection where supported. These safeguards reduce risk but cannot guarantee that information will never be accessed, disclosed, altered, lost, or destroyed without authorization. If a security incident creates notification obligations, we will make the notifications required by applicable law. This policy does not transfer our legal privacy or security responsibilities to you.

• Account and workout data: saved profile information, plans, history, preferences, and AI notes remain with the account until changed or deleted through supported controls, an account-deletion process, or a verified data request. Uninstalling alone does not delete backend records.
• Body-scan photos: photos are transmitted for analysis but are not saved as raw photos in our backend storage. Saved copies remain on your device until removed using supported scan controls or local app data is erased. They are excluded from device backup and may be unrecoverable if you lose the device or uninstall the app.
• Scan results and request records: saved results remain until deleted. Draft analysis and request records may remain on the backend when a scan is abandoned or a history deletion does not remove its associated request record. The current service does not automatically expire all such records. You may request removal of remaining personal scan records at support@sweatbud.app; completed Apple-account deletion removes records stored under that account.
• Deletion and operational records: minimal account-deletion markers can remain to prevent deleted data from being recreated. Service-provider logs, support correspondence, and any applicable backups follow their operational retention settings and legal requirements. Their durations vary; contact us for information about a particular record. We do not claim immediate erasure from every provider system.

We retain personal information only for the purposes described in this policy and applicable legal requirements. Where information is no longer needed, it should be deleted or de-identified through the applicable retention and deletion processes. We may retain information where needed for a legal obligation, a specific dispute, fraud prevention, or security, subject to applicable limits.

8. Your choices and requests

You can edit supported profile settings, manage device permissions, and use Account & Backup → Delete account while signed in with Apple to delete that account and associated backend records. The current guest experience does not provide the same complete account-deletion control. For guest data or information that remains after deleting a scan, contact support@sweatbud.app while you still have access to the app so we can identify and verify the relevant records. Deleting the app can remove access to a guest identifier without deleting its backend data. Apple Health records, subscriptions, and copies on other devices may require separate management. Scan-history deletion and account deletion have different scopes, as explained above. Deleting an account does not cancel an Apple subscription.

To withdraw consent for future optional processing, disable the relevant device permission and stop using the affected feature, or contact support@sweatbud.app to request that processing stop. For AI sharing, do not submit further planner or scan requests while a withdrawal request is being handled. A withdrawal does not undo processing already lawfully performed and may prevent us from providing the feature that requires that information. We will obtain new consent for a new purpose where required.

Depending on your location, you may have rights to access, correct, delete, or obtain a copy of your personal information, restrict or object to processing, withdraw consent, or complain to a privacy regulator. Contact us to make a request. We may need to verify your identity before acting. Some information may remain where legally required or in provider backups until those expire.

9. Children’s privacy

SweatBud is not directed to children under 13. If you believe a child has provided personal information without the required parental consent, contact us so we can review and address it.

10. Changes and contact

We may update this policy as the service changes. The date above identifies the latest revision. When required, we will provide additional notice or obtain consent for material changes.