Privacy Policy

Last Updated: June 11, 2026
Effective Date: June 11, 2026

Health & Beauty AI ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App").

1. Information We Collect

1.1 Information You Provide Directly

• Account Information: When you sign in using Google or Apple Sign-In, we collect your email address and basic profile information.
• Health and Fitness Data:
  • Food tracking data (calories, macronutrients, meal photos)
  • Weight logs
  • Activity logs
  • Water intake records
  • Sleep logs
  • Progress photos
  • Supplement logs
  • Menstrual cycle information (if applicable)
  • Mood, energy, digestion, and skin logs
• User-Generated Content: Notes, descriptions, and other information you enter into the App.

1.2 Information Collected Automatically

• Device Information: Device type, operating system, unique device identifiers, and mobile network information.
• Usage Data: How you interact with the App, features used, and time spent in the App.
• Diagnostics: Crash reports and performance metrics (via Sentry) to improve app stability.
• Location Data: Approximate location data for fitness tracking (only when the App is in use).
• Health Data from Apple Health: Steps, sleep data, and other health metrics you choose to sync (iOS only).

1.3 Information from Device Permissions

• Camera: To capture photos of food for analysis
• Photo Library: To select existing photos for food analysis
• Microphone: For voice commands and voice interactions
• Location: For fitness tracking features
• Motion Sensors: To improve gesture-driven logging and activity insights
• Health Data (iOS): To sync steps and sleep data from Apple Health

2. How We Use Your Information

• Provide Core Services: Track your nutrition, fitness, and health goals
• AI Analysis: Analyze food photos and text to estimate nutritional content, provide coaching feedback, and generate health insights. Food, nutrition, activity, and health data you submit — including data synced from Apple HealthKit (steps, sleep, weight, workouts) — is forwarded to OpenAI (GPT models) and Google (Gemini models) for AI inference. These providers act as data processors on our behalf and are contractually prohibited from using your data to train their general models. We do not allow these providers to use your data for advertising or any purpose beyond delivering the Service to you.
• Personalization: Provide personalized recommendations based on your goals and preferences
• Improve the App: Analyze usage patterns to improve features and user experience
• Customer Support: Respond to your inquiries and provide technical support
• Safety and Security: Detect and prevent fraud, abuse, and security issues
• Legal Compliance: Comply with applicable laws and regulations

3. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

3.1 Service Providers

• Backend Services: Your data is stored and processed on secure servers (Vercel, Neon Postgres)
• Authentication: Firebase Authentication
• AI Providers: OpenAI (GPT models) and Google (Gemini) process food/nutrition analysis, coaching feedback, supplement guidance, and AI chat requests. Health data forwarded to these providers is used solely to generate responses within the Service and is not used for advertising, marketing, or sale.
• Progress Image Storage: Progress photos you upload are stored in Vercel Blob. These images are not shared with AI providers unless you explicitly submit them for food or body analysis.
• Payments: Apple App Store, Google Play, and Stripe process subscription and one-time purchases
• Diagnostics: Sentry receives crash reports and error metrics
• Product Analytics: PostHog (EU-hosted, eu.i.posthog.com) receives product-usage events and app interactions — for example that a food entry was logged, a screen was viewed, or a purchase was verified — so we can understand which features are used and where the app is confusing. Analytics events carry only counts, flags and category labels alongside your account identifier. No health-record content is included in analytics events: no food or supplement names, no nutrient values, no photos, no chat or journal text, and no measurements. Your data stays in the EU region and is never used for advertising or sold.

3.2 Apple Health Data

When you grant the App permission to read Apple HealthKit data, the following information may be synced: step counts, sleep analysis, and body weight measurements. This data is used exclusively to populate your health logs, personalize AI coaching responses, and display your progress within the App.

Apple HealthKit data is never used for advertising or marketing purposes, and is never sold or shared with data brokers or third-party advertisers. When HealthKit-derived data is included in an AI coaching or analysis request, it is forwarded to OpenAI or Google Gemini as described in §3.1 above, solely to generate your personalized response. Both providers are prohibited from using this data for any purpose other than fulfilling the request.

Voice audio captured during voice-chat sessions is processed ephemerally by OpenAI Realtime. Audio is not stored on our servers and is not retained by OpenAI beyond the duration of the session.

3.3 Legal Requirements

We may disclose your information if required by law or in response to valid requests by public authorities.

3.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4. Data Storage and Security

• Data Storage: Your data is stored securely on our backend servers and locally on your device.
• Encryption: We use industry-standard encryption (TLS 1.2+) to protect data in transit and at rest.
• Authentication: We use Firebase Authentication for secure sign-in.
• Offline Mode: The App can function offline, storing data locally until connectivity is restored.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

5. Your Rights and Choices

• Access Your Data: View all data associated with your account through the App
• Delete Your Data: Permanently delete your account and all associated data via Settings → Delete Account inside the App. The deletion is irreversible and removes your data from our servers within 30 days (subject to any legal retention obligations).
• Revoke Permissions: Adjust device permissions in your device settings
• Export Your Data: Request a copy of your data in a portable format by contacting us

6. Children's Privacy

The App is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we learn that we have collected personal information from a child under 13, we will delete that information promptly.

7. Third-Party Services

• Firebase (Google): Authentication and backend services. See Google's Privacy Policy
• Apple Sign-In: Authentication service. See Apple's Privacy Policy
• OpenAI / Google Gemini: AI analysis. See OpenAI and Google privacy policies.
• Sentry: Error tracking and analytics. See Sentry's Privacy Policy
• PostHog: Product analytics, hosted in the EU (eu.i.posthog.com). See PostHog's Privacy Policy
• Stripe: Payment processing. See Stripe's Privacy Policy

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your country. By using the App, you consent to the transfer of your information to these countries.

9. Data Retention

We retain your information for as long as your account is active or as needed to provide you services. If you delete your account, we will delete your personal information within 30 days, except where we are required to retain it for legal purposes.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page, updating the "Last Updated" date, and (for material changes) notifying you through the App.

11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your privacy rights

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: support@healthbeauty.app