Privacy Policy
This policy explains what Body Madness (“we”, “us”) collects when you use the Body Madness iPhone app and this website, why, who helps us process it, and what you can do about it. We wrote it in plain language on purpose.
1. Who we are
Body Madness is the controller of your personal data in the Body Madness app and on this website. You can reach us at support@bodymadness.app.
Body Madness is an iPhone app (iOS 18 or later) that needs a paid subscription (with a free trial when one is offered), available in English and Ukrainian. The Law of Ukraine “On Personal Data Protection” applies to us as the operator. Where you are in the EU, the UK or California, the laws described in Your rights and California privacy notice also apply.
2. What we collect
Account. When you open the app we create an account for your device using a random device identifier. If you choose Sign in with Apple, we also receive the identifier Apple gives us, and the name and email address you decide to share (Apple can hide your email). We keep the device identifier secret and never show it back to you or anyone else.
Profile and goals. Age (we store your birth year, not your full birth date), sex, height, weight, goals, training experience, equipment, and any injuries or health conditions you choose to enter. This is health-related information. You decide what to enter. If you connect Apple Health, the app can fill in your date of birth, sex, height and weight from it; once they are part of your profile they are stored in your account like anything you type.
Training. Workouts, sets, weights, repetitions, rest times, notes you write on exercises, personal records, and your custom exercises.
Food. Meals you log (by photo, text, voice, barcode or by hand), calories and macros, water, and the daily targets you set or accept.
Body tracking. Weight and other body measurements you record.
Coach. Your chat messages with the AI coach, the weekly check-in the coach writes for you, and, only if you turn coach memory on, short notes the coach saves about you (for example an injury, your equipment or your schedule).
Apple Health. Only if you allow it, and only the types listed in Apple Health: what the app reads, what it writes back, and which daily totals are saved in your account.
Purchases. Whether you have an active subscription, which product, and when it renews or ends. We do not see your card or Apple Account payment details. See Subscription and purchases.
Photos, voice and music. A meal photo you take or pick is sent for analysis (AI features); the app re-encodes it before upload, which removes location and other photo metadata. Voice dictation turns your speech into text using Apple’s speech recognition: on your device where your iPhone supports it, otherwise by Apple’s speech service; we receive only the text. During a workout the app can show the song that is playing in the Music app; it only reads what is playing and nothing is saved or shared. The app does not use your location.
Shared exercises and reports. The exercises you choose to share (Exercises you share) and the reports you send about someone else’s shared exercise.
Technical data. Our servers see your IP address, device and app version, language and time zone with each request, and we count how many AI requests your account makes per day so we can apply fair-use limits. We use them to run the service, limit abuse and fix problems. Our request logs hold the method and path only; we keep prompts, replies, photos and memory text out of them.
3. How we use it, and our legal bases
We use your data to:
- run your account and sync your data across your devices (necessary to provide the app, which is our contract with you);
- generate and adapt workouts, estimate meals, answer coach questions and write your weekly check-in. Where this involves sending data to our AI provider, it needs your permission (below);
- keep your plans safe, for example by limiting or swapping exercises around injuries and conditions you told us about (necessary to provide the app, and your explicit consent for health information);
- verify your subscription and unlock the app (contract);
- keep the service secure, limit abuse, review reports about shared exercises, fix bugs and meet legal obligations (our legitimate interests and legal obligations);
- answer your messages and requests (contract and legitimate interests).
Consent. Three things rest on your explicit consent, and each is a switch you control in the app: (1) AI features, which allow us to send the data described in AI features to our AI provider; (2) Let the AI use Health data, which additionally allows Apple Health numbers to be included; and (3) coach memory, which lets the coach save notes about you. Information about injuries, conditions, Apple Health data and coach memory is health data, a special category under the GDPR; we process it only with your explicit consent, which you give by entering it, allowing Health access, or turning the relevant switch on. You can withdraw consent at any time (see AI features and Deleting your data). Withdrawing does not affect what we did before.
We do not use your data for advertising, we do not sell it, and we do not use it to make decisions that have legal effects on you.
4. AI features and Anthropic
Workouts, programs, meal estimates from photos and text, coach replies, the weekly check-in and exercise import from links are produced with the help of AI models. We use Anthropic, PBC and its Claude models. Our server sends Anthropic what each feature needs, and Anthropic processes it on our behalf as our processor. The app never talks to Anthropic directly.
Your permission comes first. Before the first AI feature is used, the app explains what is sent and to whom and asks for your permission: a step before you subscribe and, for anyone who has not decided yet, a prompt before the first AI action. Nothing is sent to the AI provider without it. You can change your choice at any time in the app under Settings, Preferences, AI features.
What can be sent, depending on the feature you use:
- your profile: age, sex, height and weight (also when they came from Apple Health), goals, experience, equipment, and the injuries and conditions you entered;
- your workouts, meal totals, targets, weight log and notes on exercises;
- what you type, say or photograph for a meal or for the coach, and your recent chat messages;
- what the coach remembers, if you have turned coach memory on;
- for link import, the text we read from the public page of the link you paste;
- Apple Health numbers (such as sleep, steps, active energy, resting heart rate, heart rate variability, a readiness score and workouts from other apps) only if you also turned on “Let the AI use Health data”. That switch is separate and is available only while AI features are on.
We do not send your name, email address or Apple identifier. We send a pseudonymous identifier, a one-way hash of your account number, so that the provider can tell requests from different accounts apart.
Without AI permission the app still works: workouts and programs are built by our own rules instead of the AI, you can log meals by hand or barcode, and you can track your progress, use Apple Health and manage your subscription and data. The coach, AI meal capture from photos, text and voice, the weekly check-in and link import need the AI permission and stay off.
Withdrawing. Turn off AI features in Settings, Preferences. From then on nothing new is sent, and turning it off also switches off the Health switch. You can also delete your account (Deleting your data). Withdrawing does not undo what was already processed.
What Anthropic does with the data. Anthropic handles data it receives through its API under its own terms for business customers and its privacy documentation: see Anthropic’s commercial terms and Anthropic’s privacy policy. How long Anthropic keeps that data, and whether it is used for anything beyond providing the service to us, is governed by those terms and not by this policy, and we make no promise about it here. Meal photos are processed in memory on our server and are not stored by us. Please do not put other people’s personal data into prompts.
AI output is a suggestion for you, not a decision with legal or similarly significant effects. Safety limits for injuries and conditions are checked by our own code after the AI answers, but you remain responsible for how you train. See also the health notice in our Terms of Use.
5. Apple Health
Apple Health access is optional and asked for separately, one data type at a time. You can change it at any time in the iOS Settings app (Health, Data Access & Devices, Body Madness). The app works without it.
What the app reads. Date of birth, sex, height and weight (to fill in your profile and keep your weight up to date); steps and active energy; sleep; resting heart rate and heart rate variability; heart rate (shown during a workout); walking and running distance, cycling distance and exercise minutes (for the Apple Health overview); and workouts recorded by other apps (to show them next to yours).
What the app writes back, only if you allow it. Workouts you finish in the app (with an estimate of active energy), body weight you log, and meals and water you log (dietary energy, protein, carbohydrates, fat and water). If you delete one of these in the app, the matching entry is removed from Health.
What happens to it:
- Read on your phone. Health is read on your device. The Apple Health overview, heart rate during a workout, distance, exercise minutes and workouts from other apps are shown on your device and are not sent to our servers.
- Daily totals sync to your account. So that your own screens (readiness, steps, progress) and your other devices work, daily totals of steps, active energy, sleep, resting heart rate and heart rate variability, and the readiness score we work out from them, are saved in your account on our server. This happens whether or not you allow AI to use Health data. Your age, sex, height and weight are saved as part of your profile. Raw Health samples stay in Apple Health.
- The AI sees Health numbers only with the Health switch. These numbers, and workouts from other apps over the last days, are included in what is sent to the AI (AI features) only while Let the AI use Health data is on (Settings, Preferences). With it off, our server also ignores them when it plans for you. Your profile values (age, sex, height, weight) are part of your profile and go to the AI under your general AI permission.
We never use Health data for advertising or marketing, we never sell it, and we never share it with data brokers or other third parties, other than sending the numbers your plans and coach answers need to our AI provider under the conditions above. We do not store Health data in iCloud. The daily totals already saved in your account stay there until you delete your account (Deleting your data), or ask us to remove them.
6. Subscription and purchases
Body Madness needs an active auto-renewing subscription to use. You buy it in the app through Apple; Apple charges you, handles payment, renewal, cancellation and refunds under its own terms and privacy policy, and we never see your card or payment details. A free trial is offered only when your Apple Account is eligible.
We use RevenueCat, Inc. as our processor to check whether your subscription is active. RevenueCat’s software in the app uses our account identifier for you (not your name or email) and receives purchase information from Apple, such as the product, purchase and renewal dates and whether a trial is running; it may also receive technical information such as your IP address, as described in RevenueCat’s privacy policy. It tells our server whether you have an active subscription, and we store that status and the product.
Deleting your Body Madness account does not cancel your subscription: cancel it with Apple (see our Support page). Subscription and purchase records are also kept by Apple and RevenueCat under their own policies.
7. Who else handles your data
We do not sell your data and we do not share it for advertising. We use the following providers, who process data on our behalf or provide the platform:
- Anthropic, PBC: AI processing, as described in AI features. Only with your permission.
- Apple: Sign in with Apple, the App Store, subscriptions and payments, Apple Health, and speech recognition where your iPhone does not do it on the device.
- RevenueCat, Inc.: subscription status, as described in Subscription and purchases.
- Cloudflare: hosts this website and provides network services and, where enabled, object storage for exercise pictures and for the cover images of your custom exercises.
- our hosting provider: hosts our API server and database, which hold your account data. You can ask us at any time where it is hosted.
- Open Food Facts and USDA FoodData Central: when you scan a barcode or search a food, the barcode or search text is sent to look up nutrition data. Your account data is not sent.
- Link import: when you add an exercise from a link, our server fetches that public page and, depending on the platform, may query that platform’s public interface (for example YouTube, Instagram or TikTok). With AI permission, the text it reads is processed by Anthropic. We keep the link, a short description and a cover image taken from the link; we never download the video.
- Exercise pictures may be loaded by your device from a public GitHub repository or from our own storage, so those providers can see your IP address when you open an exercise.
Same or equal protection. We share personal data only with providers that are bound, by a contract or terms that apply to us as their customer, to protect it with the same or equal protection to what this policy describes and what Apple’s App Review Guidelines require, and to use it only to provide their service to us.
We may also disclose data if the law requires it, to protect rights, safety or the service, or in a merger or sale of the business (we would tell you first).
9. International transfers
Our providers operate in several countries, including the United States, and your data may be processed outside your country, including outside the EU, the UK and Ukraine. Where the law requires it we rely on safeguards such as standard contractual clauses or an adequacy decision, and we choose providers that commit to them.
10. How long we keep data, and deleting it
We keep your data while your account exists. You control it from the app: Settings (the gear on the Today tab), Your data.
- Export my data builds a JSON file from the data on your device that you can keep or take elsewhere;
- Delete account deletes your account and all its data from our server at once, including workouts, meals, Health daily totals, coach chat, memory notes, custom exercises and the links you shared, and removes the data from your device. It also asks Apple to disconnect Sign in with Apple; if you cancel Apple’s confirmation, your account is still deleted, and you can remove Body Madness from your Apple Account under Sign in with Apple in iOS Settings.
- Manage my data on the subscription screen offers the same choices if you have no active subscription;
- in the Coach, you can clear your chat history, and see, edit or Forget anything the coach remembers, or Forget everything. If clearing the chat is not available to you, email us and we will do it.
If you cannot open the app, email support@bodymadness.app from the address linked to your account (for Sign in with Apple, the address you shared, which may be Apple’s private relay address) and ask us to delete your account. We may ask for details that help us find it. An anonymous account has no email address, so we may not be able to find it without the app.
What can remain. Server backups are kept for a limited time and then overwritten. Deleting your account does not erase them immediately. Deleted items (for example a meal or a note you removed) can remain on our server until you delete the whole account. If you switch from an anonymous account to an existing Apple account, the anonymous account that was left behind is not removed automatically: email us to have it deleted. Copies of your shared exercises that other people saved may remain until we have removed them. Subscription and purchase records are kept by Apple and RevenueCat under their own policies, and we may keep minimal records where the law requires it. Short-lived technical logs are kept only as long as needed for security and debugging. Anthropic and our other providers keep data under their own terms.
Signing out removes the data stored on your device. Deleting your account does not cancel your subscription: cancel it with Apple.
11. Your rights (EU, UK and Ukraine)
Under the GDPR, the UK GDPR and Ukrainian law you can ask us to: give you access to your data; correct it; delete it; restrict or object to some processing, including processing based on our legitimate interests; and give you a portable copy. You can withdraw any consent at any time. Most of this you can do directly in the app (see Deleting your data and AI features). For anything else, email support@bodymadness.app. We may need to confirm it is you, and we will answer within one month.
You can complain to a data protection authority. In the EU that is the authority in your country of residence, work or where you believe a breach happened. In the UK it is the Information Commissioner’s Office. In Ukraine it is the Ukrainian Parliament Commissioner for Human Rights. We would appreciate the chance to fix things first.
12. California privacy notice
If you live in California, the CCPA/CPRA gives you the right to know what we collect, to delete it, to correct it, and not to be discriminated against for using these rights. In the last 12 months we collected these categories: identifiers (account and device identifiers, email if you share it); health and fitness information, which is sensitive personal information (profile, injuries and conditions, workouts, meals, body measurements, Apple Health daily totals, coach chat and memory); user content (meal photos, chat messages, shared exercises); commercial information (subscription status); and technical data (IP address, device and app version).
We collect them from you and from Apple Health with your permission, and use them only to provide and secure the service. We disclose them to the processors listed in Who else handles your data, including the AI provider only with your permission, for those business purposes. We do not sell personal information or share it for cross-context behavioural advertising, and we use sensitive personal information only for purposes the law permits, so there is nothing to opt out of or limit. To make a request, email support@bodymadness.app. We will verify it using your account. An authorised agent may act for you with your written permission.
13. Children
Body Madness is not directed at children, and you must be at least 16 years old to use it. We do not knowingly collect data from anyone under that age (and never from children under 13). If we learn that someone under 16 has an account, we will delete it. If you believe a child has given us data, email support@bodymadness.app and we will delete it.
14. Security
Data travels over encrypted connections. Sign-in tokens are short-lived and rotate on use, requests are rate limited, and we keep sensitive content such as coach memory text, prompts and image data out of our logs. No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.
15. This website
bodymadness.app is a static website. It sets no cookies, uses no analytics, advertising or tracking scripts, and loads fonts and images from the same domain only, so there is no cookie banner. Cloudflare, which serves the site, processes standard request data (IP address, browser, requested page, time) to deliver and protect it. Your language choice is the address you visit, not a cookie. If you email us, we use your message and address only to reply.
16. Changes to this policy
We may update this policy as the app changes. We will change the effective date above and, for material changes, tell you in the app or by email before they apply. If a change affects what we send to the AI provider, we will ask for your permission again.
17. Contact
Questions, requests or complaints: support@bodymadness.app. Help with the app, your subscription or deleting your account: Support.