1. Information We Collect

We collect information you provide through the app and onboarding process, including:

• Account information — name, email address, and account credentials
• Body & health data — physical measurements, body composition, health history, and areas of discomfort
• Fitness & lifestyle data — training background, goals, exercise logs, sleep, stress, and nutrition habits
• Ongoing tracking data — workout logs, meal logs (including optional food photos), and body composition over time
• Coaching conversations — messages exchanged with your AI and human coach, and plan progress records
• Device information — device type, timezone, and push notification token

2. How We Use Your Information

We use your data to:

• Deliver personalized coaching, training plans, and nutrition guidance
• Work with AI language model providers to create personalized plans and coaching recommendations
• Power AI-driven conversations and meal analysis (including food photo recognition)
• Track your progress and adapt your plan over time
• Send push reminders and coach communications
• Maintain app stability and improve the service
• Comply with legal obligations

3. Third-Party Services

We work with a small set of trusted service providers to operate the platform. Each handles only the data necessary for their function:

• Cloud database & authentication provider — stores your profile and coaching data securely in the cloud
• AI language model providers — process anonymized inputs (profile, coaching context, food photos) to generate personalized plans, coaching responses, and meal estimates. See Section 4 for full details per provider. Your data is never used to train their models without your explicit opt-in.
• Push notification & app delivery provider — delivers reminders and app updates to your device
• Transactional email provider — used for coach-to-user notifications
• Crash reporting & observability provider — receives anonymized usage logs and app version info to monitor stability
• Website hosting & analytics provider — hosts this website and collects anonymous visitor analytics

All providers operate under Data Processing Agreements (DPAs) and are contractually prohibited from using your data for their own purposes.

4. Data Sharing with AI APIs

When you use AI-driven features (coaching, plan generation, nutrition tracking), we send anonymized or pseudonymized inputs to third-party AI APIs. Your name is never transmitted. The data sent is limited strictly to what is needed for each feature.

Anthropic (Claude) — primary provider for coaching & plan generation

Data sent: wellness goals, motivation, health context (age, height, weight, activity level, sleep, stress, pain areas).

• Data retained by Anthropic for a maximum of 30 days for abuse monitoring, then deleted
• International transfers covered by Standard Contractual Clauses (SCCs)
• Bound by a DPA; data shared with affiliates/subprocessors only under equivalent contractual protections
• Not used for model training without explicit opt-in
• Full policy: anthropic.com/legal/privacy

OpenAI — primary provider for nutrition tracking

Data sent: food descriptions and meal photos you voluntarily submit for macro/calorie estimation. No health profile data is sent.

• Data shared with vendors only per contractual instructions
• No CCPA "sale" or "sharing" of personal information
• Confidentiality-bound DPA; subprocessors held to equivalent standards
• Not used for model training; API data not used to improve OpenAI models by default
• Full policy: openai.com/policies/privacy-policy

DeepSeek — fallback provider for coaching & plan generation

Data sent: same anonymized coaching context as Anthropic (used only when Anthropic is unavailable).

• GDPR-aligned controls; ISO 27001 certified
• Data shared within DeepSeek group and partners under equivalent contractual protections
• Note: DeepSeek servers are located in China. Data transfers are subject to Chinese data laws in addition to the contractual protections above. If you have concerns about this, you may contact us to discuss alternatives.
• Full policy: deepseek.com/privacy-policy

All three providers maintain appropriate technical and organizational security measures, operate subprocessors under equivalent contracts, and disclose data only for service delivery or legal requirements. We periodically review compliance with these commitments. You may request deletion of your data from our systems at any time; we will communicate your request to the relevant providers per their DPA terms.

5. Device Permissions

The app requests the following permissions:

• Camera — used only when you choose to photograph a meal for food logging; photos are transmitted to OpenAI for macro analysis and are not stored on our servers
• Push Notifications — used for step reminders and coach messages; can be disabled at any time in iOS Settings
• Background App Refresh — used for periodic data sync

6. Information Sharing

We do not sell or trade your personal information. We do not engage in CCPA "sale" or "sharing" of personal data. We share data only:

• With your assigned coach, to provide personalized guidance
• With the AI and infrastructure service providers described in Sections 3 and 4, under DPAs
• When required by applicable law or valid legal process

7. Data Security

We use encrypted data transmission (TLS), encrypted local storage on your device, and secure cloud infrastructure. Access to user data is restricted to authorized personnel only.

8. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure ("right to be forgotten") — request deletion of your personal data
• Portability — receive your data in a structured, machine-readable format
• Restriction — limit how we process your data in certain circumstances
• Objection — object to processing based on legitimate interests
• Withdraw consent — at any time, for any processing based on consent (including AI data sharing)

California residents (CCPA) additionally have the right to know what personal information is collected and how it is used, to opt out of sale or sharing (we do not sell or share your data), and to non-discrimination for exercising these rights.

To exercise any of these rights, contact us at the address in Section 13. We aim to respond within 30 days (GDPR) or 45 days (CCPA).

9. Data Retention

We retain your personal data for as long as your account is active. Upon a deletion request or leaving the program, personal data is removed within 30 days. Anonymized data may be retained for service improvement.

Data sent to AI providers is subject to each provider's own retention policy. Anthropic retains API inputs for a maximum of 30 days. OpenAI and DeepSeek retain data per their respective DPA terms. We communicate deletion requests to providers upon account deletion.

10. International Data Transfers

Your data may be processed in countries where our service providers operate, including the United States and, in the case of DeepSeek, China. Transfers to countries outside the EEA are protected by one or more of the following mechanisms:

• EU Standard Contractual Clauses (SCCs) — used with Anthropic
• Provider-specific Data Processing Agreements — used with OpenAI and DeepSeek
• Adequacy decisions where applicable

Regarding DeepSeek: As a Chinese-headquartered company, DeepSeek's servers are located in China and data may be subject to Chinese data laws (including the Personal Information Protection Law, PIPL) in addition to the contractual protections described above. We use DeepSeek only as a fallback when our primary AI provider is unavailable. If you have concerns, please contact us.

11. Children's Privacy

Our services are intended for users 18 and older. We do not knowingly collect data from minors. If you believe a minor has provided us with their information, please contact us immediately.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or a notice within the app. Continued use of the app after notification constitutes acceptance of the updated policy.

13. Contact Us

For questions about this privacy policy, to exercise your data rights (access, correction, deletion, portability), or to raise a concern about AI data processing, please contact us:

Email: yourcoach@underforge.io
Response Time: We aim to respond to all privacy inquiries within 48 hours (general) or within the statutory period for formal GDPR/CCPA requests