Privacy policy

1. Information We Collect

We collect information you provide directly to us when you create an account, complete your onboarding profile, log daily check-ins, or communicate with the AI coach. This includes:

• Account Details (Name, Email, Password Hash)
• Physical Metrics (Height, Weight, Age, Body Fat)
• Fitness Goals, Experience Level, and Equipment
• Chat History with the AI Coaching Assistant
• Health & Wearable Data you choose to connect (e.g., heart rate, resting heart rate, HRV, sleep, steps, and workouts from Apple Health or Health Connect)

Health Data (Apple Health & Health Connect): If you connect Apple Health (HealthKit) or Health Connect, we read only the specific metrics you authorize and use them solely to personalize your training, readiness, and recovery recommendations inside the app. We never use health data for advertising or marketing, never share it with third parties for their own purposes, and never sell it. You can revoke access at any time in your device's Health settings.

2. How We Use Your Information

We use the information we collect to operate, maintain, and provide our services. Your physical metrics and training data are securely passed to our Large Language Models (LLMs) to generate personalized fitness and nutrition programs that evolve with you. We also use the information we collect, in de-identified or aggregated form where feasible, to understand how the app is used and to improve our services and coaching models.

Note on AI Processing: Your chat logs and check-in metrics are temporarily processed by third-party AI providers (Google Gemini, with OpenAI as a backup provider) via secure, encrypted API endpoints to generate responses. If you use voice input, your audio is transcribed by OpenAI. Under our agreements with these providers, data sent through their APIs is not used to train their models. We do not use your personal training data to train broader foundational AI models without explicit consent.

3. Data Sharing & Third Parties

We do not sell your personal data. We only share data with trusted third-party providers necessary to run the platform:

• Supabase: Dedicated secure managed Postgres database and Authentication.
• Stripe: Secure payment processing (we do not store your raw credit card numbers).
• Google (Gemini): Inference endpoints for the Coach AI text generation.
• OpenAI: Backup AI inference and voice transcription.
• Twilio: SMS/WhatsApp message delivery if you use text-message coaching.
• RevenueCat: In-app subscription management for App Store purchases.
• Sentry: Error and crash reporting so we can find and fix problems.
• FatSecret: Food-database lookups for the foods you log.
• Resend: Programmatic email delivery.
• PostHog: Privacy-conscious product analytics to understand feature usage and improve the app.

4. Your Data Rights

You have the right to request access to the data we hold about you, to request that we correct any inaccuracies, and to request the deletion of your account and associated data. You can delete your account from the Profile settings dashboard.

5. Data Retention After Deletion

When you delete your account, we permanently remove all personally-identifiable data — your name, email address, profile photo, chat history, training programs, and goal records — typically within one minute and at most within 30 days.

We retain pseudonymous training and nutrition records (workouts logged, foods logged, meal plans generated, body-metric trends) under a randomly-assigned identifier (e.g., deleted_user_47) so we can study how the app is used in aggregate and improve it. These records cannot be tied back to you.

Subscription billing records are retained as legally required (US: 7 years for tax). Backup copies cycle out within 90 days. If you have an active App Store subscription, you must cancel it separately in Settings → [Your Apple ID] → Subscriptions; we cannot cancel App Store subscriptions on your behalf.

6. Instagram Messaging (Connected Creator Accounts)

Some fitness creators on CreatorClone connect their Instagram professional account to our platform through Meta's official Instagram API. When a creator has connected their account and you comment on their content or send their account a direct message, Meta delivers that interaction to us. This includes the message or comment text, your Instagram username and user ID, and a timestamp.

We use this data solely to provide messaging tools to that creator: automatic replies to keywords (for example, commenting a keyword to receive a link) and a managed inbox where the creator and their authorized team review messages and send replies. Replies are always sent from the creator's own account, within the messaging windows Meta's platform policies allow. We do not use this data for advertising, do not sell it, and do not use it to train AI models.

Message data is retained while the creator's account remains connected. If you have messaged a connected creator account and would like your message data removed from our systems, email support@creatorclone.fit from the relevant context (or ask the creator) and we will delete it. Creators can disconnect their account at any time, which stops all further collection.

7. Cookies and Tracking

We use standard JWT-based authentication cookies and local storage to keep you logged into the application and to secure your current session.

We also use first- and third-party product analytics (PostHog) to understand how features are used so we can improve the app. This relies on local storage and similar identifiers tied to a pseudonymous device ID. We do not use advertising or cross-site marketing tracking cookies, and we do not sell this data. Where required by law, we will ask for your consent before enabling non-essential analytics.