Privacy Policy

1. Information we collect

We collect the following categories of data when you use the Service:

• Account data – Email address, display name, and authentication credentials (or tokens from third-party sign-in providers such as Google).
• Fitness and health data – Weekly plans, daily check-ins, weekly reviews, body metrics (weight, waist measurement, body-fat percentage), subjective readiness scores, feeling tags, and reflection notes.
• Progress photos – Images you upload as part of your weekly review. Photos are stored securely and are never shared publicly.
• Usage data – Pages visited, features used, timestamps, and device/browser information, collected via analytics tools when you have given consent.
• Preferences – Notification settings, sharing preferences, theme preference, and timezone.

2. How we use your data

• Provide and maintain the Service
• Display your fitness data back to you (plans, check-ins, reviews, trends)
• Generate AI-powered summaries and insights from your weekly data
• Enable optional data sharing with your chosen accountability partner
• Send transactional emails (e.g., weekly summaries, partner invitations)
• Improve the Service through aggregated, anonymized analytics (only with your consent)

3. Google sign-in and limited use disclosure

If you choose to sign in with Google, we access only basic profile information (email address, name, and profile picture) for authentication purposes.

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we:

• Only use Google data to provide and improve user-facing features of the app
• Do not transfer Google data to third parties except as necessary to provide or improve user-facing features, comply with applicable laws, or as part of a merger/acquisition with adequate data protection
• Do not use Google data for advertising or to serve ads
• Do not allow humans to read Google user data except with your affirmative consent, for security purposes, to comply with law, or when aggregated and anonymized for internal operations

You can revoke our access to your Google account at any time via your Google Account permissions.

4. Data sharing

We do not sell your data.

Your data may be shared only in the following cases:

• Accountability partner – If you opt in, specific categories of data you select are visible to your chosen partner.
• Optional agent connection – If you explicitly create and confirm a connection, the agent you choose receives access only under the scopes or complete owner coaching grant you explicitly authorize, as described below.
• Service providers – We use third-party services to operate the app (hosting, email delivery, AI analysis). These providers process data on our behalf under appropriate data protection agreements.
• Legal requirements – We may disclose data if required by law or to protect rights, safety, or property.

5. Optional agent connections

You may create an optional, scope-limited connection for an automated agent you choose. All access categories are off by default and require your explicit selection and confirmation. Depending on selected read scopes, the agent may receive bounded summaries of recent weekly plans, weekly adherence reviews, or daily check-in status.

If you separately grant daily check-in write access, the default policy requires your review and in-app approval before a complete categorical check-in proposal for your local current day can be saved. You may instead explicitly confirm an automatic policy. Under that policy, after server validation, the agent may immediately save one complete five-category check-in for your local current day; it creates no pending proposal and does not request later in-app approval. In either policy, this is insert-only: it cannot edit, update, upsert, overwrite, or delete an existing check-in, and an existing partial or complete check-in is not changed. This write permission does not include or write notes or reflections, photos, body metrics, logged nutrition quantities, raw health readings, email, plans, settings, or partner information. The server enforces the selected policy and exact scope on every request; a policy cannot grant a missing scope. You can inspect recent activity, change the policy without credential rotation, or revoke a connection at any time in Settings; revocation blocks future agent access immediately. The agent or its operator is responsible for protecting the credential and handling information you explicitly authorize it to receive.

You may separately grant complete owner coaching in Settings. This explicit grant allows your chosen agent to read your complete saved fitness context, preferences, defaults, plans, prescriptions, goals, measurements, check-ins, review reflections and session outcomes, including notes and correction history. If you also confirm automatic routine execution, the listed fitness writes and corrections save after validation without repeated in-app approval; otherwise they require your approval. The grant excludes partners, photos, raw device stores, credentials, sharing, billing, deletion and submitting or locking commitments. You can revoke the grant immediately without expanding or changing the connection’s original restricted scopes.

6. AI-generated insights

Fitness summaries are off by default. If you enable them in Privacy settings and request insights, we send your saved plans, training, nutrition, sleep, body metrics, readiness, notes and reflections for the selected week and up to eight prior weeks directly to OpenAI. Photos and account details are excluded. OpenAI API data is not used for model training by default; abuse-monitoring retention may last up to 30 days. Disable this permission anytime to stop future summaries; existing insights remain saved. Progress photos stay in private storage. Photo comparison is a separate, default-off permission for adults 18 and over. Where available, only an explicit Analyze selected photos request sends the exact selected matching JPEG/PNG views and dates directly to OpenAI, after server ownership checks, resizing and metadata removal. Uploading, enabling permission and navigation never start analysis. No account details, notes, unrelated photos or other saved fitness records accompany them. Confirm that the photos are your own, with no other people or nudity. OpenAI does not train on API photos by default; safety retention may last up to 30 days, with longer safety/legal exceptions including flagged image review. The API store setting is not zero retention. Results are cautious visual observations for your account only, unavailable to partners and agents; they cannot measure body fat, weight, health or fitness, or diagnose conditions. Lighting, pose, framing and clothing can make comparison unreliable. Turn off permission in the photo comparison panel to stop future requests and remove saved comparisons. Source deletion/replacement invalidates results; account deletion removes them. A request already sent to OpenAI cannot be recalled by Ledger. AI insights are non-medical and may be inaccurate. Public blog generation uses OpenRouter and does not use personal fitness records.

7. Analytics

We use analytics tools to understand how the Service is used. Analytics are disabled by default and require your explicit opt-in consent. You can change your analytics preference at any time in Settings. When analytics are enabled, we may collect page views, feature usage, and anonymized interaction data. Session recording and automatic capture of interface content are disabled. Progress photos, rendered fitness records, and Apple Health previews are not recorded. Query parameters and fragments are removed from analytics URLs to protect sign-in and invitation tokens.

8. Data security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), secure authentication, and row-level security policies that ensure you can only access your own data.

9. Your choices and rights

You have the right to:

• Access your data at any time through the app
• Correct your data through your settings
• Delete your account and all associated data through Settings
• Withdraw consent for analytics and optional data sharing at any time
• Export your data (available through account settings)

10. Data retention

We retain your data for as long as your account is active. If you delete your account, personal data is removed from the live service, including agent connections and agent authorization audit events linked to your profile. Encrypted backup copies may persist temporarily within our limited backup-retention period before automatic deletion. Anonymized, aggregated data may be retained for service improvement.

11. International data transfers

Your data may be processed in countries other than your own. We ensure appropriate safeguards are in place for any international transfers.

12. Changes to this policy

We may update this Privacy Policy periodically. If changes are significant, we will notify you in the app. Continued use of the Service means you accept the updated policy.

13. Contact

For questions or concerns about your privacy:
📩 support@ledgerfitness.com