SculptR Privacy Policy

Last updated: 27 August 2026

This Privacy Policy explains what personal data the SculptR mobile app ("SculptR", "we", "us", "our") collects, how and why we use it, who we share it with, and the rights you have. It is written to meet the requirements of the UK GDPR and the EU General Data Protection Regulation (GDPR).

Who we are (data controller)

SculptR is operated by SCUPTR LTD, a company registered in England and Wales ("the controller"). For any privacy question or to exercise your rights, contact us at support@sculptr-app.com.

Information we collect

• Account information. Your email address, and your name where you provide it. If you use Sign in with Apple or Sign in with Google, we receive the identifier (and, where you allow it, the name and email) that provider shares. Used to authenticate you and sync your data.
• Profile and fitness data. Age, sex, height, weight and target weight, goals, activity level, equipment, your training discipline and cardio preferences, diet and allergies, and your country (used to set your currency).
• Health-related data (special category). Your body weight and weigh-ins, body metrics, diet and allergy information, and, if you complete an optional weekly check-in, your self-reported energy, sleep, hunger, stress and how your training felt. With your permission we also read your step count from your device's motion sensors, and, if you connect Apple Health (iOS) or Health Connect (Android), your most recent body weight and today's steps. These connections are optional and off by default. Health Connect and Apple Health data is read on your device to show your activity and progress; it is never used for advertising and is never sold. Because this reveals information about your health, we treat it as "special category" data and process it only with your explicit consent (see "Legal bases"). You can revoke motion, Apple Health or Health Connect access at any time in your device Settings (for Health Connect, in the Health Connect app under App permissions).
• Content you create. Logged foods and workouts, saved meals, plans, and your messages to the in-app AI coach ("Sola").
• Profile picture. Optional. If you add one, the image is resized on your device and stored in a private area of our storage that only you and members of teams you belong to can read, and only through short-lived links. Your teammates see it beside your name. You can change or remove it at any time, and removing it deletes the stored image.
• Camera and photos. If you scan a barcode, the camera reads the product code in real time and no image is stored. If you use AI meal-photo analysis, the photo is sent to our AI provider to estimate nutrition and is not stored by us afterwards. If you add progress photos to a weekly check-in (up to four, taken with the camera or chosen from your photo library), each photo is resized on your device and sent to our AI provider once so it can write a few sentences of feedback, and is then gone: we never upload it to our storage, never save it to your account, and never keep a copy anywhere. Resizing also removes the location and device details your camera stores inside a photo file, so those are never sent either. Only the written feedback is saved, alongside that check-in, and you can remove it before you save. When you share a meal, workout or your progress, you may take a photo or choose one from your photo library to include on the share card; that image stays on your device and is only passed to your device's share sheet when you tap share. We do not upload or store photos you attach to share cards. Photos and videos you attach to a team post are different: those are uploaded to our storage so your teammates can see them. See "Teams" below. We never scan your photo library. On Android you choose images through the system photo picker, so the app only receives the items you pick and has no access to the rest of your library.
• Teams content. If you choose to create or join a team, we store the team name, its join code, your membership, and the display name you use in that team. We also store the summary counters your app publishes to your team (your streak, your steps today, whether you trained today, and how many workouts you logged this week), anything you explicitly publish to your team page including any photos or videos you attach, and the likes, comments and tags you leave on other members' posts. If you tag somebody, we handle the notification token for their device so the tag can be delivered as a push notification, and we keep each member's notification preference. If you report a post or comment, or block a member, we keep a record of that report or block so we can act on it. See "Teams" below for who can see this.
• Subscription data. If you subscribe, your subscription status and an app-generated user identifier are processed by our payments partners. We never receive your full payment card details.

Legal bases for processing

Under the GDPR we rely on the following legal bases:

• Consent (Art. 6(1)(a)) and explicit consent (Art. 9(2)(a)): for processing your health-related and other special-category data to power tracking, plans and coaching, and, where you use Teams, for sharing your summary counters and published posts with the other members of your team. You may withdraw consent at any time by leaving a team, deleting your account, or contacting us; this does not affect processing carried out before withdrawal.
• Performance of a contract (Art. 6(1)(b)): to create your account, provide the app's features you request, and manage your subscription.
• Legitimate interests (Art. 6(1)(f)): to keep the service secure, prevent abuse, and maintain reliability, balanced against your rights. This includes handling reports and blocks in teams so that members can be protected from unwanted content.

How we use your information

• To provide core features: tracking, calorie and macro targets, and progress charts.
• To generate AI workout and meal plans, adapt them, and answer coaching questions. To do this, the profile, goal, log and check-in details needed for the request (and, for meal scans and check-in progress photos, the photo) are sent to our AI provider (Anthropic) through a secure server function. We do not send your email address or account identifiers to the AI provider, and it does not use your data to train its models under our API terms.
• To run Teams, if you use it: to show your summary counters, your profile picture and your published posts to the other members of your team, to show you theirs, to deliver the comments and tags you and they create, and to send a push notification when somebody tags you, if you have that turned on. See "Teams" below.
• To manage your subscription and restore purchases.
• To secure the service and enforce fair-use limits.

Teams (sharing with other users)

Teams is optional and off unless you create or join one. It is the only feature in SculptR that makes any of your information visible to another person. Nothing is shared with anyone until you take a deliberate action, and nothing is ever public: what you share is visible only to the members of the team or teams you belong to, never to other SculptR users, and never on the open internet.

Two kinds of information become visible to your teammates:

• Your summary counters, shown on the team's member list: your display name, your profile picture if you set one, your logging streak, your step count for today, whether you trained today, and how many workouts you logged in the last seven days. These update while you are a member of a team.
• What you publish, shown on the team page: a workout and the exercises you chose to include, a step count, or a note, each with a short title and an optional description you write yourself, plus up to four photos or videos you attach, and the likes, comments and tags you leave on other members' posts. Publishing is always a separate, explicit action; logging something never posts it.

Photos and videos on posts. Anything you attach to a team post is uploaded to private storage hosted by Supabase and is served only through short-lived signed links to members of that team. Access is enforced by the storage layer itself, not just by the app. Deleting the post deletes the files with it, and you can delete your own posts at any time. Please do not attach anything you would not want your teammates to keep a copy of, since they can screenshot or save what they can see.

Reporting and blocking. Because members can put content in front of each other, every post has a report action and every comment can be reported by pressing and holding it, and you can block a member so their posts and comments disappear for you across every team you share. When you report something we record what you reported and why, and it is hidden from you immediately. We review reports and act within 24 hours, which may mean removing the content or removing the member's access. You can also email support@sculptr-app.com.

Because a published workout and a training streak can say something about your health, we treat this sharing as processing of special-category data and rely on your explicit consent, given by the act of joining a team and, for each post, by choosing to publish it.

What teams never expose. Your weight and weigh-in history, your body metrics, your food and calorie logs, your meal and workout plans, your check-in answers, your conversations with the AI coach, and your email address are never readable by other members. This is enforced in the database itself with row-level security, not only in the app: a team grants access to the counters and posts described above and to nothing else.

Your control. You can delete any post or comment you have made, and the team owner can remove posts from their team's page for moderation. Leaving a team removes you from its member list and stops your counters being shared with it. Deleting your account removes your posts, comments, likes, memberships and counters, and deletes any team you own along with its content. Note that other members may have already seen or copied what you published, which we cannot undo.

How and where your data is stored

Your account and synced data are stored using Supabase, our backend and database provider, over encrypted connections and with access restricted to your own account. Some data is also cached on your device so the app works offline.

Sub-processors we use

Supabase	Authentication, database, cloud backup/sync, and private storage for photos and videos attached to team posts.
Anthropic	AI model that generates plans, coaching replies and meal-photo estimates.
RevenueCat	Manages subscription entitlements and purchase status.
Apple	Sign in with Apple, Apple Health (opt-in), and App Store payment processing.
Google	Sign in with Google and Google Play payment processing (Android).
Open Food Facts	Looks up product nutrition when you scan or enter a barcode.
US Department of Agriculture (FoodData Central)	Looks up nutrition for generic whole foods.
Expo	Delivers push notifications to your device, for example when a teammate tags you.

We do not sell your personal data, and we do not use it for third-party advertising.

International data transfers

Some of our providers (including Anthropic and RevenueCat, and, depending on the hosting region, Supabase) process data on servers in the United States. Where your data is transferred outside the UK/EEA, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses (and the UK Addendum) and, where applicable, the providers' certification under the EU-US Data Privacy Framework.

Data retention

We keep your account and associated data for as long as your account is active. Team posts, their attached photos and videos, comments and likes are kept until you delete them, until the team is deleted, or until you delete your account, whichever comes first; leaving a team stops your counters being shared with it. Your profile picture is deleted when you remove it or delete your account. When you delete your account, we remove it from our live systems immediately and from encrypted backups within 30 days. Content sent to our AI provider may be retained by that provider for a limited period (up to around 30 days) to detect misuse, after which it is deleted. We may keep minimal records where required to comply with a legal obligation.

Your rights

Subject to the GDPR, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate data (you can edit most of it in Profile).
• Erasure: delete your account and data.
• Portability: receive your data in a portable format.
• Restriction and objection: restrict or object to certain processing.
• Withdraw consent: at any time, for processing based on consent.
• Complain: lodge a complaint with your data protection authority (in the UK, the Information Commissioner's Office; in the EU, your local authority).

How to exercise your rights

• Delete your data. Open Profile → Delete account in the app to permanently delete your account and associated data.
• Export your data. Use Profile → Export data to receive a copy of your data.
• Edit your data. Update your details any time in Profile.
• Everything else. Email support@sculptr-app.com and we will respond within one month.

Security

We protect your data with encrypted connections, database row-level security that limits each record to its owner, and server-side controls on sensitive actions. Photos, videos and profile pictures are held in private storage and are served through links that expire, rather than through public addresses, so they cannot be fetched by anyone outside the team they were shared with. No system is perfectly secure, but we work to protect your information.

Data breaches

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required, and we will inform affected users without undue delay where the risk is high.

Children

SculptR is not directed to children under 13, and we do not knowingly collect their data. In the EU, where the applicable digital-consent age is higher than 13, users below that age should only use SculptR with the consent of a parent or guardian.

Complaints and disputes

If you are unhappy with how we have handled your personal data, tell us first at support@sculptr-app.com and we will try to put it right. You always have the right to complain to a data protection regulator: in the UK that is the Information Commissioner's Office (ico.org.uk), and in the EU it is the supervisory authority for the country where you live. Nothing in this policy or in our Terms of Use takes that right away.

Disputes about the app itself, including how they are resolved and the arbitration terms that apply to users in the United States, are covered by section 13 of our Terms of Use.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above and, where appropriate, notified in the app.

Contact

Questions about this policy or your data? Email support@sculptr-app.com.