Back

BodyFat AI

Privacy Policy

Last updated: 30 June 2026

This Privacy Policy explains what data BodyFat AI collects, why we collect it, how we use it, and the rights you have over it. The app is operated by Aylan Apps (“we”, “us”, “our”). By creating an account or using the app you accept this policy.

If anything here is unclear, email contact@aylantech.com.

1. What BodyFat AI is

BodyFat AI is an AI body-fat % scanner and physique tracker. You take a full-body photo; our backend forwards that photo (and any optional details you provide — height, weight, age, sex, goal and timeline) to Google Gemini to estimate your body fat %, lean and fat mass, BMI, FFMI, a 0–100 physique score, per-muscle-group scores, and calorie / macro targets. You can also generate a goal-physique image — an AI-edited version of your own photo showing a target body-fat level. It is not a medical device, diagnosis, or clinical body-composition measurement. See the Health Disclaimer for details.

2. Data we collect

2.1 Account data

  • Email address (mandatory for full accounts; anonymous accounts use a device-derived synthetic ID).
  • Hashed password (or sign-in token from Apple / Google when those options are enabled).
  • Username.

2.2 Scan submissions and body metrics

  • The full-body photos you capture or upload for analysis.
  • Optional body metrics you enter: height, weight, age, sex, fitness goal, and target timeline.
  • Derived results we compute and store against your account: body fat %, lean / fat mass, BMI, FFMI, physique score, per-muscle-group scores, percentile ranking, and calorie / macro targets.
  • AI-generated goal-physique images we hand back to you, stored so you can revisit them.
  • Your scan history and any notes or tags you add for progress tracking and side-by-side comparison.

2.3 Device + abuse-prevention signals

  • A per-install random identifier (install_id).
  • A hashed device fingerprint (brand / model / OS, hashed locally before upload).
  • Platform-stable identifiers used only for fraud prevention so a reinstall cannot reset the free-scan limit:
    • iOS: DCDevice attestation token (Apple).
    • Android: AppSetId (Google Play Services).
  • A SHA-256 hash of submitted photos, used for de-duplication and a short analysis cache (cost discipline).
  • IP address of register / login requests, retained for 30 days for abuse investigation.

2.4 Usage analytics

  • Screen views, button taps, scans, goal-image generations, compares, subscription events.
  • Crash reports (anonymised stack traces via Firebase Crashlytics).

2.5 Push tokens

Your FCM device token, registered when you allow notifications. We use it only to send the notifications you've enabled (e.g. “your scan is ready” or a check-in reminder).

3. How we use the data

We use the data to:

  • Run the AI body-composition analysis and goal-image generation you requested (contract basis).
  • Build your progress timeline, trends, comparisons, and percentile ranking (contract).
  • Track free-tier usage (1 free scan, then Premium) and your Premium entitlement (contract).
  • Send the notifications you enabled (consent).
  • Detect duplicate-account / refund abuse (legitimate interest).
  • Fix crashes and performance issues (legitimate interest).
  • Improve the product via aggregated, de-identified usage trends (legitimate interest).

We never:

  • Sell your data.
  • Share your photos or body metrics with advertisers.
  • Use your body photos or measurements to train external models.
  • Make your scans, scores, or goal images public.

4. Third parties we share data with

We share the minimum necessary data with vetted infrastructure providers:

  • Google Cloud / Gemini API — your photo plus any metrics you provided, for body-composition analysis and goal-image generation.
  • Firebase (Google) — authentication, crash + analytics, FCM push tokens, encrypted media storage (scan photos and generated goal images).
  • RevenueCat — subscription receipts and entitlement state.
  • Apple / Google App Stores — purchase + restore receipts.

We do not transfer your data to other third parties for their own use.

5. Where data is stored and for how long

  • Servers and storage are hosted in the United States via Google Cloud / Firebase.
  • Scan photos and generated goal images are encrypted at rest in Firebase Storage, scoped to your account.
  • Database is encrypted at rest; passwords stored as salted hashes.
  • We retain your data while your account is active so your progress timeline stays intact.
  • Anonymous accounts that are never converted are deleted after 180 days of inactivity.
  • If you delete your account, all personal data — including scan photos and goal images — is removed within 30 days, except where law requires us to keep records.

6. Age requirement

BodyFat AI is intended for adults 18 and older. The app processes full-body photos and body-composition estimates, which are not appropriate for minors. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, email us — we will delete the account and associated data.

7. A note on body-image sensitivity

Body fat %, physique scores, and rankings are AI estimates for general fitness tracking and can be imperfect. They are not a clinical measurement or a judgement of your worth. If numbers or goal images affect how you feel about your body, please step back and, where helpful, speak with a qualified professional. See the Health Disclaimer.

8. Your rights

You can, at any time:

  • Access: email support for an export.
  • Correct: Me tab → edit profile / metrics (or contact support).
  • Delete: Me tab → Delete account.
  • Restrict / object: contact support.
  • Withdraw consent for analytics: turn off analytics in your device settings.
  • Portability: contact support for a JSON export.

EU / UK users may also lodge a complaint with their local data protection authority. California residents (CCPA / CPRA) have the right to know, delete, correct, and to opt out of any “sale” or “sharing” of personal information — we do neither.

9. Cookies and similar

The mobile app does not use cookies. The companion website (aylanapps.com) uses only essential cookies.

10. Security

  • All API calls go over HTTPS / TLS 1.2+.
  • Access tokens are short-lived; refresh tokens stored in the device keychain.
  • Apple DCDevice and Google AppSetId gate registration against abuse.
  • Backend has IP-based and device-based rate limiting.

Report security issues to contact@aylantech.com — we acknowledge within 72 hours.

11. Changes to this policy

We update this policy when our practices change. Material changes trigger an in-app notice. Continued use after the change means you accept the updated policy.

12. Contact

Email: contact@aylantech.com

For deletion-only requests: Me tab → Delete account, or email with subject “Delete my account”.

← Back to legal information