Privacy policy

Who is responsible for your data?

The data controller is Martin Haas, an individual entrepreneur operating under the French micro-enterprise regime, SIREN 914 125 562, 23 bis boulevard Brune, 75014 Paris, France.

Email: martinhaas.pro@gmail.com
Telephone: +33 7 69 40 86 41

Data processed by Sculptt

• Account and authentication: a Supabase user identifier is created automatically. If you link Apple or Google, Supabase may receive the email address, provider identifier and, where supplied by the provider, a name associated with the account.
• Profile and fitness information: first name, age, gender, height, weight, goal, experience, activity level, equipment and training schedule.
• Nutrition and activity: logged meals and macros, workout plans and completion, and visual progress results.
• Photos and AI analysis: meal and torso photos you choose to analyse are sent through Sculptt's Supabase server to Google Gemini. The source image is not written to Sculptt's Supabase analysis-results table by the current code, but analysis results are stored there and linked to your user identifier. Selected photos and journal data may also be stored locally on your iPhone.
• AI coaching context: information such as the local hour, whether a workout is planned or complete, logged meals and remaining nutrition targets may be sent to Gemini to generate a short message.
• Subscriptions: RevenueCat receives the Sculptt user identifier and subscription-related information, including purchase history, receipt information, entitlement status and technical usage information. Apple processes the purchase and payment.
• Security and service records: request identifiers, timestamps, analysis type, status, input hashes and a network hash derived from the requesting IP address.

Why we process this data

• To create and operate your account, provide workouts, nutrition tracking, progress history and purchased features.
• To perform the photo analysis or coaching action that you request.
• To verify subscriptions, restore purchases, prevent abuse and secure the service.
• To answer support, privacy and account-deletion requests and comply with legal obligations.

The main legal bases are performance of the service contract, compliance with legal obligations and Sculptt's legitimate interest in securing the service. Where information qualifies as health-related or otherwise sensitive data, processing for personal fitness analysis relies on your explicit consent. You may withdraw consent for future processing, although this does not affect earlier lawful processing.

Users aged 13 to 17

Sculptt is not intended for children under 13. A user under the age at which they can validly consent or enter into the relevant agreement must use Sculptt only with the involvement and permission of a parent or legal guardian. In France, when processing is based on consent and the user is under 15, consent must be given jointly by the minor and the holder of parental responsibility. A parent or guardian should also approve any subscription through the applicable Apple account.

Service providers and transfers

Sculptt uses Supabase for authentication, server functions and result storage; RevenueCat for subscription management; Google Gemini for image analysis and generated guidance; Apple for App Store purchases and optional Apple authentication; Google for optional Google authentication; and Cloudflare Pages to host this website.

The Supabase project's primary region is configured in Paris, France. Some providers and their subprocessors may process data outside the European Economic Area. Where required, those transfers are governed by the safeguards made available in the providers' data-processing terms, such as adequacy mechanisms or standard contractual clauses.

Gemini receives submitted photos and prompts. Sculptt's exact Gemini billing and zero-data-retention configuration has not been independently verified for this notice. Google's treatment and limited safety logging depend on the applicable Gemini service terms and configuration. Sculptt therefore does not promise zero retention by Google or state that submitted content can never be used under every possible service configuration.

Retention

• Local profile, journal and photo data remains on the device until you delete it, clear the app's data or uninstall the app, subject to normal device backups.
• Account, entitlement, analysis-result and associated technical records are currently retained while the Sculptt account remains active. Records that must be kept for security, dispute handling or legal compliance may be retained for the period necessary for that purpose.
• Support correspondence is retained only as long as needed to handle the request and any related legal obligations.
• Apple, RevenueCat, Supabase, Google and Cloudflare apply their own backup, security and legally required retention cycles. A deletion request is passed to relevant processors where necessary, but residual copies may remain temporarily in protected backups or where retention is legally required.

Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or object to certain processing. You may withdraw consent for future sensitive-data processing. Contact martinhaas.pro@gmail.com. We may ask for information necessary to verify your identity.

You may also lodge a complaint with the French Data Protection Authority, CNIL, or another competent supervisory authority.

Delete your account and data

Website storage

This website has no contact form, advertising tracker or audience analytics. It stores only a language preference in your browser's local storage. This preference is used to provide the language you selected. Links to external services are activated only when you choose them.

Updates

This policy may be updated when Sculptt's features, providers or legal obligations change. The date shown at the top identifies the latest version.