BodyNorth Privacy Policy

Effective: 4 October 2026

BodyNorth is a general-wellness meal, workout, calorie, and sleep diary for adults. We minimize server data and do not use advertising trackers.

Data kept on your iPhone

Your profile, body measurements, birthday, calorie guide, meal history and locations, workout plans and logs, reports, sleep summaries, saved meal thumbnails, and AI Workout Coach workflows are stored locally with Apple SwiftData. A coach workflow includes the reviewed profile summary, baseline plan, paraphrased intent, proposal and status so a request can resume after relaunch. It contains no audio or verbatim transcript. New coach requests can use the bounded history summaries described below.

Private iCloud diary sync

A versioned JSON journal stores profile, meal records and locations, calorie targets, workout plans and logs, preferences and durable coach state. When available, sync is enabled by default and can be controlled in You → Data controls. Apple CloudKit stores encrypted record payloads in your private iCloud database and synchronizes changes between your devices. This uses your Apple Account and iCloud settings; BodyNorth’s AI service does not receive the synced diary. Photos, recordings, transcripts, login tokens and Apple Health-derived caches are excluded. Meal records may therefore restore without photos, and Health access must be connected on each device. Offline changes wait for connectivity. Changing the iCloud account pauses transmission to avoid sending the prior account’s records to a different account.

AI meal analysis

Only after your one-time app-wide AI consent, the app sends one resized, metadata-stripped meal photo through OpenRouter or Cloudflare AI Gateway to the selected model provider (currently Google). The service asks the model to identify visible food, estimate portion scale automatically from scene context and typical container dimensions, and return gram and calorie ranges, assumptions, warnings, and confidence.

The full-resolution source photo is not uploaded. The BodyNorth Worker does not persist analysis images, prompts, or meal results. OpenRouter requests require privacy-restricted provider routing with zero data retention and denied data collection. Google requests through Cloudflare AI Gateway use zero-data-retention routing. Gateway request/response logging and caching are disabled. Cloudflare, the selected gateway (OpenRouter or Cloudflare AI Gateway), and the selected model provider necessarily process the request to return the result under their service terms. AI can be wrong, including about foods, portions, ingredients, oil, sauces, preparation, and calories. Results are saved automatically on your iPhone and remain editable and deletable.

Pending meal photos and structured review drafts stay on your iPhone until you complete or remove them. Pending photos are removed from the queue after a successful save or deletion; the saved meal retains its photo.

Optional meal voice recovery

When a meal scan fails or explicitly needs clarification, you can choose to describe that meal in a recording of up to 30 seconds. We ask for separate meal voice consent on first use and iPhone microphone permission. Only after you stop, we send the completed 16 kHz mono WAV recording, that meal’s resized photo if available, and its existing food names and portions through OpenRouter or Cloudflare AI Gateway for Whisper transcription and meal estimation with Google. If automatic fallback is enabled, the other service may process the request following a primary-service failure. Your spoken corrections take priority. Other diary entries, profile, workout history, Apple Health data, and meal location are not sent.

Audio and transcripts are processed in request memory, are not returned as transcripts, and are not stored or logged by BodyNorth. The temporary recording is deleted after processing, cancellation, or failure. A structured food-and-calorie review is saved locally on your iPhone until you update the meal or discard the review. The original meal stays unchanged until you choose Update meal. We retain only consent and operational metadata on the server, including scan/request identifiers, recovery status, duration, model, cost, and quota accounting. The same provider privacy routing requirements apply.

Workout plans

When you send a coach request, the selected profile/body measurements and workout content described below are collected by our service and linked to your app account for functionality and personalization. Encryption protects these temporary records but does not make them device-only data.

Manual and deterministic workout plans and active-calorie ranges are created on your iPhone. The optional AI Workout Coach accepts a completed recording of up to 60 seconds or a typed request of up to 4,000 characters, under the app-wide AI consent. Recording also requires microphone permission. The request includes computed age, calculation sex, height, weight, activity level and calorie goal; saved schedule and lifestyle preferences; current workout settings, equipment, limitations, More/Less/Never preferences and an exact baseline; a 30-day workout summary with up to 30 recent exercise aggregates; a 14-day summary of logged meal calories and protein; and optional active-workout progress. Missing logs mean unknown intake or activity. Model context excludes your birthday, account or email identifiers, individual meal descriptions, meal locations, meal photos and Apple Health sleep data.

Coach accepts voice and text requests. Stopping a recording or tapping Send starts interpretation and generation automatically. The coach infers whether to create a new plan or modify the displayed preview or active plan, using saved settings for missing details. Continued corrections preserve earlier requirements unless corrected and share one daily allowance. The result is an expandable preview: only Use plan applies it and any requested preference changes. Discarding a preview changes neither your active plan nor preferences. Applied updates preserve completed workout logs. Adaptive policy changes wait until any current workout ends; older document-based plans may update unfinished exercises after approval. Today-only changes leave other days intact and expire for future plans at the next local midnight. A running session keeps its revision. A deterministic fallback, when available, is clearly labelled and also requires Use plan.

Cloudflare authenticates Coach requests, stores temporary encrypted job state in D1, and runs background generation in Cloudflare Workflows. The Worker calls the enabled primary AI service: OpenRouter or Cloudflare AI Gateway. OpenRouter is the initial primary; Cloudflare AI and automatic fallback are initially disabled. The owner can change this configuration in the private dashboard. If automatic fallback is enabled, the other service may process a request after a network, funding, rate-limit or service failure. Audio, photos, typed request text and transcripts are processed in memory without storing or logging them. GLM handles Coach interpretation and planning, Whisper handles transcription, and Google handles meal and gym images. These models are accessed through the selected service; the Cloudflare route uses Cloudflare-hosted GLM and Whisper. Older supported app builds continue using their existing Cloudflare Coach contracts. After interpretation, validated profile context, baseline, structured intent and the eventual proposal are encrypted temporarily on the server for at most 24 hours, with earlier removal after confirmed local saving, cancellation or account deletion. File-backed iPhone uploads continue through ordinary app switches and device locking; protected temporary request files are excluded from backup and diary sync and removed after completion, cancellation or expiry. Force-quitting before upload completes requires reopening the app to resume; accepted server generation continues. No completion notification is sent. Durable jobs and intake coordination retain content-free identifiers and phase metadata. Operational diagnostics include model, recording duration, token counts, latency, generation identifiers, cost, quota and error codes or field paths, never raw request content. Google requests require zero-data-retention routing. Cloudflare does not use Workers AI inputs and outputs to train models without explicit consent. Gateway content logging and response caching are disabled. OpenRouter requests require privacy-restricted provider routing with zero data retention and denied data collection. Cloudflare, OpenRouter when selected, and the selected model providers necessarily process requests under their terms.

AI proposals and local fallbacks use registered exercises and are validated against equipment, experience, schedule, time, Never preferences and approved structured changes. They can still be unsuitable or wrong. Review exercises before performing them and edit or undo an applied plan when needed. BodyNorth does not provide medical diagnosis, rehabilitation, supplement, meal-planning or individualized clinical programming.

Apple Health sleep data

If you choose to connect Apple Health, BodyNorth requests read-only access to sleep analysis. Sleep records are summarized locally and are not uploaded to the BodyNorth service or AI providers. Disconnecting stops app access; deleting BodyNorth data does not delete source records from Apple Health.

Meal location

With foreground permission, BodyNorth can attach coordinates and a short place label to a meal. These are saved with the meal locally and, when diary sync is enabled, in your private iCloud data. Coordinates and place labels are not sent to the BodyNorth service or the model provider. Location failure never blocks analysis.

Account and operational data

When you use an AI feature, Sign in with Apple provides an app-specific identifier and, if available, an email or private-relay email. We store that identifier, email, hashed session credentials, account status, the current app-wide AI consent state, separate daily meal and workout usage, model and token counts, workout recording duration, latency, provider generation identifiers, provider cost, and limited non-content operational errors for authentication, quota enforcement, security, support, and operation. We do not store raw session tokens. A private, owner-only dashboard shows account email, status, membership and operational usage so we can manage access. When we suspend or reactivate an account, an account-linked audit record stores the previous and new status, time and administrator email. Provider configuration changes also record the previous and new settings, time and administrator email, without API keys or request content. This dashboard does not show meal diary entries, workout content, photos or recordings.

Support messages

When you contact support, we collect your reply email, message category, subject, message, optional name, and any screenshot you choose to attach. In the iPhone app, you can separately choose to include app version, build, iOS version, and device type. No diary or Apple Health data is attached automatically. Screenshots are resized and re-encoded to remove source metadata before upload.

Cloudflare processes the form and delivers your message to support@bodynorth.app, hosted through our email provider, Apple iCloud Mail. The website uses Cloudflare Turnstile to limit automated abuse; it processes browser and network signals for verification. A signed-in app request is authenticated using your existing session. Support content is not sent to AI providers.

Queued messages are encrypted and removed from our service database after the email provider accepts delivery, or after seven days if delivery cannot be completed. Our content-free delivery records and keyed security identifiers are retained for up to 30 days. Cloudflare also retains email delivery metadata, including addressing and subject headers, for up to 31 days. Correspondence in the support mailbox is retained as needed to answer and follow up on your request. You can request its deletion by emailing support. Account deletion does not automatically delete separate email correspondence.

Subscriptions and purchases

Apple processes payments and payment-card information. BodyNorth does not receive or store your payment-card details. To provide and restore Pro access, Apple gives the app a signed transaction and subscription status. The app sends that signed transaction to the BodyNorth service for verification. We store limited purchase information linked to your app account, including product identifier, original transaction identifier, expiration, environment, and revocation status. You can manage or cancel a subscription in your Apple Account subscription settings.

Sharing and tracking

We do not sell personal data, track you across other companies' apps or websites, or use meal photos, results, or workouts for advertising. AI request processing uses Cloudflare, OpenRouter when selected, and the selected model provider. An enabled fallback may process a request if the primary service fails. Routine adaptive training runs locally on your iPhone using saved training rules and logged workouts; it does not send a new AI request. Coach-generated changes to those rules require an explicit Use plan action. Apple processes Sign in with Apple, subscriptions, and optional Apple Health permissions under your Apple settings.

Retention and deletion

Encrypted recovery backups from the retired Coach server can retain earlier copies for up to 31 days. They are used only for recovery, with expiry and account-deletion records reapplied before any restored data becomes available. New Coach requests do not use that server. Cloudflare Access restricts administration to the owner account; app users continue to use Sign in with Apple.

You can delete your account in You. This revokes server sessions and Apple authorization, deletes account-linked service records, removes local diary and coach data, and requests deletion of the app’s synced iCloud records. Individual record deletions propagate through the sync journal when sync is enabled and connectivity returns. Turning sync off leaves an existing iCloud copy in place. Anonymous aggregate cost totals may remain without an account link. Removing the app removes its local container, subject to iOS backup and device-management behavior, but does not by itself delete the private iCloud copy.

Your choices

Meal location, Apple Health sleep access, iCloud diary sync, meal-photo AI, meal voice recovery and workout AI are optional. BodyNorth asks for app-wide AI consent covering photo analysis and the current Workout Coach context, and separately before your first meal voice recovery. Consent is renewed when its terms, providers or data uses materially change. You can decline AI, turn sync off, cancel a request, refine or discard the coach preview before using it, undo or edit an applied workout, edit or delete meals, disconnect Apple Health, sign out or delete account data from You. Microphone access is requested only when you choose to record. Typed coach requests need no microphone permission. The app does not request Apple Speech Recognition permission because transcription occurs through the service.

Children

BodyNorth is intended for adults age 18 and older and is not directed to children.

Contact

For privacy questions or support, email support@bodynorth.app or visit the support page. Please do not include sensitive health, meal, or workout information unless necessary. See also the Terms of Use and Methodology & Limitations.