BodyComp

Privacy Policy — BodyComp

Last updated: October 25, 2026

Data controller: Sebastian Sanftleben. Contact for any questions about this policy: bodycomp@sebastian-sanftleben.de

1. Health data from Health Connect

BodyComp reads the following data types via Android Health Connect — subject to the permissions you grant: weight, steps, active/total calories, heart rate, sleep, workouts, distance, nutrition, body fat, lean body mass, height, body water.

  • Purpose: displaying trends and calculating training/nutrition recommendations in the app.
  • Storage location: exclusively local on your device (SQLite database). This data is never transmitted to our servers.
  • Daily notifications (optional): if you turn on daily notifications in the Profile tab and additionally grant Health Connect's background-access permission, the app also reads steps, calories, workouts, sleep, and weight and body fat in the background — solely to compute the notification's content on your device. Nothing is transmitted in the process, neither to our server nor to any third party; the content is generated by fixed rules, without AI. Without the background permission, the notification only uses values already stored locally. The notification text contains health values (e.g. steps, calories, protein); on the lock screen it is hidden by default — you can change this option in the Profile tab. To show notifications, the app requests Android's notification permission. You can turn notifications off at any time in the Profile tab; the background permission can be revoked in Health Connect.
  • Legal basis: your consent via Health Connect's Android permission dialog (Art. 9(2)(a) GDPR).
  • Withdrawal: possible at any time via Health Connect or the Android settings. Uninstalling the app deletes the local database.

2. Progress photos (camera)

The camera button on the Heute (Today) tab lets you voluntarily take photos to document your physical progress.

  • Storage location: exclusively local on your device — in the app's own storage area, and, if you allow it via the system dialog, additionally in your device's regular Photos app. Not transmitted to our server, not transmitted to Anthropic (see section 5 for the distinction from meal-photo recognition). Note: if your device's general backup feature is enabled (e.g. Google Account backup on Android, iCloud backup on iOS), that backup may include these photos too — this is outside our control and can be disabled in your device's backup settings.
  • Legal basis: your consent through active use of the camera feature (Art. 9(2)(a) GDPR).
  • Deletion: at any time in the app via long-press on a photo, or by uninstalling the app. A copy additionally saved to the Photos app, if any, is not affected and must be deleted there separately.

3. Profile and food-log data (optional Cloud Sync)

If you voluntarily sign in with a Google account via "Cloud Sync", we back up the following data on a server we operate ourselves, so you can use it across devices: height, date of birth, sex, target values, food-log entries, custom foods you've created, completed workouts, notification settings (on/off, number per day, time window, hide-on-lock-screen option — no notification content), and the type and timestamp of each AI generation (workout/meal plan, meal-photo analysis). The content of the generated plans or photos itself is not transmitted — this record exists solely to enforce your daily usage limit correctly across devices and reinstalls. Foods you create yourself may be reviewed in anonymized form (without any link to your account or email address) — their names, nutrition values and the number of affected users (aggregated, without any link to an account or email address) are displayed in a separate instance we operate on the same server — and added to the shared food catalog.

  • Home-screen widget (optional): the app always keeps a copy of today's calorie and macro values and your targets (from your food log and your goals) in the app's own storage (SharedPreferences) on your device, so that an optional home-screen widget can show them. The copy exists whether or not a widget is installed. This feature does not transmit anything to our servers or to any third party. The copy is part of the app's data and can be included in Android's device backup (Auto Backup / device transfer) like the rest of the app's local data. If the widget is placed, anyone who can see your unlocked home screen sees the values.
  • Pseudonymization: we store neither your email address nor your name. During Google sign-in, only the stable Google user ID ("sub") is processed — it is hashed with a salt (SHA-256) directly on your device, and only that hash is used as your user identifier in our database. The Google session is ended immediately after sign-in.
  • Legal basis: your consent (Art. 6(1)(a) in conjunction with Art. 9(2)(a) GDPR, since nutrition and body data can be health-related).
  • Deletion: self-service at any time via bodycomp.sebastian-sanftleben.de/account/delete, or via the contact address above.

4. Google Sign-In

Google Sign-In is used exclusively to generate the anonymous user identifier (see section 3) — not for tracking or advertising purposes. We only request the openid scope — no email address, no name. Regardless of the requested scope, the Google account-picker dialog returns your profile picture as part of the basic account info — we store only its URL locally on your device, to show in the app which account is connected. It never leaves the device and is removed again when you sign out or delete your account. The Google Sign-In button on the account-deletion page (see section 3) additionally returns your email address and name in the sign-in token; the email is shown only in your browser so you can see which account you're deleting, and the token is sent once to our server for verification — it is neither stored nor logged there. Provider: Google Ireland Limited; Google's privacy policy applies in addition.

5. AI features (Anthropic Claude API)

For AI-powered features — meal-photo recognition, and generating workout and meal plans — the data needed for that is sent directly from your device to the Anthropic Claude API (api.anthropic.com, Anthropic PBC, USA), without passing through our server.

  • Meal-photo recognition: the photo you take is sent to Anthropic for analysis, together with an optional free-text note you can enter (e.g. about ingredients or preparation), if you enter one. We don't store the photo itself — only the nutrition values recognized from it are saved, locally on your device. This is different from the progress photos in section 2, which are never sent to Anthropic.
  • Workout/meal-plan generation: this sends your food log, profile data (age, sex, height, target values, activity level, dietary/health notes), and select same-day Health Connect values (weight, body fat, steps, calories burned, sleep duration) as context. Not transmitted: e.g. heart rate, workout history, or other raw Health Connect data.
  • International transfer: USA. Anthropic processes the data according to Anthropic's privacy policy.
  • Legal basis: your consent through active use of the respective AI feature.

6. No tracking, no advertising

BodyComp contains no third-party advertising, tracking, or analytics software, except for the technical Google ML Kit data described in section 11.

7. Data retention

Local data is kept until you delete it or uninstall the app. Cloud Sync data is kept until you delete it via bodycomp.sebastian-sanftleben.de/account/delete. After deletion, only the anonymous hash of your Google account together with a deletion marker (no name, no email address, no other personal data) remains stored, so a deleted account cannot be silently recreated under the same user_id.

Shared workouts follow the retention rules in section 10 instead, and server logs the information in section 12 (15 days at the latest).

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15–21 GDPR), as well as the right to lodge a complaint with a data protection supervisory authority. For any request, contact bodycomp@sebastian-sanftleben.de.

9. Subscriptions (Google Play)

Premium features are unlocked through a Google Play subscription. When you purchase or whenever we re-check your subscription status, our server stores only the purchase token issued by Google Play, the expiry date derived from it, and the selected plan type (monthly, semiannual, or annual). This purchase token is used to automatically re-verify your premium status with Google on an ongoing basis; it contains no payment or card data — that stays entirely with Google Play. Deleting your account removes the stored purchase token and plan type.

10. Sharing a workout

When you share a workout via QR code, we store the workout plan on our server: title, description, notes on the individual exercises, sets, repetitions, rest times, and the estimated duration and calorie burn. The title, description and notes are written by the AI coach and can contain what you told the coach (for example injuries or health restrictions). Everything that is stored can be read by anyone who has the link.

The plan is stored without your name and without your user ID. The entry is keyed by a one-way hash of your user ID and the plan ID, used only so that a workout gets exactly one link. Your user ID is transmitted to our server when you share, solely to check that your premium subscription is active; it is not stored next to the plan.

The link is valid for 3 hours. We automatically delete the stored plan 7 days after the link expires, that is, at most 3 hours and 7 days after sharing. Shared plans are not removed when you delete your account because they cannot be matched to an account; they delete themselves as described. Opening a link does not require an account.

11. Barcode scanner (camera, Open Food Facts)

When logging a meal you can scan the barcode on a package. The camera is used only on the scan screen; the Android permission for it is requested the first time you scan. The camera images are processed only on your device by the scanner and are neither stored nor transmitted to us or to third parties. Detection runs on the device using Google ML Kit. The library may send technical usage and diagnostic data to Google; according to Google this includes performance metrics (e.g. processing time), device model and manufacturer, the operating system version, the name and version of our app, and an identifier assigned per app installation that is not intended to uniquely identify you or your device (see Google's Privacy Policy).

Only the scanned barcode number is sent to our server, without any user identifier; like every request it appears there in the server log (see section 12). A "not found" result is remembered in server memory for 10 minutes. If the product is not yet in our food catalog, our server forwards the number to Open Food Facts (openfoodfacts.org) and adds the product data found there (name, where applicable with brand, category, barcode number and nutrition values per 100 g or 100 ml) to the shared food catalog that all users receive. The request to Open Food Facts is made by our server, not by your device; your IP address and other information about you or your device are not passed on to them.

Legal basis: the camera and the scan feature are based on your consent through the camera permission and active use (Art. 6(1)(a) GDPR). The server log is based on our legitimate interest (section 12).

Product data from Open Food Facts, licensed under the Open Database License (ODbL).

12. Server logs

For every request to our API server (for example fetching the configuration at app start, checking your subscription status, sharing and opening a workout, account deletion, barcode lookup) the server writes a log entry with: time, request method, requested address (for shared workouts including the link identifier, for barcode lookups including the barcode number), response status, response time and your IP address. Request contents, headers, credentials and any user identifier are not logged. In addition, the web server in front of it (nginx) logs time, IP address, request line, response status, data volume and the identifier of your app or browser (user agent). The logs are kept on our own server and analyzed with a log service we operate ourselves (Grafana Loki); they are not passed on to third parties. Both the log files and the entries in the log service are deleted after 15 days at the latest.

Purpose: operation, error analysis, security and protection against abuse (including rate limiting). Legal basis: legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). On grounds relating to your particular situation you may object to this processing under Art. 21 GDPR (contact see above).