Privacy Policy

Last updated: September 19, 2026

1. Information We Collect

When you use the bodify.fit API, we collect:

• Account data: Organization name, email address, and API usage metrics
• Food images: Photos you submit for analysis are transmitted to our AI inference provider for processing only
• Barcode scans: Barcodes you query are cached locally and may be sent to Open Food Facts
• Log data: Meal entries and nutrition data you create through the API
• User profiles: Age, sex, height, weight, activity level, dietary preferences and allergies that you store for your end users
• Chat messages: Prompts sent to the AI chat endpoint, together with any profile fields you include in the request

2. How We Use Data

Your data is used solely to operate the Service:

• Process food recognition and nutrition lookups
• Track API usage for rate limiting
• Improve cache hit rates by storing past results
• Monitor service health and diagnose errors

3. Data Sharing

We share data only with necessary third-party providers:

• AI vision provider: Food images (for AI analysis)
• Open Food Facts: Barcode lookups (public database)
• USDA FoodData Central: Nutrition search queries (public database)
• AI text provider: Chat prompts, for response generation only
• Error monitoring: Exception details and the failing request path, so we can diagnose outages
• Payment providers: Organization name, email and billing identifiers, to operate subscriptions
• Cache provider: Search and barcode query strings with short expiries, to speed up repeated lookups
• Sign-in providers you choose (Google or GitHub): Only when you sign in with them

We never sell your personal data or API keys to third parties.

4. Body Scans

When you use the body scan endpoints we receive and store: six body measurements (height, weight, chest, waist, hips), a gender value used only to fit the 3D mesh, an optional capture-mode label, and the consent flag you must confirm before a scan is accepted.

We do not receive or store any photo, video or depth data. In the mobile demo app, photo scans are processed entirely on your device and the photos are deleted immediately after the measurements are extracted — the API receives measurements only.

Measurements are sent to our mesh-generation service to produce a 3D mesh. The mesh is stored under an opaque identifier with an integrity checksum, scoped to your organization. Body scan data is never used to train models and is never sold.

Deleting it: DELETE /body/scans removes every body scan and stored mesh for your organization immediately, and the demo app exposes the same action as "Delete All Body Data". To remove a single person's scans, contact us and we will do it for you.

5. Data Retention

We retain your data only as long as necessary to provide the Service:

• Food images: Not stored on our servers — they are transmitted to our AI inference provider for processing only
• Usage metrics: Retained while your account is active, and removed when your account is deleted
• Log entries and meal data: Retained while your account is active, and removed when you delete entries or close your account
• Body scans and meshes: Retained until you delete them with DELETE /body/scans or ask us to
• Account information: Until you ask us to delete your account

6. Data Deletion

A self-service deletion API is available for body scan data: DELETE /body/scans immediately removes all of your organization's body scans and stored meshes. For any other data — including a single person's scans — contact us at support@bodify.fit and we will fulfil the request within 30 days.

7. Security

API keys are stored as bcrypt hashes. All traffic is encrypted via HTTPS. We perform daily database backups, retained for 14 days, with a restore drill verified against a separate database.

8. Your Rights

You may request access to, correction of, or deletion of your personal data at any time by emailing support@bodify.fit. We respond within 30 days.

9. Children's Privacy

The Service is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us so we can delete it. This policy complies with the Children's Online Privacy Protection Act (COPPA).

10. Cookies

The dashboard uses an httpOnly, secure session cookie for authentication. No client-side storage, tracking cookies, or analytics are employed.

11. Changes

We may update this policy. Material changes will be communicated via the email address associated with your account.

← Back to Sign Up