Privacy Policy

Information you provide

We process your account information, such as your name, email address, account identifier, and sign-in records. We use Amazon Web Services, including Amazon Cognito, to operate accounts and store app data. Apple processes Sign in with Apple.

We store the workouts, sets, meals, custom foods, recipes, goals, preferences, check-ins, and notes you choose to save. Your account connects those records across your devices. Apple handles App Store payments; Form receives transaction and subscription information, not your full payment-card details.

When you complete or update your fitness setup, we store the answers you choose to provide, including reported sex, an optional calorie-equation reference, birthday and age, height, current and highest adult weight, recent weight trend, everyday activity, exercise frequency, training experience, and selected goals. We use these account-linked answers to create starting estimates and personalize your fitness plan; they are not a medical assessment. They sync with your Form account. If you separately permit Coach AI sharing, relevant setup answers may also be included in the context sent to OpenAI. Apple Health permission is a separate choice and is not required to provide these answers.

Search, diagnostics and support

Form processes public food-search terms and scanned product barcodes to return results. Short-lived server caches reuse public search and barcode results without linking that cache history to your Form account or device. Where a barcode lookup uses an external food-data provider, such as USDA FoodData Central or Open Food Facts, Form sends the product code through its service; it does not forward your account identifier.

We process operational information such as request identifiers, route, status, timing, and app or operating-system details to run, secure and troubleshoot Form. Some diagnostic records can be associated with your account through a request identifier. Routine operational logs exclude private Health values, Coach messages, meal images and credentials; they are retained for 14 days. This is separate from account-linked interaction records described below.

When you contact support or make a privacy request, we process your email address, message, attachments and related correspondence using Google Workspace. We retain resolved correspondence for support and privacy-request history and legal needs; resolution does not trigger automatic deletion. You may request deletion at privacy@form-fitness.app. We consider those requests subject to applicable legal exceptions. Deleting your Form account does not automatically delete separately retained support correspondence.

Apple Health

With your permission, Form reads steps, active energy, workouts, sleep, resting heart rate, and body mass. You choose the categories in Apple’s permission screen. Form does not write data to Apple Health.

Raw HealthKit samples and source names stay on your iPhone. If you separately allow health trend sync, Form sends derived summaries covering up to 30 local days of sleep totals and seven days of other metrics. If you also allow health trends in Coach and AI data sharing, relevant derived summaries and bounded sleep, food and training comparisons may be sent to OpenAI to answer your question. We do not share live heart rate or unrelated clinical records. A previous permission for a shorter history does not authorize a longer history without renewed consent.

You can withdraw cloud and Coach sharing in Settings → Apple Health, including after your subscription ends. Manage read permissions in Apple Health. Withdrawing cloud sharing requests deletion of the stored health summary.

Coach and OpenAI

Coach is optional and uses OpenAI. Before using it, you choose whether Form may send your questions, a limited portion of the selected chat, and relevant workouts, foods, meals, recipes and preferences to OpenAI to generate an answer. Your complete chat archive is not automatically sent with every question. Derived Apple Health context requires separate Health-sharing permissions.

After you accept the updated Coach sharing notice, Form saves your completed chats in your Form account and keeps a protected copy on your iPhone so you can return to earlier conversations across devices. Starting a new chat preserves earlier chats. You can read, rename, export account-saved chats, or delete chats without an active Plus subscription or ongoing AI-sharing permission. Generating a new answer requires the applicable subscription and permissions.

Saved chats remain until you delete them or your account. Deleting a chat clears its messages and title from saved history and clears associated message content from Form’s interaction records. A minimal deletion record prevents delayed replies or older device copies from restoring the chat. This does not remove meals, workouts, recipes or goals that you separately confirmed.

Withdrawing either required Health-sharing permission clears chats that used the affected Apple Health context, including their titles and follow-up messages. Other chats remain available. Turning off shared AI permission stops new Coach answers and food-photo processing and preserves saved chats and meals.

Form separately keeps account-linked interaction records for safety, support and reliability. Message content and tool activity in these records are redacted after 90 days. Deleting a linked chat or withdrawing applicable Health sharing may clear that content sooner. Content-free metadata in these interaction records stays linked to your account until you delete your account. The 90-day content window does not automatically delete saved chat history.

Your account export includes chats saved to Form’s service. It does not include device-only drafts, unsent questions, draft-only chats, or older local chats awaiting renewed permission to upload. Copies you have already exported to a location you control are outside Form’s deletion controls.

Form does not use Coach or Apple Health data for advertising or model training. Our optional OpenAI organization sharing settings for feedback, evaluation/fine-tuning data and API inputs/outputs are disabled. This does not eliminate provider processing or retention: OpenAI may retain API inputs and outputs for abuse monitoring and applicable service operations. Form does not promise zero provider retention. See OpenAI’s API data controls. Coach proposes supported food and training changes for your review; changes are saved only after your separate confirmation. Coach cannot change nutrition targets, weight-change settings or sleep-opportunity targets. You can manage those settings directly in the app.

Meal photos and corrections

When you choose meal-photo recognition with shared AI permission enabled, Form sends the selected image and your optional meal description to Form’s service, hosted by Amazon Web Services, and OpenAI. If you have not accepted the shared permission, Form asks before the first upload. The app prepares a bounded image without the original metadata. The image and description help estimate foods and portions; estimates can be wrong and remain editable. Nothing is added to your meals until you review and confirm it. You can use search, barcode lookup or manual entry without photo sharing.

When you take a meal photo with Form’s camera, the app also sends measurements from that moment: the camera’s lens geometry, the direction of gravity, the distance to the table and, on iPhones with LiDAR, a coarse depth map. Form uses them only to estimate portion sizes for that photo. They go to Form’s service with the photo and are never sent to OpenAI, which receives only derived figures such as the camera’s height above the table. They are discarded when analysis ends and are not written to storage or logs. A confirmed meal keeps only how each portion was estimated, such as the method and a measured volume. Photos you choose from your library are sent without measurements.

Form uses uploaded images as temporary processing inputs. We delete Form’s uploaded copy after processing and retry failed cleanup. A separate one-day storage expiration rule covers failed or abandoned uploads; lifecycle removal can occur later. This describes Form’s storage; OpenAI’s handling follows its separately disclosed service controls. Confirmed food entries and permitted structured correction records remain in your account. Photo analysis does not authorize storing original photos for training.

Use of structured corrections for a curated improvement program is a separate, optional account setting, off by default. That permission excludes original photos and Apple Health data. Withdrawing it stops future eligibility and withdraws eligible correction records from pending curated batches. It does not erase your saved meals. Collection does not automatically authorize training: an approved program, processor and dataset release are required before a curated batch is used.

Service providers and other disclosures

AWS provides Form’s hosting, storage, account infrastructure and operational services. Apple provides Sign in with Apple and App Store billing. With your permission, OpenAI processes Coach questions and selected context, and meal photos and descriptions for recognition. Google Workspace processes support and privacy correspondence. Food-data providers may process public barcode lookups as described above. We share the information needed for those services and apply access controls. See the feature disclosures above for your separate choices and the difference between Form’s storage and provider controls.

We may disclose limited information when required by law, to respond to a valid legal request, to investigate fraud or security incidents, or to protect people’s rights and safety. If the business is transferred, personal information remains subject to applicable law and notice requirements.

Retention and security

We keep account and saved fitness records while your account is active or until you delete them. Saved Coach chats follow the chat-deletion and Health-withdrawal rules above. Derived Health summaries expire after up to 35 days. Message content and tool activity in Form’s separate Coach interaction records are redacted after 90 days; content-free metadata in those interaction records remains until account deletion. Routine operational logs exclude private Health values, Coach messages, meal images and credentials.

After a verified account deletion request, access ends and active account data is scheduled for removal within 30 days. Encrypted backups age out on a rolling schedule of up to 35 days. Limited transaction, fraud-prevention, or legal records may be retained where required. Deleted records must not be returned to active use after a backup restoration.

We use encrypted connections, protected storage, and account access controls. No service can guarantee absolute security. Form’s local account database is excluded from device and iCloud backups.

Account export and local data controls

Your account export contains records saved to Form’s service. If changes on two devices conflict, Form keeps your pending local version for review. Before you choose to use the other version or accept its deletion, Form saves a local copy of your changes and the competing version’s details on this iPhone. Saved conflict copies are associated with your account on this device, are not uploaded to your Form account, and are not shared across devices.

Account exports do not include pending changes that have not synced or saved conflict copies. In Settings, open Sync conflicts & saved copies and choose Export local version and conflict details to save a separate file. Nothing is shared until you choose an export destination. Erasing the account’s local data removes these pending changes and saved copies from this iPhone. Files you have already exported to a location you control remain outside Form’s deletion controls.

Your choices and rights

• Review or change your saved records in Form.
• Withdraw optional Health or Coach sharing in the app.
• Request a portable copy of your data in Settings.
• Delete your account and data from the app.

Depending on where you live, you may also have rights to access, correct, delete, or restrict the use of your information, and to appeal a privacy decision. We may verify your identity to protect your account. We do not discriminate against you for exercising applicable privacy rights.

Adults only and changes to this policy

Form is intended for adults aged 18 and older. We do not knowingly collect personal information from people under 18. If you believe someone under 18 has provided personal information to Form, contact privacy@form-fitness.app so we can investigate and remove it where required.

We will update this page when our practices change and provide additional notice or request consent when required.

Contact

For privacy questions or requests, email privacy@form-fitness.app. For app help, email support@form-fitness.app.