What we collect

When you create an account, we collect your name, email address, and the fitness and nutrition information you provide during onboarding (height, weight, goal weight, activity level, health conditions you choose to disclose, and dietary restrictions). We also collect your workout logs, meal plan selections, and chat session data to power your personalized coaching experience. We collect usage data (app activity, session frequency, feature usage) to improve the product. We do not collect payment information directly. All billing is handled by Stripe, our payment processor.

How we use your data

Your data is used exclusively to deliver and improve BFF. This includes: personalizing your meal plans and workout programs, powering your AI coach's memory and context, calculating your nutrition targets, and analyzing aggregate usage to improve the product. Your health and body data is never used for advertising, never sold to third parties, and never shared with anyone outside of the services required to operate BFF.

AI coaching and chat

Your chat history with your AI coach is stored to enable conversation memory. So she can remember what you said last week and build on it over time. Chat content is processed by trusted third-party AI services under data processing agreements. Message content is not used to train AI models without your explicit consent. BFF is not a medical service. Your AI coach does not provide medical advice, clinical nutrition counseling, or mental health treatment. If you disclose a medical condition, she will recommend you consult your healthcare provider.

Data sharing

We share data only with the third-party services required to operate BFF: • Supabase (database and authentication) • AI coaching provider (powers your BFF coach) • Stripe (payment processing) • Vercel (hosting and infrastructure) • Resend (transactional email) All third-party services are bound by their own privacy policies and data processing agreements. We do not sell your data. Ever.

Your rights

You have the right to access, correct, or delete your personal data at any time. You can export all your data from your profile page. To request deletion of your account and all associated data, use the "Delete all data" option in your profile or email us at [email protected]. If you are located in the European Union, you have additional rights under GDPR including the right to data portability and the right to lodge a complaint with a supervisory authority. If you are a California resident, you have rights under CCPA including the right to know what personal information we collect and the right to opt out of sale (we do not sell data).

Data retention

We retain your data for as long as your account is active. If you delete your account, your personal data is deleted within 30 days, except where we are required to retain it for legal or financial compliance purposes (e.g., billing records are retained for 7 years per tax law requirements).

Security

Your data is stored in Supabase with row-level security policies that ensure you can only access your own data. All data is encrypted in transit (TLS) and at rest. We use Supabase Auth for authentication with industry-standard security practices. No security system is perfect. If you discover a security vulnerability, please report it to [email protected].

Contact

Questions about this policy? Email us at [email protected]. We'll respond within 5 business days. BFF is a service operated by The Heart Market LLC. The Heart Market LLC is the data controller for the personal information described in this policy. Last updated: April 2026.