Privacy Policy

Last updated: 22 October 2026

The short version

• Swoleboard handles health data (sleep, steps, weight, food, workouts). That is special-category data, so we only use it with your explicit consent, only to run the app, and we never sell it or use it for advertising.
• Location is coarse only: the city you choose, if you choose one. We never collect or show your exact position.
• For now, no one's own photos are shown to other people. Profiles show your Google profile picture (if you sign in with Google) or your initials; deals show the product picture from the shop's page; meal posts and recipes have no photos.
• A photo you send for a calorie estimate is seen only by you and is deleted within 24 hours (usually as soon as the estimate is done). Every image is re-encoded and stripped of hidden data, including GPS tags, the moment it reaches us.
• Food photo estimates run on our own server and only when you ask for one. Photos go to an outside AI provider (Anthropic) only if we switch that option on, and this policy will say so first.
• If you connect Google Health, we read your steps, sleep, calories, weight, resting heart rate and workouts to fill in your board. We never write anything to Google, and you can disconnect at any time.
• We use only essential cookies. No ads, no trackers.
• You can download everything or delete your account at any time from Settings.

Who we are

Swoleboard (swoleboard.com) is run by [legal name of the operator], [registered address] ("we", "us"). We are the controller of your personal data under the UK GDPR and the Data Protection Act 2018 (and the EU GDPR where it applies). Contact us at [privacy@swoleboard.com].

What we collect

Account data

Your email address, the handle and display name you pick, an optional bio, your privacy choice, your time zone and, if you sign in with Google or Facebook, a link to that account (its id and the basic profile it shares). If you sign in with Google, we keep a copy of your Google profile picture and show it as your profile photo. We record when you confirmed you are 16 or older and when you gave consent to process health data.

Health and activity data

Whatever you choose to log: sleep, steps, active minutes, weight, notes, food and meals, workouts, sets and personal records, and goals. This is special-category data (data concerning health).

Data from Google Health (only if you connect it)

Daily steps, distance, active minutes, calories burned (active and total), sleep sessions with their stages, weight, daily resting heart rate and workout summaries, plus the name of the device or app that recorded them when Google tells us. See Google Health below.

Social content

Friends and requests, blocks, league entries, votes, meal posts, recipes, deals and reports you make.

Location

Only the city you pick from a list, and whether you opted in to local leagues. We do not use GPS or your IP address to locate you, and we never show anyone a precise position.

Technical data

Sign-in sessions (device type from your browser's user agent, IP address, time of sign-in and last activity), so you can see where you're signed in and so we can keep the service secure. Server logs are kept briefly for security.

Why we use it, and our legal basis

• Running your account and the app (profiles, boards, leagues, friends): performance of our contract with you.
• Health data: your explicit consent (UK GDPR Article 9(2)(a)), given during sign-up. It is used only to show you your stats, scores, streaks and goals, and to share the results you choose to share with the people your privacy setting allows.
• Security and abuse prevention (rate limits, moderation of reported content): our legitimate interest in keeping Swoleboard safe.
• Emails: sign-in links are needed to run your account. The weekly recap email is off unless you switch it on.

You can withdraw your health-data consent at any time by deleting your account. Because the app cannot work without processing health data, withdrawing consent means closing the account.

Who can see your data

Your privacy setting decides who sees your profile and scores: Public (anyone), Friends (only friends you accepted) or Private (only you). Your email address is never shown to other users. Your city is shown only if you opt in to local leagues.

In a crew duel with a friend, unless your profile is Private, they see this week's numbers next to theirs: steps, sleep, calories burned, your average calories eaten per logged day, and your workouts.

Photos

For now, Swoleboard shows no photos of yours to other people: you can't add a photo to your profile, a meal post, a recipe or a deal. The only pictures others see are:

• your Google profile picture, if you sign in with Google (otherwise your initials). We copy it from Google once, keep our own copy and show it to the people who can see your profile;
• on a deal, the product picture from the shop's page, which we copy when the deal is posted.

Photos added to profiles, meal posts, recipes or deals before this change are kept but not shown to anyone, you included, until we switch photos back on (this policy will say so first). They are deleted with your account. Every image is re-encoded on our server: all hidden metadata (EXIF, including GPS location, camera model and timestamps) is removed, and large images are scaled down.

Photo estimates

If you ask Swoleboard to estimate a meal from a photo, the photo is processed on our own server by an open-source image model: it suggests which foods are on the plate, and you set the amounts. The photo never leaves our hosting provider for this, the model keeps nothing, and it is not used to train anything. Suggestions can be wrong — always check them before saving.

The photo is processed privately: only you can see it (not your friends, not our moderators), and it is never attached to anything others see. A meal you log from it carries no photo. We delete it as soon as the estimate is done, when you log the meal or start over, and in any case within 24 hours.

We may later offer more detailed estimates from Anthropic, an outside AI provider, and the reading of screenshots from other apps works the same way. Only when that option is switched on is an image you submit for an estimate sent to Anthropic, and only when you tap the button for it. Anthropic processes the image on our behalf to return the result and, under its commercial terms, does not use it to train its models. [Confirm Anthropic's current data-retention terms and the transfer mechanism to the US before switching it on.]

Google Health

In Settings → Connected apps you can link your Google account through the Google Health API (the service that holds the data from Fitbit devices, Pixel Watches and the Google Health app). It is optional and off until you press "Connect Google Health" and agree on Google's own screen, where you can also untick any kind of data you don't want to share.

• What we read: steps, distance, active minutes, calories burned, sleep and sleep stages, weight, resting heart rate and workouts — read-only. We never write, change or delete anything in your Google account.
• Why: only to show your own stats, goals, streaks and scores, and to share the results your privacy setting allows (for example a "Google" badge next to synced numbers your friends can see). It is health data, processed on the same explicit consent as everything you log yourself.
• How: Google gives Swoleboard an access key for your data; we store it encrypted and use it to fetch new data when Google tells us something changed, when you press "Sync now", and once a night.
• How long: imported data stays like anything else you logged, for as long as you have an account. When you disconnect you choose whether to keep it or delete it; you can also delete it later from the same card. Deleting your account deletes it, and we withdraw our access at Google.
• How to stop: Settings → Connected apps → Disconnect (this also removes Swoleboard's access in your Google account). You can also remove access at any time in your Google account under "Third-party apps & services" (myaccount.google.com/connections); we then stop syncing.

Swoleboard's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: we use data from Google only to run the features you see in Swoleboard; we never use it for advertising; we never sell it or transfer it to anyone (except where the law requires it, or as part of a merger with the same promises); and no person at Swoleboard reads it, unless you ask us to for support, it is needed for security or the law requires it.

Who we share data with

We never sell your data. We use a small number of processors to run the service:

• OVHcloud — hosting, database and email sending (servers in [EU/UK region]).
• Anthropic — AI estimates from photos and screenshots, only if that option is switched on and only when you request one (United States).
• Google and Meta (Facebook) — only if you choose to sign in with them.
• Google — only if you connect Google Health; we receive your data from Google, we do not send your Swoleboard data to Google.

Where data leaves the UK/EEA we rely on adequacy regulations or the UK International Data Transfer Addendum / EU Standard Contractual Clauses. [Confirm with each processor.]

How long we keep it

• Account and health data: for as long as you have an account.
• When you delete your account: your profile is hidden and you are signed out immediately, and your personal data and photos are permanently erased straight away (in rare failures, within [30] days). Backups roll off within 14 days.
• Photos you send for a calorie estimate: deleted as soon as the estimate is done, and always within 24 hours.
• Sign-in links expire after 15 minutes. Signed-in sessions expire after 30 days of inactivity.
• Google Health access keys: until you disconnect or delete your account (then revoked at Google straight away, or within [7] days if Google can't be reached). Imported data: see Google Health above.
• Reports you filed may be kept without your name for moderation records. Content others reported may be kept for up to [12 months] where needed to deal with abuse.

Your rights

You can access, correct, download (portability), restrict, object to processing of, and erase your data. Most of this is self-service in Settings:

• Download my data gives you a JSON file with everything you've logged, posted and set up.
• Delete account erases your account and data across every part of Swoleboard.

For anything else, email [privacy@swoleboard.com]; we reply within one month. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113, or to your local data protection authority. [ICO registration number: placeholder.]

Age

Swoleboard is for people aged 16 and over. We ask you to confirm your age when you sign up. If we learn that someone under 16 has an account, we will delete it.

Cookies

We use only essential cookies that keep you signed in. See the Cookie Policy.

Security

Data is encrypted in transit (HTTPS). Sign-in uses one-time links or Google/Facebook, so we never store a password. Access to production systems is limited to the people who run Swoleboard.

Changes

If we change this policy in a meaningful way we will tell you in the app or by email before the change takes effect.

Credits

City names: GeoNames (geonames.org), licensed under CC BY 4.0. Generic food data: U.S. Department of Agriculture, FoodData Central (SR Legacy), public domain. Packaged product data: © Open Food Facts contributors, available under the Open Database License (ODbL).