Privacy Policy

Last updated: 17 October 2026

The short version

• Swoleboard handles health data (sleep, steps, weight, food, workouts). That is special-category data, so we only use it with your explicit consent, only to run the app, and we never sell it or use it for advertising.
• Location is coarse only: the city you choose, if you choose one. We never collect or show your exact position.
• Photos are re-encoded and stripped of hidden data (including GPS tags) the moment you upload them.
• Food photos are sent to an AI provider (Anthropic) for an estimate only when you ask for one.
• We use only essential cookies. No ads, no trackers.
• You can download everything or delete your account at any time from Settings.

Who we are

Swoleboard (swoleboard.com) is run by [legal name of the operator], [registered address] ("we", "us"). We are the controller of your personal data under the UK GDPR and the Data Protection Act 2018 (and the EU GDPR where it applies). Contact us at [privacy@swoleboard.com].

What we collect

Account data

Your email address, the handle and display name you pick, an optional bio and profile photo, your privacy choice, your time zone and, if you sign in with Google or Facebook, a link to that account (its id and the basic profile it shares). We record when you confirmed you are 16 or older and when you gave consent to process health data.

Health and activity data

Whatever you choose to log: sleep, steps, active minutes, weight, notes, food and meals, workouts, sets and personal records, and goals. This is special-category data (data concerning health).

Social content

Friends and requests, blocks, league entries, votes, meal posts, recipes, deals, comments and reports you make.

Location

Only the city you pick from a list, and whether you opted in to local leagues. We do not use GPS or your IP address to locate you, and we never show anyone a precise position.

Technical data

Sign-in sessions (device type from your browser's user agent, IP address, time of sign-in and last activity), so you can see where you're signed in and so we can keep the service secure. Server logs are kept briefly for security.

Why we use it, and our legal basis

• Running your account and the app (profiles, boards, leagues, friends): performance of our contract with you.
• Health data: your explicit consent (UK GDPR Article 9(2)(a)), given during sign-up. It is used only to show you your stats, scores, streaks and goals, and to share the results you choose to share with the people your privacy setting allows.
• Security and abuse prevention (rate limits, moderation of reported content): our legitimate interest in keeping Swoleboard safe.
• Emails: sign-in links are needed to run your account. The weekly recap email is off unless you switch it on.

You can withdraw your health-data consent at any time by deleting your account. Because the app cannot work without processing health data, withdrawing consent means closing the account.

Who can see your data

Your privacy setting decides who sees your profile and scores: Public (anyone), Friends (only friends you accepted) or Private (only you). Your email address is never shown to other users. Your city is shown only if you opt in to local leagues.

Photos

Every photo you upload is re-encoded on our server. All hidden metadata (EXIF, including GPS location, camera model and timestamps) is removed, and large images are scaled down. Photos are only shown to people who are allowed to see the post or profile they belong to.

AI photo estimates

If you ask Swoleboard to estimate a meal from a photo, or to read a screenshot from another app, that image is sent to Anthropic (our AI provider) to produce the estimate. This happens only when you tap the button for it. Anthropic processes the image on our behalf to return the result and, under its commercial terms, does not use it to train its models. Estimates can be wrong — always check them before saving. [Confirm Anthropic's current data-retention terms and the transfer mechanism to the US before launch.]

Who we share data with

We never sell your data. We use a small number of processors to run the service:

• OVHcloud — hosting, database and email sending (servers in [EU/UK region]).
• Anthropic — AI estimates from photos, only when you request one (United States).
• Google and Meta (Facebook) — only if you choose to sign in with them.

Where data leaves the UK/EEA we rely on adequacy regulations or the UK International Data Transfer Addendum / EU Standard Contractual Clauses. [Confirm with each processor.]

How long we keep it

• Account and health data: for as long as you have an account.
• When you delete your account: your profile is hidden and you are signed out immediately, and your personal data and photos are permanently erased straight away (in rare failures, within [30] days). Backups roll off within [35] days.
• Sign-in links expire after 15 minutes. Signed-in sessions expire after 30 days of inactivity.
• Reports you filed may be kept without your name for moderation records. Content others reported may be kept for up to [12 months] where needed to deal with abuse.

Your rights

You can access, correct, download (portability), restrict, object to processing of, and erase your data. Most of this is self-service in Settings:

• Download my data gives you a JSON file with everything you've logged, posted and set up.
• Delete account erases your account and data across every part of Swoleboard.

For anything else, email [privacy@swoleboard.com]; we reply within one month. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113, or to your local data protection authority. [ICO registration number: placeholder.]

Age

Swoleboard is for people aged 16 and over. We ask you to confirm your age when you sign up. If we learn that someone under 16 has an account, we will delete it.

Cookies

We use only essential cookies that keep you signed in. See the Cookie Policy.

Security

Data is encrypted in transit (HTTPS). Sign-in uses one-time links or Google/Facebook, so we never store a password. Access to production systems is limited to the people who run Swoleboard.

Changes

If we change this policy in a meaningful way we will tell you in the app or by email before the change takes effect.

Credits

City names: GeoNames (geonames.org), licensed under CC BY 4.0. Generic food data: U.S. Department of Agriculture, FoodData Central (SR Legacy), public domain. Packaged product data: © Open Food Facts contributors, available under the Open Database License (ODbL).