Privacy Policy

Last updated: May 8, 2026

1. General Provisions

1.1. This Privacy Policy (the "Policy") governs how information that the User provides when using the Bodylytics service (the "Service") is processed and protected.

1.2. By using the Service, the User confirms acceptance of the terms of this Policy. If the User does not agree with these terms, they must stop using the Service.

1.3. The Service processes data in accordance with Federal Law No. 152-FZ "On Personal Data" (Russian Federation) and the principles of Regulation (EU) 2016/679 (GDPR).

2. Data We Collect

2.1. When using the Service, the following categories of data may be processed:

Identifiers: Telegram ID, username, first and last name from the Telegram profile;
Profile data: height, weight, age, sex, physical activity level, calorie and nutrient goals (macros);
Food diary: text descriptions of meals, AI analysis results (calories, protein, fat, carbohydrates, fiber);
Voice messages: audio recordings sent for food recognition (transcribed and deleted after processing);
Food photos: images sent for visual recognition (analyzed and not stored on the server after processing);
Workout data: sport type, duration, intensity;
Weight history: weight tracking records;
Technical information: interaction timestamps, interface language.

2.2. Special category — health data. Weight, height, age, sex, eating habits, and workouts may be considered health-related data (152-FZ, GDPR Art. 9). The Service processes them solely on the basis of the User's explicit consent, expressed by using the Service.

2.3. The Service does not collect passport data, addresses, phone numbers, or financial information (except for the fact of subscription payment via Telegram Stars or a payment provider).

3. Purposes of Data Processing

3.1. Data is used exclusively for:

AI analysis of nutrition and macro tracking;
generating reports and analytics for the User;
personalizing recommendations (TDEE calculation, calorie deficit/surplus);
improving recognition accuracy;
technical support and notifications.

4. Sharing Data with Third Parties

4.1. To operate the Service, data is shared with the following processors:

OpenAI (USA) — text food descriptions, photos, and voice transcriptions are sent to the OpenAI API for AI analysis. OpenAI does not use API data to train its models (API Data Usage Policy);
Groq (USA) — backup voice transcription service;
Telegram — message delivery platform;
Railway (hosting) — infrastructure for operating the Service.

4.2. Data is not sold, not shared for advertising, and not used for purposes other than those listed in Section 3.1.

4.3. Data may be disclosed as required by applicable law in the Russian Federation.

5. Data Retention

5.1. Profile data, food diary, workout history, and weight history are stored for the entire period of Service use.

5.2. Voice messages and food photos are processed in real time and are not stored on the server after the analysis result is obtained.

5.3. When an account is deleted, data is removed within 24 hours of request confirmation.

5.4. Payment data is retained in accordance with accounting requirements (up to 5 years).

6. User Rights

6.1. The User has the right to:

Data export: obtain a copy of their data in CSV format via the /export command in the bot;
Data deletion: request deletion of all personal data via the /deletedata command in the bot. Requests are processed within 24 hours;
Withdraw consent: stop using the Service and block the bot in Telegram at any time;
Data correction: update profile data via bot commands (/goals, /profile).

7. Data Security

7.1. Data is stored in an encrypted database (PostgreSQL with SSL connection).

7.2. Only the Service administrator has access to the data.

7.3. Data transfers to third-party APIs are carried out over the secure HTTPS protocol.

7.4. The administration takes reasonable measures to protect data but does not guarantee absolute security of information transmitted over the internet.

8. Changes to This Policy

8.1. The administration may amend the terms of this Policy. The current version is published in the Service.

8.2. Continued use of the Service after changes are made constitutes the User's acceptance of the updated Policy.

9. Contact Information

For questions about personal data processing, contact us via the /bug command in the bot or at: support@bodylytics.app