Privacy Policy

This policy explains how Axeract Technologies ("we", "us") handles personal data in the Physora mobile app and on this website. Physora is an AI fitness coach that analyses physique photos, builds training and nutrition plans, and tracks progress.

The short version: we collect what the app needs to coach you, we keep physique photos private and encrypted, we never sell your data or use it for advertising, and you can export or delete everything at any time.

• Account data: email address or Apple / Google sign-in identifier, display name, language, units and settings.
• Profile and goals: age range, sex (used for programming and scan scoring), height, weight, goal, experience, equipment, schedule and any injuries you tell us about.
• Physique photos: the front, back and optional side photos you take for a scan, and the scores derived from them. See the next section.
• Training data: workouts, sets, reps, loads, personal records, rep-counter summaries and exercise preferences.
• Nutrition data: foods you log by search, barcode or photo, and the targets set for you.
• Coach conversations: messages you send to the AI coach and its replies.
• Device and usage data: app version, device model, operating system, crash reports and, with your consent, product analytics events.
• Purchase status: whether you have an active subscription. Payment details are handled by Apple or Google; we never see your card.

Physique photos are the most sensitive data we hold. They are stored privately and encrypted, never made public, never used for advertising, and you can delete them at any time.

• Photos are uploaded over an encrypted connection to private storage with encryption at rest. They are only ever accessed through short-lived links (five minutes or less).
• Photos are used to produce your scan result and your own progress comparisons. They are not shown to other users, and there is no public profile.
• You choose how long photos are kept in Settings → Privacy, and you can delete any individual scan.
• When you delete a scan or your account, the photos are permanently deleted within 24 hours.
• We do not currently use your photos to train AI models. If that ever changes, it will be strictly opt-in, off by default, and explained before you agree. Declining will never limit the app. To be confirmed: Final position depends on decision 19
• Scans are for adults (18+). Images that appear to show a minor, explicit content or another person are rejected and deleted.

If you connect Apple Health (HealthKit) or Android Health Connect, Physora reads the data types you approve, such as workouts, steps, body weight and energy. We use it only to improve your plan and progress tracking.

• Health data is never used for advertising, marketing or sold to anyone.
• You can disconnect at any time in the Health app or Health Connect, and in Physora settings.

• To provide the app: scans, plans, progression, nutrition targets, coaching and progress reports.
• To keep the service secure and reliable: preventing abuse, rate limiting and diagnosing crashes.
• To improve Physora, using aggregated product analytics, only with your consent.
• To communicate with you: service messages, and reminders you have switched on.

AI features produce explanations and suggestions. Scores and calorie targets are calculated by our own rules engine, not invented by a language model.

Where data-protection law requires a legal basis, we rely on:

• Contract: to provide the features you signed up for.
• Explicit consent: for physique photos, health data and product analytics. You can withdraw consent at any time.
• Legitimate interests: for security, fraud prevention and keeping the service running.
• Legal obligation: where we must keep records by law.

To be confirmed: Counsel to confirm the legal bases for each launch market

We use service providers who process data on our behalf under contract. They may only use it to provide their service to us.

• Cloud hosting and private file storage for the app backend and encrypted photo storage. To be confirmed: Vendor to be confirmed
• MongoDB Atlas: database hosting.
• AI model provider for photo analysis and coach replies. Requests are sent without your name or email. To be confirmed: Vendor to be confirmed (ADR 0009)
• RevenueCat: subscription status across the App Store and Google Play.
• Firebase Cloud Messaging: delivering push notifications you have enabled.
• Sentry: crash and error reporting.
• PostHog: product analytics, only with your consent.
• Apple and Google: sign-in, app distribution and payments, under their own privacy policies.

Our providers may process data in countries other than yours. Where that happens, we rely on recognised safeguards such as standard contractual clauses.

To be confirmed: Processing regions and transfer mechanisms to be confirmed by counsel

• Physique photos: for the period you choose in settings, and deleted within 24 hours of a scan or account deletion.
• Account, training, nutrition and coach data: while your account is active, then deleted when you delete your account.
• Crash and analytics data: kept for a limited period, then aggregated or deleted. To be confirmed: Periods to be confirmed
• Subscription records: minimal entitlement records may be kept where the law requires it. To be confirmed: Period to be confirmed by counsel

Depending on where you live, you have the right to:

• Access and export your data. Use Settings → Privacy → Export my data to download a copy (JSON plus a photo archive, via a link that expires).
• Delete your account and data. See how to delete your account.
• Correct inaccurate data, most of which you can edit in the app.
• Withdraw consent for photos, health data or analytics at any time.
• Object to or restrict certain processing, and to complain to your local data-protection authority.

We do not sell or share personal data for cross-context behavioural advertising.

Product analytics are off until you agree. On iOS we ask for permission as Apple requires. You can change your choice in settings at any time.

This website does not set advertising cookies. If we add website analytics, it will only load after you consent.

Physora is for adults. You must be 18 or older to use physique scans, and the app is intended for users 18 and over. We do not knowingly collect data from children. If you believe a child has used Physora, contact us and we will delete the data.

Data is encrypted in transit and at rest, access is limited to staff who need it and is audit-logged, and sign-in tokens are stored in your device keychain or keystore. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

We will update the date and version above when this policy changes, and tell you in the app before any material change takes effect.

For privacy questions or to exercise your rights, email To be confirmed: privacy email.

Axeract Technologies. To be confirmed: Registered address