Privacy policy

1. Information We Collect

We collect information you provide directly to us when you create an account, complete your onboarding profile, log daily check-ins, or communicate with the AI coach. This includes:

• Account Details (Name, Email, Password Hash)
• Physical Metrics (Height, Weight, Age, Body Fat)
• Fitness Goals, Experience Level, and Equipment
• Chat History with the AI Coaching Assistant
• Food descriptions you type or speak to log a meal, kept until you delete your account to check that food logging is accurate
• Health & Wearable Data you choose to connect (e.g., heart rate, resting heart rate, HRV, sleep, steps, and workouts from Apple Health or Health Connect)

Health Data (Apple Health & Health Connect): If you connect Apple Health (HealthKit) or Health Connect, we read only the specific metrics you authorize and use them solely to personalize your training, readiness, and recovery recommendations inside the app. We never use health data for advertising or marketing, never share it with third parties for their own purposes, and never sell it. You can revoke access at any time in your device's Health settings.

2. How We Use Your Information

We use the information we collect to operate, maintain, and provide our services. Your physical metrics and training data are securely passed to our Large Language Models (LLMs) to generate personalized fitness and nutrition programs that evolve with you. We also use the information we collect, in de-identified or aggregated form where feasible, to understand how the app is used and to improve our services and coaching models.

Note on AI Processing: Your chat logs and check-in metrics are temporarily processed by third-party AI providers (Google Gemini, with OpenAI as a backup provider) via secure, encrypted API endpoints to generate responses. If you use voice input, your audio is transcribed by OpenAI. Under our agreements with these providers, data sent through their APIs is not used to train their models. We do not use your personal training data to train broader foundational AI models without explicit consent.

3. Data Sharing & Third Parties

We do not sell your personal data. We only share data with trusted third-party providers necessary to run the platform:

• Supabase: Dedicated secure managed Postgres database and Authentication.
• Stripe: Secure payment processing (we do not store your raw credit card numbers).
• Google (Gemini): Inference endpoints for the Coach AI text generation.
• OpenAI: Backup AI inference and voice transcription.
• Twilio: SMS/WhatsApp message delivery if you use text-message coaching.
• RevenueCat: In-app subscription management for App Store and Google Play purchases.
• Sentry: Error and crash reporting so we can find and fix problems.
• FatSecret: Food-database lookups for the foods you log.
• Resend: Programmatic email delivery.
• Google (Firebase Cloud Messaging): Push notification delivery on Android.
• PostHog: Privacy-conscious product analytics to understand feature usage and improve the app.

4. Your Data Rights

You have the right to request access to the data we hold about you, to request that we correct any inaccuracies, and to request the deletion of your account and associated data. You can delete your account from the Profile settings dashboard.

5. Data Retention After Deletion

When you delete your account, we permanently remove all personally-identifiable data — your name, email address, profile photo, chat history, training programs, and goal records — typically within one minute and at most within 30 days.

We retain pseudonymous training and nutrition records (workouts logged, foods logged, meal plans generated, body-metric trends) under a randomly-assigned identifier (e.g., deleted_user_47) so we can study how the app is used in aggregate and improve it. These records cannot be tied back to you.

Subscription billing records are retained as legally required (US: 7 years for tax). Backup copies cycle out within 90 days. If you have an active App Store subscription, you must cancel it separately in Settings → [Your Apple ID] → Subscriptions; we cannot cancel App Store subscriptions on your behalf. The same applies to an active Google Play subscription: cancel it in the Play Store app under Payments & subscriptions → Subscriptions.

6. Instagram Messaging (Connected Creator Accounts)

Some fitness creators on CreatorClone connect their Instagram professional account to our platform through Meta's official Instagram API. When a creator has connected their account and you comment on their content or send their account a direct message, Meta delivers that interaction to us. This includes the message or comment text, your Instagram username and user ID, and a timestamp.

We use this data solely to provide messaging tools to that creator: automatic replies to keywords (for example, commenting a keyword to receive a link) and a managed inbox where the creator and their authorized team review messages and send replies. Replies are always sent from the creator's own account, within the messaging windows Meta's platform policies allow. We do not use this data for advertising, do not sell it, and do not use it to train AI models.

Message data is retained while the creator's account remains connected. If you have messaged a connected creator account and would like your message data removed from our systems, email support@creatorclone.fit from the relevant context (or ask the creator) and we will delete it. Creators can disconnect their account at any time, which stops all further collection.

7. Cookies and Tracking

We use standard JWT-based authentication cookies and local storage to keep you logged into the application and to secure your current session.

We also use first- and third-party product analytics (PostHog) to understand how features are used so we can improve the app. This relies on local storage and similar identifiers tied to a pseudonymous device ID. We do not use advertising or cross-site marketing tracking cookies, and we do not sell this data. Where required by law, we will ask for your consent before enabling non-essential analytics.

8. Google User Data (Sign in with Google)

If you choose to sign in with Google, we request only the basic scopes Google offers for sign-in: openid, email, and profile. Through these we receive your Google account ID, your email address, your name, and your profile photo URL. We do not request access to your Gmail, Google Drive, Google Calendar, contacts, or any other Google data.

We use this information only to create and secure your CreatorClone account, sign you in, display your name and photo in the app, and contact you about your account. It is stored in our authentication database (Supabase), is not sold, is not used for advertising, is not shared with third parties except the service providers listed in Section 3 that help us operate the app, and is not used to develop, improve, or train generalized AI or machine-learning models.

CreatorClone's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke CreatorClone's access at any time at myaccount.google.com/permissions. Deleting your CreatorClone account deletes the Google profile data we stored, as described in Section 5.

9. How We Protect Your Data

All data is encrypted in transit with TLS and encrypted at rest by our database and hosting providers. Access to production data is limited to authorized staff who need it to operate and support the service, and is protected by multi-factor authentication. Database access is enforced with row-level security so each member can reach only their own records. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the relevant authorities of a breach as required by law.

10. Requesting Deletion Without the App

You can delete your account in the app under Profile settings. If you cannot access the app, email support@creatorclone.fit from the email address on your account with the subject “Delete my account.” We will verify the request and complete the deletion described in Section 5 within 30 days.

11. Children

CreatorClone is not directed to children. You must be at least 13 years old (16 in the European Economic Area and United Kingdom) to use it, and we do not knowingly collect personal information from children under these ages. If you believe a child has given us personal information, contact us and we will delete it.

12. International Users and Regional Rights

We are based in the United States, and your information is processed and stored in the United States. If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your data to perform our contract with you, with your consent (for example, health data you choose to connect), and for our legitimate interest in improving the service. You may access, correct, delete, or export your data, object to or restrict processing, withdraw consent at any time, and complain to your local data protection authority.

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request its deletion or correction, and not to be discriminated against for exercising these rights. We do not sell or share your personal information for cross-context behavioral advertising.

To exercise any of these rights, email support@creatorclone.fit. We respond within 30 days.

13. Changes to This Policy

We may update this policy from time to time. We will change the “Last updated” date above and, for material changes, notify you by email or in the app before the change takes effect.

14. Contact Us

Realizing Nascent Solutions LLC (developer of CreatorClone)
2409 Shiloh Drive, Austin, TX 78745, USA
Email: support@creatorclone.fit
Phone: +1 (352) 362-0722