Privacy Policy

Last updated: July 1, 2026

Swolly LLC ("we," "our," or "us") operates the Swolly mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App. Please read this policy carefully. By using Swolly, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address — used for authentication, account recovery, and transactional emails
• Display name — visible to other users in competitions and leaderboards
• Profile photo — optional, visible to other users
• Timezone — used to display times correctly and schedule reminders
• Date of birth — used to verify you meet our minimum age requirement (18+). Stored securely in your private account data and not shared with other users or third parties.

If you sign in using Google or Apple, we receive your name, email address, and profile picture (Google) or name and email address (Apple) from those services. Apple users may choose to share a private relay email address instead of their real one. We do not receive or store your Google or Apple password.

1.1.1 Profile & Fitness Information

During onboarding (or later from Fuel Settings), you may provide the following profile details so the App can personalize calorie and macro targets:

• Height and weight
• Gender — used in the calorie-needs formula
• Activity level — sedentary through extra active
• Fitness goal — lose weight, maintain, or gain muscle
• Unit preference — imperial or metric
• Dietary preferences — foods you like, dislike, and optional notes

This information is stored in your private account data and is not visible to other users. You can skip these prompts during onboarding; doing so disables calorie and macro tracking but does not affect the rest of the App.

1.2 Fitness & Health Data

If you choose to connect Apple Health (iOS) or Health Connect (Android), we may read the following data types:

• Active energy burned (calories)
• Step count
• Walking and running distance
• Workout sessions (type, duration, start/end times)

On iOS, we also write workout data (from runs you track in Swolly) back to Apple Health with your permission. On Android, Swolly currently only reads from Health Connect and does not write data back.

1.2.1 Health Data in Competitions

If you join a competition that tracks fitness metrics (such as steps, calories burned, distance, active time, or body-weight change in weight-loss competitions), your competition score derived from health data may be visible to other participants on the competition leaderboard. This includes:

• Your aggregated score (e.g., total steps, total calories, or progress toward a weight-loss goal)
• Your rank among participants
• Your display name and profile photo

We do not share raw health data (individual workouts, heart rate, etc.) with other users. Only aggregated competition scores are visible on leaderboards.

1.3 Location Data

If you use the run-tracking feature, we collect precise GPS location data including:

• Route coordinates (latitude and longitude points along your run)
• Distance traveled
• Pace calculations

We request background location access so that run tracking continues when the App is minimized. Location data is collected only while you are actively tracking a run and is never collected passively. Your GPS route data is private and visible only to you.

1.4 Nutrition & Dietary Data

When you use calorie tracking, we collect:

• Food names, calorie counts, and macronutrient values you enter
• Meal types and dates
• Barcode scan data (sent to the Open Food Facts API to retrieve product nutrition information — no personal data is included in these requests)
• Recipes you create or save, including ingredients and preparation instructions
• Meal prep plans and scheduled meals
• Daily calorie and macro goals you set

1.5 Tasks & Reminders

If you use the task feature, we collect task names, due dates, and completion status. Task reminder times are used to schedule local notifications on your device.

1.6 Competition & Social Data

When you participate in competitions, we collect:

• Activity posts (workout metrics, notes, and optional photos)
• Comments on posts
• Chat messages within competition groups
• Competition scores, rankings, and progress data
• Likes and interactions

This data is visible to other participants in the same competition.

1.7 Photos & Media

We access your camera and photo library only when you actively choose to:

• Take or select a profile photo
• Add images to activity posts
• Add screenshots to recipes

We do not access your camera or photo library in the background.

Image processing: When you upload a photo, the image is re-encoded on your device before upload. This process removes EXIF metadata — including GPS coordinates, device information, and camera details — from the image file. This is done to protect your privacy; only the visible image content is stored on our servers.

1.8 Device & Usage Data

We automatically collect certain information through Firebase services:

• Analytics data: Screen views, feature usage, and interaction events (e.g., competition created, workout completed) via Firebase Analytics
• Crash data: Error reports, stack traces, and device information via Firebase Crashlytics
• Performance data: App startup time, screen load times, and network request metrics via Firebase Performance Monitoring
• Push notification tokens: Device tokens for delivering push notifications via Firebase Cloud Messaging

1.9 Recipe Suggestions (Opt-In)

If you use the "Suggest a Recipe" feature to recommend one of your private recipes to the Swolly team, the following information is sent to us for review:

• The recipe content you selected (title, category, ingredients, instructions, photos, and any optional note you include)
• Your user ID and display name (so we can credit you if we publish your suggestion)

Suggestion data is stored in a private collection that only the Swolly team can access, and a notification is sent to our internal review inbox. If we publish your suggestion as a Swolly Official recipe, your display name will appear as a plain-text credit on that recipe ("Suggested by <your display name>"). We will not link to your profile or expose any other personal information.

You can request deletion of a submitted suggestion at any time by emailing support@swolly.io.

1.10 Feedback Submissions

If you send us feedback through More > Send Feedback, we collect the message you write along with your user ID, email address, display name, operating system, and app version (so we can respond to you and reproduce reported bugs). Feedback is stored in a private collection that only the Swolly team can access, and a copy is emailed to our support inbox. Feedback submissions are deleted when you delete your account.

2. How We Use Your Information

Purpose	Data Used
Provide and maintain the App	Account info, fitness data, nutrition data
Enable competition features and leaderboards	Activity posts, scores, rankings, social interactions
Track your runs with GPS mapping	Location data
Sync with your device's health app	Health data (with your permission)
Send push notifications	FCM token, notification preferences
Send transactional emails (password reset, verification)	Email address
Diagnose bugs and improve the App	Crash reports, analytics, performance data
Track your nutrition and calorie goals	Food entries, macro data, barcode lookups
Provide AI-powered fitness and nutrition suggestions	Your messages to Swolly AI, profile data (fitness goals, dietary preferences, height, weight, age, gender, activity level), and — when needed to answer your question — your meal logs, nutrition summaries, recipes, tasks, and workout plans
Respond to feedback and bug reports	Feedback message, email address, display name, OS and app version

We do not use your data for advertising. We do not sell your personal information to third parties. We do not use health data for any purpose other than providing fitness tracking features to you.

2.1 AI-Powered Features

Swolly includes an AI companion feature powered by Google's Gemini API. When you use the AI companion:

• Your messages and relevant profile data (fitness goals, dietary preferences, height, weight, age, gender, activity level) are sent to Google's Gemini API to generate personalized responses
• To answer your questions, the AI companion can also retrieve data from your account — including recent meal logs and nutrition summaries, your recipes, tasks, and workout plans — and that retrieved data is included in the request sent to the Gemini API
• Conversation history is stored to provide context within a session
• AI-generated content (workout plans, meal plans, recipes, nutritional estimates) is created by artificial intelligence and is not reviewed by medical or nutrition professionals
• We do not use your AI conversations for advertising or share them with third parties beyond the AI service provider

3. How We Share Your Information

3.1 With Other Users

The following information is visible to other Swolly users:

• Your display name and profile photo
• Activity posts, comments, and chat messages within competitions you participate in
• Your score, ranking, and progress in shared competitions

The following information is never shared with other users:

• Your email address or phone number
• Your GPS route data
• Your individual calorie or nutrition entries
• Your private recipes. The in-app "share" button opens your device's share sheet with a plain-text copy of the recipe (title, ingredients, instructions) for you to send manually — no Swolly-hosted link is created and no recipe data is ever shared with other Swolly users.
• Your task lists

3.2 With Service Providers

We use the following third-party services to operate the App:

Service	Provider	Purpose
Authentication, Database, Storage	Google Firebase	Core infrastructure
Analytics	Firebase Analytics (Google)	Usage metrics
Crash Reporting	Firebase Crashlytics (Google)	Bug detection
Performance Monitoring	Firebase Performance Monitoring (Google)	App startup and network latency metrics
Push Notifications	Firebase Cloud Messaging (Google)	Delivering notifications
Maps	Google Maps	Displaying run routes
Nutrition Lookup	Open Food Facts	Barcode product lookup (no user data sent)
Email Delivery	Gmail SMTP	Transactional emails from no-reply@swolly.io
Subscription Management	RevenueCat	Processing in-app subscriptions and purchase validation
AI Assistant	Google Gemini API	Powering the Swolly AI companion for personalized fitness and nutrition suggestions

These providers process data on our behalf and are bound by their own privacy policies and data processing agreements.

3.2.1 Subscription Data (RevenueCat)

When you subscribe to Swolly Pro, subscription management is handled by RevenueCat, Inc. The following data is shared with RevenueCat:

• Your pseudonymous App User ID (your Firebase UID — a unique identifier linked to your account, which constitutes personal information under CCPA)
• Purchase receipts and transaction data from the Apple App Store or Google Play Store
• Subscription status, renewal dates, and billing history
• Device platform (iOS or Android)

RevenueCat does not receive your name, email, health data, fitness data, or any content you post in the App. For more information, see RevenueCat's Privacy Policy.

3.3 As Required by Law

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or subpoena).

4. Data Storage & Security

Your data is stored on Google Firebase servers located in the United States. We implement the following security measures:

• All data transmitted between your device and our servers is encrypted in transit (TLS/SSL)
• Firebase Authentication secures your account with industry-standard practices
• Firestore Security Rules enforce access control so users can only read and write their own data
• Firebase Storage rules restrict file access to authenticated users
• Passwords are hashed by Firebase Authentication and never stored in plaintext

4.1 Data Breach Notification

In the unlikely event of a data breach that compromises your personal information, we will:

• Investigate the breach and take steps to contain it as quickly as possible
• Notify affected users via email within 72 hours of becoming aware of the breach, where feasible
• Describe the nature of the breach, the types of data involved, and the steps we are taking to address it
• Provide guidance on steps you can take to protect yourself
• Notify relevant regulatory authorities as required by applicable law (including state attorneys general and data protection authorities)

5. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or legitimate business purposes (e.g., resolving disputes, enforcing our agreements).

5.1 Retention Schedule

Data Type	Retention Period
Account data, fitness data, nutrition data, recipes, tasks, workouts, runs	Until account deletion + 30 days
Feedback submissions and recipe suggestions	Until account deletion + 30 days
AI conversation history	Until account deletion + 30 days
Content moderation reports	12 months after resolution (for pattern detection); indefinitely if unresolved
Data export files	Available until account deletion; download links remain active until the file is deleted
Firebase Analytics data	14 months (Google's default retention), then automatically deleted
Firebase Crashlytics data	90 days (Google's default retention)
Anonymized/aggregated data	Indefinitely (cannot be used to identify you)
Inactive accounts	Accounts inactive for 24 months may be deleted after email notification

5.2 Inactive Accounts

If your account has been inactive (no logins) for 24 consecutive months, we may send you an email notification at the address on file. If you do not log in within 30 days of that notification, we may delete your account and all associated data. This helps us comply with data minimization principles and reduce unnecessary data storage.

6. Your Rights & Choices

6.1 All Users

• Access & Update: You can view and update your display name, profile photo, dietary preferences, and most other profile information through the App's Profile and Settings screens. To correct a field that is not editable in-app (such as date of birth), contact us at support@swolly.io.
• Delete Your Account: You can delete your account and all associated data from Settings. Deletion is permanent and cannot be undone.
• Notifications: You can disable push notifications at any time from your device's system settings (Settings > Notifications > Swolly on iOS, or App info > Notifications on Android). The App also stops sending notifications automatically if you deny the system permission prompt.
• Health Data: You can disconnect Apple Health or Health Connect at any time through the App's Health Connections screen or through your device's health app settings.
• Location: You can revoke location permission at any time through your device settings. Run tracking will not function without location access.

6.2 California Residents (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request that we delete the personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You may request that we correct inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising. There is nothing to opt out of.
• Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

Categories of Personal Information Collected (CCPA)

CCPA Category	Examples	Sold?
A. Identifiers	Name, email, unique user ID	No
B. Personal Information (Cal. Civ. Code § 1798.80(e))	Name, email address	No
C. Protected Classifications	Gender and age (date of birth), collected during onboarding to personalize calorie and macro targets	No
D. Commercial Information	Subscription purchase history, subscription status	No
F. Internet/Network Activity	App usage data, feature interactions, crash logs	No
G. Geolocation Data	Precise location (only during active run tracking, with your permission)	No
K. Inferences	Fitness preferences, dietary goals (derived from profile data)	No

We do not collect Category E (biometric data), Category I (professional information), or Category J (education information). Fitness data synced from Apple Health or Health Connect (steps, calories, distance, workouts) may fall within Category H (sensory data) depending on the source device. This data is collected only with your explicit consent and is used solely for the fitness tracking features described in Section 1.2.

Sensitive Personal Information (CPRA)

Under the CPRA, the following categories of data we collect are classified as Sensitive Personal Information (SPI):

• Precise geolocation: GPS coordinates collected during active run tracking sessions (with your permission)
• Health data: Fitness and health metrics synced from Apple Health or Health Connect (steps, calories, distance, workouts), and body-weight entries used in weight-loss competitions
• Account credentials: Email address and password used for account login (passwords are hashed by Firebase Auth and never stored by Swolly)

Swolly uses Sensitive Personal Information only to provide the App's features as described in this Privacy Policy. We do not use SPI for cross-context behavioral advertising or any purpose other than providing the services you expect. You have the right to limit the use of your Sensitive Personal Information — contact us at support@swolly.io to exercise this right.

To exercise any of the above rights, contact us at support@swolly.io.

6.3 Other State Privacy Laws

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws may have similar rights to access, correct, delete, and opt out. Contact us at support@swolly.io to exercise these rights.

6.4 European Economic Area, United Kingdom & Switzerland

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and equivalent local laws.

Lawful Bases for Processing

We process your personal data on the following legal bases:

Lawful Basis	Processing Activity
Contract Performance (Art. 6(1)(b))	Providing the App, managing your account, processing subscriptions, enabling competition and social features
Legitimate Interests (Art. 6(1)(f))	Analytics and crash reporting (to improve the App), fraud prevention, security monitoring
Consent (Art. 6(1)(a))	Location tracking during runs, push notifications
Explicit Consent for Special Category Data (Art. 6(1)(a) + Art. 9(2)(a))	Health data integration (Apple Health/Health Connect), health and profile data sent to the AI companion (height, weight, age, gender, fitness goals, dietary preferences, and — when relevant to your question — meal logs, nutrition summaries, recipes, tasks, and workout plans), health data shared on competition leaderboards (including body-weight change in weight-loss competitions). Health and fitness data is classified as special category data under GDPR Article 9. Separate explicit consent is obtained via dedicated consent dialogs before each of these processing activities begins.

Where we rely on consent, you may withdraw it at any time by adjusting the relevant settings in the App or your device, or by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

Your GDPR Rights

You have the right to:

• Access — Request a copy of the personal data we hold about you. You can export your data directly from the App via Settings > Download My Data.
• Rectification — Request correction of inaccurate personal data via the App's Profile and Settings screens, or by contacting us.
• Erasure ("Right to be Forgotten") — Request deletion of your personal data. You can delete your account and all associated data from Settings > Delete Account.
• Data Portability — Receive your personal data in a structured, commonly used, machine-readable format (JSON). Available via Settings > Download My Data.
• Restriction of Processing — Request that we limit processing of your data in certain circumstances.
• Object — Object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
• Automated Decision-Making — The App does not make decisions based solely on automated processing that produce legal or similarly significant effects on you. AI-generated fitness and nutrition suggestions are informational only and do not constitute automated decision-making under GDPR Article 22.
• Lodge a Complaint — You have the right to lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at support@swolly.io. We will respond within 30 days.

International Data Transfers

Your data is stored on Google Firebase servers in the United States. For transfers of personal data from the EEA, UK, or Switzerland to the US, we rely on the following safeguards:

• EU-US Data Privacy Framework: Google LLC is certified under the EU-US Data Privacy Framework, the UK Extension, and the Swiss-US Data Privacy Framework.
• Standard Contractual Clauses (SCCs): Where the Data Privacy Framework does not apply, our service providers (including Google and RevenueCat) incorporate Standard Contractual Clauses approved by the European Commission into their data processing agreements.

You may request a copy of the applicable safeguards by contacting us at support@swolly.io.

Privacy Contact

Swolly LLC does not currently have a designated Data Protection Officer. For privacy-related inquiries, data access requests, or complaints, you may contact us at support@swolly.io.

7. Children's Privacy

Swolly is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. Users must confirm they are at least 18 years old when creating an account.

If we learn that we have collected personal information from a person under 18, we will promptly delete that information. If you believe someone under 18 has created an account, please contact us at support@swolly.io.

8. Third-Party Links & Services

The App may contain links to third-party websites or services (e.g., recipe URLs). We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any personal information.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy in the App and updating the "Last updated" date. Your continued use of the App after changes are posted constitutes your acceptance of the revised policy.