ButtMaxx is a glute-training app. To do its job it processes information about your body, photos of you, what you eat and how you train. This policy explains what we collect, why, who we share it with, how long we keep it and what rights you have. We have written it in plain language on purpose. If anything is unclear, email us at info@buttmaxx.app.

The data controller is Mats Claes, trading as Weight Loss Made Practical, Kerkenbos, 2812 Muizen, Belgium, email info@buttmaxx.app. This policy covers the ButtMaxx mobile app (app id com.kekka.buttmaxx) and the website buttmaxx.app.

When you first open the app we create an anonymous account with a random user ID; no name or email is needed. If you choose to link the account to Apple, Google or an email address, we store the email address (or the private relay address Apple gives us) and the provider's user identifier so you can sign in again on another device.

Your onboarding answers: age, height, weight, goal, training experience, available equipment, activity level and preferences. Body measurements you log over time (weight, hip and waist circumference). Your training plan and every workout you complete (exercises, sets, reps, weights, duration, streaks and milestones), plus recovery check-in answers.

If you use the body scan, the photo you take of your glutes in underwear or tight shorts, the date, and the shape and zone scores the AI model derives from it. Photos are stored in a private storage folder that only your account can read.

Your calorie and macronutrient targets, the meals you log, meal photos you take, voice recordings you make to describe a meal, barcodes you scan and foods you search for.

Messages you send to the AI coach, any photo you attach, and a short summary of your plan, targets and recent sessions that gives the coach context. Chat history is stored on your device only; our servers do not keep a copy of your messages. The one exception is the weekly check-in: your answers (weight, energy, soreness, sleep, eating) and the coach's written feedback on them are saved with the check-in so you can read them back later.

Which subscription or guest scan pack you bought, when, and its status, as reported by the app store through RevenueCat. We never see your card number or payment details; the store handles payment.

Device model, OS and app version, language and time zone; the screens and features you use; crash and error reports; the IP address and timestamps in our server logs; and, on iOS only if you allow tracking, the advertising identifier (IDFA). On Android the advertising ID is used for install attribution unless you have disabled it in system settings.

Thumbs-up or thumbs-down ratings on coach replies, scan results and plans, free-text feedback you send in the app, and any emails you send us.

Under the GDPR we need a legal basis for each purpose:

Your weight, measurements, body scan photos and the scores derived from them, and food and calorie logs can reveal information about your health. Under the GDPR this is special-category data (Art. 9). We process it only with your explicit consent and only to provide the features you asked for. The app asks for that consent in a dedicated screen before the first AI feature you use (body scan, coach, weekly check-in, meal photo or voice log), listing exactly what is sent and to whom. You can switch it off at any time in Settings → AI processing, after which the app asks again before the next AI feature.

We never use health-related data, workout data or photos for advertising, we never sell them, and we never share them with ad networks or attribution partners. They are not used to train AI models.

You can withdraw consent in Settings → AI processing, by simply not using the scan, photo or voice features, by deleting individual scans, photos and meals in the app, or by deleting your account. Withdrawing consent does not affect processing that already happened.

Who receives it. The AI features are provided by Google LLC's Gemini API (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), called from our own servers. Nothing goes to Google directly from your device.

What is sent, per feature. Body scan: your scan photos and the zones you chose to focus on. Meal photo: the photo and any hint you type. Voice log: the recording. Text estimate: the meal text. Coach and weekly check-in: your messages, any photo you attach, and a short plan summary consisting of your goal, experience level, focus zones, training location and equipment, plan week, today's session, streak, last week's sessions, per-exercise loads, calorie and protein targets, today's intake, your latest scan score, your weight, and for the check-in your answers about energy, soreness, sleep and eating. We do not send your name, email address, account identifier, date of birth or device identifiers to Google.

Why, and on what terms. Google produces the scan scores, food estimates, transcriptions and coach replies you see. We use Google's paid API tier under the Gemini API Additional Terms and Google's Data Processing Addendum: Google acts as our processor, does not use submitted content to train or improve its models, does not use it for its own purposes, and may retain requests only briefly for abuse monitoring before deleting them. Google processes this data in the United States; the transfer is covered by the EU Standard Contractual Clauses in that addendum, so your data receives the same level of protection Google's terms give it inside the EU (see section 11).

Your permission first. None of this happens until you have agreed in the app: the consent screen described in section 4 appears before the first AI feature you use and repeats what this section says.

AI output can be wrong. Scores, estimates and coach replies are automated suggestions to help you track and plan; they have no legal or similarly significant effect on you, and no decision about your access to the Service is made from them.

Your own scans. The photo is uploaded from your device to a private storage bucket in your own folder, readable only by your signed-in account and our server. Our server sends it to the AI model, saves the resulting scores next to the photo reference and shows you the result. Photos are never public, never shown to other users and never used in marketing. They stay until you delete the scan or your account.

Guest scans ("Scan a friend"). Guest scans are not currently offered in the app. If they are, a guest photo is processed the same way but the photo is deleted from storage immediately after scoring, whether or not the scan succeeded, and no result is stored on our servers. Only a count of the credits you used is kept. You must have the other person's agreement before scanning her; we act as processor of her photo on your behalf for the seconds it takes to score it.

Meal photos are stored in a private bucket in your folder and sent to Gemini for food recognition; voice recordings are sent to Gemini for transcription and are not stored after the estimate is produced. Barcode lookups send the barcode number (and nothing about you) to Open Food Facts, a public food database. Text searches send the search term to the USDA FoodData Central API. Neither receives your identity. Every estimate is shown to you for confirmation before a meal is saved.

Product analytics (PostHog). We record which screens you open and which features you use under a pseudonymous user ID so we can see what works and fix what does not. We do not send photos, measurements, meals, scan scores or coach messages to analytics.

Install attribution (AppsFlyer). AppsFlyer tells us which campaign or store listing led to an install and whether that install later subscribed. It receives device data, an install ID, the advertising identifier where permitted, app-open events and purchase events (product and price) forwarded server-side by RevenueCat. It may pass conversion events back to the network that showed you an ad (for example Apple Search Ads or Google Ads) so the campaign can be measured. We embed no ad-network SDKs or pixels, and no health-related data is ever included.

Apple App Tracking Transparency. On iOS we ask once, after onboarding, whether we may track you across apps. If you decline, the IDFA is not read and attribution is limited to Apple's privacy-preserving aggregate data. You can change your choice in iOS Settings → Privacy & Security → Tracking. On Android you can reset or delete your advertising ID in system settings.

We do not show third-party ads in the app and we do not use advertising cookies on buttmaxx.app.

Training reminders are local notifications scheduled on your device. We only schedule them after you opt in, we do not send push notifications from a server, and you can turn them off in the app or in your system settings at any time.

We do not sell your personal data. We share it only with service providers that process it on our instructions under data-processing agreements, with the stores that sell our app, or when the law requires it:

If the Service is sold or merged, your data may be transferred to the new operator under this policy. We may disclose data when required by law, court order or to protect the rights and safety of users.

Some providers above process data in the United States or other countries outside the EU/EEA. Where they do, we rely on the European Commission's Standard Contractual Clauses, the EU-US Data Privacy Framework where the provider is certified, or an adequacy decision, together with technical safeguards such as encryption in transit and at rest. You can ask us for details of the safeguards used for a specific provider.

Deleting your account (Settings → Delete Account) removes your storage files and every database row linked to your user ID, then deletes the sign-in record itself. This is immediate and irreversible. Backups are overwritten within 30 days.

Data is encrypted in transit (TLS) and at rest. Photos live in private buckets with row-level access rules so that one account can never read another's files. Scan scores are written only by our server; clients cannot alter them. AI requests are authenticated and rate-limited. Access to production systems is limited to the operator. No system is perfectly secure; if you suspect a problem, tell us at info@buttmaxx.app.

Under the GDPR and similar laws you can:

To exercise a right, email info@buttmaxx.app from the address linked to your account or include your user ID from the app's Settings screen. We answer within one month. You also have the right to lodge a complaint with a supervisory authority, in particular the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be) or the authority in your country of residence.

If you live in California or another US state with a consumer privacy law, you have the right to know what personal information we collect and how we use it (this policy), to access, correct and delete it, and not to be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioural advertising as defined in the CCPA/CPRA; attribution data only measures our own campaigns. Photos, measurements and nutrition logs are sensitive personal information used only to provide the features you request. To exercise your rights, email info@buttmaxx.app; an authorised agent may act for you with written permission.

ButtMaxx is for adults only. We do not knowingly allow anyone under 18 to create an account, and the onboarding blocks under-18s. If you believe a minor has used the app, email us and we will delete the account and its data.

We will update this policy when our data practices or the law change and post the new version at buttmaxx.app/privacy with a new "Last updated" date. For material changes, such as a new category of data or a new purpose, we will tell you in the app and, where required, ask for your consent again.