Privacy Policy

Effective date: 22 July 2026 · Version 1.0

1. Who is responsible for your data

BodEvo (bodevo.app) is operated by Carter Hubble (an individual, based in the United States), who is the data controller for any personal data described in this policy.

For any privacy question or request, contact us at support@bodevo.app or use the in-app support flow (Settings (gear icon) → Contact support), which ties your request to your signed-in account so we can verify it is really you. See also the Contact page.

2. What this policy covers

This policy covers the BodEvo web app and installable PWA served from bodevo.app, including its serverless API routes. It does not cover third-party websites we link to (for example a supplement brand's product page, Amazon, YouTube, or a university dining site). Those sites have their own privacy policies.

3. Local-first data that stays on your device

BodEvo is deliberately built local-first. Unless a feature explicitly involves your account, everything you type stays in your browser's own storage (localStorage and the PWA cache) on your device:

• Macro calculator inputs: age, sex, height, weight, activity, goals, and any body-fat estimate you enter
• Bodyweight and strength projections
• Saved plans (the save/import plan file system)
• Meal builder, daily planner, food library, grocery and meal-prep preferences
• Supplement stacks and library preferences
• UI preferences: theme, hidden sections, install state

This data is never transmitted to us. It is not synced, not backed up by us, and we cannot see it. It stays until you clear it — from Settings → Your data → Delete local data, by clearing site data in your browser, or by uninstalling the PWA. Because we never receive it, data-protection law generally does not treat us as processing it at all — it is yours, on your device.

4. Optional account data

Creating an account is optional and only needed for community features, voting, the synced daily tracker, reminders, and support requests. Accounts are managed through Supabase Auth (our database and authentication provider). Depending on how you sign in, we process:

• Email + password: your email address and a password (stored by Supabase in hashed form — we never see the plain password)
• Magic link: your email address
• Google or Apple sign-in: your email address and basic profile information those providers share (subject to their own policies and your settings with them)
• Profile record: an optional display name and an internal role field (e.g. member, moderator)

5. Health & body-composition data (special category data)

Some BodEvo data is health-related: food-log entries, calorie and macro targets, bodyweight, body-fat estimates, and reminder schedules built around your eating pattern. Under Article 9 GDPR / UK GDPR this can be special category data concerning health, which gets extra protection.

• If you use BodEvo without an account (or without the synced tracker), this data exists only on your device (see section 3). We never receive it.
• If you sign in and use the synced daily tracker, the following is stored in our database, linked to your account and protected by row-level security so only you (and no other user) can read it: daily food-log entries, active calorie/macro targets, foods you save for quick logging, and reminder preferences (times and timezone).

We process this special category data only on the basis of your explicit consent (Article 9(2)(a)): syncing starts only when you sign in and actively use those features, and every screen that writes synced data is behind that sign-in. You can withdraw consent at any time by deleting individual entries in the app, deleting your local data, or requesting account deletion (section 16) — withdrawal stops future processing and removes the stored data, though it does not undo processing that already lawfully happened.

We never use health data for advertising, profiling, or automated decisions with legal or similarly significant effects, and we never sell it.

6. Community and public content

If you choose to participate, we store content you submit, linked to your account:

• Community questions, replies, and votes
• Reports you file about other content
• PR Song Board votes, saves, playlists, comments, and reports
• Product votes and content votes
• Support requests (kind of request + your message)

Approved community questions and replies are publicly visible together with your display name. Votes, saves, playlists (unless you make one public), reports, and support requests are not public. Community submissions pass through moderation (section 8) before they appear publicly.

7. Reminders and push notifications

Meal-reminder notifications are strictly opt-in: they only exist if you sign in, enable reminders, and grant the browser notification permission. To deliver them we store your reminder times and timezone, plus a push subscription: the endpoint URL and encryption keys your browser generates, your browser's user-agent string, and delivery success/failure timestamps. Push messages are delivered through your browser vendor's push service (for example Google, Apple, or Mozilla, depending on your browser) — that is how web push works and it is chosen by your browser, not by us. Disable reminders in the app or revoke the browser permission at any time; failed or revoked subscriptions are deactivated automatically.

8. Food, restaurant, and moderation lookups (server proxies)

A few features call our own serverless API routes, which forward only the text of your search or submission to an external data source. This proxy design exists so that API keys stay on the server and the external service never receives your identity, account ID, or any stored app data:

The moderation route also rate-limits by IP address to prevent abuse; that IP handling is transient (an in-memory counter) and is not written to a database. Administrator tooling additionally uses search providers (SerpApi, Best Buy, Exa) for product and source research — those calls contain queries typed by the administrator, not end-user data.

9. Affiliate links and affiliate tracking

BodEvo is monetized through clearly-labeled affiliate links, never through ads or data sales. Affiliate links never change how products are ranked.

• Amazon Associates. Product cards include a labeled “Search on Amazon” link carrying our Associates tag. If you click one, Amazon sets cookies on amazon.com to attribute any purchase to BodEvo. We receive aggregate commission reports from Amazon; we do not receive your identity or your Amazon history. As an Amazon Associate, BodEvo earns from qualifying purchases.
• Impact.com — only with your consent. If you allow it, our pages load the Impact Universal Tracking Tag, a script served from utt.impactcdn.com that verifies our site with affiliate partners and records ad-impression and click events when you interact with partner links; it may set cookies or similar identifiers in your browser for attribution. The tag does not load until you choose “Allow” in the affiliate-tracking notice, and you can change your choice any time in Settings → Your data → Affiliate click tracking (turning it off takes full effect the next time a page loads). Details are in Impact's privacy policy.
• Other affiliate networks (for example for supplement or gear brands) may be added; when they are, links remain labeled and this section will be updated.

10. Hosting, logs, and security telemetry

• Hosting. The site and its API routes run on Vercel; the database and authentication run on Supabase. Like any web host, Vercel processes connection metadata (your IP address, user agent, requested URLs) in short-lived operational logs used for delivering the site, debugging, and abuse prevention.
• Security reports. Your browser may send Content-Security-Policy violation reports to our /api/csp-report endpoint. These contain technical details of the blocked resource (URLs and directive names), are used only to keep the security policy correct, and are not stored beyond transient server logs.
• No analytics. We currently run no third-party analytics or tracking pixels (no Google Analytics or similar). If that ever changes, this policy will be updated first.

11. Cookies and browser storage

BodEvo itself works without traditional cookies. Storage on your device:

You can clear all first-party storage at any time via Settings → Your data → Delete local data or your browser's site-data controls, and you can block third-party scripts with a content blocker without breaking the planning tools.

12. Legal bases for processing (GDPR / UK GDPR)

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects about you.

13. Who we share data with

We share personal data only with the service providers needed to run BodEvo:

• Supabase — database and authentication (processor)
• Vercel — hosting, CDN, and serverless functions (processor)
• USDA FoodData Central / Nutritionix — receive search text only (section 8)
• OpenAI — receives community-question text for safety moderation where AI review is enabled (section 8)
• Google / Apple — only if you choose them for sign-in
• Browser push services — deliver notifications you opted into (section 7)
• Amazon / Impact.com — affiliate attribution as described in section 9

We do not sell personal data, we do not share it with data brokers, and we do not share it for third-party advertising. We would disclose data if genuinely required by law, and we would tell you unless legally barred from doing so.

14. International transfers

Our providers (including Supabase, Vercel, and OpenAI) may process data in the United States or other countries outside the EEA/UK. Where that happens, transfers rely on appropriate safeguards such as Standard Contractual Clauses and/or the EU–US Data Privacy Framework (and its UK extension) where the provider is certified. You can request more detail about a specific provider via the contact routes in section 1.

15. How long we keep data

• Local data: on your device until you clear it — we never hold it.
• Account and synced data: for as long as your account exists. Deleting your account removes it (section 16).
• Individual entries: food-log entries, saved foods, votes, playlists, and comments can be deleted in-app at any time and are removed from the live database immediately.
• Support requests: kept while being handled and for a reasonable period afterwards to keep an audit trail of data-rights requests, then deleted.
• Hosting and function logs: short-lived and rotated automatically by our hosting provider.
• Backups: our database provider maintains rolling backups; deleted data leaves backups as they expire on the provider's schedule.

16. Your rights, export, and deletion

Under GDPR / UK GDPR you have the rights of access, rectification, erasure, restriction, portability, and objection, plus the right to withdraw consent at any time. BodEvo builds the two most important ones directly into the app:

• Export your data (portability & access). Settings (gear icon) → Your data → Export my data downloads a JSON file containing your local app data and — if you are signed in — every cloud record linked to your account (profile, tracker entries, targets, saved foods, reminder settings, push subscriptions, votes, community content, playlists, and support requests). No email or waiting required; it runs on your device.
• Delete local data. Settings → Your data → Delete local data erases all BodEvo data stored in this browser (and signs you out). This is immediate and cannot be undone.
• Delete your account and cloud data. Sign in, then Settings → Your data → Delete my account files a deletion request tied to your account (no email needed, which is also how we verify the request is yours). We delete the account and its data — including community content — within 30 days. Deletion is currently completed manually by the operator; the request itself is logged instantly.

For rectification, restriction, objection, or anything else, use the in-app support flow or email support@bodevo.app. We respond within one month as required by law. We may need to verify your identity before acting on a request; for in-app requests, your signed-in session is the verification.

17. Security

• All traffic is encrypted in transit (HTTPS/TLS).
• Database access is protected by row-level security: your private rows are readable and writable only by your authenticated account.
• Passwords are hashed by Supabase Auth; we never store or see plain-text passwords.
• API keys for external services live only on the server, never in the browser.
• The site ships security headers including a Content-Security-Policy, and user-generated content is sanitized on output.
• No system is perfectly secure; if a breach ever affects your personal data, we will notify you and the relevant authority as the law requires.

18. Children

BodEvo is a general-audience fitness tool for adults and is not directed at children under 13. Do not create an account if you are under 13 — or under the age your country sets for consenting to online data processing (13–16 across the UK/EEA) — without a parent or guardian. If we learn we hold account data belonging to a child below the applicable age without proper consent, we will delete it.

19. Changes to this policy

When this policy changes, the effective date and version at the top change with it, and material changes will be announced in the app before they take effect. Earlier versions are preserved in the project's version history.

20. Complaints

If you believe we have mishandled your data, contact us first and we will do our best to fix it. You also always have the right to complain to a supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, your national data-protection authority.