Privacy Policy

ScaleAi is operated by Diego Horvatti, who is the controller of your data. The contact for any privacy matter, including GDPR and LGPD requests, is contact@horvatti.com.

We collect only what the app needs in order to work. You provide almost all of it directly. We do not buy data and we do not cross-reference information from third parties.

• Sign-up: name, email, phone (optional), gender and date of birth.
• Health and exercise data: weight, height, body measurements, body fat percentage, workouts performed, sets, loads, repetitions and the notes you write.
• Food: meals, foods and nutrition targets that you log.
• Progress photos and meal photos: only the ones you choose to upload.
• Conversations with the AI assistant: the messages you write, when you use the assistant.
• Technical data: device model, operating system, app version and error logs, used to fix failures.
• Access data: IP address and device identification, recorded when you sign in, to recognise known devices and warn you about new sign-ins.

Weight, height, body measurements, body fat percentage, training and food logs and progress photos are a special category of personal data under Article 9 of the GDPR (and sensitive data under the Brazilian LGPD).

We process this data on the basis of your explicit consent: by logging a measurement, a workout, a meal or a photo, you consent to that data being processed to build your charts, histories and comparisons inside the app. You can withdraw your consent at any time by deleting the entry, deleting the photo or deleting your account — this does not affect processing carried out before the withdrawal.

We do not use this data for advertising, we do not sell it and we do not share it with advertisers, insurers, employers or any third party for commercial purposes.

• To authenticate you and keep your account working.
• To record and display your training, measurement and food progress.
• To answer your questions when you use the AI assistant.
• To send operational emails: account verification, password recovery, new sign-in alerts and notices about account deletion.
• To fix app errors based on technical failure logs.
• To protect your account against unauthorised access.

Every use of your data rests on a legal basis. In plain language, this is how it breaks down under Article 6 of the GDPR (and the equivalent bases in the LGPD):

• Performance of a contract: keeping your account, authenticating access, storing and displaying what you log for training and diet, and sending the operational emails that make the service work.
• Consent: health data, progress and meal photos, and the use of the AI assistant. You give this consent by logging the data or by starting the assistant, and you can withdraw it by deleting the data or your account.
• Legitimate interests: account security, preventing unauthorised access and fraud, and fixing app errors from technical failure logs. You can object to this processing by writing to the contact email.
• Legal obligation: where the law requires us to keep or hand over information.

We do not sell your data. We share it only with the services the app needs in order to exist, and each one receives only the minimum required to perform its function:

• Supabase: database and storage of your photos, in the us-west-2 region (Oregon, United States).
• Vercel: hosting of the API and the website.
• Google (Gmail SMTP): sending of verification, password recovery, new sign-in alert and deletion notice messages.
• OpenRouter and Google (Gemini models): when you use the AI assistant, they receive the messages in the conversation, the profile and daily data (training and diet) that give it context, and the meal photo when you send one. None of this is sent if you do not use the assistant.
• OpenFoodFacts: when you scan a barcode, it receives only the barcode, with no data about you.
• ipwho.is: when a new sign-in triggers the security alert, it receives the IP address of that sign-in so we can resolve the approximate city shown in the email.
• OpenStreetMap: receives only the approximate coordinate of that city — never your IP address, your name or any other account data — and returns the map image embedded in the alert email.

Your data is stored and processed in the United States: the database and the photos live on Supabase in the us-west-2 region (Oregon), and the API and website run on Vercel. The other services listed above may also process data outside the European Union and Brazil.

These providers act as processors under contract, and transfers outside the European Economic Area rely on the standard contractual clauses set out in each provider’s data processing agreement. If you want to know more about these safeguards, write to the contact email.

For as long as your account exists. When you request deletion, it is scheduled for 30 calendar days, and during that period you can change your mind by signing in to the app and cancelling. Once the deadline passes, everything is erased for good, across all tables, with no residual copy.

Two kinds of record have their own retention period, either shorter or tied to the life of the account:

• Technical crash records (error message, screen, app version and device model): deleted automatically 90 days after the last occurrence, by a daily routine. They exist only to fix bugs.
• IP address and device identification of the last sign-in: kept for as long as the account exists, so we can recognise known devices and warn you when a new sign-in shows up. Each device stores only the last IP used, not a history. It goes away with the account when it is deleted.

Under the GDPR (and the LGPD), you can at any time:

• Access your data and find out what we process about you.
• Rectify incorrect or incomplete information in your profile, directly in the app.
• Erase your account and everything in it: Settings → Delete account, or through the form at scale.horvatti.com/delete-account.
• Port your data: Settings → Export data produces a file in an open, machine-readable format that you can keep or take to another service.
• Restrict processing, asking us to stop using certain data while a challenge of yours is being reviewed.
• Object to processing we carry out on the basis of legitimate interests, such as the security logs.
• Withdraw your consent for health data, photos and the AI assistant by deleting the entries or your account, without affecting processing carried out before the withdrawal.
• Ask for explanations about any processing, by writing to the contact email. We reply within 30 days.

If you think we have handled your data improperly, talk to us first through the contact email — it is usually faster. But you do not have to go through us: you can complain directly to a data protection authority.

If you are in the European Union, that is the supervisory authority of your country of residence, of your place of work, or of the place where the problem happened. In Brazil, it is the Autoridade Nacional de Proteção de Dados (ANPD).

Passwords are stored hashed, never in plain text. Traffic between the app and the API is encrypted. Access to the database is restricted and sessions use tokens with expiration. Sign-ins from unknown devices trigger an alert email to you.

ScaleAi is not intended for anyone under 13. In European Union countries where the local minimum age for digital consent is higher, the local age applies. If we learn that an account belongs to someone below that age, it will be removed.

If we change anything relevant, we will let you know by email or inside the app before the change takes effect. The date at the top of this page indicates the last revision.