Axis Privacy Policy

1. Introduction

Adelyons Software LLC ("we," "our," or "us") operates the Axis mobile application (the "App"), a fitness and body composition tracking platform powered by AI vision analysis. This Privacy Policy explains how we collect, process, store, and protect your personal data.

Our Privacy Commitment: Your body composition data is sensitive and personal. Axis keeps your saved photos, measurements, and workout log on your device. A photo or AI Coach message leaves it only when you send it for AI analysis, workouts only when you sync with Hevy, and app-usage and crash data go to Firebase (see below). We never sell your information.

2. Information We Collect

What We Collect:

• Body Composition Photos: Images you capture for body scanning. Photos you scan are sent over an encrypted connection to Google Gemini for body fat estimation and measurements. The saved copy of each photo stays on your device, and you control whether to save it.
• Measurement Data: Estimated body fat %, neck, chest, waist, thigh, bicep, forearm measurements, and timestamps.
• Nutrition Scans: Optional food photos analyzed for calorie, protein, carb, and fat content.
• Workout Data: If you sync with Hevy, we retrieve your workout history, exercise names, sets, reps, and weight data.
• User Profile: Optional name, height, weight, units, daily calorie target, and Instagram handle (shown on your share card).

What We DO NOT Collect:

• Location data or GPS coordinates
• Device identifiers (IDFA, GAID) for advertising or tracking
• Advertising or cross-app behavioral profiles (the in-app usage analytics and crash reports we do collect are described below)
• Contact lists, call logs, or other personal files
• Your Hevy password (you paste your own Hevy API key instead)
• Biometric data beyond what you voluntarily enter or scan (height, weight, measurements)

3. How We Use Your Data

• To Provide AI Analysis: Body and food photos are sent over an encrypted connection to Google Gemini for analysis. Google processes the image to return the estimate and, per Google's API terms, does not use it to train its models. Only the resulting measurements are stored on your device.
• To Sync Fitness Data: Hevy workout data is retrieved via API and cached locally on your device. This enables your unified dashboard.
• To Display Analytics: Measurements are used to generate trend graphs, symmetry comparisons, and body composition insights.
• To Improve the App: Firebase Crashlytics sends crash reports (the error, device model, and OS and app version), and Firebase Analytics records in-app usage events, to help us fix bugs and improve the App.
• No Advertising: Your data is never used for targeted ads or behavioral profiling.
• No Commercial Sharing: We never sell your measurements, photos, or fitness data to gyms, coaches, insurers, or health platforms.

4. Data Storage & Security

• Local-First Architecture: Your body composition data, saved photos, and measurements are stored in SQLite on your device. They leave your phone only when you scan (the photo is sent for AI analysis), when you message the AI Coach (your message plus the relevant measurements and workouts), or when you sync to Hevy.
• Encryption at Rest: The App adds no encryption of its own: the SQLite database and saved photos are kept in the App's private sandbox and protected by your device's operating-system storage protections.
• AI Vision Processing: When you analyze a body or food photo, the image is sent over an encrypted connection to Google Gemini and the estimate is returned to your device. AI scans therefore require an internet connection. You approve AI analysis before any photo is sent, and you can revoke that consent at any time in Profile → AI Permissions.
• Hevy Integration: The Hevy API key you paste is stored in the App's local preferences on your device. API calls to Hevy use HTTPS. Your Hevy password is never requested or stored.
• No Central Database: Adelyons does not operate servers that store your measurement data. You are the sole owner and custodian of your body composition history.

5. Third-Party Services & Data Sharing

AI Analysis (Google Gemini):

• What's Shared: The photo you scan, or the message you send the AI Coach, plus the relevant measurements needed for context. These are sent to Google Gemini to produce the result and are not used for advertising.
• Purpose: Vision-based analysis (body fat estimation, measurement extraction, food nutrition recognition) and AI Coach replies. Requests go through our Supabase edge function, which forwards them to Google Gemini.
• Data Retention: Adelyons does not keep the photo or message; our edge function records only a per-user token count and request type so it can enforce usage limits. Google processes the request under its API terms.
• Offline: AI scans and the AI Coach need an internet connection; manual measurements, the workout log, and analytics charts work offline.

Hevy API:

• What's Shared: The Hevy API key you paste (no password). When you sync, we fetch your workout history, exercise data, and training volume.
• Purpose: To display your recent Hevy sessions and training volume in the Axis dashboard.
• Hevy's Privacy: Hevy data is governed by Hevy's Privacy Policy.
• Optional Feature: Hevy sync is entirely optional. Axis works fully offline without a Hevy account.

Google Play Services:

• Required for Google Play app distribution. Uses basic Play Services functionality, plus Firebase (Google) for app-usage analytics and crash reporting. No AdMob or other advertising.

No Other Data Sharing:

• We do not share measurement data with Facebook SDK, health platforms (Apple HealthKit, Google Fit), or advertising networks.
• We do not sell or rent your data to fitness companies, nutritionists, or insurance providers.

6. Permissions & Why We Need Them

• Camera: To capture body and food photos for AI analysis. Only activated when you press "Scan."
• Storage: To save analyzed photos and measurement data to your device's local database.
• Internet: To send scans and AI Coach messages for analysis, to fetch and sync Hevy workout data, and to create the anonymous session used for AI usage limits. AI analysis does require an internet connection.
• No Background Activity: Axis does not access camera, location, or collect data when closed or in the background.

7. Data Retention & Deletion

• Local Deletion: Delete individual scans, measurements, or photos directly in the app with one tap. Deleted data is immediately removed from your device's database.
• Full Profile Deletion: Delete your entire profile and all associated data. This action is permanent.
• App Uninstall: Uninstalling Axis deletes all local data from your device. Adelyons has no backup copy of your data.
• Hevy Data: If you disconnect your Hevy account, Axis clears the cached workout data from your device but does not affect your Hevy account.
• No Archival: Adelyons does not retain archived copies of deleted data.

8. Your Privacy Rights

• Data Access: All of your measurement data is shown in the app (Analytics and Body-fat history); the App does not offer a file export.
• Data Deletion: Delete your profile and data at any time. No permission required, no waiting period.
• Opt-Out of AI: Use manual entry for measurements instead of AI photo analysis.
• No Tracking Opt-Out Needed: Axis does not use advertising networks or behavioral tracking—there's nothing to opt out of.

Invite a Friend (Optional)

aXis includes an optional invite feature: if a friend enters your invite code, you both receive 30 days of aXis Pro at no charge. When — and only when — you open the invite screen or enter a code, the App sends the following to our invite service (hosted on Supabase) so the free month can be granted through RevenueCat:

• A random installation identifier generated on your device the first time the invite screen is used. It is a random value, not a device or advertising ID.
• Your RevenueCat customer identifier, so the free month is applied to the right customer.
• The six-character invite code being created or redeemed.

That is the entire payload. Nothing else you have entered or created in aXis is involved in the invite feature, and we do not learn your contacts or who you shared a code with.

9. Children's Privacy (COPPA Compliance)

Axis is designed for fitness enthusiasts of all ages, including minors. We comply with the Children's Online Privacy Protection Act (COPPA):

• For users under 13: We require verifiable parental consent before collecting profile data (age, gender).
• Functional data (measurements) is collected only with parental authorization.
• No behavioral tracking or marketing to minors.
• Parents can review, modify, or delete their child's profile data at any time.

10. International Privacy Laws

GDPR (EU/EEA Users):

• Data Processing: Since most data is stored locally on your device, traditional GDPR processing rules have limited scope. However, we respect your rights under GDPR.
• Your Rights: You can request access to data we hold (limited), delete data anytime, and object to AI processing.
• Legal Basis: Consent (for profile data), legitimate interest (improving the app), and contractual necessity (providing the service).
• Data Transfer: Body and food photos are sent to Google for AI analysis and may be processed on servers outside your country. AI requests pass through our Supabase edge function, which also holds the anonymous session and the usage count.

California Consumer Privacy Act (CCPA):

• Right to Know: You can request what data we collect (limited, mostly local).
• Right to Delete: Delete your profile and all data from Axis anytime in-app.
• Right to Opt-Out of Sales: Axis does not sell personal information, so this right is not applicable.

Other Jurisdictions:

• Axis complies with privacy laws in all jurisdictions where it operates. Contact us with questions about your local privacy rights.

11. Security & Breach Notification

• Encryption: Data is encrypted in transit (TLS). At rest it is protected by your device's operating-system storage protections; the App adds no encryption of its own.
• No Cloud Backups (Default): Your data stays on your device by default. There is no account and no cloud sync of your data. If your device's own backup (iCloud or Android backup) is on, it may include the App's data.
• Vulnerability Disclosure: If you discover a security flaw, email dev@adelyons.com. We commit to responding within 48 hours and will credit you if appropriate.
• Breach Notification: If we discover unauthorized access to data we hold (rare, given local-first design), we will notify you within 30 days.

12. Policy Updates

We may update this Privacy Policy as we improve features or comply with new regulations. Material changes will be communicated via app notification. Your continued use of Axis after updates constitutes acceptance of the revised policy.

13. Contact Us

Questions about your data or our privacy practices? Reach out:

Adelyons Software LLC
Email: dev@adelyons.com
Contact Form: adelyons.com

Your Body, Your Data, Your Control

• ✅ Local First: Measurements stay on your device
• ✅ Encrypted in transit: Scans, Coach messages and Hevy calls use TLS
• ✅ No Selling: Your body composition data is never sold
• ✅ Easy Deletion: One-tap permanent data removal
• ✅ Optional AI: Use manual entry if you prefer not to share photos
• ✅ No Ads: Zero advertising, zero behavioral tracking