Privacy Policy

Last updated: August 18, 2026 (v1)

1. Overview

OptiPeak is operated by Optipeak LLC, a South Carolina limited liability company ("we", "us", or "our"), the data controller for the information described here. Because a fitness app necessarily handles sensitive health and fitness data, we collect only what we need to provide the Service and ask for your explicit consent to process it. This policy explains what we collect, how we use and share it, how long we keep it, and your rights.

2. Information We Collect

• Account information: email address and password (hashed; never stored in plain text).
• Health & fitness data: body weight, height, age, gender, body measurements, food intake logs, workout history, calorie and macro targets, and progress photos you choose to upload.
• AI interaction data: messages to and from the AI coaching feature, food images submitted for analysis, and AI-generated plans associated with your account.
• Device & usage data: device type, operating system, app version, session timestamps, and feature-usage patterns for analytics and crash reporting.

3. How We Use Your Information

We use your information to provide, operate, and improve the Service; power AI coaching, food analysis, and personalized recommendations; calculate nutrition targets and track progress; communicate account and service updates; detect and prevent fraud or abuse; and comply with legal obligations. We do not sell your personal or health data to third parties for marketing purposes.

4. Legal Bases for Processing (GDPR)

Where the GDPR applies, we rely on: consent (for special-category health and fitness data, which you may withdraw at any time by deleting your account); contract (to provide the Service and your tier's features); legitimate interests (to secure the Service, prevent abuse, and improve it); and legal obligation (to comply with applicable law).

5. Third-Party Services

• Supabase — database and authentication provider; data is stored in Supabase-managed PostgreSQL with encryption at rest and in transit.
• Google Gemini API (Vertex AI) — food images and coaching messages are processed by Google's Gemini models via Google Cloud Vertex AI under enterprise data-processing terms; your prompts, images, and responses are not used to train Google's models.
• FatSecret Platform API — food search queries are sent to retrieve nutritional data; only search terms are transmitted, no personal health data.
• RevenueCat — subscription and entitlement management; receives purchase/entitlement data (not your health data). We do not receive or store your full payment-card details.
• PostHog — product analytics limited to app-interaction and device information, used to improve the Service, not to sell data or serve third-party ads.
• Sentry — crash and error reporting; receives diagnostic information (the error, device type, operating system, app version) so we can diagnose and fix it. We do not send your health or fitness data to Sentry.

6. Data Storage and Security

We implement industry-standard measures including TLS/HTTPS in transit, encryption at rest, Row-Level Security so users can only access their own data, and hashed passwords. No system is completely secure; in the event of a breach we will notify affected users in accordance with applicable law (including GDPR's 72-hour requirement where applicable).

7. Data Retention

We retain your data while your account is active or as needed to provide the Service. On account deletion, your account is soft-deleted immediately and personal and health data is permanently deleted within 30 days. We may retain limited records where required for legal, tax, security, or fraud-prevention purposes, and anonymized or aggregated data that can no longer identify you. You can delete your account at any time from the App: go to Profile, tap Delete Account, and confirm. Your account is suspended immediately and scheduled for permanent erasure 30 days later; if you change your mind, sign back in during those 30 days and we will cancel the deletion. You can also request deletion by emailing us at support@optipeakhq.com from the address on your account, and we will action it within 30 days. Deleting your account does not cancel your subscription: paid subscriptions are billed by Apple or Google, not by us, so we cannot cancel them on your behalf — cancel in your Apple or Google account settings or billing will continue. When we delete an account we keep a permanent, non-reversible record that the deletion happened — the date, and a one-way cryptographic hash of the account email. We keep it so that we can confirm to you, or to a regulator, that your data was erased. It cannot be used to contact you or to recover your address; it can only be matched against an address you give us. Deletion takes effect immediately in our live systems. Where encrypted database backups exist, they are retained for no more than 7 days and are used only for disaster recovery; if we ever restore from one, we re-apply any deletions that were outstanding.

8. Your Rights (GDPR)

If you are in the EEA, you have the rights of access, rectification, erasure ("right to be forgotten"), portability, objection, and restriction. To exercise them, contact us at support@optipeakhq.com; we will respond within 30 days.

9. Your Rights (CCPA)

If you are a California resident, you have the rights to know, to delete, to opt out of sale (we do not sell personal information, so this is inherently honored), and to non-discrimination for exercising your rights. To submit a request, contact us at support@optipeakhq.com.

10. Children's Privacy

The Service is offered in the United States and is not intended for children under 13. We ask for date of birth at sign-up and block account creation by anyone under 13, and we do not knowingly collect personal information from children under 13; if we learn we have, we will delete it promptly. Users aged 13–17 may use the Service only with the permission and supervision of a parent or guardian, who must confirm that permission and provide a parent or guardian email at sign-up (used to notify them and to let them review or delete the minor's account). AI coaching stays switched off for these accounts until the parent or guardian approves it via a link we email them, and they may withdraw approval at any time. Weight-loss coaching is additionally restricted: never for users under 16, and capped well below adult levels for 16- and 17-year-olds. A parent or guardian, or anyone who believes a child under 13 has provided us data, may contact us at support@optipeakhq.com and we will remove it as appropriate.

11. Data Location and Travel

OptiPeak is operated from the United States, and your data is stored and processed in the United States. The Service is intended for U.S. users; if you continue to use it while temporarily traveling outside the United States, your data will still be transferred to and processed in the United States, and by using the Service you consent to that processing. We take appropriate safeguards to protect it in accordance with this policy.

12. Cookies and Tracking

The mobile app does not use traditional browser cookies. This website, and any future browser-based version of the app, may use local storage and session tokens for authentication and product analytics. We do not use third-party tracking cookies for advertising, and where required we will present a consent notice before setting non-essential storage.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated in the app or by email, and the version number increments with each material update. Continued use after changes constitutes acceptance.

14. Contact Us

For privacy questions, data requests, or to exercise your rights: