Effective and last updated: October 18, 2026

Privacy policy

Your assessment is private by default. You choose whether to save it or share it.

Policy language: English

Who operates this service

What Is My Body Fat? is operated by 10951811 Canada Inc., in Quebec, Canada. For support, refunds, or the person responsible for protecting personal information, contact 10951811canadainc@gmail.com.

Adults and photo choices

The service is for adults 18 and older. You must explicitly confirm adulthood before selecting a photo, confirm that you are the pictured person, and agree to AI processing. A declared age below 18 overrides the checkbox. Our servers reject missing adult declarations and declared under-18 ages before image decoding, repeat-result reuse, or AI work. Self-declaration and appearance screening do not verify identity or legal age. Avoid including other people or identifying background details.

What Is My Body Fat may retain the age you provide with your assessment and use it as context for your chosen estimate or plan. You can use the measurement calculator without a photo. We do not request a birth date or identity document for the adult check.

Information and purposes

We process information you submit to provide assessments, plans, workout tracking, account access, payment verification, and service protection. This can include sign-in email and basic profile, training preferences, exercise selections, performed sets, weights, repetitions or duration, completion marks, notes, and timer events. Do not put sensitive information unrelated to these features in optional answers or notes.

What Is My Body Fat processes your measurements, optional profile details, selected habit cards and written answers, and a photo if you choose one. These inputs produce the requested estimates and optional fitness, habit, and physique breakdowns. A training package also uses your equipment, experience, goals, and availability.

Photo and AI processing

The browser reduces photo size and re-encodes it, removing embedded metadata; the backend also re-encodes accepted images. Requested AI features send the relevant photo and submitted context to OpenAI through our Google Cloud backend. API credentials remain on the server. Requests use store:false where supported; this does not mean zero provider retention. Providers may retain operational or abuse-monitoring data under their own terms. We do not use your private photos as public examples or sell them.

Photo estimates and selected AI explanations use the inputs needed for the requested assessment. The measurement calculator can work without a photo. Training generation uses the retained assessment and training intake. Recording workouts does not send those entries to OpenAI.

AI outputs and some screening or moderation decisions are automated. Scores are approximate and can be wrong. You can contact us to ask about the information used, correct your submitted information, or raise concerns for human review. The methodology explains the intended scoring rules; model outputs are not medical decisions.

Providers, access, and international processing

We use Supabase for private customer records, Firebase for customer sign-in, Google Cloud for backend processing, OpenAI for requested AI features, Stripe for checkout and subscription billing, and Sites for website hosting. These providers receive the information necessary for their role. Firebase sign-in receives sign-in information, not your assessment photo or workout records through that sign-in flow. Stripe receives payment details; our application stores transaction, customer, and subscription references, payment and access status, and activation and billing periods, not full card numbers. The current private preview also uses Sites' ChatGPT sign-in for hosting access.

What Is My Body Fat stores private images and documents in its Google Cloud Storage project. Firebase and browser session information support account access. Private results and files have ownership checks. Signing in alone does not save a check-in or publish a photo.

We operate in Quebec. Our customer database is hosted in Canada, but hosting, authentication, AI, payment, support, and infrastructure processing may occur outside Quebec or Canada, including in the United States. Information can be subject to the laws of those locations. No storage-region promise applies to all providers. We limit application access to the requested features and authorized support or administration; no system can guarantee absolute security.

Retention and deletion

Guest assessments and their photos become inaccessible after 24 hours. Explicitly saved assessments are accessible for 180 days from saving. Expiry ends application access immediately; physical cleanup may occur later in maintenance batches, particularly on a quiet site. Losing the guest browser cookie can prevent access to an unsigned result. Use the result's Delete control to remove it and its associated private images. Provider backups, recovery copies, and required transaction records may have separate retention.

What Is My Body Fat purchased programs, training information, and PDFs remain private until you delete them or your account, independently of assessment or photo expiry and premium access. Deleting an assessment removes its associated assessment images, not a separately purchased program or its journal. Contact us to request deletion of a purchased document and its linked journal or account-related information. Deleted Google Cloud Storage objects have a seven-day provider recovery window; those copies are inaccessible through the application. Stripe retains its own billing records. Restricted purchase and security records can remain, including transaction and result identifiers, account or browser linkage, payment references, amount, currency, status, and timestamps; retained payment records do not include the deleted assessment measurements or written answers.

The signed-in workout journal retains routine guides, sets, completion marks, timer events, and notes until you delete the journal, its linked training document, or your account. It excludes photos, body measurements, and assessment snapshots. Ending premium or assessment expiry does not delete it; basic logging and history viewing and export remain available. Clearing workout history removes recorded workouts, timers, and notes while preserving purchased plans and the shared exercise library. Old queued saves cannot restore cleared history. Removing your personal records never deletes the shared exercise catalogue.

Browser storage, timers, and calendars

Essential cookies and browser storage support sessions, design and language preferences, workout drafts, and the free workout builder. Recovery drafts and unconfirmed workout saves can remain in this browser for up to seven days; signing out clears this site's recovery copies. Other preferences or builder drafts can remain until you clear them or browser storage. Drafts contain workout entries and notes, not photos or payment credentials. Timers record device event time, time zone, and server receipt time while the visible counter runs locally. Example workout changes remain in page memory and reset on refresh.

A downloaded calendar file contains exercises and a link to your private portal. Importing or sharing it is your choice; we do not connect to your calendar account or add events automatically. PDFs and share cards you download are outside our deletion controls.

If you allow optional usage analytics, we record a random browser journey reference, broad device and traffic-source categories, steps reached and fixed error categories. We do not include photos, measurements, assessment text, email addresses or written answers. Analytics records expire after 90 days and are pruned as new activity arrives. You can decline or change your choice here; withdrawing also deletes the current journey. Do Not Track and Global Privacy Control disable this tracking. Separately, internal experiments and discount codes are linked to a hashed reference for your verified guest or signed-in account. Codes retain their assigned variant, discount amount, activation, expiry and purchase outcomes. These records apply the displayed price and are not marketing-email consent. A code’s deadline begins at its configured event, such as a completed assessment; refreshing does not restart it.

Service protection and advertising

Temporary counters and secret-salted or hashed network or browser identifiers help limit abuse and expensive processing. Infrastructure providers may keep their own request and security logs. We do not use third-party advertising pixels or sell personal information for advertising. Links to another service can carry referral campaign tags; following them is your choice, and our application does not send your photo or assessment to that service.

Your choices and privacy requests

You can omit optional inputs, decline saving or publication, use available deletion and withdrawal controls, or stop using the service. Contact 10951811canadainc@gmail.com to request access, correction, a copy of your personal information, withdrawal of consent, deletion of account-related information, or to make a privacy complaint. We may need to verify that the information belongs to you. Written access and correction requests are handled within applicable legal deadlines, normally 30 days in Quebec. A portability request can seek computerized information you provided in a structured, commonly used format, subject to applicable exceptions. We explain any applicable legal retention or other limit rather than promise every request is unconditional. Withdrawal can prevent features that require the information. You may also contact the privacy authority in your jurisdiction, including Quebec's Commission d'accès à l'information or Canada's privacy commissioner, where applicable.

Changes and contact

We update the date on this page when the policy changes. If a new use requires consent, we ask before that use. For questions or incidents, contact 10951811canadainc@gmail.com. This policy explains the implemented service; it does not waive rights under applicable privacy or consumer law.