Privacy Policy

Effective date: July 17, 2026

BDYWRK is made by Studio Bokeh AI LLC (“BDYWRK,” “we,” “us”). This policy explains what data the BDYWRK iOS and watchOS app (the “App”) and the bdywrk.app website (the “Site”) handle, and the choices you have. BDYWRK is built privacy-first: your workouts are detected and processed on your device, and finished sessions sync to your BDYWRK account so your training is backed up and can be restored.

1. Data stored on your device

The App keeps your data in local app storage, including a shared container that lets the BDYWRK widget and Apple Watch app show the same data:

• Workout sessions: exercise type, rep counts and timestamps, duration, detection confidence, and heart-rate samples recorded during the session.
• Weekly goals, streaks, and achievements.
• Protein log entries (food descriptions and gram amounts).
• App settings and preferences.
• Diagnostic records, which are stored locally, and basic usage events (such as app opens, completed sessions, and protein logs) that are sent to us when you are signed in, as described in section 7.

This local data is deleted when you delete the App, and it may be included in your device backups according to your iOS backup settings. Copies synced to your account are covered by section 7.

2. Apple Health (HealthKit)

With your permission, the App:

• Reads your heart rate (to show live heart rate and trends during workouts) and your dietary protein (to track daily protein progress).
• Reads, if you turn on Cardio Fitness: your workouts from other apps, activity rings, active energy, exercise minutes, resting heart rate, and VO2 max, used to show your training load and cardio fitness trends. These readings are processed on your device and are never synced to your account.
• Writes your workouts, active energy burned, heart-rate samples, and dietary protein entries to Apple Health.

We commit to the following for all Apple Health data:

• It is used solely to provide the App’s fitness features.
• It is never used for advertising, marketing, or ad targeting.
• It is never sold, and never shared with data brokers or advertising partners.
• It is never used to train AI models off your device.

You can grant or revoke Health access at any time in the Health app or in iOS Settings. Entries the App has written to Apple Health are managed by you in the Health app and remain there until you remove them.

3. Motion and camera

Automatic rep counting uses your device’s motion sensors and, for some exercises, the camera. Camera frames are analyzed on your device in real time to detect movement and are never recorded, stored, or uploaded. Motion data is processed on-device only.

4. On-device AI (protein estimator)

The protein estimator runs a small language model entirely on your device. Food descriptions you type are processed locally to produce the estimate; the estimator itself never sends your text anywhere. Saved protein entries (food text and gram amounts) sync to your account as described in section 7. Depending on the App version, the model file is either included with the App or downloaded once from our model host (Hugging Face) when you enable the feature. That download is a plain file fetch and contains none of your data. Estimates are approximations, not nutrition advice.

5. Advertising (free tier)

The free tier shows ads served by Google AdMob. Advertising is the only part of the App that shares data with a third party: your synced content goes only to our own servers, as described in section 7. In connection with serving ads, Google may collect:

• Your device’s advertising identifier (IDFA): only if you allow tracking when iOS asks (App Tracking Transparency).
• IP address, which can be used to estimate coarse, city-level location.
• Ad interaction data (which ads were shown, viewed, or tapped).
• Diagnostic and performance data related to ad delivery.

If you decline tracking, ads are non-personalized. Apple’s SKAdNetwork may provide aggregated, privacy-preserving ad attribution either way. You can change your choice at any time in iOS Settings > Privacy & Security > Tracking. Upgrading to Premium removes ads entirely.

No health, workout, motion, or camera data is ever shared with Google or any advertising partner. For details on Google’s processing, see Google’s Privacy Policy and How Google uses data from partners.

6. Purchases

Premium subscriptions are processed by Apple through your Apple Account. We never see your payment details. Your subscription status is checked with Apple and cached on your device so the App and its widget know whether Premium is active.

7. Accounts and cloud sync

The App requires a free BDYWRK account, and cloud sync is on by default. Exercise detection always happens on your device; once you are signed in, the App syncs the following to our servers:

• Account: an email address, or Sign in with Apple, used to create and secure your account.
• Synced content: finished workout sessions (summaries plus rep events, detection confidence, and heart-rate samples), nutrition entries (food text and gram amounts), goals and achievements, and your profile (display name and avatar). Food lookups may be processed by our servers.
• Usage analytics: feature-usage events (for example app opens, completed sessions, and protein logs), used to understand and improve the App. Some events include the values involved: for example, a completed session event includes its rep count and duration, and a protein log event includes the food text and gram amount you entered. Usage analytics are never used for advertising.
• Notifications: a device push token, if you enable notifications.
• Social features: follows, kudos, feed items, and leaderboard entries, if you use them, with controls over your profile’s visibility.
• Storage: synced data is stored with Amazon Web Services in the United States, encrypted in transit and at rest. Exercise detection always stays on your device: servers only ever receive finished sessions.
• Deletion: deleting your account (in the App or by emailing us) permanently removes your account and all synced data from our systems.

8. The bdywrk.app website

The Site uses privacy-respecting, first-party analytics only: a random anonymous identifier (kept for the duration of your browser session) and basic events such as page views. We do not use third-party analytics or cross-site tracking. Forms may be protected by Cloudflare Turnstile to block bots. If you sign in on the Site, it uses secure, httpOnly session cookies and shows the same data described in section 7. The Site is hosted on Amazon Web Services.

9. Service providers

We rely on a small number of providers, each processing only what its function needs:

• Apple: App distribution, payments, and subscriptions.
• Google: advertising in the App’s free tier.
• Amazon Web Services: hosting for the Site and your synced data.
• Cloudflare: bot protection on Site forms.
• Upstash: rate limiting for the Site.
• Hugging Face: hosting for the downloadable AI model file.

10. Aggregated and de-identified data

We may create and use aggregated or de-identified information (for example, overall feature-usage statistics) that cannot reasonably be used to identify you, to understand and improve BDYWRK. We do not sell personal information.

11. Your choices and rights

• Tracking: allow or deny at the iOS prompt, or change anytime in Settings > Privacy & Security > Tracking.
• Health access: manage in the Health app or iOS Settings.
• Deleting your data: deleting the App removes all App data from your device; entries written to Apple Health are managed in the Health app; deleting your BDYWRK account (in the App or by emailing us) removes your account and all synced data from our systems.

If the EU/UK GDPR applies to you, you have rights to access, correct, delete, export, restrict, or object to processing of your personal data, to withdraw consent at any time, and to lodge a complaint with your supervisory authority. Where we process personal data, we rely on consent (e.g., personalized ads), performance of a contract (providing the service), and legitimate interests (securing and improving the service).

If you are a California resident, the CCPA/CPRA gives you rights to know, delete, and correct personal information, and to opt out of “selling” or “sharing.” We do not sell personal information. Personalized advertising may be considered “sharing”. You can opt out by denying tracking as described above. We will never discriminate against you for exercising your rights. To make any privacy request, email support@bdywrk.app.

12. Children

BDYWRK is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

13. Retention, security, and international transfers

On-device data stays until you delete it. Server-side data is retained while your account is active and deleted when you delete your account. We use industry-standard safeguards, including encryption in transit and at rest for any server-side data. We are based in the United States; if you use BDYWRK from elsewhere, your data is processed in the United States.

14. Changes to this policy

We will post any changes here and update the effective date. For material changes, we will provide more prominent notice in the App or on the Site.

15. Contact

Studio Bokeh AI LLC
support@bdywrk.app

See also our Terms of Use and Support pages.