Privacy Policy

Last updated October 8, 2026

This policy explains what BicepsMaxx ("we", "us") collects when you use the BicepsMaxx apps for iPhone, iPad and Android, the web app at app.bicepsmaxx.altuzar.dev and this website, why we collect it, and the choices you have. BicepsMaxx is operated by Altuzar. Questions: support@altuzar.dev.

What we collect

• Account details: your email address and, if you sign in with Apple or Google, the name and email they share with us. If you use Sign in with Apple's private relay, we only see the relay address.
• Profile and plan answers: gender, age, height, weight, training habits, goals, location preference (home or gym) and arm measurements you enter. We use them to calculate your plan and calorie and protein targets.
• Arm scan photos: photos you take or choose for an arm scan, and the scores generated from them.
• Food photos and descriptions you submit to the food scanner, and the meals you log.
• Training data: workouts, sets, reps, weights and timestamps.
• Coach messages: what you write to Coach Flex and its replies.
• Purchase status: whether you have an active subscription, the product, the store and the renewal date. We never receive your card details; payments are handled by Apple, Google or Stripe.
• Technical data: a random device identifier used to limit free scans during onboarding, crash reports, and, if enabled, product analytics events (for example "finished onboarding"). We do not use advertising identifiers and we do not track you across other companies' apps or websites.

How we use it

• To provide the service: scoring scans, building workouts, estimating meals, answering coach questions, and syncing your data across devices.
• To manage your subscription and restore purchases.
• To send sign-in codes and essential account emails. We don't send marketing email without your consent.
• To keep the service secure, prevent abuse and fix bugs.

We do not sell your personal data, we do not use your photos or health-related data for advertising, and we do not use your photos to train AI models.

Service providers

We share data only with providers that process it on our behalf under contract:

• Convex: database, file storage and authentication (stores your account, profile, scans and logs).
• OpenAI: analyzes scan photos, food photos and coach messages to generate scores and replies. Under OpenAI's API terms, data sent through the API is not used to train their models.
• RevenueCat: manages subscription status across the App Store, Google Play and the web.
• Stripe: processes web payments.
• Apple and Google: app distribution, in-app purchases and, if you choose, sign-in.
• Resend: delivers sign-in and password emails.
• Netlify: hosts this website and the web app.
• Sentry and PostHog (when enabled): crash reporting and product analytics.

Storage and retention

Your data is kept while your account exists. Some data is also stored on your device so the app works offline. When you delete a scan, its photo is deleted. When you delete your account, we delete your profile, scans, photos, workouts, meals, measurements and coach history from our systems, normally right away and in all cases within 30 days, except where we must keep limited records (for example purchase records) to meet legal obligations.

Your choices and rights

• Delete your account in the app: Profile, then Delete account. You can also email us.
• Access, correct or export your data by emailing us.
• Turn reminders on or off in the app or in your device settings.
• Depending on where you live (for example the EU, UK, California or Brazil) you may have additional rights, including objecting to processing and complaining to your data protection authority.

Health information

Body measurements and photos can be sensitive. We process them only to provide the features you ask for, based on your consent, which you give when you take a scan or enter a measurement and can withdraw by deleting that data or your account.

Children

BicepsMaxx is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we'll delete it.

Security

Data is encrypted in transit. Sign-in tokens are stored in your device's secure storage (Keychain on iOS, Keystore on Android). No system is perfectly secure, so we also limit what we collect.

International transfers

Our providers may process data in the United States and other countries. Where required, we rely on standard contractual clauses or equivalent safeguards.

Changes

We'll post changes here and update the date above. For significant changes we'll notify you in the app.