Legal
Privacy policy
What we collect, why, who we share it with and the choices you have.
Who we are
The Model Body app is run by Kassia, trading as The Model Body, as an individual. There is no company. The same person is the seller on Gumroad ("we", "us"). We are the controller of your personal data. ICO registration: [ICO registration number]. Contact: kassy@themodelbody.com.
What we collect
| Data | Examples | Why | Lawful basis |
|---|---|---|---|
| Account | Email address, sign-in records, membership and purchases | To run your account and give you the access you paid for | Contract |
| Profile and goals | Sex, date of birth, height, activity level, goal, diet choice, units | To work out your targets and plan | Contract |
| Body and health data | Weight, body measurements, progress photos, steps, sleep, water | To show your progress and adjust your targets | Explicit consent |
| Food and training logs | Meals, recipes cooked, shopping lists, workouts, sets, activities, Glow Points | The core of the service | Contract |
| Cycle data (only if you turn on Cycle insights) | Period start dates, cycle length, symptoms, life stage | To show your cycle phase and tips | Explicit consent |
| Coach check-ins (only if you have coaching and agree) | Weekly ratings and notes, a snapshot of your latest body entries if you choose, messages with your coach | To coach you | Explicit consent |
| Messages | Feedback, support emails, coaching applications | To reply to you | Contract |
| Community | Team name, initials or profile name, challenge progress shared with your team | To run Teams and Challenges | Contract |
| Notifications | Push subscription for your device, reminder times | To send reminders you asked for | Consent |
| Marketing email | Email address, sign-up date | To send news and offers | Consent |
| Technical | Device and browser type, error logs, IP address held by our hosts | To keep the app secure and working | Legitimate interests |
We do not sell your data. We do not use it for advertising. Tips and targets are worked out automatically from what you enter. They never decide your access to the service and have no legal or similarly significant effect.
Who we share it with
These suppliers process data for us under contract and only on our instructions:
- Supabase: database, sign-in, file storage and server functions. Data held in Ireland, in the European Union.
- Cloudflare: hosting and delivery of the app.
- Brevo: marketing email if you sign up, and delivering feedback you send from the app.
- Apple, Google, Microsoft or Mozilla push services: deliver notifications to your device.
- Google Forms and Gmail: coaching applications, and feedback or support emails you send us.
Gumroad takes payments and handles your card details as its own controller under its privacy policy. Barcode and food searches go to Open Food Facts and USDA FoodData Central; we send the search term or barcode, not your name or email.
Cookies and similar storage
We do not use advertising or analytics cookies. The app stores your sign-in and your progress on your device so it works and keeps you signed in. That storage is strictly necessary, so there is no cookie banner. When you buy, you go to Gumroad, which has its own cookie policy. The free guide forms are provided by Brevo, which may set its own cookies when you use them.
Transfers outside the UK
Your account, logs, photos and cycle data are held in Ireland. UK law recognises the European Union as giving adequate protection, so no further safeguard is needed. Cloudflare and the push services may handle data in other countries, including the United States. For those transfers we rely on the UK adequacy regulations, including the UK extension to the EU-US Data Privacy Framework, or on the International Data Transfer Addendum to the EU Standard Contractual Clauses.
How long we keep it
| Data | Kept for |
|---|---|
| Account, profile, logs, body data | While your account is open. Deleted within 30 days of you deleting your account, backups within a further 30 days |
| Accounts with no sign-in | Deleted after 24 months, with an email warning first |
| Cycle data | Until you delete it, or delete your account. Turning Cycle insights off hides it; deleting removes it |
| Purchase records | 6 years, for tax |
| Feedback and support emails | 2 years |
| Marketing email list | Until you unsubscribe |
Your rights
You can ask to see, correct, export or delete your data, object to or restrict our use of it, and withdraw consent at any time. Withdrawing consent does not affect what we did before. You can delete your account and your cycle data yourself in Settings. For anything else, email kassy@themodelbody.com; we reply within one month.
You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. Please contact us first so we can try to help.
Children
The Model Body is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you think a child has an account, email us and we will delete it.
Security
Data is encrypted in transit and at rest. Each member can reach only their own data, enforced by database rules. Our team accesses member data only to provide support.
Changes
We will tell you in the app before any change that affects how we use your data. Draft version 0.1, [effective date].