Formfy Privacy Policy

This Privacy Policy explains how HSAG LLC ("HSAG," "we," "our," or "us") collects, uses, shares and protects personal information when you use Formfy: AI Body Fat Scanner ("Formfy" or the "App") on Android and iOS. It applies only to Formfy. Our general privacy policy at hsaggroup.com/privacy covers our other apps. For Formfy, this policy controls.

1. Who We Are

Formfy is developed by HSAG LLC, 45 Hoyt Street, Brooklyn, NY 11201, United States. HSAG LLC is responsible for (the "controller" of) the personal information described in this policy. You can reach us at contact@hsaggroup.com.

2. Information We Collect

2.1 Your Account

When you first open Formfy, the App creates an anonymous account for you with Firebase Authentication, a Google service. This account is identified by a random user ID and does not need your name or email address.

You can choose to create an account or sign in, so your data can move with you to a new device. Depending on the method you choose, we receive:

• Email and password: your email address and password. The password is handled by Firebase Authentication, which stores it in hashed form. We send a verification email to the address you enter.
• Sign in with Google: your name, email address and profile picture link, as shared by your Google account.
• Sign in with Apple: your email address (which can be an Apple private relay address) and your name, if you choose to share it.

If you want, you can also add a first and last name, a phone number and a profile photo to your profile. These are optional.

2.2 Body and Fitness Information

Formfy is a body composition and fitness app, so most of what it handles is information about your body. Some countries treat this as health information. We collect:

• Measurements you enter: sex, age, height, weight and your preferred units.
• Scan results: the estimated body-fat range; the sex, age, height and weight used for that scan; the date and time; a link to the scan photo; and whether the result is locked or unlocked.
• Body Score: weekly summaries of the scores and progress the App calculates for you.
• Weekly plans: personalized plans generated for you by AI (see Section 4).
• Daily check-ins: the mood you pick, your weight if you enter it, and an optional selfie.
• Guided workouts: when you start and finish each workout, how many workouts counted toward an unlock, your device's time zone offset (so we can tell your days apart), and the unlock credits you earn.
• Meal scans: the meal photo you take or choose. The meal name and the calorie and macronutrient estimates are saved only on your device.

Your measurements, scan results, Body Score summaries, weekly plans and check-ins are stored in Cloud Firestore, a Google Firebase database, under your user ID. The App also keeps copies of some of this information on your device.

2.3 Photos

Formfy handles these photos:

• Body scan photos you take with the in-app camera or choose from your gallery.
• Meal photos for meal scans.
• Optional daily check-in selfies and an optional profile photo.

Photos are uploaded over an encrypted connection to Firebase Storage (Google Cloud Storage), where they are stored under your user ID. Body scan photos and meal photos are then sent to Google's Gemini AI for analysis (see Section 4). We do not show your photos to other users and we do not publish them. Formfy does not need nude photos, and you do not need to undress for a scan.

Photo metadata. Before upload, the App resizes and re-compresses each photo and removes the metadata stored inside the image file (EXIF data), such as the location, the date it was taken and the camera or phone model. Formfy never asks for your location. In the rare case that a photo cannot be processed on your device, the App uploads the original file, which may still contain that metadata. Photos uploaded with versions of the App released before November 2026 may also still contain it. We do not use photo metadata for anything, and Delete my data removes these photos with the rest (see Section 7).

2.4 Purchases

Formfy Premium subscriptions are sold and billed by Apple (App Store) or Google (Google Play). We never receive your card number or other payment details. To give you Premium and keep your subscription status accurate, we receive and store:

• the product you bought (Premium weekly, monthly or yearly), order and transaction IDs, purchase, renewal and expiry dates, and the subscription status (for example active, canceled, refunded or expired);
• the country or region the store reports for the purchase;
• an identifier that links the purchase to your Formfy account: on Google Play, your Formfy user ID; on the App Store, an app account token derived from your Formfy user ID;
• the notifications Apple and Google send us when a subscription renews, is canceled, is refunded or expires.

2.5 Invite-a-Friend Program

If you invite friends, or join Formfy through someone's invite, we collect the following to run the program and prevent fraud:

• your invite code and link and, when someone joins through it, which account invited which. The person who invited you never sees your identity, scans or results, only a count of friends who joined.
• On Android, the install referrer from Google Play, which tells us which invite link led to an install. The App reads it once on your device and sends it to us only if it contains a Formfy invite code.
• The days an invited friend uses the App (recorded by our servers) and whether they subscribed, because these decide when the person who invited them earns a reward.
• A device hash: a one-way SHA-256 hash of a device identifier combined with a fixed Formfy value. On Android the identifier is the Android ID. On iOS it is a random ID the App creates and keeps in your device's Keychain. We never receive the identifier itself. The hash lets us check that one device is not used to claim rewards again and again.
• Device integrity results: on Android, Google Play Integrity verdicts (whether the App is genuine and was installed from Google Play, and whether the device passes Google's integrity checks); on iOS, Apple App Attest (through Firebase App Check) and Apple DeviceCheck.
• Your IP address, used only to limit abuse. We store a one-way hash of the network part of the address (the first three blocks of an IPv4 address, or the first three groups of an IPv6 address), never the full address.

2.6 Notifications

If you allow notifications, we store a Firebase Cloud Messaging token on your profile so we can send you push notifications, for example when a friend joins through your invite. Reminders, such as scan, workout and weekly plan reminders, are scheduled on your device. You can turn notifications off at any time in the App or in your device settings.

2.7 Analytics, Diagnostics and Security

We use these Google Firebase services to keep Formfy working and to improve it:

• Google Analytics for Firebase records how the App is used, for example screens viewed, scans started and completed, workouts finished, subscription screens viewed and purchases, together with device model, operating system, app version, language and approximate country. It uses a random app instance ID. Analytics events do not include your name, email address or photos. Two events include body-related values: a completed scan records the body-fat estimate and the sex used, and a daily check-in records the mood you chose.
• Firebase Crashlytics collects crash reports with technical details, such as the error, device model, operating system, app version and a random installation ID.
• Firebase Performance Monitoring collects performance data such as app start time and how long network requests take.
• Firebase Remote Config lets us turn features on or off. It uses a Firebase installation ID.
• Firebase App Check checks that requests come from the genuine App, using Google Play Integrity on Android and Apple App Attest or DeviceCheck on iOS.
• Server logs: our scan server and cloud functions keep technical logs so we can run and fix the service. Scan logs include your user ID, the link to the scan photo, and the sex, age, height and weight sent with the scan.

Formfy does not use your device's advertising identifier. On Android the App removes the advertising ID permission, and on iOS the App does not ask for permission to track you.

2.8 When You Contact Us

If you email us, including through Send feedback in the App (which opens your email app), we receive your email address, your message, and the app version and platform that the App adds to the message.

3. How We Use Information

We use the information above to:

• estimate your body fat and analyze your meal photos;
• save your history so you can see your progress, compare photos and get your Body Score;
• create your AI weekly plans;
• show how your result compares with people similar to you. These comparisons use only aggregated statistics from groups of at least 20 people, never another person's individual data. Your own results may be included in these statistics without your identity;
• run the free unlock options (guided workouts and invite-a-friend) and prevent fraud and abuse;
• process subscriptions, give you Premium and restore your purchases;
• send the notifications you allowed;
• keep the App secure and working, fix crashes, and understand which features help people so we can improve them;
• answer your messages and meet our legal obligations.

We do not sell your personal information. We do not use it for advertising, and we do not share it for cross-context behavioral advertising. We do not use your photos or body information to train AI models.

The body-fat estimate is produced automatically. It is a fitness estimate and is not used to make any decision that has legal or similarly significant effects on you.

4. AI Processing by Google

Formfy uses Google's Gemini AI models through Google Cloud Vertex AI. Google processes this data as our service provider, on our instructions, and returns the result to us:

• Body scans: your body photo and the sex, age, height and weight you entered, to estimate a body-fat range.
• Meal scans: your meal photo and your app language, to estimate calories and macronutrients.
• Weekly plans: your age, sex, height, goal and app language, and your past scan results and weights with their dates, to write your plan. No photos, name or email address are sent for weekly plans.

Before your first body scan, the App shows a "Before you scan" screen that explains this and asks for your consent. Under Google Cloud's terms for Vertex AI, Google does not use this data to train its AI models. We use Google's global Vertex AI endpoint, so these requests may be processed in any country where Google Cloud operates.

5. How We Share Information

We share personal information only in these ways:

• Google, as our service provider: Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, App Engine (our scan server), Vertex AI (Gemini), Google Analytics for Firebase, Crashlytics, Performance Monitoring, Cloud Messaging, Remote Config, App Check and Google Play Integrity. Google processes this data on our behalf under its data processing terms, which require it to protect the data at least as well as this policy describes.
• Apple: Sign in with Apple, App Attest, DeviceCheck, and App Store purchases and subscription notifications.
• Google Play: purchases, subscription notifications and the install referrer.
• Legal reasons: when the law, a court order or a government request requires it, or when needed to protect the rights, property or safety of our users, HSAG or others, or to prevent fraud.
• Business transfers: if HSAG is involved in a merger, acquisition or sale of assets, your information may transfer to the new owner, who must continue to protect it as this policy describes.
• When you choose: if you share a result or progress image using your device's share options, you decide who receives it.

When you sign in with Apple or Google, or buy through their stores, Apple and Google also act under their own privacy policies: Apple Privacy Policy and Google Privacy Policy. You can also read how Google uses information from apps that use its services.

We do not sell personal information and we do not share it with advertisers or data brokers. Formfy contains no advertising SDK and shows no ads.

6. How Long We Keep Information

• Account, profile, measurements, scans and scan photos: until you delete them in the App (see Section 7) or ask us to. We keep scan photos so you can compare scans over time.
• Check-ins, weekly plans and Body Score summaries: until you delete your data in the App (see Section 7) or ask us to.
• Meal photos: kept in cloud storage until you delete your data in the App or ask us to.
• Workout and invite-a-friend records: until you delete your data in the App. Records that stop repeat claims (the device hash and the hashed network address) are kept after that, with no link to your account.
• Purchase records: as long as needed to manage your subscription and for accounting, tax, fraud prevention and legal purposes. This can be after you delete your account.
• Analytics data: Google Analytics keeps event-level data for up to 14 months. Reports built from it contain only aggregated figures.
• Crash reports: about 90 days in Crashlytics.
• Server logs: a limited period, after which our hosting provider deletes them automatically.
• Support emails: as long as needed to handle your request and keep a record of it.

7. Deleting Your Data and Withdrawing Consent

In the App, open Profile and scroll to the bottom:

• Delete my data (available to everyone, including people who never created an account) permanently deletes from our servers your profile (including your name, phone number, measurements, notification token and unlock credits), every scan and every photo you uploaded (body scans, including scans that did not finish, meal photos, check-in selfies and your profile photo), your weekly plans, Body Score summaries and check-ins, your workout and invite-a-friend records and your daily usage counters. If you never created an account, it also deletes the anonymous sign-in record. It clears Formfy's data on your device, cancels scheduled reminders and signs you out.
• Delete account (if you created an account) does all of the above and also deletes your sign-in account. If you use Sign in with Apple, it also revokes Formfy's access to your Apple ID. You may be asked to sign in again first.

Two kinds of records are kept after deletion: purchase records, as described in Section 6, and the device hash and hashed network address that stop repeat invite-a-friend claims, which no longer link to you. If something goes wrong during deletion, the App tells you and you can try again; you can also email contact@hsaggroup.com.

We will complete deletion requests within the time the law requires. Server logs, analytics data and crash reports expire on the schedules in Section 6. The App does not currently let you delete a single scan; to delete specific scans, email us.

Deleting your data or your account does not cancel a subscription. To stop billing, cancel the subscription in your App Store or Google Play account.

Withdrawing consent. You can withdraw your consent to photo analysis at any time. Stop scanning and use Delete my data: it deletes your stored scan photos and resets your consent, so the App asks again before any new scan. You can also turn off camera, photo library and notification permissions in your device settings. Withdrawing consent does not affect processing that happened before.

8. Your Rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy in a portable format;
• correct it (you can edit your profile and measurements in the App, or ask us);
• delete it;
• object to or restrict some processing;
• withdraw your consent at any time;
• complain to your data protection authority.

To make a request, email contact@hsaggroup.com. We may need to confirm that the request comes from you. We will not treat you differently for using your rights.

8.1 European Economic Area, United Kingdom and Switzerland

We rely on these legal bases:

• Consent: to analyze your photos and the body measurements sent with them, which you give on the "Before you scan" screen, and to send push notifications.
• Performance of our contract with you: to provide the App and the features you use, including saving your history, and to process your purchases.
• Legitimate interests: to keep the App secure, prevent fraud (including in the invite-a-friend program), measure usage, fix crashes and improve the App.
• Legal obligation: to keep purchase records for tax and accounting.

International transfers. HSAG is based in the United States. Our service providers store and process data in the United States, and Vertex AI may process requests in other countries (see Section 4). For transfers from the EEA, the UK and Switzerland we rely on Google's data processing terms, which include the European Commission's Standard Contractual Clauses.

8.2 Brazil

You have the rights in Article 18 of the Lei Geral de Proteção de Dados (LGPD), including confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about who we share data with, and withdrawal of consent. You can also contact the Autoridade Nacional de Proteção de Dados (ANPD).

8.3 California and Other US States

In the last 12 months we collected these categories of personal information: identifiers (user ID, email address, device hash, hashed network address, app instance ID); customer records (name and phone number, if you add them); commercial information (subscription purchases); internet or other electronic network activity (app usage and diagnostics); and sensitive personal information (account login, photos, and body and health information such as body-fat estimates, weight and sex). We collect it from you, your device, Apple and Google, for the purposes in Section 3, and we disclose it for business purposes only to the service providers in Section 5.

We do not sell personal information or share it for cross-context behavioral advertising, including information about consumers under 16. We use sensitive personal information only to provide the App you ask for. You can ask to know, access, correct and delete your personal information, and you can use an authorized agent. Residents of other US states with privacy laws have similar rights. Email us to use them.

9. Security

We protect your information with encryption in transit (HTTPS/TLS) and Google's encryption at rest. Our database rules let each signed-in account read and change only its own records, and values that grant access, such as Premium status and unlock credits, can be changed only by our servers. Firebase App Check helps block requests that do not come from the genuine App. No system is perfectly secure, so we cannot guarantee absolute security.

10. Children

Formfy is not directed to children and is not for anyone under 13. We do not knowingly collect personal information from children under 13. If you are under the age of majority where you live, use Formfy only with permission from a parent or guardian. If you believe a child under 13 has given us personal information, contact us and we will delete it.

11. Health Information Disclaimer

Formfy provides fitness estimates only. It is not a medical device and does not diagnose, treat or prevent any condition. Always consult a healthcare professional for medical advice, diagnosis or treatment. See the Formfy Terms of Service.

12. Changes to This Policy

We may update this policy. When we do, we will change the Effective date at the top of this page. If we make material changes, we will give notice in the App or on this page before they take effect.

13. Contact Us

For questions about this policy or your data, or to make a request, contact us at: