Privacy Policy
Last updated: 4 October 2026
This policy explains what personal data the Platelift app (iPhone and Apple Watch) collects, why, who we share it with, how long we keep it and the rights you have. We have tried to write it plainly. If anything is unclear, email support@platelift.online.
The short version
- We use your body, food and training data to build and run your plan. You agree to this on the consent screen at the start of the app.
- Meal photos, meal descriptions and Coach messages are sent to Anthropic (Claude) to be analysed. Anthropic does not use them to train its models.
- Body progress photos never leave your iPhone.
- Apple Health data is read on your device. We never sell it and never use it for advertising.
- We never sell your personal data.
- You can export everything (Settings › Export my data) and delete your account (Settings › Delete account) inside the app.
1. Who we are
The controller of your personal data is Bruno Silva, a sole trader trading as Platelift, based in Portlaoise, Co. Laois, Ireland. Postal address: [ADDRESS].
- Privacy and support: support@platelift.online
- General enquiries: hello@platelift.online
We have not appointed a Data Protection Officer because the law does not require one for a business of our size. Email the support address above for any privacy question.
2. Data we collect
Information you give us
| Data | Examples | Where it is stored |
|---|---|---|
| Name | The first name you type during onboarding | Your device and our servers |
| Body and goal data | Sex, year of birth (from your age), height, current and target weight, goal, timeframe, training experience, injuries or pain you mention, workday activity | Your device and our servers |
| Training data | Your plan, workouts, sets, loads and reps, cardio, notes, burned calories per workout | Your device and our servers |
| Nutrition data | Meals you log, foods, grams, calories, macros, water, weight logs, habits | Your device and our servers |
| Meal photos | Photos you take or pick to scan a meal | Sent for analysis; the server copy is deleted after 24 hours (see Retention) |
| Coach conversations | Messages you send to the AI Coach and its replies, your 👍/👎 feedback | Your device and our servers |
| Body progress photos | Photos you take in You › Body photos | Only on your iPhone. Never uploaded, never sent to the Coach, not part of the export |
| Account data | Account ID, and the email address you sign in with (Sign in with Apple, which may be an Apple private relay address, or a magic link) | Our servers |
| Support emails | What you write to us, plus the app version, device model, iOS version and language that the app adds to support emails (never photos) | Our mailbox |
Information collected automatically
- Purchase history: your subscription product, status, expiry date and store transaction ID, received from Superwall when you subscribe, renew, cancel or are refunded.
- Product interaction: which screens and steps you view and complete (for example each onboarding step), and when an error or edge case occurs. We drop events that would reveal health information, such as the Coach giving a medical safety answer.
- Identifiers: your account ID and a random app identifier created on install. Platelift does not access your device's advertising identifier (IDFA).
- Region and time zone: used to show the correct emergency number in the Coach and to group your logs by day.
We do not collect your precise location, contacts or browsing history.
Voice input
When you dictate a meal or a Coach message, iOS converts speech to text. Where your device supports it, Platelift asks iOS to do this on the device. Only the resulting text is sent to us. On devices without on-device recognition, Apple may process the audio under Apple's privacy policy.
3. Health data and Apple Health
Much of what you log (weight, food, training, injuries) is data concerning health, a special category of personal data under Article 9 GDPR. We process it only because you give explicit consent on the consent screen at the start of the app, and only to provide the app to you. You can withdraw consent at any time by deleting your account (see Your rights); this does not affect processing that already took place.
Apple Health (HealthKit). If you allow it, Platelift:
- reads active energy, heart rate, weight (body mass), height and steps, to add the calories you burn to your day;
- writes your workouts (including those recorded on Apple Watch), weight and nutrition (energy, protein, carbohydrates, fat) to Apple Health.
Apple Health data is read on your device. Raw readings such as heart rate samples are not uploaded to our servers. The only figure derived from them that we store is the total calories burned for a workout you log, saved with that workout so it syncs to your account; if Health data is not available, the app uses an estimate instead. We never sell Apple Health data, never use it for advertising or marketing, never share it with advertising or analytics providers, and never use it to build profiles for those purposes. You can change Platelift's Health access at any time in the Health app › Sharing › Apps, or turn individual types off in Platelift's settings.
4. AI features
Photo scan, Describe a meal and the Coach use Claude, an AI model provided by Anthropic. The app never talks to Anthropic directly; our server does, and only when you use one of these features:
- Photo scan: the meal photo and the meal slot are sent so the model can estimate the foods, grams, calories and macros.
- Describe a meal: the text you type or dictate is sent.
- Coach: your message and recent messages in the conversation are sent, together with the context the Coach needs to answer about your day: your name, sex, age, height, weight, target weight, goal, units, language and region, your plan and today's workout, and what you have eaten and done today.
Anthropic processes this content on our behalf as a processor. Under Anthropic's commercial terms, content sent through its API is not used to train its models. Anthropic may keep inputs and outputs for a limited period under its own policies, for example to detect abuse. AI estimates can be wrong: always check portions and numbers. AI results are not used to make any decision that has legal or similarly significant effects on you.
The Coach screens every message before it reaches the model. Messages that suggest a medical emergency, an eating disorder, self-harm or similar get a fixed safety answer with your local emergency number instead of advice. We store whether a reply was a safety answer with the conversation; we never send this to analytics.
5. Why we use your data (legal bases)
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account, building your plan, syncing your logs between iPhone and Apple Watch, AI features, customer support | Contract (Art. 6(1)(b)). For health data: your explicit consent (Art. 9(2)(a)) |
| Managing your subscription and unlocking Pro | Contract (Art. 6(1)(b)) |
| Transactional emails (sign-in link, welcome email, account deletion confirmation) | Contract (Art. 6(1)(b)) |
| Product analytics to understand where people get stuck and to fix bugs | Legitimate interests (Art. 6(1)(f)): improving the app. You can object (see Your rights) |
| Measuring which ads brought people to the app | [LAWYER TO CONFIRM: consent (Art. 6(1)(a)) or legitimate interests (Art. 6(1)(f))] |
| Fraud prevention, security, fair-use limits on AI features | Legitimate interests (Art. 6(1)(f)) |
| Keeping records we must keep (for example tax records) | Legal obligation (Art. 6(1)(c)) |
6. Who we share it with
We never sell your personal data. We share it only with the service providers below, who process it for us under data processing agreements, and with Apple and Meta as described.
| Provider | What for | Data | Location |
|---|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | All account, body, training, nutrition and Coach data; meal photos (24 h) | EU region |
| Anthropic (Claude) | Photo scan, Describe a meal, Coach | Meal photos, meal descriptions, Coach messages and context (see AI features) | United States |
| Apple | App Store billing, Sign in with Apple, Apple Health, notifications | Apple processes your payment and Apple ID as an independent controller under its own terms | Apple's locations |
| Superwall | Paywall and subscription status | Account ID, subscription and purchase events | United States |
| PostHog | Product analytics | App events, random app ID, account ID | EU cloud |
| Resend | Sending emails | Email address, name, language | United States |
| Meta | Ad measurement (see Advertising measurement) | A small set of app and purchase events | Ireland and United States |
| Open Food Facts | Barcode lookup | Only the barcode number, sent from our server. No personal data | France |
We may also disclose data if the law requires it, to protect our rights or the safety of others, or to a buyer if the business is ever sold (you will be told first).
7. Advertising measurement
We advertise Platelift on Meta (Facebook and Instagram). To learn which ads work, we send Meta a small set of events:
- from the app: app opened, onboarding completed, paywall viewed, with a random app identifier;
- from our server: subscription purchases, with the price and currency, a hashed (SHA-256) version of your account ID and, if we have it, a hashed version of your email address.
Events are marked to tell Meta whether tracking was authorised through Apple's App Tracking Transparency prompt. We never send health, body, food, training or Coach data to Meta, and Platelift does not access the advertising identifier (IDFA). Meta's use of the data is described in Meta's privacy policy.
You can turn off "Allow Apps to Request to Track" in iOS Settings › Privacy & Security › Tracking, and you can object to this processing by emailing us.
8. International transfers
Some providers (Anthropic, Superwall, Resend, Meta and parts of Supabase's and PostHog's operations) are based in, or may access data from, the United States or other countries outside the European Economic Area. When that happens we rely on the European Commission's Standard Contractual Clauses, and where the provider is certified, on the EU–US Data Privacy Framework. You can ask us for a copy of the relevant safeguards.
9. How long we keep it
| Data | Retention |
|---|---|
| Your account and everything in it | Until you delete your account. In-app deletion removes it from our servers straight away |
| Accounts we are asked to delete by email | Deleted within 7 days of the request being confirmed |
| Items you delete inside the app (a meal, a set, a chat) | Hidden at once, permanently removed after 30 days |
| Meal photos on our server | Deleted automatically after 24 hours. The app keeps its own copy on your phone |
| Data export files | The download link works for 1 hour; the file is deleted after 24 hours |
| Subscription events about a deleted account | Kept without any identifier, for accounting |
| Product analytics (PostHog) | [RETENTION PERIOD]. Email us to have them deleted |
| Server backups | Overwritten on a rolling basis within [BACKUP RETENTION PERIOD] |
| Tax and accounting records | As long as Irish law requires |
10. Your rights
Under the GDPR you have the right to:
- Access your data and get a copy. In the app: Settings › Export my data gives you a .zip with every table we hold about you, in JSON and CSV.
- Data portability: the same export is in a machine-readable format.
- Rectification: correct your data in the app (Settings, or edit any log), or ask us.
- Erasure: Settings › Delete account removes your plan, logs, chats and files from our servers and sends you a confirmation email. If you signed in with Apple, it also revokes Platelift's Sign in with Apple access. Your App Store subscription is separate: cancel it with Apple so you are not charged again.
- Withdraw consent at any time, without affecting earlier processing. For health data, this means deleting your account, because the app cannot work without it.
- Object to processing based on legitimate interests (analytics, ad measurement), and to direct marketing at any time.
- Restriction of processing in certain cases.
For anything you cannot do in the app, email support@platelift.online from the address linked to your account. We reply within one month and may need to confirm your identity first.
11. Security
Data is encrypted in transit (HTTPS). On our servers, row-level security means each account can only read its own rows, and stored files sit in private buckets under your account ID. AI provider keys live only on our server, never in the app. No system is perfectly secure; if a breach affects you, we will tell you and the Data Protection Commission as the law requires.
12. Age limit
Platelift is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you think a child has given us data, email us and we will delete it.
13. Changes
We will update this page when our practices change and change the date at the top. If a change is significant, we will tell you in the app or by email before it takes effect.
14. Contact and complaints
Email support@platelift.online or write to Bruno Silva, Platelift, [ADDRESS], Portlaoise, Co. Laois, Ireland.
You can complain to the Irish supervisory authority, the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, at dataprotection.ie, or to the authority in the EU country where you live or work. We would appreciate the chance to sort it out first.