Privacy Policy

The app is provided to clients of ScienceBuilt Coaching. Accounts are created by your coach; there is no public sign-up. If you are not a client and received an account in error, contact us at sciencebuiltcoaching@gmail.com.

You do not need an account for this policy to apply to you. If you have messaged @TonyWonyF on Instagram, the section below on Instagram messages covers you.

You (or your coach on your behalf) provide, and we store:

• Account details — your name, email address, and a securely hashed password. We never store your password in readable form.
• Health & fitness data — the information the app exists to track: body weight and measurements, workouts and logged sets, nutrition and food logs, step and cardio activity, habits, progress photos you choose to add, and your weekly check-in answers.
• Coaching communication — messages exchanged between you and your coach within the app.
• Billing status — if you pay for coaching, we store your subscription status and a Stripe customer reference so your coach can see whether payments are current. We never see or store your card number; all card data is handled directly by Stripe (see below).

We do not collect location, contacts, advertising identifiers, or any camera or microphone data in the background.

Your camera is used in three places, always started by you: barcode scanning, which runs entirely on your device and uploads nothing; meal photos; and form-check clips of your lifts, which record audio as well as video. Meal photos, progress photos and form-check clips are uploaded to private storage and are visible only to you and your coach. They are never public, and there is no direct link to them: every view is checked against who is signed in.

Notifications— if you allow them, we store a device token so we can send you a notification when your coach messages you or your check-in is due. The token is sent to Apple’s notification service to deliver the message, is not used for advertising or tracking, and is deleted when you log out or delete your account.

When you send a direct message to our Instagram business account @TonyWonyF, Meta delivers that message to us and we keep a record of the conversation. This applies whether you found us through an advert or organically.

We store:

• Your Instagram username and the account identifier Meta gives us for you (an ID scoped to our account only — it cannot be used to identify you elsewhere).
• Basic profile details Meta returns with the message: your display name, your follower count, whether your account is verified, whether we follow each other, and whether the thread is a group.
• The content of the messages exchanged between us, and when the conversation started.
• Which advert you came from, if any, as reported to us by Meta.
• Notes your coach writes about the enquiry — for example whether a call was booked — so we can follow up properly.

Why: to reply to you, to keep track of where a conversation got to, and to measure which of our adverts actually lead to real enquiries. That last part is ordinary advertising measurement done on our own records. It is not used to target adverts at you, and none of it is sent back to Meta.

You may be talking to an automated system. Replies to enquiries on Instagram are written by an AI assistant, and some are sent to you automatically without a person reading them first. It is not a person typing, even though it writes in Tony’s voice and signs nothing differently.

To write a reply, the content of the conversation is sent to Anthropic’s API. Anthropic processes it to produce the reply and does not use it to train their models. Nothing is sent anywhere else.

How to reach a person instead. Ask whether you are talking to a bot, or ask to speak to a human or to Tony, and that message is passed to him rather than answered automatically. Replying STOP does the same and tells us not to message you again.

Some conversations are passed to Tony without you asking, and the automation writes nothing in them: anything mentioning pregnancy, an eating disorder, a diagnosis or bereavement, or anything that reads as a crisis, and any conversation long enough to be an existing relationship rather than an enquiry.

Nothing is bought or paid for over Instagram. No payment details are ever requested or taken in a message, and no money changes hands until you have spoken to Tony directly.

Deleting it: email sciencebuiltcoaching@gmail.com from, or naming, the Instagram account in question and we will delete the conversation record. We keep enquiry records for up to two years so we can measure advertising over time, then remove them.

Instagram is operated by Meta, and your messages are also subject to Meta’s privacy policy. You can review the apps connected to your Instagram account in Instagram under Settings, Apps and websites.

Client data is used solely to deliver coaching: to show you and your coach your progress, plan your training and nutrition, run weekly check-ins, and communicate. We do not use your data to train advertising models or sell it to anyone.

We share data only with the service providers that run the app:

• Your coach at ScienceBuilt Coaching, who can see your coaching data in order to coach you.
• Stripe — payment processing. Stripe receives your payment details directly and is the custodian of that data under Stripe’s privacy policy.
• Hosting & database — Vercel (app hosting) and Turso (encrypted database), which store the data on our behalf.
• USDA FoodData Central — when you search foods, your search terms are sent to this public U.S. government database to return nutrition facts. No account data is sent.
• Anthropic— the content of Instagram enquiry conversations is sent to Anthropic’s API to draft a suggested reply for your coach. This applies only to Instagram enquiries. Coaching data belonging to clients of the app is not sent to Anthropic.
• Apple— if you turn on notifications, your device token and the notification text are passed to Apple’s push service to deliver them to your phone.
• Meta — the source of Instagram messages sent to us, not a recipient of anything we hold. We do not send client data or conversation records to Meta.

Traffic is encrypted with HTTPS/TLS and forced over HTTPS (HSTS). Passwords are hashed with bcrypt. Sessions are signed and can be revoked; changing your password signs out your other devices. Access to your coaching data is restricted to you and your coach.

We keep your data for as long as your coaching account is active. When your account is deleted, your personal and coaching data is removed from our database. Billing records that we are required to keep for accounting or legal reasons may be retained by Stripe under their own retention rules.

Meal photos and form-check clips are deleted automatically after 30 days unless your coach marks one to keep, so old media does not sit around. Progress photos are kept for as long as your account is, because comparing them over months is the point of taking them, and they go when the account does.

You can delete your account and its data at any time from Settings → Account → Delete account inside the app, or by emailing sciencebuiltcoaching@gmail.com. Deletion is permanent and removes your coaching data from our systems.

ScienceBuilt Coaching works with adults aged 18 and over. The app and our coaching are not offered to minors, and our advertising is targeted to adults.

If we learn that someone who messaged us is under 18, we do not take them on as a client. If you believe a minor has sent us information, email sciencebuiltcoaching@gmail.com and we will delete the record.

You may request a copy of your data, ask us to correct it, or ask us to delete it. Your coach can also export your logs for you. To make a request, email sciencebuiltcoaching@gmail.com.

If we make material changes, we will update the date at the top of this page and, where appropriate, notify you in the app.

Questions about your privacy? Email sciencebuiltcoaching@gmail.com and we will respond within a reasonable timeframe.