Privacy Policy

Effective 2026-06-23 · support@squadpax.com

Summary

SquadPax collects the fitness, nutrition, and account data you enter so the app can work. We treat your health and fitness data as sensitive. We do not sell your data or use it for advertising. You can export or delete your data at any time.

1. Data we collect

Account: email address (for sign-in), and your chosen handle and display name.

Squads & check-ins: squad membership, check-in records, and optional check-in photos (which auto-expire after 24 hours).

Nutrition: food logs and totals (calories, protein, carbs, fat), water intake, and optional meal photos you submit to the AI scanner.

Fitness & body: workouts and sets, body measurements, weight, and BMI you log.

AI: the messages and images you send to the coach, and a per-day count of AI calls (for rate limiting).

Subscriptions: if you subscribe, your purchase and subscription status (tied to your account ID) so we can unlock paid features. Payment is handled by the App Store or Google Play — we never receive your card details.

Device: a push-notification token if you enable notifications. We do not collect precise location or your contacts.

2. Sensitive (health) data & your consent

Body measurements, weight, BMI, and the food/exercise data you log are health-related and are treated as a special category of personal data under laws such as the EU/UK GDPR, India’s DPDP Act, and the California CPRA.

We process this data only with your explicit, opt-in consent, which we ask for in the app and which you can withdraw at any time from Profile → Privacy & data — without deleting your account. We process it solely to provide the tracking and coaching features you requested.

3. Who processes your data

Supabase — hosts our database, authentication, and photo storage (data processor).

Anthropic — receives the text and images you send to the AI coach / meal scanner to generate responses (data processor). Your inputs are not used to train its models, are retained only transiently for operational and safety purposes under its commercial terms, and are covered by a data-processing agreement with Standard Contractual Clauses.

RevenueCat — manages subscriptions; it receives your account ID and your purchase/entitlement history to determine which paid features you can access (data processor).

Expo / Apple / Google — deliver push notifications and provide app sign-in and store billing.

Lookups to USDA FoodData Central and Open Food Facts are for food search only and do not include your personal data.

4. How we use it

To operate the features you use, show your squad shared progress (streaks and whether members checked in), generate AI coaching, and keep the service secure. We do not sell your data or run third-party ads.

5. Your rights

Depending on where you live, you can request access, correction, deletion, a portable copy, or restriction of your data, and you can object to or withdraw consent for processing.

You can export your data yourself from Profile → Privacy & data → Export my data, and delete everything from Profile → Delete account, which permanently removes your account, your logs, and your stored photos. For any other request, contact support@squadpax.com. You may also complain to your local data-protection authority.

Your export covers your account, squad, nutrition, fitness, and body-measurement records. Check-in photos are short-lived (auto-deleted after 24 hours) and are therefore not part of the export; deleting your account also removes any photo still stored.

6. Retention & security

We keep your data until you delete your account; check-in photos auto-expire after 24 hours. Data is encrypted in transit, and access is restricted per-user by database row-level security.

No system is perfectly secure; we will notify affected users and regulators of a qualifying breach as required by law.

7. International transfers & children

Your data may be processed in countries other than yours (including the United States) under appropriate safeguards such as Standard Contractual Clauses.

SquadPax is not for anyone under 18 and we do not knowingly collect their data; if you believe an under-18 user has signed up, contact us and we will delete the account.

8. California privacy rights (CCPA/CPRA)

Notice at collection: we collect the account, squad, nutrition, fitness, body-measurement, and AI-interaction data described above to operate the app. Health and fitness data is treated as Sensitive Personal Information (SPI).

We do NOT sell or “share” your personal information for cross-context behavioral advertising, and have not in the prior 12 months — so there is nothing to opt out of. You may still email support@squadpax.com to confirm this preference.

We use your SPI solely to provide the features you requested, never to infer characteristics about you, so no separate “Limit the Use of My Sensitive Personal Information” step is required; you can still withdraw consent in-app (Profile → Privacy & data) at any time.

California residents may exercise access, deletion, correction, and portability rights as described in Section 5, and we will not discriminate against you for exercising them.

Categories of personal information we collect — source — purpose — disclosed to:

• Identifiers (email, account ID, push token) — from you and your device — to run your account and notifications — Supabase, Expo/Apple/Google.

• Health & fitness data, treated as SPI (workouts, body measurements, weight, BMI, food logs) — from you — to provide tracking and coaching — Supabase, and Anthropic for AI features.

• Photos (check-in and meal photos) — from you — to display to your squad and run the meal scanner — Supabase, Anthropic.

• Other user content (handle, display name, coach messages) — from you — to operate squads and coaching — Supabase.

• Commercial information (purchase and subscription status) — from the app stores — to unlock paid features — RevenueCat, Apple/Google.

We disclose each category only to the processors above to operate the service; we do not sell or “share” any category for cross-context behavioral advertising.

9. India (Digital Personal Data Protection Act, 2023 & DPDP Rules, 2025)

If you are in India, we act as a Data Fiduciary and process your personal data on the basis of your consent, which is free, specific, informed, unconditional, and given by a clear affirmative action in the app. You may withdraw it at any time from Profile → Privacy & data, as easily as you gave it.

As a Data Principal you have the right to access a summary of your data and how it is processed, to correction and completion, to erasure, to nominate another person to exercise your rights, and to grievance redressal. You may give or withdraw consent directly or, where available, through a registered Consent Manager.

Grievance Officer: the Grievance Officer of Trenith Technologies Pvt Ltd is your contact for any grievance or to exercise these rights, reachable at support@squadpax.com. We will respond within the period prescribed under the DPDP Rules, 2025; if unresolved, you may complain to the Data Protection Board of India through its online portal. We will notify the Board and affected Data Principals of a personal-data breach as required.

10. Canada (PIPEDA & Québec Law 25)

If you are in Canada, we process your personal information with your consent and remain accountable for it under PIPEDA. Our designated Privacy Officer is reachable at support@squadpax.com, and you may request access to and correction of your information.

For Québec residents, the person in charge of protecting personal information (the Privacy Officer above) is responsible for your Law 25 rights, including access, correction, and de-indexing.

We will report a confidentiality incident posing a real risk of serious injury to the Office of the Privacy Commissioner of Canada (and, for Québec, the Commission d’accès à l’information) and to affected individuals as soon as feasible, as required by law.

11. Changes & contact

We will notify you in-app of material changes to this policy.

Effective 2026-06-23. Data controller: Trenith Technologies Pvt Ltd, contactable at support@squadpax.com. You may also complain to your local data-protection authority.