Last updated: September 2026

1. Who we are

OTG is a product of Ziippoco Inc. ("we", "us"). Contact: dhruvsharrma@gmail.com.

2. Data we collect

- Account info: name, email, phone (via Firebase Authentication).

- Fitness profile: sex, date of birth, height, weight, fitness goals, preferred activities, dietary preferences, and city. Stored to personalize recommendations and AI prompts.

- Body metrics: every weight entry you log, with timestamp.

- Food log: every food or meal you log (manual, AI scan, or barcode) with calories, macros, meal type, and timestamp. If you correct an AI scan's values, the original suggestion and your correction are stored alongside the entry to improve future scans.

- Photos: food photos and progress photos you submit are sent to our AI provider for analysis. We retain a link to the photo and the AI's response in your account history. Photos are never used to train models.

- Health conditions and supplements: if you add health conditions or supplements in your plan, that information is stored in your account and, when relevant to a question you ask, is sent to our AI provider so the AI Coach can give a safer, more relevant answer, for example avoiding a suggestion that conflicts with a condition you've logged. The AI Coach does not diagnose conditions or advise on medication or supplement dosage, and will direct you to a qualified clinician for those questions. This data is never used to train models.

- AI conversation history: your chats with the AI Coach are stored so the assistant can maintain context across turns.

- Mood check-ins: the 1-5 score, optional note, and timestamp from the in-app daily mood check-in. This is not clinical data and is not shared with third parties.

- Usage: anonymized AI request logs (model used, token counts, latency, cost) for billing and abuse prevention.

- Feedback: anything you submit through the in-app "Send feedback" screen, including the text, your user id, and the app/build version.

- Device info: coarse device type and OS version, via Firebase Crashlytics, only when a crash occurs.

- Health & wearables: only data you explicitly connect (Apple Health, Google Fit, Garmin, Fitbit). Stored on-device and synced for display.

3. Data we do NOT collect

- We do not sell or share data with advertisers.

- We do not collect contacts, SMS, browsing history, or precise location except when you opt in to a workout-tracking session.

- We do not collect biometric face data; progress photos are analyzed for body-composition cues, not identity. Camera-based rep counting runs on-device, the camera feed itself is never uploaded or sent to our AI provider.

4. Third parties

- Firebase (Google): Auth, Crashlytics, Analytics, Push. Region: US/EU.

- Supabase: Backend, AI proxy, Postgres storage. Region: US.

- Google Generative AI (Gemini): Vision + chat AI. Region: US.

- RevenueCat: Subscription management. Region: US.

- Apple / Google: App distribution and in-app purchase. Region: Global.

5. Your rights

- Access: request a copy of your data via the in-app Help screen.

- Deletion: Settings -> Delete account. Removes your Supabase rows immediately and your Firebase Auth user record. Cached analytics are purged within 30 days.

- Withdrawal of consent: disable AI features by signing out; delete the account to remove server-side data.

- EU/UK/CA residents: additional rights under GDPR / UK GDPR / PIPEDA. Email us to exercise them.

6. Children

OTG is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect data from children.

7. Security

- Data in transit is encrypted with TLS.

- Data at rest is encrypted by Supabase (Postgres) and Firebase.

- AI provider API keys live only on the server; the app never holds them.

8. Changes

We will update this policy if our practices change. Material changes will be notified in-app and via push.