Privacy Policy

1. Introduction

This Privacy Policy explains how the SixPeak mobile application (the "App") handles information. It applies to your use of the App on iOS and Android.

SixPeak is a paid, subscription-based application. We are currently shipping the first update of the App, and we expect its feature set to grow over time; this Policy is written to cover that ongoing development and will be revised as needed.

SixPeak has no user accounts and no persistent database of your personal information. Your profile, nutrition logs, workout history, and scan history are stored locally on your device. The App does send certain content — physique photos, and your messages to the AI coach — to our backend so that it can be analysed by our AI provider, as described in Section 5.

Please also read our Terms & Conditions.

2. Who We Are

For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), NexAtlas Labs is the data controller in respect of the processing described in this policy.

3. Information We Collect

3.1 Information stored on your device only

The following is created by you or generated by the App as you use it, and is stored locally on your device. It is not transmitted to us for storage and we cannot access it directly:

• Profile information — details you enter such as your body stats, goals, and preferences, used to personalise workout and nutrition guidance.
• Nutrition logs — foods and meals you add, whether typed manually or confirmed from an AI coach suggestion.
• Workout history — routines, sessions, and exercise sets you complete or generate.
• Scan history — your past physique scan results and the photos associated with them, kept on your device after analysis completes.
• Coach chat history — your conversation with the in-app AI coach.

This information is removed when you uninstall the App.

3.2 Information processed for AI analysis

When you run a physique scan or send a message to the AI coach, the photo or message text (and, where relevant, recent chat history for context) is transmitted to our backend, which forwards it to our AI provider for analysis, then returns a result to your device. See Section 5 for full detail.

3.3 Technical diagnostics

Our backend host (Google Cloud) and our AI provider may process technical information inherent to handling a network request — such as IP address, request timestamp, and device or app version — for security, abuse prevention, and service operation. This is processed under each provider's own privacy terms and is not linked back to you by name.

4. What We Do Not Collect

To be explicit, the App does not collect, or require you to provide:

• your name, email address, phone number, or postal address;
• account credentials of any kind (there are no accounts);
• contacts, calendar entries, messages, or call logs;
• precise or approximate location data;
• advertising identifiers, or any identifier used for cross-app tracking;
• health or fitness data from Apple Health, Google Fit, or any wearable device;
• browsing history or activity in other applications;
• payment card numbers or financial account details.

The App contains no third-party advertising SDKs and no analytics SDKs that profile you.

5. Physique Scans, Coach Chat & AI Processing

This is the most privacy-sensitive part of the App, so we describe it precisely.

5.1 What happens, step by step

1. You take or choose a physique photo, or send a message to the AI coach. Capture and submission only ever begin from a deliberate action by you.
2. A photo is compressed on your device before it is uploaded.
3. The photo, or your chat message and recent conversation history, is sent over an encrypted connection to the SixPeak backend, which we operate on Google Cloud infrastructure.
4. The backend forwards the content to OpenAI for analysis, and returns the structured result (a physique score and notes, a chat reply, or a suggested nutrition entry) to your device.
5. The backend does not write photos or chat content to a database or disk. The backend processes each request in memory and does not retain a copy once the response has been returned. Your device is what stores the analysed result and the photo going forward, in your local scan and chat history.

5.2 Our AI provider's handling of the content

Processing by OpenAI is governed by OpenAI's own terms and privacy policy. OpenAI acts as our processor for this operation. We do not control, and are not responsible for, how OpenAI's infrastructure itself logs or retains API traffic under its own retention practices; we encourage you to review OpenAI's published policies for its API services.

5.3 Nutrition suggestions from chat

When the AI coach proposes a nutrition entry from your conversation (for example, after you describe a meal), the App shows you the proposed entry for review before anything is saved. Nothing is added to your nutrition log until you confirm it.

6. Live Exercise Form Tracking

SixPeak's real-time exercise form feature uses your device's camera together with on-device pose detection (Google ML Kit) to track body landmarks while you exercise.

7. How We Use Information

We do not use any information for advertising, profiling, automated decision-making with legal effect, or resale.

8. Legal Bases for Processing (GDPR)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — for processing a physique photo or chat message to provide the analysis or reply you have asked the App to perform, and for managing your paid subscription.
• Consent (Art. 6(1)(a)) — for access to your camera and photo library, which you grant through your device's permission prompts and may withdraw at any time in device settings.
• Legitimate interests (Art. 6(1)(f)) — for the security and abuse-prevention measures applied by our backend and AI provider when handling a request.

Where a physique photo could be considered to contain biometric or otherwise special category data, we rely on your explicit consent (Art. 9(2)(a)), given by your deliberate choice to capture or select a photo and submit it for analysis. You may withdraw that consent at any time by not using the scan feature; the App's other features do not require it.

We note that the App does not perform biometric identification: the AI is asked only to assess physique characteristics relevant to fitness tracking, never to identify a person.

9. Sharing & Disclosure

We do not sell, rent, or trade your information. We share it only as follows:

We may disclose information where required by law, court order, or valid governmental request, or to establish or defend legal claims. Because we retain no server-side copy of your photos or chat content, our practical ability to comply with such a request in respect of that content is extremely limited.

If NexAtlas Labs is involved in a merger, acquisition, or asset sale, we will provide notice before any information becomes subject to a different privacy policy.

10. Data Retention

Uninstalling the App removes all locally stored data. This cannot be undone, and because we hold no backup, data removed this way is not recoverable.

11. Device Permissions

Each permission is requested only for the stated purpose, and may be revoked at any time in your device settings.

The camera is activated only while you are actively capturing a photo or running a live exercise-tracking session. The App does not record in the background.

12. Subscriptions & Payments

SixPeak is a paid application, offered on an auto-renewing subscription basis. We may offer a free trial period; unless cancelled before the trial ends, it converts automatically into a paid subscription. All payments are processed by Apple or Google — never by us.

We do not receive, see, or store your payment card number, billing address, or financial account details. The app stores provide us only with aggregate, non-identifying information about purchases (for example, the number of active subscriptions).

Payment data is handled under Apple's Privacy Policy or Google's Privacy Policy respectively.

13. Security

We apply measures appropriate to the data involved:

• Photos, chat messages, and analysis results are transmitted over encrypted TLS connections only.
• Locally stored data resides in app-private storage, protected by your device's operating system sandbox and, where enabled, its device encryption.
• Our backend does not write your photos or chat content to disk or to a database, which limits the impact of a server-side compromise on that content.
• Optional server-side access uses a shared API key mechanism to reduce abuse of backend endpoints.

No method of transmission or storage is completely secure. We encourage you to protect your device with a passcode or biometric lock, since local data is only as secure as the device holding it.

14. International Data Transfers

Photos and chat content sent for AI analysis may be processed on Google Cloud and OpenAI infrastructure located outside your country of residence, including in the United States.

Where such a transfer involves personal data of individuals in the EEA or UK, it is made under appropriate safeguards, including the European Commission's Standard Contractual Clauses as incorporated into our providers' data processing terms.

Because this content is processed transiently and is not retained by our backend after a result is returned, the transfer is momentary and no cross-border data store is created by us.

15. Your Rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent.

If you wish to make a formal request or have a question about your rights, contact support@nexatlaslabs.com. We will respond within 30 days.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

16. Children's Privacy

SixPeak is not directed at children under 13, and we do not knowingly collect personal information from them. The App has no accounts, no social features, and no advertising.

If you are a parent or guardian and believe a child under 13 has used the App in a way that concerns you, please contact us. Note that because all data is stored locally, uninstalling the App removes it immediately.

17. Regional Disclosures

17.1 California (CCPA / CPRA)

We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we have not done so in the preceding twelve months. We do not use personal information for cross-context behavioural advertising.

California residents have rights to know, delete, correct, and opt out. As explained in Section 15, we hold no long-term copy of your personal information, so the practical exercise of these rights takes place on your device.

17.2 European Economic Area & United Kingdom

Legal bases are set out in Section 8, international transfers in Section 14, and your rights in Section 15. We have not appointed an EU or UK representative, as our processing does not meet the threshold requiring one under Art. 27 GDPR.

17.3 Apple App Store & Google Play disclosures

The privacy labels we publish on the App Store and the Data Safety section we publish on Google Play are consistent with this policy. In summary: data is not collected for tracking, is not linked to your identity, and is not sold. Camera and photo data are used solely for app functionality described above.

18. Changes to This Policy

We may update this Privacy Policy from time to time, including as we ship updates beyond the App's first release. When we do, we will revise the "Last updated" date at the top of this page.

If we make material changes — particularly any change that would introduce collection or retention of data we do not currently collect — we will provide prominent notice within the App before the change takes effect, and obtain your consent where required by law.

We encourage you to review this page periodically.

19. Contact

For any question, concern, or request regarding privacy: