Privacy Policy
Your data should work for you.
This policy explains what AfterFire processes, how it is used, and the choices available to you.
Information you provide
AfterFire stores the profile details, goals, workouts, workout feedback, meals and nutrition, water, sleep, weight, body measurements, supplement plans and confirmed intakes, notification choices, Coach memory, approved Coach actions, progress photos, referral attribution, privacy choices, and legal acknowledgments you choose to provide. A verified sign-in identity connects those records to your account.
Information created by AfterFire
AfterFire creates summaries, trends, milestones, reminder status, data-coverage notes, safety checks, and coaching recommendations from your records. Missing logs remain unknown rather than being treated as zero. Estimated meals and imported records remain labeled with their source and level of certainty.
AI processing and permission
AI processing starts off until you turn it on. You then choose which categories AI may use. When you intentionally use Coach chat, voice, photo analysis, AI-assisted logging, or AI workout creation, AfterFire sends the content needed for that request—and only the enabled supporting categories—to OpenAI. AfterFire marks supported requests as non-persistent, but OpenAI may retain limited API data for safety and abuse monitoring under its current service terms unless a separate zero-retention arrangement applies. Turning AI processing off keeps manual tracking and local rule-based safety checks available.
Photos and recordings
Progress photos are retained in private object storage so you can view them later. Coach receives dates and pose metadata, not progress-photo pixels. Meal, plate, nutrition-label, and supplement-label images are processed only for the analysis you request and are not retained by AfterFire afterward. Voice recordings are sent for transcription and are not retained by AfterFire after processing; resulting text may remain visible during the current conversation.
How information is used
AfterFire uses account information to provide tracking, history, calculations, reminders, personalization, coaching, workout creation, account security, subscriptions, support you request, and health connections you authorize. AfterFire does not sell health information, use it for targeted advertising, or give an advertiser access to it.
Service providers
AfterFire uses Supabase for account authentication, database storage, private object storage, and server functions; OpenAI for AI processing you authorize; Expo for application delivery and push-notification routing; and Apple for iPhone subscriptions, offer-code redemption, billing, refunds, and transaction status. A provider receives only information needed for its role and processes it under its own contractual and legal obligations.
Subscriptions and referrals
Apple provides AfterFire with signed transaction identifiers, product and subscription status, expiration, refund or revocation status, and offer identifiers needed to verify access. AfterFire creates a non-identifying referral code for each account and records attribution, qualification, reward, and redemption status. Apple one-time offer codes are stored server-side, assigned once, and shown only to the assigned member. AfterFire does not receive full payment-card details.
Health and wearable connections
Health connections are optional and permission is requested by category. You may revoke a connection later. AfterFire labels the originating platform, app, or device; avoids importing its own records back as duplicates; and does not silently write imported information back to the originating health platform.
Account separation and security
Every private request resolves the signed-in account on the server. Record IDs are checked against that owner, pages and responses containing personal information are marked private and non-cacheable, and stored photos require the signed-in owner. AfterFire uses HTTPS, encrypted provider storage, restrictive browser headers, controlled changes, and metadata-only audit records. Emergency controls can pause AI or make the service read-only while an incident is contained. No internet service can promise absolute security.
Operator and support access
AfterFire is designed so ordinary administration and support do not display health records, Coach questions, or progress photos. Production access should be limited, time-bound, and audited. Because the current service must process account information to provide coaching and recovery, this beta is not end-to-end encrypted and should not be described as technically unreadable by every infrastructure administrator.
Retention, backups, and deletion
Active records remain until you delete them or delete the account. Account deletion removes that account’s AfterFire records and progress photos from active systems. Encrypted disaster-recovery backups may retain deleted information temporarily until the provider’s normal backup lifecycle expires; they are not used for ordinary browsing. Billing providers may retain transaction records when required by law. Deleting AfterFire data does not delete a separate ChatGPT, Apple, Google, Stripe, or device-platform account.
Your choices and rights
In Data & Privacy, you can control AI access, review recent Coach activity, and download a copy of your account data. You can also edit or delete supported records, remove Coach memories, disable notifications, disconnect health sources, revoke device permissions, and permanently delete AfterFire data. A request may require identity verification.
Security incidents
AfterFire will investigate suspected unauthorized access or disclosure, contain the problem, preserve appropriate audit information, and provide notices required by applicable law. Health information will not be copied into general diagnostic logs merely to investigate an error.
Children
AfterFire is intended for adults and the current beta does not permit accounts for people under 18. Do not submit another person’s sensitive information without lawful authority and permission.
Changes
Material changes receive a new effective date and may require you to acknowledge the updated policy before continuing. New health categories, new AI purposes, or materially different sharing will require an updated explanation and any permission required by law.
Contact
AfterFire is operated by BroadBrain Development in Utah, United States. Send privacy, access, correction, deletion, support, or security questions to support@broadbrain.dev. We may verify your identity before acting on an account or data request.