Privacy Notice

Summary

• LOCKEDTFIN is for adults aged 18 and over.
• We use your photo to create an AI-generated illustration of a fitness direction you choose (your Future Form). The image is an illustration, not a prediction.
• We build your training and nutrition plan from values you enter yourself. We never estimate your weight, health, ethnicity, or identity from your photos.
• We do not sell your data, do not show third-party advertising in the product, and do not allow AI providers to train their models on your content.
• You can see, download, correct, and delete your data, and withdraw your consent at any time.

Contact us

For any question about privacy or to exercise your rights, write to [email protected]. Report security vulnerabilities to [email protected]. For other questions, contact [email protected].

What we process, why, and on what legal basis

1. Trying LOCKEDTFIN before you have an account

You can try the Future Form without an account. When you start, we create a temporary session. We process a random session identifier, your chosen presentation (feminine or masculine), the photo you upload, the Future Form images generated from it, and the record of your consent.

• Purpose: to let you create and view a Future Form before deciding to create an account or subscribe.
• Legal basis: your explicit consent (GDPR Article 6(1)(a) and Article 9(2)(a)), which we ask for before you upload a photo. We record it against your temporary session.
• Retention: the session, photo, generated images, and the consent record are deleted automatically 24 hours after the session is created. If you create an account or sign in within that time, the Future Form and your consent record move to your account, so you do not upload the photo again.

2. Your account and sign-in

We process your email address, a one-time sign-in code, your preferred language, an optional display name, your coach style preference, and technical session identifiers.

• Purpose: to create and secure your account and let you sign in.
• Legal basis: performance of our contract with you (Article 6(1)(b)).
• Retention: for as long as you keep your account.

3. Your Future Form (AI image generation)

We send your photo, together with a fixed instruction (and, for a refinement, the preset option you selected), to an AI image model that edits the photo into an illustrative Future Form. We do not include your weight, goals, or any other health values in the instruction. See AI Transparency for details.

• Purpose: to create the illustration you asked for and up to two refinements.
• Legal basis: your explicit consent (Article 6(1)(a) and Article 9(2)(a)).
• Retention: until you delete the image or your account.

4. Content safety checks

Every uploaded photo, progress photo, and generated image is checked automatically for malware and for content we do not accept, such as nudity, images of minors, or self-harm. The check uses an open-source virus scanner on our own servers and an AI image classifier. Only a pass or block result is kept.

• Purpose: to protect you, other members, and the service, and to prevent unlawful content.
• Legal basis: our legitimate interest in operating a safe service (Article 6(1)(f)); for images that reveal health information, the same explicit consent that covers your upload (Article 9(2)(a)).
• Retention: the classifier result is not stored beyond the upload decision.

5. Your plan, screening, and nutrition targets

When you lock in your plan we process your age, height, current and target weight, goal date, training experience, equipment, training days, activity level, goal, and time zone. Your presentation choice selects which reference version of a standard energy equation is used; we do not ask for or record your sex. You also answer a short safety screening: you confirm that you are an adult, and answer yes or no to whether you are pregnant or breastfeeding, have a current or past eating disorder, or are under clinical management for a condition that affects training or nutrition. If any answer is yes, we do not create a plan, and we recommend that you speak to a professional.

• Purpose: to select and scale a reviewed training program and calculate conservative nutrition targets within safe limits.
• Legal basis: your explicit consent (Article 6(1)(a) and Article 9(2)(a)).
• Retention: plan inputs are kept until you delete your account. Screening answers are used when the plan is created and are not stored separately.

6. Progress, check-ins, and logs

We process the workouts, sets, meals, water, and weekly check-ins you log, including weight, adherence, energy, notes, and optional progress photos.

• Purpose: to show your real progress, keep it separate from AI illustrations, and adapt your plan within its limits.
• Legal basis: your explicit consent (Article 6(1)(a) and Article 9(2)(a)).
• Retention: until you delete the entry, the photo, or your account.

Feedback you send: if you use "Send feedback", we store the note you write, an optional rating from 1 to 5, the screen path you were on (for example /app/workout, never photos or health data), and the time. Please do not include health information in the note.

• Purpose: to fix problems and improve the pilot.
• Legal basis: our legitimate interest in improving the service (Article 6(1)(f)).
• Retention: until you delete your account. The notes are included in your data export.

7. The AI coach

When you write to the coach we send your message and a short summary of today's mission (for example workout name, targets, and what you have completed) to an AI language model. We do not send your photos or weight history. When you use voice, audio is streamed live from your device to the AI provider during the conversation; LOCKEDTFIN does not record or store your voice.

• Purpose: to answer your questions about your plan and propose changes that you confirm.
• Legal basis: your explicit consent (Article 6(1)(a) and Article 9(2)(a)), because messages may contain health information.
• Retention: we do not keep a conversation history. The latest reply is held for up to 24 hours so that a repeated request is not charged or processed twice.

8. Subscription and payments

Payments are processed by Stripe. Stripe collects your card details and billing address; we never see or store your full card number. We store a Stripe customer and subscription reference, subscription status, renewal date, and entitlement events.

• Purpose: to sell and manage your subscription, handle cancellations, withdrawals, and refunds.
• Legal basis: performance of our contract (Article 6(1)(b)) and our legal obligations under Norwegian bookkeeping law (Article 6(1)(c), bokføringsloven).
• Retention: subscription records for as long as you have an account; accounting documentation for the period required by bokføringsloven (normally five years after the end of the financial year), even if you delete your account.

9. Security, abuse prevention, and error monitoring

We process limited technical data: request identifiers, timestamps, error codes, a keyed one-way hash (HMAC) of your IP address, a one-way hash of your browser details for rate-limiting, and a bot-protection token from Cloudflare Turnstile when you start a session or request a sign-in code. If an error occurs, an error report may be sent to our error-monitoring provider with personal content removed.

• Purpose: to keep the service secure, prevent fraud and abuse, and fix faults.
• Legal basis: our legitimate interest in a secure and reliable service (Article 6(1)(f)). You can object at any time (see Your rights).
• Retention: security logs up to 30 days unless needed to investigate a specific incident.

10. Service messages

We send sign-in codes and essential messages about your account or subscription by email. We do not send marketing email unless you have separately agreed to it.

• Legal basis: performance of our contract (Article 6(1)(b)).

Is providing data required?

You do not have to give us any data, but some features cannot work without it: we need an email address to create an account, a photo to create a Future Form, and your plan inputs to build a plan. If you do not consent to processing of health-related data, you cannot use the Future Form, plan, progress, or coach features. We never make consent a condition for anything that does not need the data.

Your consent and how to withdraw it

We ask for your explicit consent in the app, separately from accepting the Terms of Use, before you upload a photo and before we create your plan. We record the time, your language, your confirmation that you are 18 or older, and the version of the consent text you agreed to.

If you consent to the photo processing before you have an account, we record it against your temporary session. When you then create an account or sign in, we move that record to your account unchanged and note when it was moved. Consent to processing of health-related information for your plan is only given with an account.

You can withdraw your consent at any time in the app settings or by writing to [email protected]. Without an account, you can withdraw it on the Future Form screen, and we delete your photo and Future Form straight away. Withdrawal does not affect processing that took place before (GDPR Article 7(3)). After withdrawal we stop the processing that relied on consent and delete the related data, unless you ask us to export it first.

Who receives your data

We use service providers (data processors) who process personal data only on our documented instructions under data processing agreements (GDPR Article 28):

• Railway (application hosting in EU West, Amsterdam, Netherlands);
• Supabase (database, authentication, and private file storage);
• Cloudflare (network security, DNS, content delivery, and Turnstile bot protection);
• Zoho (delivery of sign-in and service emails through our authentication provider);
• OpenAI (AI image generation and the text and voice coach);
• Google (AI image generation as a fallback provider and automated content-safety classification);
• Sentry (error monitoring, only if enabled, with personal content removed).

Stripe processes payments. Stripe is our processor for payment processing and an independent controller for its own legal obligations, such as anti-money-laundering checks and fraud prevention, under its own privacy policy.

We may disclose data to public authorities when we are legally required to. We do not sell personal data or share it with advertisers or data brokers.

Transfers outside the EEA

We aim to keep data in the European Economic Area. Our application servers are in Railway’s EU West region (Amsterdam), and the coach uses OpenAI's European data residency endpoint. Some providers, or their sub-processors, are established in or may access data from the United States or other countries outside the EEA, including OpenAI, Google, Cloudflare, Stripe, and Sentry.

Where data is transferred outside the EEA, we rely on an adequacy decision of the European Commission (GDPR Article 45), including the EU–US Data Privacy Framework for certified US recipients, or on the European Commission's standard contractual clauses (Article 46(2)(c)) with additional safeguards such as encryption in transit and at rest and contractual limits on retention and model training. You can ask us for a copy of the relevant safeguards at [email protected].

How long we keep data

• Anonymous sessions and their photos and images: 24 hours.
• Failed or abandoned image generations: 24 hours.
• Account data, photos, Future Forms, plan inputs, progress, and logs: until you delete them or your account.
• Coach replies: up to 24 hours. Voice audio: not stored.
• Security logs: up to 30 days unless an incident requires longer.
• Duplicate-request records: 24 hours.
• Accounting documentation: as required by bokføringsloven.

When you delete your account we delete your account data, stored files, and generated images from our systems, and remove your sign-in account. Backups are overwritten on a rolling basis and are not used to restore deleted data. We keep only a minimal record that a deletion took place, without its content, so that we can prove we complied.

Your rights

Under GDPR Articles 15 to 22 you have the right to:

• access your personal data and receive a copy (Article 15);
• have inaccurate data corrected (Article 16);
• have your data deleted (Article 17);
• restrict processing in certain cases (Article 18);
• receive the data you gave us in a structured, machine-readable format and have it transferred (Article 20);
• object to processing based on our legitimate interests (Article 21);
• withdraw consent at any time (Article 7(3)).

You can download your data and delete your account in the app settings. For anything else, write to [email protected]. We will respond without undue delay and within one month, which may be extended by two further months for complex requests; we will tell you if that happens (Article 12(3)). We may need to confirm your identity before acting on a request.

Automated decisions

Your plan and nutrition targets are calculated automatically by fixed, reviewed rules, and the safety screening automatically decides whether a plan can be offered. These decisions do not have legal effects or similarly significant effects on you within the meaning of GDPR Article 22. You can always ask for a person to review how a rule was applied to you.

We do not use your data for profiling for marketing, and we do not identify you from your face or body.

Children

LOCKEDTFIN is only for people aged 18 and over. We do not knowingly process data about children. Because the service is not offered to children, the special rules on a child's consent in GDPR Article 8 and personopplysningsloven § 5 do not apply. If you believe a child has used the service, contact us and we will delete the data.

Security

We protect your data with measures appropriate to its sensitivity (GDPR Article 32), including: private storage that is never publicly accessible, access restricted to your own account, encryption in transit, removal of photo metadata such as location before storage, strictly limited logging that excludes photos and message content, and regular testing. If a personal data breach is likely to result in a high risk to you, we will tell you without undue delay (Article 34) and notify Datatilsynet within 72 hours where required (Article 33).

Complaints

If you are unhappy with how we process your data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with a supervisory authority (GDPR Article 77). In Norway this is Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, datatilsynet.no. If you live in another EEA country, you may complain to the authority there.

Cookies and device storage

We use only the cookies and device storage needed to run the service and keep it secure. See Cookies and Device Storage for the full list.

Changes to this notice

We will update this notice when our processing changes. The version and effective date are shown at the top of the page. If a change materially affects you, for example a new purpose or a new category of recipient, we will tell you in the app or by email before it applies, and ask for new consent where required.