Privacy Policy

Levl is a workout and nutrition tracker with an AI coach. This policy explains exactly what data we collect, why, who processes it on our behalf, and the control you have over it. We keep this policy, our App Store privacy label, and our sub-processor list in lockstep.

1. What we collect

• Account & identity — email, display name, and profile photo, via Firebase Auth (including Google or Apple sign-in).
• Health & fitness — workouts, sets, reps, weights, routines, body weight, and your strength score.
• Nutrition — food logs, macros and calories, and barcode scans.
• Social — posts, follows, kudos, and shareable graphics you create.
• Device — push-notification tokens and crash/diagnostic data.
• Purchases — your subscription status. Billing is handled by Apple; no card data ever touches our servers.

2. How we use it

We use your data to run the app you signed up for: to store and display your training and nutrition, calculate your strength score, power social features you opt into, deliver notifications you enable, and generate your AI coaching insights. We do not use your data for advertising, and we never sell your personal data.

3. AI coaching

Levl’s coach generates insights on request by sending an anonymized, aggregated summary of your recent training and nutrition context to our AI provider (Anthropic’s Claude API). Insights are produced per-request. Anthropic does not use data sent through its API to train its models, and Levl never uses your data to train any model.

Levl’s insights are general fitness guidance, not medical advice. Always consult a qualified professional before making significant changes to your training or diet.

4. Who we share it with

We use a small set of trusted sub-processors to run the service. Each receives only the data needed for its purpose:

Sub-processor	Purpose	Data	Region
Firebase (Google)	Auth, push (FCM), crash reporting	Identity, device tokens	US / global
Anthropic	AI coaching insights	Anonymized training + nutrition context	US
Open Food Facts	Food database lookups	Food queries (no PII)	EU
FatSecret	Food database lookups	Food queries (no PII)	US
AWS S3 + CloudFront	Image storage & delivery	Uploaded images	eu-north-1
Railway	App & API hosting	All app data	EU
RevenueCat + Apple	Subscription management / IAP	Purchase status	US

5. Your rights & controls

Export your data

Download a complete, machine-readable JSON of your account anytime from Settings → Privacy → Export my data (GDPR Art. 15/20; CCPA right to know).

Delete your account

Delete from Settings → Account → Delete account. Your account is locked immediately, then enters a 30-day grace period during which you can recover it by signing back in; after that, your data is permanently purged. Content you contributed to the community (such as shared foods) is anonymized, not orphaned. See our deletion guide.

Regional rights

Depending on where you live (e.g. the EU/UK under GDPR, or California under CCPA), you may have rights to access, correct, port, or delete your data, and to object to certain processing. Email privacy@levl.fitness to exercise any of these.

6. Security & retention

Data is encrypted in transit with TLS 1.3 and at rest with AES-256. We retain your data for as long as your account is active. When you delete your account, we purge it after the 30-day grace period, except where we’re required to retain limited records by law.

7. Children

Levl is rated 17+ and is not directed to anyone under 17. You must be at least 17 to use Levl. We do not knowingly collect data from anyone under 17; if you believe someone under 17 has provided us data, contact us and we’ll remove it.

8. Changes & contact

We’ll update this policy as our practices change and revise the “last updated” date above; material changes will be highlighted in-app. For any privacy question or request, email privacy@levl.fitness.