1. Who controls your data
Brain Boogerz, LLC (“we,” “us,” or “our”) is the data controller for personal data processed through FlexYin. This Notice explains what we collect, why we use it, who receives it, and the choices available to you.
2. Information we collect
- Account and profile data: name, email address, login credentials, and membership details.
- Fitness and wellness data: age, sex, height, weight, body-fat estimates, measurements, goals, activity, workouts, performance, injuries, movement limitations, medications and listed side effects, nutrition, allergies, hydration, progress photos, and body-visualization settings.
- Reflective check-ins: mood, energy, stress, HALT responses, and notes you choose to record.
- Communications: intake answers, support requests, and feedback.
- Usage and device data: pages and features used, timestamps, browser or device information, IP address, diagnostics, and security events.
- Purchase records: membership or session status, product, transaction identifiers, and renewal dates. Paddle collects and processes payment-card and billing details under its own privacy terms.
3. Why we use it and our legal bases
- To create your account, provide the app's tracking tools, personalize plans, display progress, process purchases, and deliver requested services — performance of our contract.
- To secure FlexYin, prevent fraud, troubleshoot, understand service use, improve features, and respond to support — our legitimate interests.
- To send optional communications or process information where consent is required — your consent, which you may withdraw.
- To keep financial, safety, and compliance records — our legal obligations.
Health and wellness information is sensitive. We process it to provide the features you request and, where applicable, on the basis of your explicit consent. FlexYin is not a healthcare provider, and information stored here should not be treated as an emergency or medical record service.
4. Photos, Apple Health and optional AI features
Adding a photo is optional. Your library is private to your account, not publicly posted or shared with other members. Selecting a file prepares it on your device; nothing is uploaded until you agree to AI review and tap Save & check photo. FlexYin creates a fresh JPEG, removes embedded camera details such as location and device information, and validates the prepared image before storage and review. This does not remove faces, tattoos, text or surroundings visible in the image. Your confirmed date and written note are stored separately.
Saving includes an AI standards check. We save the prepared photo in your private account, then send the image through Lovable AI to OpenAI to check clothing and photo standards—not to estimate body fat, assess health or fit your 3D outline. Provider processing and retention terms apply; private account access does not mean no service provider processes the image. Use an adult body-progress photo in posing trunks, shorts, a sports bra or fitted athletic wear. Nudity, see-through clothing, sexualised posing and images of anyone who appears underage are not accepted. Automated checks can make mistakes. Pending and unapproved photos remain in your library but cannot be selected for comparison. If a check cannot finish, retrying requests another check of the saved photo without uploading a duplicate. Older photos may still contain original camera metadata; no new AI review is requested just by viewing them.
Comparing needs a separate choice. Photos + measurements starts off. When you opt in, selected approved photos appear beside recorded weight, waist and chest from the exact photo date; missing values are not estimated or taken from nearby dates. Comparison sends nothing new to AI, makes no appearance-based health claims, does not change your plan and does not alter the measurement-based 3D outline. Unchecking, closing comparison or leaving the view clears your selection and comparison choice, not your saved records. Deleting a photo removes it from your library; it does not undo processing already completed by AI providers. Provider retention terms and the retention provisions below still apply.
If you authorize Apple Health access and import readings, selected steps, exercise, sleep, heart-rate and workout readings are saved to your private FlexYin cloud account to support your records and Goal Check. FlexYin does not write to Apple Health. You can revoke Health access in your device settings; previously imported records remain until you remove them or delete your account.
When you request an AI day plan, the details used may include your work and sleep schedule, chosen places, training, goals, dietary restrictions and saved planner notes. These details are sent through Lovable AI to OpenAI for the requested answer. Pose explanations send the pose name and guidance. These are optional requests, not human coaching. Provider retention and processing terms apply; FlexYin does not promise zero retention by every processor.
5. Who receives data
We share only what is reasonably needed with:
- Hosting, database, email, analytics, security, and customer-support providers that help run FlexYin.
- Lovable AI and OpenAI for the AI requests and photo review described above; Google for a requested nearby-place search.
- Paddle, our Merchant of Record, for product sales, subscription management, payments, tax compliance, invoicing, customer service, and refunds.
- Professional advisers such as legal and accounting providers.
- Authorities or other parties when required by law, needed to protect rights and safety, or involved in a legitimate business transfer.
We do not sell your personal information.
6. Retention
We keep personal data while your account is active and as needed to provide FlexYin. After closure, we retain records only as long as reasonably necessary for legal, tax, fraud-prevention, dispute, backup, and security purposes, then delete or anonymize them. Retention periods differ by record type and legal requirement.
7. Security
We use appropriate technical and organizational safeguards, including access controls, encrypted network connections, private storage rules. No online service can promise absolute security, so protect your password and tell us promptly if you suspect unauthorized access.
8. Cookies and similar technology
FlexYin uses essential browser storage and cookies for sign-in, security, session continuity, preferences, and payment functionality. We may use limited analytics to understand performance and improve the service. Where law requires consent for non-essential analytics or marketing cookies, we will ask before using them. You can manage cookies in your browser, though blocking essential cookies may prevent sign-in or checkout.
9. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your personal data; object to certain processing; withdraw consent; or appeal a decision. You may also have the right to complain to your local data-protection or consumer-protection authority. We may need to verify your identity before completing a request.
10. International transfers
Our providers may process data outside your state or country. Where UK or EEA law applies, we use recognized safeguards such as adequacy decisions or standard contractual clauses. UK and EEA users may exercise GDPR rights including access, rectification, erasure, restriction, portability, objection, consent withdrawal, and complaint to a supervisory authority. We aim to respond within one month where GDPR applies.
11. Updates and contact
We may update this Notice as FlexYin or the law changes. We will post the revised effective date here. To ask a privacy question or exercise your rights, email flexyinapp@gmail.com.