Privacy Policy

1. Information we collect

• Account information, such as your username, email address, account identifiers, optional profile picture, optional profile bio, and your app language or locale preference.
• Sign-in information handled by AWS Cognito and, if you choose one, Google or Apple. Braced does not receive or store your plain-text password.
• Workout and fitness information you enter, including sessions, dates, exercises, templates, notes, sets, repetitions, weight, duration, distance, statistics, and personal records. This information may reveal details about your fitness or physical health.
• Your privacy choices, including your profile visibility setting and the visibility setting saved on each workout.
• Social activity, including who you follow, who follows you, pending follow requests, workouts you like, and comments you write. Comments can be up to 2,000 characters and are written by you.
• Safety information, including accounts you have blocked and reports you submit about a workout or an account. A report records your account, the reason you selected, anything you added, and which content it referred to.
• Media you choose to upload, such as profile pictures, photos attached to a workout, exercise images or demonstrations, and images attached to feedback.
• Notification information, including the push token issued by your device, its platform, your language, your notification preferences, and the in-app notification history generated by social and subscription events.
• Feedback and support information, including messages, problem reports, suggestions, reference links, optional attachments, and diagnostic context supplied by your device such as app version, platform, operating-system version, and timezone.
• Subscription information, such as product and store identifiers, entitlement status, renewal or expiration status, purchase environment, management URL, and related transaction or event identifiers. Braced does not receive your full payment-card details.
• Network, request, and security metadata automatically processed by our hosting and authentication providers. Depending on their systems and settings, this may include IP address, browser or device user-agent, request details, timestamps, and error or security information. Braced does not store IP addresses or user-agent strings in its own database, and does not use this information for advertising.

2. Sources and device permissions

We receive information directly from you, generate information through your use of Braced, receive information about you from other users when they follow, like, or comment on your content, and receive limited information from service providers such as identity providers, app stores, and RevenueCat.

Braced asks for camera or photo-library access only when you choose to take or select an image, and for notification permission so it can send the alerts described in this policy. You can change these permissions in your device settings at any time. The current app does not access precise location, contacts, HealthKit, Health Connect, or advertising identifiers. Braced does not collect your age, date of birth, gender, height, or body weight, and has no field for them.

3. How we use information

• Create and secure your account and authenticate sign-ins.
• Store, synchronize, and display your workouts, templates, media, and statistics across supported devices.
• Operate the social features you choose to use, including your profile, search, following, the feed, likes, and comments.
• Show your content to the people you have chosen to show it to, according to your profile and workout visibility settings.
• Send the notifications you have not turned off, and remember which ones you have already seen.
• Keep Braced safe: check uploaded images automatically before storing them, review reports, act on content that breaks our rules, and enforce blocks between accounts.
• Generate advanced statistics and AI training insights when you request them, and review the quality of those insights as described below.
• Provide workout templates and exercise content created by Braced in your selected app language, and keep your custom templates private to your account.
• Verify purchases, maintain subscription access, prevent fraud, and process billing-related events.
• Respond to feedback and support requests.
• Operate, troubleshoot, secure, and improve Braced, and comply with legal obligations.

4. Social features and what other people can see

Braced has two separate visibility settings, and it is important to understand how they combine. Your profile visibility controls who can find and view your profile. Each workout also carries its own visibility. Your profile setting can only narrow what a workout reaches, never widen it.

Profile visibility

• Public: anyone signed in to Braced can find you in search and view the workouts you have shared.
• Private: you approve each follower, and only approved followers can see your workouts. Your username, profile picture, bio, join date, and follower, following, and workout counts remain visible to others, and you still appear in search.
• Hidden: you do not appear in search or in anyone's follower lists, and social features are turned off for your account.

New accounts start as Private. You choose your visibility when you first set up your profile and can change it later in Privacy Settings. If you switch from Private to Public, any follow requests still waiting for your approval are accepted automatically and those people are notified.

Workout visibility

• Everyone: visible to any signed-in user who can view your profile.
• Followers: visible only to people who follow you.
• Only me: never shown to anyone else.

New workouts default to Everyone. This means that if you set your profile to Public, each workout you record is visible to any signed-in Braced user unless you change that workout's visibility. You can change a workout's visibility at any time, including after you have shared it.

What a shared workout reveals

When someone can see one of your workouts, they can see its name, date, duration, exercises, sets, repetitions, weight, distance, any photo you attached, and its like and comment counts. Your private workout notes are never shown to other users, and neither is your email address or your internal account identifier.

Anyone who can see a workout can also see the full list of people who liked it, and every comment on it together with the commenter's username and profile picture. Your follower and following lists are not browsable by other people, but follower and following counts are visible on your profile, and liker lists and comment authors can reveal parts of who follows whom.

Search matches usernames only. Your email address is never searchable and is never shown to other users. Braced does not have a public web profile: your content is visible inside the app to signed-in users who meet your visibility settings, and Braced does not publish it to search engines.

If you use the share card to post a workout outside Braced, the image includes your username, workout name, date, statistics, and a highlighted muscle map. Once you share that image with another app or person, this policy no longer controls where it goes.

5. Safety, moderation, and reporting

Automated image checks

Every image you upload — profile pictures, workout photos, and custom exercise images and demonstrations — is checked automatically before it is stored. Braced sends the image to Amazon Rekognition, an automated image-analysis service, which returns categories describing what it detects. Images that appear to break our Community Guidelines are refused and never stored, and you are told the image could not be used. If the check cannot be completed, the upload is refused rather than allowed through unchecked.

This check is automated, and no person at Braced looks at your image as part of it. Amazon Rekognition processes the image in Ireland, which may differ from the region where the rest of your data is stored. Images attached to feedback are not put through this check.

Reporting

You can report a workout or an account from its menu, and choose a reason. Reports are anonymous to the person you report: we never tell them that they were reported or who reported them. We do keep the report linked to your account, together with the reason, anything you added, and which content it referred to, so that we can review it, recognize repeat problems, and avoid the reporting tool being misused.

Submitting a report does not automatically remove or hide the content. It sends the report to us for review. If you want to stop seeing someone immediately, block them.

Blocking

Blocking is mutual and takes effect immediately. Neither of you can see the other's profile or workouts, neither of you appears in the other's search results, and any follow relationships between you are removed in both directions. The person is not notified that you blocked them. You can unblock from Settings; unblocking restores visibility but does not restore the follows, so either of you would need to follow again.

Enforcement and child safety

When we review reported content, we may remove it, remove an uploaded image, limit a feature, or suspend or terminate the account responsible. We keep a record of reports and of the action taken.

We have zero tolerance for content that sexualizes or endangers minors. Where we identify such content we remove it, act against the account, and report it to the relevant authorities as required by law. Records we create about a child-safety incident are kept separately from your account, and are retained even if the account involved is deleted, because we are required to preserve them.

6. AI training insights

When you request AI analysis, Braced assembles a limited snapshot of your workout statistics on its own servers, including training frequency, exercise performance, equipment and muscle distribution, personal records with their dates, and trends. The snapshot and your timezone offset are sent to OpenAI to generate the analysis. The snapshot is deliberately built without direct account identifiers: it does not include your name, email address, account identifier, workout notes, or payment information. Names you gave to custom exercises are included, so avoid putting personal details in them. Braced instructs OpenAI not to retain the response for its own purposes.

Braced stores generated insights so you can view them again and to limit repeated AI requests.

Braced also keeps a diagnostic record of each AI request, linked to your account, containing the instructions sent to the model, the statistics snapshot, and the model's response. We use these records to check the quality of the feature and improve it. They are kept until you delete your account.

AI output can be incomplete or inaccurate and is provided for general information only, not as medical advice.

7. Service providers and disclosures

We disclose information when needed to provide Braced, complete transactions, protect the service or its users, respond to legal process, or comply with law. Separately from these providers, information you choose to share through the social features is disclosed to other users as described in section 4. We require providers that process information on Braced's behalf to protect it consistently with this policy and applicable law. Current providers include:

• Amazon Web Services, including Cognito, Lambda, API Gateway, database hosting, S3 file storage, CloudFront content delivery, logging, and email delivery. Braced's servers and database are hosted in the European Union.
• Amazon Rekognition, which automatically checks images you upload before they are stored, as described in section 5. This service processes images in Ireland.
• OpenAI, for the workout analysis described above.
• Expo, which relays push notifications from Braced to Apple and Google for delivery to your device.
• Cloudflare and Google, which route and host the support mailbox that receives feedback you submit.
• RevenueCat, for subscription entitlement and purchase-event management.
• Apple and Google, for app distribution, store purchases, renewals, cancellations, refunds, and push-notification delivery.
• Google or Apple, if you use the corresponding sign-in option.

Notifications sent to your device include the username of the person who triggered them, and a comment notification includes a short excerpt of the comment. That content passes through Expo and then Apple or Google in order to reach your device, and may appear on your lock screen.

App stores and identity providers may also process information under their own privacy policies. We do not sell personal information, share it for cross-context behavioral advertising, or include third-party advertising SDKs in the current app.

8. Tracking and Do Not Track

Braced does not track your activity across other companies' apps or websites for advertising. The app contains no analytics, advertising, attribution, crash-reporting, or session-replay software of any kind. The mobile app does not respond to browser Do Not Track signals because it does not perform that kind of tracking. Other parties do not collect personal information through Braced for cross-service advertising.

9. Storage, retention, and deletion

Braced keeps local app data on your device and synchronizes account data to its backend. Account and workout information is kept while your account is active. AI results and diagnostic records, feedback, technical logs, security records, and subscription records are kept according to operational, quality, fraud-prevention, dispute-resolution, accounting, and legal needs.

When you delete an individual item such as a workout, a comment, or a like, or when you unfollow someone, Braced marks the record as deleted and stops showing it. The underlying record, including the text of a deleted comment, is retained on our servers so that deletions can be synchronized to your other devices. These records are erased when you delete your account.

Photos are kept even after the workout they belong to is deleted or the photo is replaced, and are erased when you delete your account. Media is delivered through a content-delivery network. Links to workout photos are time-limited, but a link that has already been issued keeps working until it expires, and links to profile pictures are not time-limited. Anyone who has such a link can open the image while it is valid, including someone who could see it before you changed a visibility setting or removed them as a follower. Your device and the network may also keep cached copies for a period.

Blocks are kept until you unblock the person. Reports are kept while we review them and afterwards, so that we can recognize repeat problems. Because a report is about someone other than the person who filed it, deleting an account does not delete the reports that account submitted or the reports made about it. Records about a child-safety incident are held separately from your account and are retained even if the accounts involved are deleted, because we are required to preserve them.

Clear Local Data removes local app records but does not delete synchronized server data or your account. Delete Account permanently removes your Braced account and associated data from our active systems, including synchronized workouts, custom exercises and templates, uploaded media, your bio, your followers and the people you follow, your likes and comments including those left on other people's workouts, the blocks you have set, your notifications and notification devices, your notification preferences, feedback and attachments, stored AI results and AI diagnostic records, and Braced subscription records. Deletion is immediate and cannot be undone; there is no grace period or recovery window.

Some things are not reached by account deletion. Reports you submitted are kept, but are no longer linked to you. Reports about your account are also kept, and so are records about a child-safety incident, as described above. Technical and security logs generated by our hosting provider may still contain account identifiers such as your username, email address, or internal account identifier, and are retained for operational and security purposes. Feedback you have already submitted has been emailed to our support mailbox, and that copy remains in the mailbox. Routine backup copies may also remain temporarily until they are overwritten and are used only for disaster recovery, security, or legal compliance.

We also delete the customer profile associated with your Braced account from RevenueCat. This does not cancel an active app-store subscription or erase purchase history held by Apple or Google. If you later create a new Braced account and restore purchases, the store may provide the purchase again and RevenueCat may create a new customer profile. App stores and identity providers retain their own records under their policies.

10. Security and international processing

We use reasonable technical and organizational safeguards, including authenticated API access, managed cloud infrastructure, and restricted storage for uploaded files. No system can guarantee absolute security.

Braced's servers and database are located in the European Union. Braced and its providers may process information in countries other than your own, including the United States, where OpenAI, RevenueCat, Expo, Apple, and Google operate, subject to applicable legal safeguards.

11. Your choices and privacy rights

You can update your profile information, change your profile and workout visibility, approve or remove followers, delete your likes and comments, manage notification preferences in the app and device permissions in your system settings, manage subscriptions through the store, clear local data, or delete your account from Settings. Depending on where you live, you may also have rights to access, correct, delete, restrict, object to, or receive a copy of personal information; withdraw consent; appeal a denied request; and complain to a privacy or data protection authority.

Braced does not currently offer a self-service data download in the app. If you would like a copy of your personal information, contact us and we will provide it in a portable format.

Workout information and derived fitness insights may qualify as consumer health data under some laws. Where those laws apply, you may have additional rights concerning the collection, sharing, withdrawal of consent, and deletion of that information. See the Consumer Health Data Privacy Policy.

Contact us to exercise a right or ask a privacy question. We may need to verify your identity before completing a request, and we will not discriminate against you for making a privacy request.

12. Legal bases for EEA and UK users

Where the GDPR or UK GDPR applies, we process information as needed to provide the service you request, including operating the social features you choose to use; comply with legal obligations; and pursue legitimate interests such as securing and improving Braced. We rely on consent when it is the appropriate legal basis, including for optional device permissions such as camera, photo library, and notifications. Where workout information is treated as health data, we rely on your making it manifestly public or on your explicit consent when you choose to share it with others. You may withdraw consent through device settings, by changing your visibility settings, or by contacting us, without affecting earlier processing.

13. Children

Braced is not intended for children under 13, and we do not knowingly collect personal information from them. If the law where you live requires a higher minimum age to use an online service without parental authorization, that higher age applies. Because Braced lets people share photos and write comments that other users can see, we ask parents and guardians to be aware of how their child uses social features. If you believe a child has provided personal information contrary to this rule, contact us so we can investigate and delete it.

14. Changes and contact

We may update this policy as Braced changes. We will update the effective date and provide additional notice of material changes when required.

Privacy contact: Airat Akhmadullin, operator of Braced. Email privacy@getbraced.app.