Privacy Policy
Last updated: 15 November 2026
1. Who is responsible
Skyform is run by Mattia Zorzanello, based in Luxembourg, the “data controller” under the EU General Data Protection Regulation (GDPR). Contact: skyform.hq@gmail.com.
Skyform is for people aged 18 or over.
2. What we collect and why
Account. Your email address and sign-in method (email code, Apple or Google). Apple and Google share an account ID, your email (with Apple’s “Hide My Email”, a relay address) and your name, which we use to pre-fill sign-up. Legal basis: providing the service (Art. 6(1)(b)).
Profile. Name, date of birth, sex, height, weight, units, goal and training experience, to calculate your targets and plan. Legal basis: providing the service (Art. 6(1)(b)).
Health and fitness data. Body photos, body-fat estimates, weigh-ins, workouts, meals and food photos, nutrition plans, sleep from Apple Health (read only), and your messages to the Coach and Chef, to provide the tracking, plans and coaching you use. Nothing is collected unless you add it or connect Apple Health (iOS asks first). Legal basis: your explicit consent (Art. 9(2)(a)), which you can withdraw by deleting the data, your account, or Skyform’s access in the Health app.
AI features. The Coach, Chef, meal recognition, body-fat estimates and Potential picture use outside AI providers. The app asks your permission for each kind of data before anything is sent, and you can change it in Account > Privacy:
| You allow | Sent to |
|---|---|
| Body photos (with basic profile) | Google (Gemini), OpenAI |
| Food photos and meals | OpenAI |
| Training, food and sleep, and your messages | Anthropic |
The providers don’t use this data to train their models and may keep it for a limited time for abuse monitoring. Legal basis: your explicit consent (Art. 9(2)(a), Art. 6(1)(a)).
Usage and errors. Which screens and features you use, errors, crashes, app version and device model, stored in our own database, never containing health data, food names, messages or photos. Legal basis: our legitimate interest in keeping the app working and improving it (Art. 6(1)(f)).
Email. We send sign-in codes only.
No advertising, no selling of data, and no automated decisions with legal or similar effects.
3. Who processes your data
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Supabase | database, photo storage, sign-in | EU (Paris) | Standard Contractual Clauses |
| Anthropic | Coach, Chef | USA | Standard Contractual Clauses |
| OpenAI | meal recognition, Potential picture, recipe pictures | USA | Standard Contractual Clauses |
| body-fat estimate (Gemini), Sign in with Google | USA and other countries | EU-U.S. Data Privacy Framework | |
| Resend | sign-in emails | USA | EU-U.S. Data Privacy Framework |
| Apple | Sign in with Apple, app distribution |
All are bound by data processing agreements.
4. How long we keep data
Until you delete it or your account. When you delete your account (Account > Delete account), your data and photos are deleted immediately; backup copies are removed within 30 days. We keep only an anonymous count that an account existed. AI providers may keep requests for a limited time under their own terms.
5. Your rights
You can access, correct, export, delete or restrict your data, object to our analytics, and withdraw consent at any time. Write to skyform.hq@gmail.com; we answer within one month. You can also complain to a data protection authority, in Luxembourg the CNPD (cnpd.public.lu).
6. Changes
We update the date above when this policy changes and tell you in the app about important changes.