Privacy Policy

Depending on the features you use, we collect:

• Account and contact data, such as your email, username, display name, profile photo, age information, support messages, and contact-form submissions.
• Fitness and health data, such as workouts, routines, body measurements, nutrition, hydration, fasting, goals, progress, and health-integration data you choose to connect.
• Content you submit, including notes, AI prompts, meal or progress photos, body-scan photos, custom exercises, and optional social content.
• Service and transaction data, such as subscription status, referral or creator attribution, feature settings, notification tokens, and Workout Buddies activity.
• Technical, safety, and website analytics data, such as app version, pages viewed, referring site, campaign parameters, approximate country or region, device and operating-system information, browser type, security identifiers, crash reports, and limited diagnostic records.
• Advertising and subscription measurement data, such as Apple Ads attribution, app-install and app-session events, campaign parameters, IP address, IDFV, an internal account identifier, device model, operating-system and app version, user agent, network information, and limited trial, purchase, renewal, refund, and revenue events. Buffro configures Singular to limit advertising identifiers and third-party data sharing. RevenueCat may collect a device-provided IDFA if it is available because tracking permission was granted to an older Buffro version. Apple Ads attribution may operate without ATT through Apple's AdServices framework.

The Site uses PostHog to measure clicks on app-store download buttons. These events include the public page path, button position, selected platform, and a random temporary identifier held only in page memory. PostHog also receives and may retain the connection's IP address; location enrichment is disabled for these events. This measurement does not use cookies or track visitors across unrelated websites, create account-linked profiles, or record browsing sessions. It respects Do Not Track and Global Privacy Control signals. The Site does not use advertising pixels or cross-site behavioral tracking. The iOS app separately uses Apple Ads attribution and Singular to measure installs, sessions, and subscription outcomes. Singular may exchange limited attribution and conversion information with advertising partners such as Meta as described in this policy.

We use personal data to:

• create and secure accounts, sync and restore data, and provide the features you request;
• generate AI responses, meal estimates, routines, and body-scan results when you choose those features;
• manage subscriptions, referrals, optional social features, notifications, support, and fraud prevention;
• understand which public pages and campaigns are useful, improve website performance, and measure aggregate referral traffic;
• diagnose crashes, maintain service reliability, enforce our Terms, and comply with law; and
• measure Apple Ads and other paid-acquisition performance, and connect installs, sessions, and subscription outcomes through Singular and RevenueCat, including limited Meta campaign measurement.

Our legal bases, where required, are performance of our contract, compliance with law, our legitimate interests in operating and protecting Buffro, and your consent for optional health access or other processing that requires consent. You may withdraw consent through the relevant setting or by contacting us. Withdrawal does not affect processing already completed lawfully.

We do not sell personal data. We do not use or disclose workout, nutrition, health-integration, body-scan, progress-photo, or AI content for third-party advertising.

Apple Health and Health Connect are optional. If you enable an integration, Buffro reads only the permissions you approve. These may include weight, height, body-fat percentage, lean body mass, heart rate, energy, and exercise data. Imported body measurements are stored with your Buffro records and may sync to your Buffro account. Heart-rate and energy data are used to calculate workout estimates; Buffro does not use health data for advertising.

If you enable workout export, Buffro writes workout time, type, and available calorie information to your selected health store. You can disconnect the integration in Buffro or revoke permissions in your device settings. See our concise Consumer Health Data Privacy Notice.

We disclose data only as needed to operate Buffro, at your direction, or when legally required. Our main service-provider categories are:

• Cloud operations: hosting, database, authentication, and account-security providers.
• Website analytics: PostHog processes the limited download-button events described above. Event payloads exclude query parameters, account identifiers, form contents, and health data.
• AI processing: model providers receive relevant prompts, context, or images only when you use an AI feature.
• Food information: nutrition-database providers for search, barcode, and food lookups.
• Purchases and subscriptions: app stores and RevenueCat process subscription status and limited trial, purchase, renewal, refund, and revenue events. RevenueCat may forward limited subscription outcomes and device identifiers to Singular for attribution.
• Apple Ads attribution: Apple may provide ad-attribution data through AdServices. This attribution does not require ATT permission.
• Advertising attribution: Singular processes app-install and session data, IDFV, an internal user ID, device and network information, and limited conversion and subscription data to measure campaigns. Singular may exchange limited attribution information with connected advertising partners such as Meta. Buffro configures Singular to limit advertising identifiers and third-party data sharing.
• Meta Ads attribution: Buffro disables the direct Meta SDK's automatic initialization, app-event logging, and advertising-identifier collection. Meta campaign measurement is handled through Singular and Apple's privacy-preserving attribution mechanisms.
• Advertising-content limits: we do not share workout, nutrition, health-integration, body-scan, progress-photo, or AI content for advertising.
• Diagnostics: crash and reliability providers configured to limit personal information.
• Messages and support: email, form-delivery, and internal support-channel providers.
• Delivery: device-platform notification providers when you enable notifications.

We may also disclose information to professional advisers, a buyer in a corporate transaction, or authorities when reasonably necessary to protect rights, safety, and the service or to comply with law. We do not give service providers permission to use Buffro health data for their own advertising.

AI features process the prompt, photo, and relevant fitness context needed to answer your request. Do not submit emergency, medical-record, or third-party confidential information. AI outputs can be wrong and are not medical advice.

Photos are uploaded only when you choose a feature that needs them or save them to your account. Workout Buddies is opt-in and shares only the profile or summary information allowed by your settings. It does not expose your underlying workout sets, body measurements, nutrition logs, AI chats, or account email to buddies.

Core records are available locally for offline use. Data needed for backup, account features, subscriptions, social features, or support may also be stored by our cloud providers. We use encrypted connections, access controls, and database security rules, but no system is risk-free.

We keep account content while your account is active. When you delete your account in the app or ask us to delete it, we delete or de-identify account data from active systems within 30 days, except information we must retain for security, disputes, tax, payment, or other legal duties. Provider backups and store transaction records may remain for a limited period under their retention cycles. Local-only data remains on a device until you delete it or uninstall Buffro.

Subject to applicable law, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. You can manage health access, notifications, photos, Workout Buddies sharing, and other optional features in the app or device settings. You may also complain to your local data protection authority.

Buffro's current iOS attribution design does not ask you to grant App Tracking Transparency permission. Singular is configured to limit advertising identifiers and third-party data sharing, and the direct Meta SDK's automatic app-event and advertising-ID collection remain disabled. If you granted tracking permission to an older Buffro version, you can revoke it in Settings > Privacy & Security > Tracking. Apple Ads, SKAdNetwork, and other limited attribution can continue without ATT permission. These choices do not block Buffro's core features, and changing them does not automatically erase records already sent to service providers.

Email support@buffro.app from your account address to make a privacy request. We may verify your identity and may deny or limit a request where law permits. Authorized agents must provide proof of authority.

Buffro is operated from Indonesia and uses providers that process data in other countries. Where required, we use contractual or other lawful transfer safeguards. Those countries may have different data protection rules from your home country.

Buffro is not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has created an account, contact us and we will investigate and delete the data where required. Users between 13 and 18 should have parent or guardian permission before creating an account.

We may update this policy as Buffro or the law changes. For material changes, we will provide reasonable notice and request consent again where required. The date above shows the current version.

The data controller is PT DUO DIGITAL INTERNASIONAL, Indonesia. Questions or requests can be sent to support@buffro.app or through our Contact page.