How ApexOne handles data

Information We Use

ApexOne may use the following information when you choose to use those features:

• Account and profile details, such as email address, display name, age/date of birth, gender, height, weight, strength level, schedule, and privacy settings.
• Training data, including plans, workouts, exercises, sets, personal records, and training diary entries.
• Nutrition data, including goals, food logs, meal notes, and selected meal photos used for food scanning.
• Images you choose to send to Luna for coaching, optional profile images, and photos you choose to post as Social Daily Proof or Stories.
• AI messages, plan edits, generated recommendations, user approvals, and decision history.
• Social and proof data, including terms acceptance, reports, blocks, group activity, and verified effort.
• Push notification tokens, delivery status, and notification preferences.
• Purchase and entitlement status from Apple, Google, RevenueCat, or other payment systems used by the app.
• Security and reliability metadata, such as user id, request ids, rate-limit events, webhook logs, and limited deletion audit records.

How Luna Uses Data

Luna uses approved training, nutrition, schedule, recovery, and context signals to explain your day, draft plans, and suggest actions. Meaningful changes, such as plan edits, reminders, nutrition targets, social posts, or purchases, should require user review before they are saved or shared.

Depending on the request, Luna uses Anthropic Claude, OpenAI, or Google Gemini as third-party AI providers; food and selected-image analysis use Google Gemini. Before ApexOne sends personal data to any of these providers, the app names them, explains the categories of data involved, and asks for your explicit permission. If you consent, ApexOne may send the messages, training, nutrition, recovery, schedule context, and images you deliberately provide that are needed to answer your request. You can decline or turn off third-party AI processing in the app; Luna and AI food scanning will then remain unavailable until you consent again. ApexOne does not use your consent for advertising or cross-app tracking.

Health, Wearables, And Fitness Safety

ApexOne is a fitness planning and logging product. It is not emergency care, diagnosis, treatment, or a substitute for a qualified professional. Wearable, sleep, calendar, HealthKit, and Health Connect imports are not active in this launch build. If a future version adds a supported source, ApexOne will request permission before collecting it.

Photos And Food Scans

Food images are sent through ApexOne's protected server flow to Google Gemini only when you choose to scan a meal and have consented to third-party AI processing. Images you choose to send to Luna use the same protected flow only when you choose that feature and have consented. Before publishing a profile image or Social Daily Proof/Story, ApexOne identifies Google Gemini and asks for permission to send that image for an automated safety check; images that cannot be checked or do not pass are not published. Approved profile and Social images are processed and stored using Cloudflare media services so they can be shown to the audience you select. Image-based nutrition is an estimate, and users should review the result before saving.

Service Providers

ApexOne uses service providers to run the app, including Supabase for authentication, database, and server functions; RevenueCat, Apple, and Google for purchase and entitlement handling; Expo for push notification delivery; Anthropic Claude, OpenAI, and Google Gemini for consented server-side coaching; Google Gemini for food-scan model calls, selected-image analysis, and user-approved image safety checks; Cloudflare for Social image processing, storage, and delivery; and a public web host for policy pages. ApexOne does not sell personal data and does not use advertising ID or cross-app tracking in the launch scope.

Security And Retention

Public mobile clients must only use publishable keys. Server secrets, model keys, service-role credentials, webhook secrets, and payment secrets belong on protected servers. ApexOne may keep limited security, diagnostic, rate-limit, webhook, and deletion audit records to protect accounts, prove deletion handling, and operate the app reliably. Those records are not used for advertising or tracking.

Account and feature data is retained while needed to provide the account and the features you use. An account deletion request starts deletion or de-identification of account content from ApexOne systems, subject to limited records that may be retained when needed for security, fraud prevention, legal compliance, or proof that the request was completed. Deleting an ApexOne account does not itself cancel an App Store or Google Play subscription, which must be managed with the store account used to purchase it.

Your Choices

• You can change notification preferences in the app.
• You can decline or turn off third-party AI processing in the app.
• You can use privacy-first defaults before public sharing.
• You can report and block users in Social.
• You can request account deletion in the app, or use the public account deletion request page if you cannot sign in.

Contact

For privacy, account, or data requests, contact info@appapexone.com.