Privacy Policy — Android

This policy covers the Buff Meter Android app. It exists separately from our iOS privacy policy because the Android app handles some data differently: it can read your weight from Health Connect, it registers for push notifications, and — unlike the iOS app, where your data stays in your own iCloud account — it keeps a copy of your profile, scan results, and daily check-ins on our servers.

Photos and Images

Scan photos and goal images are stored on your device. You take photos with your camera or choose them with the Android photo picker, which gives the app access only to the images you select — the app never requests access to your whole photo library.

When you analyze a scan or generate a goal visualization, the photo is sent to our servers and passed to the AI providers described below to produce the result. We do not keep those photos on our servers after the request completes, and photos are not included in sync: they stay on your device. The AI providers handle the photos they receive under their own data policies.

Health Connect

With your permission, the app reads your weight from Health Connect. It requests only one permission, to read weight, and it reads only your most recent weight entry. When you connect Health Connect during setup, that weight pre-fills the weight in your profile, which you can change before continuing. After that, when you open the app, it updates your profile weight if your most recent Health Connect weight has changed. The app does not write anything to Health Connect.

Your profile weight, whether it came from Health Connect or you typed it in, is used in the same ways as the rest of your profile: it is sent with your photos when you analyze a scan or generate a goal visualization, so that our servers and the AI providers described below can calculate your result, and it is synced to our servers as part of your profile and scan history.

Health Connect access is optional and is never required to use the app. Data obtained from Health Connect is used only to provide these features. We do not sell it, use it for advertising, or share it with anyone other than the service providers needed to provide these features, and we do not use it to determine credit, insurance, or employment eligibility. You can revoke access at any time in Health Connect or in Android system settings, and the app continues to work without it.

Notifications

Weigh-in and check-in reminders are scheduled on your device. If you allow notifications, Firebase Cloud Messaging assigns your installation a token, which the app may register with our servers so we can send you replies to feedback you send us. The token identifies the installation, not you personally. It stops working when you uninstall the app, and you can turn notifications off in Android settings at any time.

Purchases

Subscriptions are processed by Google Play. We use RevenueCat to check whether your subscription is active, and Superwall to show the subscription screen. Neither we, RevenueCat, nor Superwall receives your payment details — those stay with Google. RevenueCat receives your purchase history for the app, tied to the random device identifier described below. Superwall receives your device type, operating system version, language and app version, whether your subscription is active, and which subscription screens you see and act on.

Sync and Your Restore Code

Once you finish setting up your profile, the app syncs your profile (including your height, weight, age, gender, and goals), your scan results, your daily check-ins, and your feature usage counts to our servers, in the background every few hours while you have a connection. This lets your data survive losing or replacing your device. There is no setting to turn sync off; deleting your account, described below, removes the synced copy. Your data is identified by a random identifier generated on your device, not by your name, email, or any account.

To move your data to a new device, open Profile → Account → Transfer or Restore Data and generate a restore code, then enter it on the new device. Treat that code like a password: anyone who has it can restore your profile, measurements, and scan results. Codes work once and expire 15 minutes after being created.

The app is excluded from Android's own cloud backup and device-to-device transfer, so none of its data is copied by Android itself. Moving to a new device works only through the restore code.

Usage Data

We use PostHog to understand which features are used and where people get stuck. This covers screens viewed and actions taken, along with your device type, operating system version and app version, tied to the same random device identifier rather than to your identity. It contains no photos or measurements. Usage analytics is on by default, and you can turn it off at any time in Profile → Data Processing → Usage analytics.

We also use Firebase Crashlytics to diagnose crashes. When the app crashes it sends a crash report containing technical details such as the error, your device type, operating system version, and app version.

Analysis Providers

Body composition analysis and goal visualizations are produced using third-party AI services: Google Gemini, and OpenRouter, which routes requests to AI model providers. When you use these features, your photos and your profile details (height, weight, age, gender, activity level, and body fat estimate, as each feature needs) are sent through our servers to those services to generate a result. The app asks for your consent before it sends scan photos for body composition analysis, and you can withdraw that consent in Profile → Data Processing and still use the rest of the app.

To monitor quality and cost, our servers keep a log of each AI request: the text sent, which includes those profile details, and the text returned. Images are recorded only by type and size, never the image itself.

Reporting AI-Generated Content

You can report AI-generated results that are offensive, harmful, or inaccurate using the Report action shown next to them. A report sends a copy of the reported content (the text, or the generated image), a reference to the related scan, and your app version to our support team, tied to your random device identifier, so we can review it.

Data Retention and Deletion

Data stored on your device is removed when you uninstall the app. Data on our servers — your synced data, AI request logs, and support messages, including any photos you attach to feedback — is kept until you delete it.

You can delete everything from Profile → Account → Delete Account. Deleting your account first removes from our servers your synced profile, scans, check-ins, usage records, and restore codes, the AI request logs described above, and your support messages and AI content reports along with any images attached to them. It then erases all of the app's data and photos from your device. If our servers cannot be reached, nothing is deleted from your device and the app asks you to try again, so the server copy is never left behind.

You can also email us at [email protected] to request deletion of your data, and we will action it.

Your Rights

You can view your profile and scans and correct your profile in the app, and delete your data as described above. You can withdraw consent for Health Connect, notifications, usage analytics, or AI analysis at any time without losing access to the rest of the app. To request a copy of the data we hold about you, email us.

Age Requirement

Buff Meter is intended for adults aged 18 and over, and we do not knowingly collect data from anyone under 18. If you believe someone under 18 has provided us data, contact us and we will delete it.

Changes to This Policy

We will update this page when the app's data handling changes, and update the date above. Material changes will be surfaced in the app.

Contact Us

If you have questions about this privacy policy or your personal data, please contact us at [email protected].