What we collect

When you create an account, we collect your name, email address, and the fitness and nutrition information you provide during onboarding (height, weight, goal weight, activity level, health conditions you choose to disclose, and dietary restrictions). We also collect your workout logs, meal plan selections, and chat session data to power your personalized coaching experience. Depending on the features you choose, we may also collect progress photos, mood, sleep, water, cycle, wearable, medication, supplement, injury, symptom, and other health or wellness information you disclose. We collect usage data (app activity, session frequency, feature usage) to improve the product. We do not collect full payment-card information directly. Billing is handled by Stripe, our payment processor.

Consumer health data

Our separate Consumer Health Data Privacy Policy explains the health-data categories BFF collects, where they come from, why they are used, the processors involved, and how to access, delete, or withdraw consent. Read it at /health-data-privacy. We do not sell consumer health data, use it for targeted advertising, or use health-care-facility geofences.

How we use your data

Your data is used to operate, personalize, support, secure, and improve BFF. This includes personalizing your meal plans and workout programs, giving Rosie relevant context from information you shared, calculating your nutrition targets, providing customer support, preventing abuse, and analyzing product usage. We do not use your health or body data for advertising or sell it. We share personal data with the service providers required to operate BFF as described below.

Optional analytics and advertising

On a limited set of public marketing pages, BFF may offer you a choice to allow PostHog analytics and Meta or TikTok advertising measurement tools. These optional tools stay off until you choose "Allow optional tracking." They do not load inside your account, on authentication or billing pages, or on health-data pages. BFF currently keeps identified server-side PostHog tracking off unless BFF has separate server-side evidence of permission. Your choice is saved in your browser. You can reopen Privacy choices on a public marketing page and change it. Keeping optional tracking off does not limit your use of BFF.

Email choices

Submitting a quiz does not automatically give BFF permission to send marketing email. Marketing permission uses a separate unchecked choice. Every marketing sequence includes an unsubscribe link and supports one-click unsubscribe. When you unsubscribe, BFF stops the sequence named in the signed link and creates a global suppression record. The suppression record contains a keyed one-way hash, the reason, the source sequence, and timestamps. It does not contain your email address. BFF keeps that minimal record so the same address is not added to another marketing sequence by mistake.

AI coaching and chat

Your chat history with Rosie is stored so BFF can use relevant details in later conversations. Chat content is processed by third-party AI services required to provide Rosie's responses and requested AI features. BFF does not use your chat content to build advertising profiles. BFF is not a medical service. Your AI coach does not provide medical advice, clinical nutrition counseling, or mental health treatment. If you disclose a medical condition, she will recommend you consult your healthcare provider.

Data sharing

We disclose personal data to service providers that operate BFF and, only after your public-page tracking choice, to optional measurement providers: • Supabase (database and authentication) • AI service providers (power Rosie and other AI features) • Stripe (payment processing) • Vercel (hosting and infrastructure) • Resend (email delivery) • hCaptcha (abuse prevention on signup and email forms; processes your IP address to tell humans from bots) • Sentry (error monitoring and security diagnostics) • PostHog, Meta, and TikTok (optional public-page measurement only after your choice) These providers process data under applicable contracts and their privacy terms. The data each provider receives depends on the feature being provided. We do not sell personal data.

Your rights

You have the right to access, correct, or delete your personal data at any time. You can export a copy of your data from your profile page. To request deletion of your account and associated data, use "Delete my account" in your profile or email us at hello@rosiethebffgirl.com. If you are located in the European Union or United Kingdom, you may have additional rights including access, correction, deletion, portability, restriction, objection, and the right to lodge a complaint with a supervisory authority. California residents may have rights to know, correct, delete, and limit certain uses of personal information. Washington and other covered consumers may have additional consumer health-data rights described in our Consumer Health Data Privacy Policy. We do not sell personal or consumer health data.

Data retention

We retain account data while your account is active and as needed to provide the service. When you use Delete my account, BFF first confirms every Stripe subscription and schedule is stopped, then deletes account data, files, connected-service tokens, and the authentication identity. Processor, archive, and backup deletion can take longer where technically necessary and as permitted by applicable law. We retain limited billing, refund, dispute, referral-credit, security, and deletion records when needed for tax, accounting, fraud prevention, dispute resolution, or legal compliance. Stripe controls retention in its payment systems. BFF retains privacy-minimized keyed identity and transaction records while it offers one-time trials, referral credits, or guarantees and for a reasonable wind-down period. BFF retains the keyed marketing-suppression hash until you expressly opt back in or BFF no longer needs it to honor the opt-out. These records are not used to reconstruct your health profile.

Security

Your data is stored in Supabase. Row-level security restricts ordinary member access to authorized records, while tightly controlled service access is used for operations such as billing, deletion, support, and security. Data is encrypted in transit using TLS and protected at rest by our infrastructure providers. We use Supabase Auth for authentication and apply access controls, logging, and security reviews appropriate to the service. No security system is perfect. If you discover a security vulnerability, please report it to hello@rosiethebffgirl.com.

Contact

Questions, privacy requests, consent withdrawals, appeals, or security concerns can be sent to hello@rosiethebffgirl.com. BFF, 1154 Orchard Ave SE, Grand Rapids, MI 49506. BFF is the data controller for the personal information described in this policy. Last updated: July 22, 2026.