My Growth Modules
Privacy Policy
This policy explains what MGM collects, why, and how you can delete it. MGM is a personal growth app (nutrition, bodyweight, steps, friends). It is not a medical device and does not give medical advice.
1. Who is responsible
The person who operates My Growth Modules is the controller of your personal data. Contact: hello@mygrowthmodules.com (the Netherlands). We do not list a street address here. If you need one for a legal request, ask by email.
2. What we collect
- Account. Sign-in through Google or Sign in with Apple (name, email, and a Google or Apple user id). We do not receive your Google or Apple password. Apple may share a private relay email instead of your real address. Email-and-password login is not in the app yet.
- Profile. Display name, photo, optional bio, height, weight, age, sex at birth (for calorie estimates), country, language, units, and (if you add it) your own phone number so friends can find you from their contacts. Sex at birth is not shown on your public profile. Your address book is not stored: names and numbers from the phone are checked briefly and then discarded.
- Photos. Profile photo, optional bodyweight progress photos, optional meal photos you send to MGM AI, and photos you put on custom foods or meals. Cloud copies are stored in private file storage, not on a public website. In the updated Bodyweight photo flow, cloud backup is off until you choose to enable it; existing saved choices remain unchanged. Without cloud backup, progress photos stay on the device. When you take a photo inside MGM, the original is saved to your device's Photos library by default and MGM uses a separate processed copy inside the app. You can turn saving originals off in General Settings. A photo you select from the library is not added to the library again.
- Module logs. Food and water logs, custom foods and meals, weight logs, optional body-fat percentage, fat mass, explicitly labelled muscle or skeletal-muscle mass, fat-free mass and total body water with its reported unit, and optional body-circumference measurements that you enter. Body measurements are stored with the weight log and do not change your calorie plan. Step totals and manual step entries, and goals you set.
- Workout (where enabled). Fitness sessions, exercise names, sets, weights, repetitions, durations, rest settings, optional effort ratings and notes, and reusable routines. These records are private to your account and synchronize with our database. Your device retains account-separated offline records across sign-out so interrupted synchronization does not lose a training. Removing an item hides it while retaining a deletion marker and its saved record until account deletion. Workout does not send training records to AI, publish them to friends or write workouts to Apple Health.
- Health. During setup you can connect Apple Health so MGM can fill date of birth, sex, height and weight, count steps, and read individual workout records such as sport, source, time, duration, distance and active energy. You can also connect later in MGM Settings. MGM does not import Apple's general active-energy total. It queries steps in an exact workout interval to avoid counting the same movement twice. With optional Health permission, MGM can also read available workout-associated heart-rate summaries (average, minimum and maximum), ascent and descent, and sport-specific distance, speed, cycling power or cadence, and swimming strokes. These compact summaries are stored privately with the Nutrition log and synced to your account. MGM does not import raw heart-rate samples or GPS routes for this feature. Declining these optional measurements does not stop normal workout logging, and they are not automatically sent to AI. Imported workout rows remain visible in Nutrition; a setting controls whether their energy changes calorie and macro targets. With Nutrition connected, a new saved workout can produce a local device notification with its sport and calorie value; estimates and unavailable energy are identified. This notification is on by default when device notification permission is granted and can be turned off in MGM notification settings. Depending on your device notification settings, that information may appear on the lock screen. Supported app builds may receive workout updates in the background using a workout observer. When connected and Steps is enabled, supported iPhones may periodically refresh recent step totals while MGM is in the background and sync them to your account. iOS and Apple Watch synchronization control delivery; force-quitting MGM can stop background updates. We do not read Health history until you connect in the app. Health data is not used for advertising. To change access, use Apple Health: profile → Privacy → Apps → MGM.
- Friends and messages. Friend requests, who you share with, and chats (including support chat with the operator). Where available, you can send photos: we resize them and store them privately for the participants in that conversation. We store delivery acknowledgements and a temporary typing indicator, which expires after six seconds and contains no draft text. Your device keeps pending messages and prepared photos so interrupted sends can be retried with the same message identifier. A bounded set of recent chat text and sent or downloaded chat photos is cached on your device, separately for each account and conversation, so an existing chat can open offline after restarting the app. The text cache does not contain photo bytes. Deleting a chat on that device removes its local text and photo cache; permanently deleting your account removes that account's cached chat text, photos, pending outbox records and prepared originals. Ordinary sign-out keeps the account-separated cache for a later sign-in. You can delete a 1:1 chat from your inbox: it stays for the other person until they delete it too. When both of you have deleted it, we remove its messages from our servers. A new message from them can put it back on your list. Unfriend removes the chat for both of you (support chat stays). Photo files may remain privately stored under the sender's account until account deletion; once the chat is removed, the former recipient cannot request new access to those files. Previously downloaded copies on a recipient's device cannot be recalled.
- Plans. Whether your plan is Basic, a paid Apple subscription, or a complimentary grant, plus related dates. For subscription accounting we retain verified Apple transaction identifiers, product, purchase and expiry dates, price, currency, refund status and test/production environment. Apple processes payments. We do not store your card number.
- Service statistics. We record an hourly activity marker while you use the app to count unique active accounts, plus anonymous changes in the total number of accounts. We also record which modules and the leaderboard are viewed and whether a goal is active. We combine these markers with action metadata (such as creating a meal or manual product, importing steps, adding a weight log, using AI or sending a message) to calculate percentages of unique active users. Activity markers are linked to your account and removed when that account is deleted. These statistics contain no diary contents or messages and are available only to the operator.
- MGM AI (meal estimate). If you use it, a photo and/or text of a meal is sent to our servers and to Google Gemini to estimate nutrition. We store that conversation (your messages, meal photos you send, and the estimate cards) so you can reopen it after a crash or leaving the screen. Your device also keeps a bounded, account- and conversation-specific history cache for offline reopening. Compact photo copies can remain on your device after both failed and successful analyses, linked to the exact account, conversation and photo message, so you can enlarge or explicitly analyse the same photo again after reopening. The local cache of photos with an existing server copy is bounded and does not create additional server copies. Older cloud-backed local copies may be cleared to limit device storage; the existing private server photo can then be downloaded again. A successful local photo whose upload failed remains available as the only app copy until you delete its conversation or account. Conversation deletion or permanent account deletion removes the corresponding local cache. Ordinary sign-out preserves account-separated copies for a later sign-in. You can delete a conversation; that removes the conversation and its photos from our servers immediately. When you log a meal made from a photo, a separate private copy of that photo is kept with the meal log and synced to your account; deleting the AI conversation does not delete your meal log or its photo. We also store the resulting foods in your log, a private AI memory for you, and usage/cost counters. Ungrounded product names may be stored in an aggregated catalog-gap list that is not tied to your identity. Product scanning uses a barcode or supported product QR identifier to search the catalog. For an unknown code, you can choose to take a photo and send it to MGM AI; the code stays with your private conversation. After a nutrition estimate is available, the code and estimated product name may be copied to an operator-only catalog-gap list without your account identifier, photo or conversation. This list supports manual catalog review and does not automatically publish your photo or create a catalog product.
- Bodyweight report chat. A measurement-report photo you choose is sent to our server and Google Gemini to read the values. You can crop names and identifiers to share fewer personal details. The report photo, conversation and draft values are saved in your private MGM AI chat so you can reopen them, ask questions and correct the result. A local copy supports reopening photos on your device; the original in your photo library remains yours. Follow-up requests use your current message and the latest report draft; the selected report photo is read again only when you explicitly ask to reanalyse it. Values become a Bodyweight log only when you choose Log. If that saved proposal used a report photo, an independent copy is attached to the log as its source. This attachment starts private and follows your existing Bodyweight photo-backup choice and protection. You can remove it using the log's photo controls without removing the chat photo. Deleting the chat does not remove a weight log or source photo you explicitly saved. Report chats use your existing MGM AI allowance; usage accounting does not contain the photo or measurement values.
- Device. Data stored on your phone so the app works offline. If the app fails we may send a crash report with error text, stack, screen name, app version/build, operating system/version, session times and, if signed in, a user id. A short local record of up to 20 predefined technical events (such as opening a screen or swiping a Steps fact) helps explain an unexpected exit at the next start. These events contain no typed text, meal contents, photos, chat messages or Health measurements. Known secret patterns are stripped from errors. Similar reports are grouped to count occurrences and affected signed-in users; grouping by the last screen/action does not prove the cause. Crash email summaries and diagnostic attachments go to the operator only.
- Notifications. Reminder preferences and scheduled reminders stay on your device. Permission is asked on the phone. When a friend messages you, we store a device push token and send a lock-screen notification through Expo, then Apple or Google. The lock-screen text may include up to 80 characters of that message. When an AI answer finishes while you are outside that conversation, the app can also show a local notification with up to 80 characters of the answer. Supported background photo requests instead use a generic completion push through Expo in the request's selected app language. This push contains the existing device token and a general ready message, without the photo, answer, measurements, account identifier or conversation identifier. Tapping it opens the current signed-in account's AI inbox. Account-specific read markers stay in the local AI history cache. Turning Chat off in Notifications, signing out, or deleting your account stops those notifications. We do not send marketing push.
- Technical logs. Our hosts (and GitHub, which serves this page) may log IP address, browser, and time when you open the app or this page, to keep the service running and secure.
In app versions that support background AI photo processing, we keep an account-owned processing record with the existing private photo reference, request settings, status and answer. An accepted request can continue on our server when you leave the app; reopening reads the saved result instead of automatically repeating a paid analysis. The record follows its source conversation and account deletion. Stop cancels pending work; it does not remove an answer already saved or a log you explicitly created.
Local chat-photo recovery and temporary relay in development. Supporting development versions can retain an independent, verified app-document copy of newly sent or opened chat photos, including AI report photos. These recovery originals are separate from the bounded display cache and are not automatically evicted when that cache fills. They remain separated by account and conversation, survive ordinary sign-out, and are removed with the corresponding intentional conversation or permanent account deletion. They use device storage and may be included in operating-system device backups or transfers; this is not MGM account synchronization or a guaranteed MGM recovery service. In the opt-in staging development route only, newly uploaded photos use separate private temporary relay storage. A friend photo can be removed there after both supported installations confirm complete local copies; an AI photo additionally requires a completed saved result and any required independent report source. Offline or incomplete transfers remain retained without a forced expiry. Confirmed account deletion uses exact-object cleanup records; deleting a recipient account without a verified sender copy does not authorize removal of the sender's remaining source. Independent logged meal, report and Bodyweight sources remain separate. Existing production photos and legacy server retention are unchanged. These ordinary chat copies are not covered by the additional Bodyweight end-to-end photo encryption.
Conversation cleanup in staging development versions. When both participants delete a friend conversation, or the existing unfriend action removes it, server messages are deleted and exact associated legacy and temporary photo files are queued for background removal. One participant hiding a conversation does not delete the other participant's messages or photos. Verified encrypted AI conversation deletion likewise retains unfinished photo-cleanup tasks and removes obsolete encrypted index copies after device verification. Cleanup can continue without the app being open and retries temporary failures. A file independently saved in a meal, report or another record remains protected. Small content-free deletion identifiers and encrypted deletion proofs are retained to prevent old devices or delayed uploads from restoring deleted content; they are not retained conversations or photos. This development behavior does not change retention in already released app versions. Previously downloaded recipient copies and infrastructure backups follow their separate retention rules.
Adaptive calorie plan. In Suggested mode, MGM can use your profile, real weight trend, confirmed complete food logs, and available activity records to adjust calories and the goal date automatically within plan limits. You can turn this feature off in Nutrition settings. The original goal, latest applied adjustment and complete-day confirmations are stored with your private Nutrition preferences and synced to your account. Weigh-in weekdays and morning reminders remain device-local. This calculation does not send these records to a generative AI provider.
Activity burn in Nutrition. When you use activity logging, your activity name, active duration, optional time interval, optional distance and distance unit for supported activities, intensity, calorie estimate and calculation reference are stored privately and synced to your account. Activity favorites are also stored privately and synced across your devices. Recent activities and reusable manual or AI activity choices are based on your saved activity logs. MGM keeps a compact daily step total and its calorie basis; it does not copy a complete timeline of Health samples. Step counts for a selected activity interval are queried to estimate overlap, and the resulting overlap count is saved with that activity. Switching Steps off preserves previously saved days. MGM AI can handle food, activities and app-help questions in one private conversation. Text routing, activity estimation and app help send your current message, up to eight recent text messages and relevant structured activity facts to Google Gemini, including duration, effort and times you provide. The selected date, local clock and whether Steps is enabled support activity time questions; they do not create a meal-time requirement. App help also receives public product facts generated from the app, such as modules and plan features. It has no tools to browse user records, change settings or purchase a plan. This path does not automatically send profile weight, Health readings or photos. Food photos remain available through the meal-estimation path described above and are not sent again for activity or help questions. Food and activity estimates remain separately identifiable within the shared conversation and can be reopened or deleted under the same account permissions. Reference activity names and codes may be kept in an aggregated improvement list without your account identifier; conversation text is not copied into that list. AI model usage shares the account allowance described below.
Packaged-product information. For packaged-food estimates, MGM AI may use the identified brand, product name, variant and barcode to find published product information through Brave Search. Search requests contain these product details only, not your photo, account identifiers, profile, diary or full conversation. Our server may retrieve relevant public product pages and send their text to Google Gemini to check the product match and nutrition. Search responses and source-page text are used temporarily; the resulting nutrition estimate and publisher source links and titles may remain in your private conversation and confirmed food log. When a scanned product is missing from the catalog, verified product details, nutrition, any verified package weight and publisher references can also be added to our operator's catalog-review list, without your account identifier, photo or conversation. This does not automatically publish a catalog product. Brave may retain API search queries for up to 90 days for billing and troubleshooting, subject to its legal obligations.
Encrypted MGM AI chats (selected adult development/staging accounts only). In this test, the ordinary MGM AI conversation uses OpenAI for text and wellbeing replies and Google Gemini for supported image/meal processing. Before using this optional AI service, you explicitly consent in one introduction to processing your submitted messages/images and relevant saved records from your own active supported modules, profile, supported settings, subscription and AI usage/reset information. This can include health information. Records are selected only as relevant to your question; a request for a personal overview can include profile facts and a bounded recent summary of active modules. Without consent, AI generation is unavailable but the rest of MGM remains usable. An older, narrower consent does not automatically authorize this expanded scope. Friends' conversations and Bodyweight photo libraries are excluded. Workout records and other conversations are not available to this test. Turning a module off excludes its records and identified derived chat context from later AI requests. Consent can be withdrawn in AI privacy settings for future requests.
Public sources and confirmed changes in this test. Public web lookups use OpenAI's search tool with code-defined general wellbeing or MGM topics and restricted public source domains. Your question, private records and identity are not sent as the search query; the resulting public guidance can be combined with relevant private context when answering. Verified source links can open external websites under those sites' privacy rules. Search calls and model tokens count towards usage; content-free cost metadata enforces a separate development limit. Supported weight logs, profile fields and the daily step goal can be proposed in chat. You review the exact values and tap Apply before the app uses its normal account-bound logging/settings functions. Existing logs are not overwritten, modules are not enabled automatically, and purchases, account security and deletion cannot be performed this way. Encrypted preparation/completion receipts prevent automatic replay after interruptions; you may need to review your logs before making a new proposal. Module logs and settings retain their existing synchronization and protection, rather than inheriting chat encryption.
What encryption covers. The supported chat route encrypts messages, cards and recovery history on your device before cloud storage. Reply processing uses a public receiving key; MGM stores ciphertext rather than a readable answer. Newer compatible development builds also keep readable, integrity-checked local copies under iOS file protection, excluded from device backups, so opening a chat does not require decrypting the entire history again. These account-separated copies survive an ordinary app restart and sign-out; intentional chat or account deletion also removes the relevant local copies. Private Bodyweight photos can be prepared locally under the same device protection; an enabled photo-viewing lock is preserved. Account/conversation identifiers, timing, ciphertext sizes and usage/cost metadata remain visible. The question, bounded conversation and selected records still pass in readable form through MGM's request processing and the AI provider when an answer is generated. Provider retention policies apply; disabling response storage does not guarantee zero provider retention. Ordinary module logs, independently saved meal/report photos and social chats are not made inaccessible to MGM by this chat vault. Completion notifications for this route use generic text without the answer or health measurements.
Local AI photos and replacement devices. In newer compatible development builds, new AI-chat photo bytes stay in protected local storage and are sent temporarily when needed to answer a request. They are excluded from the permanent encrypted cloud conversation and request archives. They do not automatically transfer to a replacement device and can be lost after uninstalling the app or losing the phone. The chat text and saved answer can still be restored. Existing encrypted photo archives are retained during this transition to avoid losing older content; independently saved Bodyweight, meal or report photos keep their own storage rules. For an already consented test account, signing in starts key verification and preparation of encrypted chat history and backed-up private Bodyweight photos. An available matching Apple Keychain key can unlock them automatically; otherwise recovery is required. Progress percentages describe the displayed step and advance after verified work, not elapsed time. Completed local files remain available for resuming an interrupted restore.
Conversion and deletion. Existing selected chat content is converted on a compatible device: full encrypted replacements are independently retrieved and checked, and recovery is verified, before readable live sources are retired. A file shared with an independently saved log is retained for that log. An incomplete conversion keeps its source and blocks normal entry rather than silently discarding it. Deleting a supported encrypted conversation removes its live chat ciphertext and converted chat copies; a content-free deletion record prevents an older device from uploading them again. Independently saved logs and their attachments remain separate. Offline devices apply deletion when they synchronize. Earlier system backups and provider copies are not retroactively rewritten; their retention rules still apply. This limited staging test does not claim that existing released chats have already been converted.
Account recovery. Compatible builds can protect separate AI-chat and Bodyweight-photo keys with one account recovery code. Only encrypted recovery bundles are stored on MGM servers. Apple Keychain synchronization can restore the matching recovery key when available; a separately saved code provides another route. MGM does not receive or email that code, and signing into MGM alone cannot replace all lost device/Apple keys and a lost code. Compatible builds also offer an explicit, device-authenticated export to a recovery text file using the iOS file picker. The file contains the secret recovery code and is created on the device; MGM does not receive it. The temporary app copy is protected and excluded from backups, with cleanup after completion, cancellation, backgrounding or the next native initialization. A saved external copy remains under your control and the protection of your chosen storage provider. Keep it safe and accessible if the phone is lost. Exporting a file does not replace the separate recovery-code verification. Save and verify the code before converting existing content. Ordinary sign-out or withdrawing AI consent preserves encrypted history. Permanent account deletion follows the retention process below.
Friends feed and streaks (supporting development/staging versions). The Friends screen can show automatic, general achievement messages about step goals, hydration, following a calorie plan and selected app-opening streak milestones. Automatic sharing starts enabled, subject to existing explicit module and goal privacy settings. You can turn automatic sharing off by category or hide an individual moment. These feed messages do not include step counts, calorie amounts, water quantities, body weight or diary entries. They still reveal that you reached the named goal. Only your current accepted friends can access shared moments, with eligibility checked again when opening them. Existing profile and leaderboard permissions remain separate. Turning sharing off, hiding a moment or removing a friendship removes the corresponding access; previously seen or captured information cannot be recalled.
We privately retain the source day, relevant goal and calculation settings, sharing context, and achievement identifiers to avoid duplicate messages and apply corrections. A calorie-plan moment is evaluated after the local day has ended, within 5% below or above that day's effective calorie target including activity. History uses available verified context; the app does not invent past achievements from today's settings. Hiding or invalidating a moment does not delete the underlying diary. Feed history and private evidence follow the account retention and deletion process below.
For an app-opening streak we record a visit identifier, time, local calendar date, time zone and whether you opened, returned to or deliberately interacted with the app. Background synchronization alone does not count. Account-separated device records retain unsent visits across ordinary sign-out and retry synchronization without creating extra days. Friends may see the streak count when sharing is enabled, but not your visit dates, times or private weekly attendance. A daily welcome can briefly display the updated count. Optional local streak reminders depend on device permission and stop for the day after a qualifying visit.
A friend can send a personal congratulations message for an achievement, without public reaction totals. We store the sender, recipient, moment and delivery/read status to avoid duplicate messages. Publishing a feed moment does not send a push notification. Congratulations can produce an in-app notice or a notification through Expo and Apple or Google, according to notification settings and device permission. Its text may name the sender, subject to profile sharing settings; its routing data identifies the recipient account and moment. We retain the device's selected notification language with its push token. Disabling congratulations notifications does not remove the underlying moment or private notification record.
3. Why we use it
To run your account, sync across devices, show friends what you choose to share, provide paid or complimentary plans, estimate meals you ask MGM AI to read, send the reminders you enable, ping you when a friend writes, and keep the app reliable. Legal bases under GDPR include the contract (providing MGM), consent (Health, camera, photo library, notifications, optional contacts), and legitimate interests (security, crash diagnosis, aggregated catalog gaps, operating the service). We also keep operational request and model-attempt metadata (model, token counts, estimated cost, outcome and conversation identifier) to measure service costs and enforce weekly usage limits. These records contain no conversation text or photos and are not reset when a chat is deleted.
4. Who can see it
- Friends. Profile and module tiles follow the sharing switches in the app. Each new bodyweight progress photo starts hidden, even if you already share other photos. Before showing a hidden photo, the app asks you to confirm that friends can see it on your profile. You can hide it again without confirmation. Existing photo choices are preserved. Sex at birth stays off unless you turn it on.
- The operator. We can access account data to run MGM, help you, stop abuse, and fix bugs (including MGM Stats and the support chat). We do not sell it and we do not use your health or food logs for third-party advertising.
- Processors. Supabase (hosting, database, file storage, auth). Google (Sign-In; Gemini for MGM AI). OpenAI (selected development/staging MGM AI text processing described above). Apple (Sign in with Apple, App Store, subscriptions, Health, notifications, device services). Expo/EAS (building the iOS app and delivering chat push). GitHub (hosting this Privacy Policy and the Terms page). Email delivery for crash alerts to the operator only. Google’s terms apply to Gemini processing.
Product-information search. Brave Software, Inc. receives the limited product queries described above. Its Search API Privacy Policy explains its handling of those queries.
5. How long we keep it
While your account is open, your logs and profile stay so the app can work. Device push tokens stay until you sign out, turn Chat off (the token remains but chat pings stop), or we delete the account. If you delete your account in Profile Settings you must type deletemygrowth. The account stays recoverable for 30 days (sign in to keep it). During those 30 days you can also type deletenow on the deletion screen to remove the live account and the private copy immediately. If you wait, we delete the live account after 30 days. A private per-account archive may then be kept for up to 180 days so we can restore one person if needed, then it is removed (this archive is not kept after a deletenow delete). Apple subscription records follow Apple’s rules. Crash reports remain available as archived diagnostics after resolution so recurring problems can be investigated. Their account reference is removed when the account is deleted. The operator can remove diagnostic records; resolving a report does not delete it. The short technical event record on your device is replaced by the next session.
AI catalog diagnostics. Where enabled, we keep limited troubleshooting records linking an AI estimate to its catalog search terms, candidate product identifiers, selected products and the identifiers of foods you actually log. The operator can use these links to inspect the existing estimate and matching log entries, investigate mistakes and improve catalog matching. We do not make additional copies of your photos or conversation messages for this purpose. Diagnostic records become inaccessible after 30 days and are removed by a cleanup job running every five minutes. Deleting the associated conversation or account also removes these records; expiry does not delete your diary or original conversation. If sending a diagnostic log link fails, your device may keep only the relevant identifiers for up to 30 days, retry on later use and discard expired identifiers when the app next processes that queue.
6. Your rights
Depending on where you live (including the EU/EEA and UK), you may access, correct, delete, or receive a copy of your data, object to certain processing, or withdraw consent (for example disconnect Health or turn sharing off). In the app you can change sharing, disconnect Health, and delete your account. There is no in-app download of a data copy. For a copy of your data, or a correction we cannot do in the app, email hello@mygrowthmodules.com. You may also contact your local data protection authority.
7. Children
MGM is intended only for adults aged 18 or older, including existing users. Do not create an account for anyone under 18. We use the date of birth already stored in your MGM profile to check eligibility; an App Store age rating is not a substitute for this check. AI eligibility is checked within MGM, without sending your date of birth to Google for that check.
An age restriction does not automatically erase an existing account or its records. The retention and account-deletion periods above still apply. You may contact hello@mygrowthmodules.com to correct an incorrect date of birth, obtain a copy of your records, or ask for help with an account belonging to someone under 18.
8. Security and international transfers
Cloud data is protected by sign-in and by who you share with. Processors may store data outside your country; they are required to protect it under their contracts with us. No method of transmission is perfectly secure.
Private Bodyweight photos: encryption on your device. We are testing an additional privacy layer for Bodyweight progress photos. It is not yet a guarantee for existing released apps or existing stored photos. In the new photo vault, private cloud backups are encrypted on your device with AES-256-GCM before upload. MGM stores the encrypted photo, but does not store the private key needed to directly view it. Our developers, or someone with access only to our database and file storage, therefore cannot directly view those private encrypted photos. New photos are resized and compressed on the device before encryption, with unnecessary image metadata removed, to reduce storage and transfer size. Existing originals are not replaced by this compression change.
Sharing a photo. When this vault is available, explicitly sharing a progress photo creates a separate, ordinary server copy for accepted friends under your sharing settings. The encrypted private original remains. MGM and its storage administrator can technically access the shared copy. Turning sharing off revokes new access and requests actual deletion of that copy; incomplete deletion is shown as pending. Copies made outside MGM cannot be recalled. Turning backup off keeps photos on the device and removes registered server copies only after confirming a usable local copy.
Optional photo lock and recovery. Photo locking is off by default unless you have already chosen to enable it. You can turn it on to use your device’s biometric authentication or passcode to control viewing of unshared Bodyweight photos in the module. Published photos remain visible without unlocking, including on your profile. Turning this viewing lock off does not turn off private-backup encryption. The private key is kept in Apple Keychain, with iCloud Keychain synchronization where available. Recovery on a replacement device requires the matching key to be available through Apple Keychain, an accessible earlier device or a previously saved recovery code. MGM does not store a plaintext recovery code and cannot restore a genuinely lost key. Older private server photos are converted on the device; the old copy is removed only after the encrypted replacement has been verified and the applicable migration checks have passed. Existing development staging data may be converted under explicit approval without independent recovery verification.
The Bodyweight vault covers private progress photos. Selected development accounts may also use the separate encrypted AI-chat route described above. Profile photos, ordinary Nutrition media and other media retain their existing protection. Device photo libraries, compromised devices and copies made outside MGM are outside this protection. Encryption does not make any system immune to every possible attack.
9. Changes
If this policy changes, we will update this page and the date above. For a change that really affects you we will try to tell you in the app or by email. If you do not agree, delete your account and stop using MGM.