What we collect, what we don't, and what you control.

Summary

Across all our apps, we never sell your data to anyone. We collect the minimum needed to make each product work, and we tell you what we collect and why in the sections below. Two of our three apps (TraqPrep and AI-Pawtner) store data on our servers using Supabase, with Row-Level Security enforcing per-user isolation. BYOK Tracker stores everything on your device by default — there is no PawCommit server in its data path.

• TraqPrep collects health-platform data, food logs, plans, and an account profile.
• AI-Pawtner collects account data, conversation history, persona preferences, and memory embeddings used for personalisation.
• BYOK Tracker keeps food, fitness, and goals in an encrypted local database on your device. AI features send media directly from your device to the AI provider you choose using your own API key.

Which app does what

PawCommit ships three products. They share some infrastructure but are isolated by authentication scope and the consent flags in your account.

Shared between TraqPrep and AI-Pawtner (but not BYOK Tracker unless you opt in) is the meal-photo calorie scanner. See §6 for how data flows through it.

Data subjects at a glance

The rest of this policy spells out the details for each app. To make the big picture easy to find, here is the closed list of personal-data subjects we process across TraqPrep and AI-Pawtner. BYOK Tracker keeps the equivalent categories on your device — see §5.

A few categories that are technically separate but worth surfacing here:

• Optional integrations. If you connect Google Calendar, Microsoft Outlook, Garmin, Oura, Whoop, Polar, or Huawei (via Terra), we receive OAuth tokens (encrypted) and the minimum data each integration exposes — for Google/Microsoft, only the start/end times of your busy intervals (event titles, attendees, locations, and notes are never sent to PawCommit).
• Operational metadata. Sentry (EU) receives crash logs and stack traces. We strip your email from every payload and filter out health-related keywords (weight, calories, steps) from breadcrumbs before sending. We set a random user identifier so we can correlate errors across sessions; you can request its deletion at any time.
• Aggregated, anonymized community data. De-identified patterns (for example, "average portion size for rice in this region") are retained indefinitely and never linked back to any individual.

That's the complete list. The detailed sections below explain how each subject is collected, where it flows, and how to control it. If anything in this table is wrong, the detailed section is the source of truth and this table will be updated in the next revision.

Data in TraqPrep

TraqPrep is built on Supabase and hosted in the EU (Frankfurt). Every user-facing table has Row-Level Security enabled — only you can read or write your own rows.

3.1 Account & profile

• Display name, email address, profile photo URL (optional)
• Account credentials managed by Supabase Auth (password hashing handled by Supabase; we never see your password in plaintext)
• Authentication tokens for the mobile client, stored in iOS Keychain / Android Keystore via Expo SecureStore

3.2 Health-platform data (with your permission)

TraqPrep can read the following from your device's health platform, only after you grant access:

• Apple Health (iOS): workouts (type, duration, calories burned), body mass entries, step count, heart rate (resting and active, where available)
• Google Health Connect (Android): the equivalent categories from Health Connect

This data is used only to display your fitness information inside the app and to calculate calorie adjustments. You can revoke access at any time from your device's Health / Health Connect settings, and TraqPrep will stop reading new data.

3.3 Food, fitness, plans, and media

TraqPrep collects the following categories of data when you use them. Everything in this list lives in our EU-hosted Supabase project, is tied to your account, and is deleted when you delete your account.

• Food logs. Meals, snacks, portions, barcode scans, and the photos you submit for AI calorie estimation.
• Recipes. Recipes you create, save, or remix from other creators.
• Workout logs. Exercise entries, sets/reps/weights, personal records, and the source (manual entry or Apple Health / Google Health Connect).
• Goals. Calorie and macro targets, weight goals, and other fitness goals you set.
• Meal plans. Private weekly plans you create, and public meal plans you publish or download. Public plans show your creator display name to other users; private plans are visible only to you.
• Plan cover images. Photos you upload as cover art for a public plan. Stored in our object storage and reachable by a public URL while the plan is live.
• Ratings and reviews. Reviews and star ratings you submit on other creators' plans. Tied to your display name.
• Profile photo (optional). Stored in our object storage and reachable by a public URL while your profile is live.
• Buddy pairing and chat. When you opt in to a 1:1 buddy pairing, your display name, activity streak, food-log consistency, and chat messages are visible to that buddy. Chat is text-only.
• Push delivery. Push token and notification preferences used to deliver buddy and reminder messages.
• Food-scan history. Your past food-photo scans, your corrections to those scans, and the per-meal vectors used to make future scans more accurate.

No item in this list is shared with any other user by default. Buddy and public-plan features are explicitly opt-in and surfaced in-app.

3.4 Buddy system

If you opt in to a buddy pairing, the following becomes visible to your paired buddy: your display name, your activity streak, your food-log consistency, and messages you send in the buddy chat. Buddy chat messages are persisted with Row-Level Security so only the two paired users can read them. Presence (online/offline) and typing indicators are ephemeral and never persisted.

3.5 Subscriptions and billing

Paid subscriptions for TraqPrep are processed by RevenueCat, not by PawCommit directly. RevenueCat receives the purchase receipt from the App Store / Play Store, validates it, and forwards the resulting entitlements to our Supabase project via the revenuecat-webhook edge function. We do not see or store your payment card details; billing is handled entirely by Apple / Google and RevenueCat's receipt validator.

What we do see in our database:

• Your subscription tier (free / premium)
• The original App Store / Play Store product identifier (e.g. premium.monthly)
• Subscription start, renewal, and expiry timestamps

3.6 Sharing controls

• You can unpublish a public plan at any time to remove it from public visibility. The plan cover image is removed from storage so it has no public surface.
• You can leave a buddy pairing from the Buddy tab; the pairing is removed and your chat history with that buddy is hidden from your view (and from theirs).
• You can revoke health permissions in your device settings at any time.
• You can delete your account from inside the app; account deletion permanently removes your account and all associated data (food logs, health sync data, plans, conversation history, memory embeddings).

3.7 Languages & localisation

TraqPrep ships with 10 languages: English (default), German, Spanish, French, Italian, Portuguese, Chinese (Simplified), Japanese, Hindi, and Korean. The app detects the device locale on first launch and falls back to English. None of your localization choices are sent to our servers.

Data in AI-Pawtner

AI-Pawtner adds an LLM-backed companion layer on top of the PawCommit Supabase project, served by our FastAPI + LangGraph backend (Pawcommit-Backend). The default data flow for a chat turn: persona + history + memory retrieval run concurrently, the LLM is called with that context, the response is stored, and a memory-update job is queued for the background worker.

4.1 Account & persona

• Supabase Auth account (email + password, or future OAuth providers)
• Persona choice (Drill / Chill / Buddy), moods, expressions, and persona prompt overrides
• Timezone, locale, and notification preferences

4.2 Conversations & memory

AI-Pawtner stores the following per-user categories when you chat with the companion:

• Conversation threads. The full message history of every chat session with your Pawtner. Threads are visible to you and to AI-Pawtner for context; nobody else can read them.
• Long-term memory. Distilled facts the companion has derived from your conversations, including confidence scores. You can review, edit, and delete any memory from the privacy settings screen.
• Memory embeddings. Numerical representations of your conversations and memories used to retrieve relevant past context. Derived from your messages, stored in encrypted form inside our Supabase project.
• Insights. Proactive nudges the system generates on its own schedule (morning forecasts, post-workout hype, weak-day encouragement). Each insight has a delivery state (pending / delivered / dismissed).
• User profile preferences. Persona choice (Drill / Chill / Buddy), timezone, locale, and notification preferences.

Memory ingest is consent-gated: if you turn off memory in settings, the backend refuses to ingest new memories. Memories that the system derives from conversations can be edited or deleted from the AI-Pawtner settings screen.

4.3 Track tab — food, workout, weight, and scan logs

The AI-Pawtner app has a full Track tab (alongside Home, Chat, Plan, Insights, and Settings) where you can log meals, workouts, and weight, and scan barcodes. Because AI-Pawtner and TraqPrep share the same user account, any tracking entry you create in AI-Pawtner is immediately visible in TraqPrep on the same account, and vice versa — they are not separate copies.

The shared Track categories across both apps are:

• Food logs (meals, snacks, portions, barcode scans)
• Workouts (type, duration, intensity, sets, distance, heart rate, calories burned)
• Body-weight entries
• Calorie, macro, and weight goals
• Meal plans you create in the Track tab

Food scans in AI-Pawtner go through the same shared meal-photo scanner that TraqPrep uses (see §6). Logs you create in AI-Pawtner are immediately visible to TraqPrep on the same account, and vice versa — they are not separate copies.

4.4 Insights & proactive nudges

The Insights tab shows daily, weekly, and monthly aggregations computed from your logs (calorie and macro trends, nutrient breakdown, weight trajectory, goal-compliance bars). These views are computed on-demand and are not persisted as their own tables.

AI-Pawtner can also send proactive messages on its own schedule (when you grant notification permission):

• Morning forecast — a preview of the day's planned meals, workouts, and calorie targets.
• Meal & training reminders — timed nudges before planned meals and scheduled workouts.
• Post-workout hype — fired by a Supabase webhook the moment a workout is logged.
• Encouragement on weak days — fired by a daily analysis job when low-effort or missed sessions are detected.

Proactive messages are generated by the same LLM provider that handles chat, queued via the background worker, and delivered through the OS notification system on your device. They reference your own logs — no other user's data is involved.

4.5 Cross-app context & derived memories (consent-based)

AI-Pawtner can read TraqPrep data — your meals, workouts, plans, weight, and the static knowledge base (exercises, anatomy, nutrition, training principles) — only if you grant cross-app consent via the consent settings. The consent flag is checked by the backend before any read. You can revoke it at any time, and the AI-Pawtner instance immediately loses access.

When consent is on, a weekly background job on our backend derives archival memories from your tracking data — for example "3.2 sessions/week average over 8 weeks", "hit 100kg bench press for the first time on 2026-03-15", or "struggles with squat depth below parallel". Each archival memory has a confidence score and a source tag (tracking, interaction, or explicit). Archival memories are visible and editable from the AI-Pawtner privacy settings.

4.6 Static knowledge base & multi-locale

AI-Pawtner's responses are grounded in a shared static knowledge base covering exercises, anatomy, nutrition, training principles, goals, and equipment. The KB is the same for all users; per-user context is layered on top via memory retrieval. The KB is shipped inside the app bundle — it is not user-specific.

AI-Pawtner ships with the same 10 languages as TraqPrep: English (default), German, Spanish, French, Italian, Portuguese, Chinese (Simplified), Japanese, Hindi, and Korean. The device locale is detected on first launch and the app falls back to English when no exact match is found. LLM output is English-first today and falls back to English regardless of the UI locale; multi-language LLM output is a planned enhancement, not a current capability.

A developer-only translation pipeline auto-translates new English UI strings into the 9 non-English locales using a developer-supplied OpenAI-compatible API key. The pipeline is a dev tool that does not ship with the app and does not receive any user data.

4.7 LLM, embedding, and vision providers

Chat completions are sent to the model provider configured by the backend (currently OpenRouter; the provider list is configurable). Embeddings for memory retrieval are generated by our hosted embedding service and stored inside the Supabase project. Meal-photo calorie estimation is handled by our shared vision service using BytePlus ModelArk (see §6). The backend does not send your raw conversations or logs to third-party model providers unless it is actively generating a response, an embedding, or a meal-scan estimate.

4.8 Progress photos (planned, not yet shipped)

Data in BYOK Tracker

BYOK Tracker is local-first by design. There is no PawCommit backend in the data path unless you opt into a future hosted feature. Everything below happens on your device unless we say otherwise.

5.1 What stays on your device

• Food entries, saved meals, favorites, and recipes
• Workout entries, templates, activity rings, and step / move data
• Goals (daily targets for calories, macros, steps, active minutes)
• Weight logs and body-mass history
• Profile preferences (non-PII, e.g. theme and units)
• Captured media (meal photos, nutrition-label scans, voice recordings) saved to your device's app-private document directory

This data is stored in a local SQLite database encrypted at rest with SQLCipher (AES-256). The encryption key is a 256-bit random value generated on first launch and stored in the device's secure keychain (iOS Keychain / Android EncryptedSharedPreferences via Expo SecureStore, accessible only while the device is unlocked). The key never leaves your device and is never written to the database, the network, or AsyncStorage.

5.2 Network usage

• Open Food Facts (world.openfoodfacts.org) for barcode lookups and food search. Only the barcode digits or search terms you enter are sent. Results are cached locally.
• AI analysis (BYOK). When you analyze a meal photo, nutrition label, or voice recording, the app sends that media directly from your device to the AI provider whose API key you configured (Settings → AI providers). The request uses your own key and goes straight to that provider's endpoint — PawCommit has no backend, proxy, or relay that sees your key or your media. If no provider is configured, media is never uploaded; capture just attaches the file locally.
• AI providers receive: the image/audio bytes you asked to analyze and the analysis prompt. Nothing else about your account, history, or other entries is included in the request.

5.3 Supported AI providers

BYOK Tracker ships with a built-in registry of OpenAI-compatible providers. Each provider's own privacy policy governs how they handle the requests you make.

Supported providers include:

• OpenAI, Google Gemini, Anthropic Claude, xAI Grok, OpenRouter, Together AI, Groq, Hugging Face, Fireworks AI, DeepInfra, Mistral
• Ollama — self-hosted (default localhost:11434, requests stay on-device) or Ollama Cloud (hosted inference, governed by Ollama's own privacy policy)
• Custom — any OpenAI-compatible endpoint you supply

Where data goes for the Ollama row depends entirely on the endpoint you configure:

• Local Ollama at localhost:11434: requests stay on your device. The provider needs no API key.
• Ollama Cloud: requests leave your device and go to Ollama's hosted inference. An API key is required. The provider's own privacy policy governs retention.

The provider client refuses non-HTTPS base URLs (loopback / Ollama local exempt). Keys are validated live against each provider's models endpoint before being saved. API keys live only in the device Keychain — never in the database, never in .env, never on the network in cleartext.

5.4 No tracking, no analytics

The current BYOK Tracker build includes no third-party analytics, advertising, or tracking SDKs. No information about you or your usage is collected or shared by PawCommit.

5.5 Languages & localisation

BYOK Tracker is currently English-only. There is no i18n layer in this build; all in-app strings are hard-coded English. Adding localisation is on the roadmap but is not yet implemented, so device-locale detection and multi-language UI are not available in this app today.

Shared infrastructure

TraqPrep and AI-Pawtner both run against the same Supabase project, with their data isolated by Row-Level Security and consent flags. The shared meal-photo scanner is a small service that both apps can call to estimate calories from a meal photo.

6.1 Supabase (Postgres + Auth + Realtime + Storage + Edge Functions)

• All persistent TraqPrep and AI-Pawtner data is stored in Supabase-hosted PostgreSQL, in the EU.
• Row-Level Security is enabled on every user-facing table. Policies ensure a user can only read or write their own rows.
• Authentication uses Supabase Auth. Tokens are verified on every request by both the data layer and the AI-Pawtner backend.
• Realtime is used for buddy chat (message delivery) and presence.
• Supabase Storage holds uploaded media: plan cover images and profile photos (public read by URL while live). The database links each object to its owning user, so deletion cascades properly.
• Data is encrypted at rest using AES-256.
• Server-side endpoints handle account lifecycle (deletion, email verification, password reset), push notifications for buddy events, and RevenueCat purchase receipt ingestion.

6.2 AI-Pawtner backend (chat + memory service)

The backend service for AI-Pawtner (and, where enabled, cross-app context for TraqPrep). It runs as two processes against the same Supabase database:

• API — foreground chat, data export, deletion, persona, and user endpoints.
• Worker — background job runner that polls memory jobs and runs retrieval-augmented memory updates.

Auth uses Supabase JWT (Bearer header for HTTP, first-frame JSON auth for WebSockets). Rate limits are tiered: anonymous, free, and premium users get progressively higher per-minute budgets.

6.3 Shared meal-photo scanner

Used by TraqPrep and AI-Pawtner to estimate calories from a meal photo. Flow:

1. The mobile app sends a multipart image with a Bearer JWT.
2. The service validates the image (correct format, HEIC support, downscaled to a reasonable size).
3. It checks for duplicates in a 1-hour window via the image's SHA-256 hash.
4. It builds a calibrated prompt (your corrections + profile), then calls BytePlus ModelArk.
5. It stores the scan + per-food vectors and returns items, totals, confidence, and bounding boxes to the client.

A correction endpoint records your manual edits so future scans of similar meals get better estimates. Account deletion cascades through scans, corrections, vectors, and your scan profile.

Third-party services

We use a small set of third parties. Each row says exactly what data crosses each boundary.

We do not sell your data to any third party.

Security

• Encryption in transit. All client → server traffic uses HTTPS / TLS.
• Encryption at rest. Supabase encrypts data at rest with AES-256. BYOK Tracker's local SQLite is encrypted with SQLCipher (AES-256).
• Authentication. Supabase Auth for server-backed apps, with secure password hashing. JWTs are verified on every request by both the data layer and Pawcommit-Backend.
• Authorization. Row-Level Security on every user-facing table in Supabase. App-pairing and AI-data-consent flags gate cross-app access.
• Rate limiting. Tiered per-user limits on the AI-Pawtner backend (anonymous / free / premium) and an internal service-to-service header for backend calls.
• Secrets. Provider API keys in BYOK Tracker are stored in the device Keychain only. Production secrets in our infrastructure are stored in environment variables and are rotated; no secrets are committed to source.

Your rights

You have the right to:

• Access your personal data at any time within each app.
• Export your data — TraqPrep and AI-Pawtner each expose an export feature; BYOK Tracker data can be exported from the device backup.
• Delete your account. Account deletion permanently removes all your data from our servers (food logs, health sync data, plans, conversation history, memory embeddings). For BYOK Tracker, uninstalling the app removes all locally stored data.
• Revoke health permissions at any time through your device's Health / Health Connect settings.
• Revoke AI data consent in AI-Pawtner settings. Cross-app context reads stop immediately.
• Clear BYOK API keys from the device Keychain at any time.
• GDPR requests — data export, deletion, and access requests can be initiated in-app or by emailing privacy@pawcommit.com.

Data retention

• Your account data is retained for as long as your account is active.
• When you delete your account, all personal data — including food logs, health sync data, plans, conversation history, and memory embeddings — is permanently deleted from our servers.
• Anonymised, aggregated statistics (for example, total public-plan enrollments or de-identified buddy matching outcomes) may be retained.
• BYOK Tracker data is retained on your device until you delete it (long-press to delete individual entries) or uninstall the app.

Children's privacy

PawCommit apps are not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will promptly delete it.

Changes to this policy

We may update this Privacy Policy from time to time. The effective date at the top of the page will always reflect the current version. For material changes we will notify you in-app and on this page. Continued use of a PawCommit app after the effective date constitutes acceptance of the updated policy.

Contact us

If you have questions about this Privacy Policy or want to exercise a right, contact us at:

• Email: privacy@pawcommit.com
• General: hello@pawcommit.com
• Issues: open a ticket on the project repository for the relevant app