Photo & Data Handling Policy
Effective Date: March 1, 2026 · Last Updated: July 2, 2026
Your photos are your private data. Period.
We built FlexScan with a privacy-first architecture. This policy explains exactly what happens to every photo and piece of data you share with us — no hidden practices, no fine-print surprises.
1. Overview
This Photo & Data Handling Policy supplements our Privacy Policy and provides specific, detailed information about how FlexScan — operated by Sole Furious LLC, a New York limited liability company — collects, processes, stores, and deletes your photographs and associated data.
Given that FlexScan processes highly sensitive visual data — including body photographs and food photographs — we believe you deserve complete transparency about our data handling practices. This document is designed to answer every question you may have about what happens to your photos from the moment you upload them to the moment they are deleted.
2. How Body Photos Are Processed
When you upload a body photo for analysis, the following steps occur:
Upload & Encryption
Your photo is uploaded from your device over a TLS 1.3 encrypted connection. The photo is encrypted in transit and never transmitted in plaintext.
No Storage — Processed in Memory
Your photo is never written to our database or file storage. It is held only briefly in server memory for the moment it takes to forward it for analysis, then discarded as soon as the analysis returns.
AI Analysis
The photo is securely transmitted to our AI processing partner (OpenAI) via their API over an encrypted connection. The AI analyzes the image and returns coaching-style fitness observations (no body measurements are produced). Under OpenAI’s API data-usage policy, your photo is not used to train their models; OpenAI may retain API inputs for up to 30 days solely to monitor for abuse and misuse, after which they are deleted.
Results Delivery
The AI-generated analysis results are returned to our servers and securely delivered to your device. The analysis results (text data) are stored in your account for future reference.
Photo Disposition
The photo is discarded the moment the analysis returns — whether or not you track your progress. Progress tracking saves only the text results of each scan (your muscle-development ratings, coaching notes, and the date) so you can compare over time; the photo itself is never written to storage.
Food Photo Processing
Food photos follow a similar process but are always temporary. After the AI identifies the food and estimates calories/macros, the food photo is immediately and permanently deleted from our servers. Food photos are never retained, regardless of your progress tracking settings.
3. Encryption Standards
We employ multiple layers of encryption to protect your photos and data:
Encryption in Transit
All data transmitted between your device, our servers, and third-party services is protected by TLS 1.3 (Transport Layer Security). This is the same encryption standard used by banks and financial institutions. We enforce HTTPS-only connections and use HTTP Strict Transport Security (HSTS) headers.
Encryption at Rest
We do not store your photos, so there is no photo data sitting at rest on our servers. The data we do store — your account details and the text analysis results — is held in our database and encrypted at rest using AES-256 (Advanced Encryption Standard with 256-bit keys).
Database Encryption
Our database (hosted on Supabase) encrypts all data at rest. Row-level security (RLS) policies ensure that users can only access their own data. Database connections are encrypted and authenticated.
4. AI Processing Details
We believe in full transparency about how AI processes your data:
- AI Provider:We currently use OpenAI’s GPT-4o model for image analysis. If we change AI providers, we will update this policy and notify users
- Data Retention by AI Provider:Under OpenAI’s standard API data-usage policy, your images are not used to train or improve their models. OpenAI may retain API inputs for up to 30 days solely to detect abuse and misuse, after which they are deleted
- What the AI Receives: The AI receives only the photo image data and a structured prompt describing the type of analysis requested. It does not receive your name, email, account information, or other personally identifiable information
- What the AI Returns: The AI returns text-based analysis results (coaching-style physique feedback, food identification, calorie estimates, exercise recommendations). No image data is returned by the AI
- No Model Training:Your photos are never used to train, fine-tune, or improve any AI models — neither ours nor our AI provider’s
5. Storage & Retention
| Data Type | Storage Location | Retention | Encryption |
|---|---|---|---|
| Body & food photos | Not stored by FlexScan (sent to AI for analysis only) | Never retained by us | TLS 1.3 in transit |
| Photos at AI provider (OpenAI) | OpenAI API | Up to 30 days (abuse monitoring only); not used for training | TLS 1.3 |
| AI analysis results (text) | Supabase Database | Until account deletion | AES-256 |
6. Your Controls
You have full control over your data at all times. Because we never store your photos, the controls below cover the data we actually keep — your saved text analyses and account information:
Delete Saved Results
Remove individual food-log entries from your nutrition history at any time in the app. Your saved scan results are removed together when you delete your account (below). Deletion is permanent and irreversible.
Nothing to Delete on the Photo Side
Your photos are never written to our servers in the first place — they are processed in memory and discarded — so there are no stored photos for you to manage or delete on our side.
Export Your Data
Request a complete export of the data we hold (analysis results and account information) in a machine-readable format (JSON) by contacting support@flexscan.app. We will fulfill export requests within 30 days.
Delete Your Account
Request complete account deletion, which removes all associated data — your analysis results and personal information (your photos were never stored). Processed within 30 days, except where data must be retained by law (e.g., payment records for tax purposes). For abuse prevention, we retain a salted one-way hash of your email address (never the address itself) solely to enforce one free scan per person. It cannot be reversed to recover your email and we never use it to contact you; because it is derived from your email it is treated as pseudonymous data (not anonymous) and is covered by the same data rights described here.
7. Absolute No-Sharing Guarantee
We will NEVER sell, share, license, rent, or distribute your photos.
This is an absolute commitment. Specifically, we guarantee that your photos will never be:
- Sold to any third party for any purpose
- Shared with advertisers, marketers, or data brokers
- Used in any public-facing material, marketing, or promotional content
- Used to train AI or machine learning models (ours or any third party’s)
- Shared with other users of the Service
- Shared with employers, insurance companies, or government agencies (unless compelled by valid legal process, in which case we will notify you unless legally prohibited from doing so)
- Made accessible to FlexScan employees or contractors (photos are processed by automated systems only; human review occurs only if you explicitly share a photo with our support team)
The only third party that processes your photos is our AI provider (currently OpenAI), and only for the sole purpose of generating your analysis. Under OpenAI’s standard API data-usage policy, your photos are never used to train their models; OpenAI may retain API inputs for up to 30 days solely to detect abuse and misuse, after which they are deleted. We never store your photos ourselves. This is the minimum data sharing necessary to provide the Service.
8. AI Processing Transparency
We are committed to being fully transparent about how AI is used in FlexScan:
- What AI Does: AI is used to analyze physique photos (subjective muscle development feedback — no body measurements), analyze food photos (estimating calories and macros), generate personalized workout plans, and generate nutrition recommendations
- What AI Does NOT Do: AI does not make medical diagnoses, does not access your personal information beyond what is necessary for analysis, does not store your data, and does not make decisions about your account or subscription
- Human Oversight: While the AI operates autonomously for analysis, our team regularly reviews the quality and safety of AI outputs (using synthetic/test data, not user data) to ensure the system provides responsible guidance
- Provider Changes: If we change our AI processing provider, we will update this policy, notify users via email, and ensure the new provider meets equivalent or higher privacy and security standards
- Opt-Out: While AI processing is core to the Service, you can choose not to upload photos and instead use FlexScan for manually generated workout and nutrition plans without AI body analysis
9. Progress Tracking Feature
FlexScan keeps a history of your scan results over time so you can track your fitness journey — without storing any of the underlying photos.
Results, Not Photos
What is saved is the text output of each scan — your muscle-development ratings, coaching notes, and the date — alongside any weight or measurement numbers you choose to log. The photo itself is never stored; it is discarded as soon as the analysis is generated.
Accessible Only to You
Your saved scan results are accessible only through your authenticated account. They are protected by row-level security policies and encrypted at rest. No other user, employee, or system can access your history.
Easy Deletion
You can delete individual food-log entries any time, and delete your entire account whenever you want. Deleting your account removes all saved results — including your scan history — and personal information from our systems.
10. Data Breach Notification Policy
In the unlikely event of a data breach that affects your personal information or photos, we commit to the following:
Notification Timeline
We will notify affected users and relevant supervisory authorities within 72 hours of becoming aware of a qualifying breach, as required by GDPR Article 33. For California residents, we will also comply with the California data breach notification requirements.
What We Will Communicate
- The nature and scope of the breach
- The types of data affected
- Steps we have taken and are taking to address the breach
- Steps you can take to protect yourself
- Contact information for further questions
Our Response Plan
We maintain a documented incident response plan that includes: immediate containment and investigation, assessment of scope and impact, notification of affected parties, remediation and prevention of recurrence, and post-incident review.
11. Sub-Processors
The following sub-processors may process your photo data or personal information:
| Provider | Purpose | Data Access | Location |
|---|---|---|---|
| OpenAI | AI image & text analysis | Photos & prompts (not stored by us; OpenAI may retain up to 30 days for abuse monitoring, not used for training) | United States |
| Supabase | Database & authentication | Account data & text results (encrypted) | United States |
| Stripe | Payment processing | Payment & billing info | United States |
| Vercel | Hosting & usage analytics | Access logs, IP addresses, anonymized usage | United States |
| Cloudflare | Bot & abuse protection (Turnstile) on sign-up / sign-in | IP address & browser signals | United States / Global |
Our use of each sub-processor is governed by the data processing terms (DPAs) they make available to their customers, and we choose providers with recognized security practices and compliance certifications.
12. Changes to This Policy
We may update this Photo & Data Handling Policy from time to time. When we make material changes — particularly changes that affect how we handle photos or introduce new sub-processors — we will:
- Notify you via email at least thirty (30) days before the changes take effect
- Display a prominent notice within the app
- Update the “Last Updated” date at the top of this policy
- Where required by law, obtain your renewed consent before processing your photos under new terms
13. Contact Information
If you have any questions about how we handle your photos and data, please reach out:
Data & Privacy Requests
For photo deletion requests, data export requests, or privacy-related inquiries:
Email: privacy@flexscan.app
This policy should be read in conjunction with our Terms of Service, Privacy Policy, and Medical & Fitness Disclaimer.