Privacy Policy

• We collect the body stats you enter, the training and nutrition you log, and the progress photos you choose to take.
• Progress photos are stored in a private bucket that only your own account can read. They are never public, and we never sell them.
• Photos and meal descriptions are sent to our AI provider to be analysed. They are not used to train anyone's models.
• You can delete every photo with one tap, and delete your entire account — with all of it — from inside the app.
• You must be at least 16 to use Month6.

Account data. An email address, or the identifier Apple or Google returns when you sign in with them, plus a user id we generate. If you use Sign in with Apple and choose to hide your email, we only ever see the relay address. You can start using the app before creating an account; that anonymous session is identified only by a random id on your device.

Body and goal data. Sex, age, height, weight, optional wrist measurement, training experience, sessions per week, available equipment, your goal mode, and every weigh-in you record.

Photos. Progress photos you take in onboarding and at weekly check-ins, and meal photos you submit for a protein estimate, together with the analysis derived from them (for example an estimated body-fat range and per-area ratings).

Activity data. Workouts and sets you log, protein and calorie entries, your daily train/protein/sleep completions, check-ins and their verdicts, and messages you exchange with the in-app coach.

Subscription data. Whether you hold an active trial or subscription, which plan, which store, and the current period dates. We never see your card details — Apple handles payment.

Device and usage data. A push notification token if you enable notifications, your time zone and notification preferences, and pseudonymous product analytics (screens viewed, features used, funnel steps) tied to your user id so we can see where the app is failing people.

We do not collect your contacts, precise location, browsing history, or advertising identifiers, and Month6 contains no third-party ad networks.

• To provide the service — computing your projection, generating and adjusting your training plan, tracking adherence, and answering coach questions. Legal basis: performance of our contract with you.
• To analyse the photos you submit, which you choose to provide. Legal basis: your consent, withdrawable at any time by deleting the photos.
• To send the notifications you turn on. Legal basis: your consent, withdrawable in Settings or in iOS.
• To keep the app working and improve it — diagnosing errors and understanding which features are used. Legal basis: our legitimate interest in a functioning product.
• To manage subscriptions and prevent abuse. Legal basis: performance of our contract and our legitimate interests.

We keep the list of processors deliberately short. Each one only receives what it needs.

• Supabase — database, authentication and photo storage. Your data is held in the EU (Ireland).
• Anthropic — the AI that analyses your photos, parses meal descriptions, writes your projection narrative and powers the coach. Inputs are processed to return a result and are not used to train models. Processing takes place in the United States under standard contractual clauses.
• RevenueCat — subscription state, keyed to your user id.
• Apple — App Store payments, and the push notification service that delivers our notifications.
• Expo — the push notification service we send through.
• PostHog — product analytics, hosted in the EU.

We do not sell your personal data, and we do not share it for advertising or profiling by anyone else.

Progress and meal photos go into a private storage bucket under a path keyed to your user id. Access rules enforced by the database mean one account cannot read another account’s files, and there is no public URL — the app fetches a short-lived signed link when it needs to display an image. When a photo is sent for analysis it is transmitted over an encrypted connection, analysed, and the resulting numbers are stored; the image itself stays in your bucket.

We keep your data for as long as your account exists. Delete individual photos and they go immediately. Delete your account and everything described above is erased — profile, body states, photos, workouts, nutrition logs, check-ins, coach messages, notification tokens and subscription records — normally at once and in any case within 30 days. Backups roll off within 30 days. Anonymous sessions that are never converted into an account are purged after 30 days of inactivity. We may keep a minimal record of a transaction where tax or accounting law requires it.

If you are in the UK, EEA or a jurisdiction with comparable law, you have the right to access your data, correct it, delete it, obtain a portable copy, object to or restrict certain processing, and withdraw consent at any time. You also have the right to complain to your local data protection authority.

Deletion is built into the app: Profile → Privacy → Delete my account erases everything, and Delete all photos removes just the images. Step-by-step instructions are on the account deletion page. For anything else, email support@month6.app and we will respond within 30 days.

Month6 is not for under-16s. The app asks your age during onboarding and refuses to continue below 16. Between 16 and 18 it applies conservative defaults and will not set an aggressive calorie deficit. If you believe a child has given us data, email support@month6.app and we will delete it.

Data is encrypted in transit and at rest. Every table enforces owner-scoped access rules at the database level rather than trusting the app, and the private photo bucket is subject to the same rules. No system is perfect; if we ever suffer a breach affecting your data we will notify you and the relevant authority as the law requires.

If we change this policy materially we will update the date at the top and, where the change affects how we use data you have already given us, tell you in the app before it takes effect.

CODEKSAI L.L.C — support@month6.app. We are the controller of the data described here, and that address reaches us for any privacy request.