CurvyPrivacy Policy
Curvy: Glute Scan & Workout · Last updated 28 September 2026
Curvy is operated by Oskar Bruce, United Kingdom.
Curvy scans your glutes from two photos, builds a training plan around your results, and helps you track workouts and food. This policy explains exactly what the app does with your data, where it goes, how long it is kept, and how to delete it.
The short version. Curvy has no accounts and no advertising or analytics trackers. Your scan and meal photos are only sent to OpenAI for analysis after you agree, and scan photos are not stored on our servers. Your scan results, onboarding answers and saved meal photos are stored on our servers, linked only to a random ID created by the app, not to your name, email or Apple ID.
We do not sell your data or share it for advertising.
Your permission for AI analysis
Before your first scan, and before your first meal photo is analysed, Curvy shows a screen explaining that the photos will be sent to OpenAI and asks you to Agree or choose Not now. If you choose Not now, nothing is sent and that feature stays paused until you agree. You can change either answer at any time in the app under You → Privacy → AI analysis.
The random app ID
When you first use Curvy, the app creates a random identifier and keeps it on your iPhone. It is sent with scans, food analysis and your onboarding answers so we can keep your results together and apply fair-use limits. It is not your Apple ID, it is not an advertising identifier, and it is not linked to your name or email. Deleting the app deletes it; a reinstall creates a new one.
Scan photos
A Curvy Scan uses two photos of you: one from behind and one from the side. The app asks you to wear tight leggings and a fitted top.
- On your iPhone. Pose and framing guidance while you take the photos is worked out on your iPhone. The app keeps your latest pair of scan photos in its own storage on your iPhone so it can show them to you; each new scan replaces them.
- For scoring. To score a scan, the app sends a resized copy of both photos (no larger than 1024 pixels) to our scoring service, which sends them to OpenAI's API. OpenAI rates each zone and briefly explains each rating; those explanations are used during scoring and are not stored.
- Not stored by us. Our service does not save your scan photos. OpenAI keeps API requests, including images, in abuse-monitoring logs for up to 30 days, unless the law requires longer, and then deletes them. OpenAI processes them as our service provider and does not use them to train its models.
- What we do keep. We store the resulting scores and the numeric ratings from each scoring pass (plus any photo-quality tip, such as asking you to step back), linked to your random app ID, so we can compare each new scan with your earlier ones. These are numbers, not images, and we do not keep the AI's written descriptions.
If you skip the scan, no photo of you leaves your iPhone.
Meal photos and food logging
- Analysis. When you log a meal by photo or by typing what you ate, the app sends the photo (resized, no larger than 1024 pixels) or your text, with your random app ID, to our food service. It uses OpenAI's API to identify the foods and portion sizes, then looks up nutrition values in the public USDA FoodData Central and Open Food Facts databases. Our service does not keep the photo or text from the analysis; OpenAI's 30-day abuse-monitoring retention described above applies.
- Saved meal photos. When you save a meal logged from a photo, the app keeps a smaller copy (no larger than 640 pixels) on your iPhone to show next to the meal, and uploads that copy through our service to a private storage area on our servers, into a folder named with your random app ID. Only our service can write to or read this storage; it is not public and is not shared with anyone. Copies are deleted automatically after 90 days.
- Food log. Your meals, recents and favourites are stored on your iPhone. The app keeps the last 7 days of meals.
- Food search and barcodes. Search terms and scanned barcodes are sent to our service and looked up in USDA FoodData Central and Open Food Facts. They are not linked to your app ID. Results are cached by the search term so repeat searches are faster.
- Food pictures. For foods without a picture, our service may create one with OpenAI's image API from the food's name only. These pictures are shared by everyone and contain nothing about you.
Onboarding answers and body measurements
During setup you answer questions about your goals, the zones you want to focus on, your experience, where you train, your equipment, how often and how long you train, what gets in your way, and your activity level. You can also enter your first name, your height and your weight.
- These answers are stored on your iPhone and used there to personalise your plan and estimate your calorie and protein targets.
- A copy of your answers, including your first name, height and weight, is stored on our servers, linked to your random app ID, so your plan can be built and improved.
- Curvy asks you to confirm your age before you start. It does not ask your date of birth.
Workouts and progress
Completed sessions, the weights and reps you log, streaks and challenges are stored on your iPhone only. Exercise videos and thumbnails are streamed from our exercise video provider, YMove, which, like any website you load, sees your iPhone's IP address. The app does not send it anything about you.
Subscriptions
Purchases are processed by Apple and managed through RevenueCat, our subscription provider. RevenueCat receives your purchase and subscription status from Apple together with an anonymous RevenueCat ID. We never receive your name, email or payment card details; those stay with Apple.
Our website
This policy also covers our website, curvy-app.com. The website does not ask for your name, email or any other details.
- Analytics. The website uses Vercel Web Analytics to count page views. It does not use cookies and does not identify you or follow you across other sites. The app itself has no analytics.
What Curvy does not do
- No accounts, sign-in or email address required.
- No advertising, no advertising identifier and no cross-app tracking.
- No analytics or crash-reporting services.
- No access to Apple Health, your location, contacts or microphone.
- No access to your photo library. If you choose a photo instead of taking one, Apple's photo picker gives the app only the photo you pick.
Service providers
We use the following providers, and no others, to run Curvy:
| Provider | What it does with your data |
|---|---|
| Supabase | Hosts our servers, database and private storage (your scan results, onboarding answers and saved meal photos). Like any server, it processes your IP address when the app connects, and keeps short-lived technical logs. |
| OpenAI | Scores scan photos, identifies foods in meal photos and text, and creates generic food pictures from food names. |
| RevenueCat | Manages subscription status. |
| Apple | Delivers the app and processes payments. |
| YMove | Streams exercise videos and thumbnails. |
| Vercel | Hosts our website and counts page views without cookies. Like any server, it processes your IP address when you visit. |
| USDA FoodData Central and Open Food Facts | Public nutrition databases. Our service sends them food names, search terms and barcodes, never anything linked to you. |
These providers process data on our behalf, under their terms of service, only to provide the features described here. Some of them are based outside the UK, including in the United States, so your data may be processed there.
How long data is kept
| Data | Retention |
|---|---|
| Scan photos sent for scoring | Not stored by our service. OpenAI keeps API requests for up to 30 days for abuse monitoring, unless the law requires longer, then deletes them. |
| Meal photos and text sent for analysis | Not stored by our service. OpenAI's 30-day abuse-monitoring retention applies. |
| Scan results and ratings | Kept on our servers, linked to your random app ID, until you delete your data in the app or ask us to. |
| Onboarding answers, including name, height and weight | Kept on our servers, linked to your random app ID, until you delete your data in the app or ask us to. |
| Saved meal photos | Deleted automatically 90 days after upload, or sooner if you delete your data. |
| Food analysis usage records | A record of each analysis (your random app ID, the time and the amount of AI processing used) is kept to apply fair-use limits and manage costs, until you delete your data in the app or ask us to. |
| Everything stored on your iPhone | Kept until you delete it or delete the app. Meal history is limited to the last 7 days. |
| Subscription status | Held by RevenueCat and Apple for as long as the subscription record exists. |
Deleting your data
- In the app. Go to You → Delete all my data. Curvy first deletes everything our servers hold for your random app ID (scan results and ratings, onboarding answers, saved meal photos and usage records), then everything the app stored on your iPhone (scan photos, meal photos, food log, workout history, answers, settings and the app ID itself), and returns you to the start of the app. If our servers can't be reached, nothing is deleted and the app tells you, so you can try again.
- By email. You can also email oskar@curvy-app.com with the app ID shown under You → Privacy and we will delete the server data linked to it and confirm within one month. Please send it before deleting the app, because deleting the app also deletes the ID.
- Deleting the app removes everything stored on your iPhone, but not what is on our servers, so use Delete all my data first.
- Subscription. Deleting your data or the app does not cancel your subscription or delete your purchase history, which is held by Apple.
Your rights (UK and EU)
If you are in the United Kingdom or the European Economic Area, data protection law gives you the right to access, correct or delete your personal data, to receive it in a portable format, to object to or restrict how we use it, and to withdraw consent at any time. Your scan photos and body measurements are sensitive, and we only process them because you choose to use the scan and enter them; photos are only sent for AI analysis after you give permission, which you can withdraw in the app at any time. To exercise any of these rights, email oskar@curvy-app.com and we will respond within one month. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
Children
Curvy is for people aged 16 and over. We do not knowingly collect data from anyone under 16. If you believe someone under 16 has used Curvy, email us and we will delete their data.
Security
Data is sent over encrypted connections. Our database and meal-photo storage are not publicly accessible, and the app can only add photos to its own folder. No system is perfectly secure, but we limit what we store to what the features need.
Changes
If this policy changes materially, we will update this page and the date above.
Contact
Questions about privacy, or to exercise any right above: oskar@curvy-app.com