TBT: Truth Body Tracker · Baginski Serviços de Informática Ltda · Last updated: 25 October 2026 · Effective: 25 September 2026
This Privacy Policy explains how TBT: Truth Body Tracker ("TBT", the "App") collects, uses, stores and protects your information. TBT is developed and operated by Baginski Serviços de Informática Ltda, a company incorporated in Brazil ("we", "us"). By using TBT you agree to the practices described here.
The data controller for the purposes of this policy is:
Baginski Serviços de Informática Ltda
Av. Juca Batista, 9000, Casa 1069
Porto Alegre — RS, 91781-200
Brazil
Privacy contact / Data Protection Officer: Ricardo Baginski
Email: contato@baginski.com.br
For privacy questions, requests to exercise your rights, or complaints, write to the address above. We respond within the time limits set by the law applicable to you.
Only if you enable the integration and grant permission. See section 4.
Payment is processed by the app store used for the purchase — by Apple through the App Store on iOS, or by Google through Google Play on Android. We use RevenueCat to manage subscription status. We never receive your card number or bank details.
TBT accesses your camera or photo library only at the moment you choose to upload an image. There are three cases:
The table below sets out what we do with your data and, for users in the European Economic Area and the United Kingdom, the legal basis under Articles 6 and 9 of the GDPR.
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Creating and maintaining your account | Account data | Performance of a contract (Art. 6(1)(b)) |
| Calculating your nutrition, hydration and sleep goals, and displaying your history and progress | Health and activity data | Explicit consent for health data (Art. 9(2)(a)), given when you create your health profile; contract (Art. 6(1)(b)) |
| Reading data from Apple Health | Weight, body composition, sleep, steps, workouts, resting energy | Explicit consent (Art. 9(2)(a)), given through the iOS permission prompt |
| AI features: analyses, plans, predictions, metric insights, check-in tips, coach, meal and lab report reading, and mapping of imported spreadsheets | The data described in section 3.1, strictly necessary for each request | Explicit consent (Art. 9(2)(a)), given on the App's AI permission screen before anything is sent |
| Managing your subscription | Subscription status, user identifier | Performance of a contract (Art. 6(1)(b)) |
| Transactional emails (password reset, account notices) | Email address | Performance of a contract (Art. 6(1)(b)) |
| Keeping the service secure and preventing abuse | Account and technical data | Legitimate interests (Art. 6(1)(f)) |
| Improving the App using aggregated, anonymised data | Aggregated data that does not identify you | Legitimate interests (Art. 6(1)(f)) |
Special category data. Health data is a special category of personal data under Article 9 of the GDPR. We process it only on the basis of your explicit consent, and only for the purposes described above. You may withdraw consent at any time by withdrawing AI permission in Menu > Settings > Privacy, revoking Apple Health access, or deleting your account. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
TBT's AI features use the Claude model, provided by Anthropic, PBC, in the United States. Before anything is sent, the App shows a screen explaining what data is sent, to whom and for what purpose, and asks for your permission. Without that permission, none of your data is sent to Anthropic: AI features are turned off and the rest of the App keeps working normally.
Depending on the feature you use, the following may be sent:
For each request, we send only the data needed for that feature. TBT does not send Anthropic your name, email or account details, and your date of birth is converted to age before sending. Documents and text you submit yourself, such as lab report files, may contain your name or other personal data.
Anthropic acts as a processor under its Commercial Terms and Data Processing Addendum, which includes standard contractual clauses for international transfers. Under these terms, Anthropic does not use data received through its API to train AI models and automatically deletes it within 30 days, unless longer retention is required by law or needed to enforce its Usage Policy. With these safeguards, Anthropic provides protection equal to that described in this policy.
You can withdraw permission at any time in Menu > Settings > Privacy. From then on, none of your data is sent to Anthropic. Withdrawal does not affect the lawfulness of processing carried out before it.
If you enable the integration (available on the paid plan) and grant permission in iOS, TBT reads the following from Apple Health: weight, body composition, sleep, steps, workouts and resting energy. If you allow it, TBT also writes the meals and water you log back to Apple Health, so your nutrition is centralised.
On Android, TBT can read data from Health Connect, Google's health data platform, only if you allow it. The data read is: steps, sleep, workouts, active calories burned, basal metabolic rate, weight, body fat percentage, lean body mass and body water. You choose whether to import history from the last 30, 60 or 90 days, or none.
We use this data only to show your progress, calculate your nutrition and sleep targets, and compute your in-app health score. We do not use Health Connect data for advertising, we do not sell it, and we do not use it to train artificial intelligence models. It is stored on Supabase servers and is sent to Anthropic, for AI features, only if you have given AI consent in the app.
In the current version, TBT only reads data from Health Connect and does not write anything to it. You can revoke access at any time in Health Connect settings or on the app's Integrations screen. Data already imported is deleted together with your account.
Use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.
Your data is stored in infrastructure operated by Supabase, encrypted in transit and at rest, with row-level access control: each user can only access their own records. We use the following processors:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database hosting and authentication | United States |
| Apple | Payment processing and App distribution on iOS (App Store), and authentication via Sign in with Apple | United States / global |
| Google Play (Google Ireland Limited / Google LLC) | Payment processing and App distribution on Android (Google Play) | United States / Ireland / global |
| Authentication via Sign in with Google (receives email and name) | United States / global | |
| RevenueCat | Subscription status management | United States |
| Anthropic | AI processing (analyses, plans, coach, meal and lab report reading — see section 3.1) | United States |
| Resend | Transactional email delivery | United States |
These providers process data only on our instructions and for the purposes described in this policy. Under the terms governing our use of the Anthropic API, your data is not used to train models (see section 3.1).
We are established in Brazil and our providers are established in the United States. If you are in the European Economic Area or the United Kingdom, your data is therefore transferred outside your region.
These transfers rely on the Standard Contractual Clauses adopted by the European Commission (and, for the United Kingdom, the International Data Transfer Addendum approved by the ICO), which our providers have entered into. Where required, transfer impact assessments have been carried out by the providers and are available on request.
If you are in Brazil, transfers rely on the mechanisms permitted by Article 33 of the LGPD, including standard contractual clauses.
We keep your data for as long as your account is active. You can delete your account at any time from within the App or by writing to contato@baginski.com.br. See the Account deletion page for step-by-step instructions.
Deletion removes your personal and health data from our active systems. Backups are purged within 30 days as part of the regular rotation cycle. We retain only records whose retention is required by law, for the period required.
We apply technical and organisational measures appropriate to the sensitivity of health data: encryption in transit (TLS) and at rest, per-user isolation at the database level (row-level security), credential-based access control and the principle of least privilege. No system is infallible; in the event of a personal data breach likely to result in a risk to your rights, we will notify the competent supervisory authority and, where required, the individuals affected, within the time limits set by applicable law.
If you are in the EEA or the UK, you have the right to:
To exercise these rights, write to contato@baginski.com.br. We respond within one month, extendable by two further months for complex requests.
You also have the right to lodge a complaint with a supervisory authority in the EU or UK member state where you live, work, or where the alleged infringement occurred. A list of EEA authorities is available from the European Data Protection Board; in the UK, the authority is the Information Commissioner's Office (ICO).
Under Brazilian Law No. 13.709/2018 (LGPD), you may at any time:
Requests: contato@baginski.com.br. Our Data Protection Officer is Ricardo Baginski.
If you are a resident of California, or of another U.S. state with comprehensive privacy legislation (including Colorado, Connecticut, Virginia, Utah, Texas and others), you have the right to:
Health data is sensitive personal information under California law. We use it only to provide the service you requested, which is a use exempt from the right to limit under the CPRA — we do not use it to infer characteristics about you for any other purpose.
To exercise these rights, write to contato@baginski.com.br. We will verify your identity by confirming control of the email address associated with your account. You may use an authorised agent; we may require proof of authorisation.
We do not knowingly collect or sell the personal information of minors under 16.
TBT is intended for people aged 18 and over. We do not knowingly collect data from minors. If we become aware that an account belongs to a minor, we will close it and delete the associated data. If you believe a minor has provided us with personal data, contact us at the address above.
TBT is a tracking and organisation tool. The goals, analyses and content generated by the App — including anything produced by artificial intelligence — are informational and educational. They do not constitute medical advice, diagnosis, prescription or treatment, and do not replace assessment by a qualified healthcare professional. TBT is not a medical device.
We may update this policy to reflect changes to the App or to the law. The "last updated" date appears at the top of the page. We will notify you in the App of material changes before they take effect, and where the law requires it we will seek your consent again.