Privacy Policy

2. What data we process

We only process the data you need to use Bulkio. You enter most of it yourself, and several items are optional:

• Account: email address, name and profile picture, managed with our identity provider (Clerk).
• Profile and body: date of birth, sex, height, weight, body-fat percentage and experience level; weight logs; body measurements (for example waist, chest or arm); progress photos.
• Training: programs, sessions, sets, reps, loads, RPE and RIR, notes, templates, calendar, and dates and results of competitions.
• Nutrition: calorie and macronutrient targets, foods, recipes and your food log.
• Wellbeing: sleep, energy, stress, soreness and perceived recovery, if you log them.
• AI Coach: the messages you write, the replies, and the training context attached to each request.
• Subscription: plan, status and dates of the subscription and Stripe customer identifiers. Your card details never pass through Bulkio.
• Feedback: the messages you send us, with the page, browser and app version you write from.
• Technical data: IP address, device type and the security and error logs produced by using the service.
• Optional analytics: only if you accept it, the pages and features you use, errors and, if you turn on session recording, how screens are used.

Some of this data (weight, body composition, measurements, progress photos, nutrition and wellbeing) can be considered health data. We only process it if you decide to enter it, and you can delete it whenever you want.

3. What we use it for and the legal basis

Each use rests on a legal basis under the General Data Protection Regulation (GDPR):

• Providing the service: managing your account, programs, sessions, calendar, nutrition and statistics. Basis: performance of the contract (GDPR art. 6(1)(b)).
• Health and wellbeing data: weight, body composition, measurements, progress photos, nutrition and wellbeing. Basis: your explicit consent (GDPR art. 9(2)(a)), which you give by choosing to enter it and can withdraw by deleting it or deleting your account.
• AI Coach and AI features: answering your questions and generating recommendations from your history. Data is only sent when you use an AI feature. Basis: performance of the contract.
• Subscription and payments: charging, invoicing and meeting tax obligations. Basis: performance of the contract and legal obligation (GDPR art. 6(1)(b) and 6(1)(c)).
• Security and reliability: preventing abuse, limiting excessive use, and detecting and fixing errors. Basis: our legitimate interest in keeping the service secure and running (GDPR art. 6(1)(f)).
• Usage statistics and session recording: understanding what is used and what is confusing so we can improve the app. Only if you accept it in the privacy notice. Basis: your consent (GDPR art. 6(1)(a) and art. 22.2 of the Spanish LSSI), which you can withdraw at any time.
• Answering your messages: replying to what you write to us. Basis: performance of the contract and our legitimate interest in helping you.

Recommendations and program adjustments are calculated automatically from your own data. They have no legal effect on you, and you can review, change or ignore them.

We do not sell your data and we do not use it for advertising.

4. Who we share it with

We use providers that process data on our behalf and under contract:

• Supabase: database and file storage, including progress photos, which are kept in a private space.
• Clerk: sign-up, sign-in and session management.
• Stripe: payments and invoicing. Bulkio never sees or stores your card details.
• Google (Gemini API): generates the answers of the AI features. It receives only what is needed for that feature (your question and training context, or the text or photo you choose to import, for example a meal or a program on paper) and only when you use it.
• Vercel: website hosting. It receives technical data about each visit, such as the IP address.
• PostHog: usage statistics, only if you accept them.
• Microsoft Clarity: anonymous session recordings and heatmaps, only if you accept them. We apply its masking to weights and to the weight, measurements and progress-photo screens.

The food search looks things up in FoodData Central, the public database of the US Department of Agriculture (USDA), from your browser: it receives the text of the food you search for and your IP address, not data from your account.

Some of these providers may process data outside the European Economic Area. When they do, the transfer relies on the safeguards the GDPR provides for: an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.

We may also disclose data to the authorities when a law requires us to.

5. Cookies and storage on your device

Bulkio uses only what it needs to work and, only if you allow it, optional tools:

• Necessary (no consent needed): the sign-in session (Clerk), your language, your interface settings and the cookie choice itself. The app does not work without them.
• Usage statistics (PostHog), only with your permission: stores an identifier in a cookie and in the browser's local storage, with names starting with "ph_".
• Session recording (Microsoft Clarity), only with your permission: sets the "_clck" and "_clsk" cookies.

Until you accept, those tools are not loaded and receive no data. You can change your choice at any time from the footer of the site or from Settings.

6. How long we keep it

• Your account: for as long as you keep it. When you delete it from Settings, we cancel your subscription and delete your data and progress photos from our systems.
• Billing: billing data and payment records are kept for as long as the applicable tax and commercial law requires, even if you delete your account.
• Messages and feedback: for as long as needed to help you.

Our providers may keep encrypted backups for a limited time after deletion.

7. Security

Data travels encrypted (TLS) and is stored encrypted at rest. Each account only reaches its own data through Row-Level Security policies in the database; the exception is the programs and routines you share with a link. Progress photos are kept in a private space and are only shown through temporary one-hour links. No system is infallible: if a breach affected you, we will notify you as the law requires.

8. Minors

Bulkio is not aimed at people under 18. If you think a minor has given us data, write to us and we will delete it.

9. Your rights (GDPR)

As the data subject you can exercise at any time:

• Access and portability: download your data from Settings → Privacy (a JSON file; it includes temporary links to your photos).
• Rectification: correct your data in the app or write to us.
• Erasure: delete your account from Settings → Privacy. It is permanent.
• Restriction and objection: you can ask us to stop processing your data in the cases the GDPR provides for, for example when the processing rests on our legitimate interest.
• Withdrawing consent: whenever you want, from the cookie preferences (analytics) or by deleting the health data you entered. It does not affect what was done before you withdrew it.

To exercise them, write to us at contact@scintly.com; we reply within one month at most. If you think we have not handled your data properly, you can complain to your data protection authority; in Spain, the Spanish Data Protection Agency (aepd.es).

10. Changes to this policy

If we change it in a relevant way, we will tell you in the app. The date above is the latest review.