Privacy notice

Version 19 September 2026 · test beta

What is stored and why

Your username, securely hashed password and recovery code support account access. Your goals, optional life-stage and dietary-source details, measurements, optional photos, food and exercise records, reviews and saved conversations support personalised plans and progress tracking. Health-related information is sensitive. Explicit health-processing consent is recorded separately from acceptance of terms, with the policy version and date. You can use a plan without body photos. A bounded consent history records the purpose, policy version, decision and time, without the content sent to AI. Consent records are retained separately after health-data deletion and removed on account closure.

AI and suppliers

When enabled, AI features send relevant inputs to OpenAI only after the confirmation shown for that request. Photo analysis sends selected photos; do not upload other people, nudity or unnecessary identifying information. AI keys stay on the server. API requests ask the provider not to store the response; this does not promise zero provider retention. Hosting uses the Sites platform with Cloudflare database and file storage. Payment processing, when enabled, uses Stripe; Papilio does not store full card details.

Barcodes and wearable imports

Barcode lookup sends only the product number to Open Food Facts through our server. Barcode camera frames stay on your device. Wearable CSV and Apple Health XML files are parsed locally; the original file is not uploaded. Only the readings you confirm are saved in your health record, with their source and date. They are included in your data export and removed when you delete health data. When configured, connecting WHOOP authorises retrieval of sleep and recovery readings. Access tokens are encrypted on the server and are excluded from exports. You can disconnect at any time; previously imported readings can be deleted separately. An optional setting retrieves and saves readings when you open Progress, at most once every 30 minutes; no background health monitoring is promised. Apple Health and Android Health Connect direct access require native mobile components and are not enabled in this web app.

Optional device storage and food tools

If you explicitly prepare an offline workout, the exercise list and draft sets are stored on this device for up to 48 hours. They are removed after successful syncing or when you clear the draft. Signing out, changing accounts or deleting health data through this browser clears its draft. Other offline devices cannot receive immediate deletion instructions; their temporary copies expire locally when next opened. Use a private device. Offline tickets on the server bind a draft to your account, consent and original workout to prevent conflicting changes.

Recipe-link imports send the selected public URL to its publisher, without your health records. Optional browser dictation uses your browser’s speech service, which may process audio externally. Dictated text remains editable and is not automatically sent to OpenAI or logged.

Your controls

Settings lets you review recent consent decisions, export structured records and obtain links to your private uploaded files, clear conversations, or delete health data and withdraw health-processing consent. Downloads require your signed-in account. Health-data deletion does not itself cancel membership or close your account. Password changes revoke existing sessions. Keep your recovery code private; losing both password and recovery code may prevent recovery.

Retention and security

Records remain until deleted, subject to the limits shown in the app. Current-month AI usage is retained to enforce allowances, and billing history is kept separately to administer subscriptions and avoid repeated trials. A complete statutory retention schedule and verified production backup-deletion timetable must be agreed before launch. App image preparation re-encodes supported photos, but server-side removal of all file metadata is not guaranteed. Check files before uploading.

Support reports should describe the problem without medical details, photos, passwords or payment credentials. Error diagnostics avoid health payloads. No security measure is an absolute guarantee.

Operator and further information

Papilio is operated by Whitechapel Apps Limited, the named data controller for this service. Company registration details will be published once supplied and verified. The applicable processing basis, processor agreements and international-transfer arrangements remain subject to the beta launch review. For privacy questions or support, email support@whitechapelapps.com; you can also use in-app support for product faults. This notice transparently identifies those unresolved launch requirements.

Information about your data rights from the ICO ↗ · Terms of use