1. The essentials, in five points
Afterbody handles data you don't show anyone. Here's exactly what we do with it.
- Your measurements and photos are hosted in Europe and tied to your account. et rattachées à votre compte.
- Your photos live in private storage, reachable only through temporary signed links that expire after an hour.
- We never sell, rent, or share any data for advertising purposes. There is no ad network in the app. à des fins publicitaires. Il n'y a pas de régie publicitaire dans l'application.
- Usage analytics are anonymized, never contain your weight, measurements, or photos, and switch off with one tap in settings.
- You can export everything and delete everything from within the app, without emailing us.
2. Who's responsible, and on what basis
The data controller is Sarah Kaddour, sole trader, contact details in the terms of service. No data protection officer is required at this stage; you can reach us directly at contact@afterbody.app for any question about your data.. Aucun délégué à la protection des données n'est requis à ce stade ; vous pouvez nous contacter directement à contact@afterbody.app pour toute question relative à vos données.
Your body measurements constitute health data under GDPR Article 9. We only process them on the basis of your explicit consent, collected on first launch and revocable at any time by deleting your account or the relevant data., au sens de l'article 9 du RGPD. Nous ne les traitons que sur la base de votre consentement explicite, recueilli au premier lancement et retirable à tout moment en supprimant votre compte ou les données concernées.
3. What we collect and why
| Data | Why | Legal basis | Pourquoi | Base légale |
|---|---|---|---|---|
| AccountApple or Google identifier, email, first name if you provide it | Create your account, sign you back in, retrieve your data on another device | Contract performance | identifiant Apple ou Google, e-mail, prénom si vous le renseignezCréer votre compte, vous reconnecter, retrouver vos données sur un autre appareil | Exécution du contrat |
| Body measurementsweight, body fat, 14 measurements, notes, goal, menstrual cycle if you enable it | Show your history and trend curves | Explicit consent (Art. 9.2.a) | poids, masse grasse, 14 mensurations, notes, objectif, cycle menstruel si vous l'activezAfficher votre historique et vos courbes | Consentement explicite (art. 9.2.a) |
| Progress photosimages and capture dates | Let you compare two dates | Explicit consent | images et dates de priseVous permettre de comparer deux dates | Consentement explicite |
| Apple Healthweight and body fat, read and write | Avoid double entry if your scale already writes to it | Consent, revocable in iOS Settings | poids et masse grasse, en lecture et en écritureÉviter la double saisie si votre balance y écrit déjà | Consentement, révocable dans Réglages iOS |
| Usage analyticsscreens opened, features used, device model, iOS version, language | Understand what's working and what isn't, fix bugs | Legitimate interest, with a permanent opt-out | écrans ouverts, fonctions utilisées, modèle d'appareil, version d'iOS, langueComprendre ce qui sert et ce qui bloque, corriger les erreurs | Intérêt légitime, avec opt-out permanent |
| SubscriptionPro status, anonymous purchase identifier | Unlock paid features and restore your purchases | Contract performance | statut Pro, identifiant d'achat anonymeDébloquer les fonctions payées et restaurer vos achats | Exécution du contrat |
| Notificationsdevice token, if you accept them | Send the weekly reminder you scheduled | Consent | jeton d'appareil, si vous les acceptezEnvoyer le rappel hebdomadaire que vous avez programmé | Consentement |
| Voice dictationvoice converted to text to log a measurement | Log without a keyboard; recognition is handled by iOS, we don't keep the audio | Consent | voix transformée en texte pour saisir une mesureSaisir sans clavier ; la reconnaissance est assurée par iOS, l'audio n'est pas conservé par nous | Consentement |
What usage analytics never contain: your weight, measurements, notes, or photos. When progress toward a goal is measured, only a percentage computed on your device is transmitted — never the values used to calculate it. votre poids, vos mensurations, vos notes et vos photos. Lorsqu'une progression vers un objectif est mesurée, seul un pourcentage calculé sur votre appareil est transmis — jamais les valeurs qui ont servi à le calculer.
4. How long we keep it
- Measurements and photos: for as long as your account exists. You delete them whenever you want, individually or all at once. tant que votre compte existe. Vous les supprimez quand vous voulez, à l'unité ou en totalité.
- After account deletion: erased within 30 days, including technical backups. effacement sous 30 jours, sauvegardes techniques comprises.
- Inactive account: after 3 years without a sign-in, we notify you by email, then delete the account absent a response. après 3 ans sans connexion, nous vous prévenons par e-mail, puis supprimons le compte faute de réponse.
- Usage analytics: 12 months. 12 mois.
- Invoices: kept for 10 years by Apple, for its own accounting obligations. conservées 10 ans par Apple, pour ses obligations comptables.
5. Who else touches it
We rely on a small number of providers, all bound by contract and prohibited from using your data for their own purposes.
| Provider | Role | Location | Rôle | Localisation |
|---|---|---|---|---|
| Supabase | Accounts, database, photo storage | European Union (EU West, Ireland) | Comptes, base de données, stockage des photos | Union européenne (EU West, Irlande) |
| PostHog | Anonymized usage analytics | European Union (eu.i.posthog.com) | Statistiques d'usage anonymisées | Union européenne (eu.i.posthog.com) |
| Apple | Distribution, payments, notifications, Sign in with Apple | Ireland / United States | Distribution, paiements, notifications, Sign in with Apple | Irlande / États-Unis |
| Sign-in with a Google account, if you choose it | Ireland / United States | Connexion avec un compte Google, si vous la choisissez | Irlande / États-Unis | |
| RevenueCat | Subscription management and purchase restoration | United States | Gestion des abonnements et restauration des achats | États-Unis |
Transfers to the United States rely on the European Commission's standard contractual clauses and, where applicable, the Data Privacy Framework. None of these providers receives your photos or measurements, except the host that stores them on your behalf.
We only disclose your data to an authority under a valid legal request, and inform you whenever the law allows it.
6. Your rights
You have the right to access, rectify, erase, restrict, and object, as well as the right to data portability and to withdraw your consent at any time. The app lets you exercise the most useful ones directly:
- Access and portability: Settings → Export my data (CSV for measurements, ZIP for photos). Réglages → Exporter mes données (CSV pour les mesures, ZIP pour les photos).
- Erasure: Settings → Delete my account. Réglages → Supprimer mon compte.
- Objecting to analytics: Settings → Privacy → Usage analytics. Réglages → Confidentialité → Statistiques d'usage.
For anything else, write to contact@afterbody.app: we reply within a month. You can also lodge a complaint with your national data protection authority (in France, the CNIL: 3 place de Fontenoy, 75007 Paris, cnil.fr).
7. Security
- Encryption of exchanges between the app and our servers (TLS), and encryption of data at rest.
- Per-account isolation: database access rules technically prevent reading another user's rows.
- Photos served through signed links valid for one hour, from non-public storage.
- Face ID lock on the app, enabled in settings.
No system is infallible. In the event of a data breach likely to result in a high risk to you, we notify you without undue delay and notify the relevant supervisory authority within 72 hours.
8. Minors
Afterbody is not intended for anyone under 16, and we do not knowingly collect their data. If you hold parental authority and believe your child has created an account, write to us: we'll delete it.
9. Contact us
A question about this document, a request to exercise your rights, a doubt about what happens to a piece of data: contact@afterbody.app. A human reply, within a month at the latest, usually well before.