1. Who we are
ChangeStamp ("we", "our") is a body transformation tracking app. Our contact address is support@changestamp.com.
2. Information we collect
- Account information — email address and password hash when you register.
- Profile data — height, weight, age, sex, date of birth, and fitness goal that you enter voluntarily.
- Meal logs — food descriptions, photos, and AI-estimated macros you record in the app.
- Body photos — progress photos you upload; stored in your private storage bucket.
- Weight entries — dates and weights you log.
- Usage data — app version, device platform (iOS/Android), and anonymous usage events for debugging.
- Fraud-prevention signals — IP address, device fingerprint (a hash derived from non-sensitive device properties such as model, OS version, and locale), and behavioral patterns (signup velocity, referral graph). Collected only for the purposes described in Section 3.f below.
- Phone number — collected if you opt into or are required to complete SMS verification, such as for high-volume signups or fraud review.
- Identity verification documents — if an Earned Reward program requires identity verification, we may collect a government-issued ID image and a real-time selfie. These are processed by our KYC provider and not retained on ChangeStamp servers beyond verification.
3. How we use your information
- To provide the app's core features: meal logging, deficit tracking, weight trends, and body photo storage.
- To generate AI macro estimates from your meal descriptions and photos.
- To display personalized coaching messages based on your logged data.
- To verify new Purchased Credit payments through Apple App Store or Google Play Store, and to service existing Stripe obligations (we do not store card numbers).
- To send optional push notifications (reminders you configure).
- 3.f — Fraud prevention. IP address, device fingerprint, phone number (when collected), and behavioral patterns are used solely to detect and prevent abuse of the Referral Program, store purchases, Earned Reward offers, and account creation. These signals are retained for up to 24 months and are not used for advertising. We may share fraud-related signals with payment processors (Apple, Google, Stripe) when investigating chargebacks or coordinated abuse.
4. AI analysis disclaimer
ChangeStamp uses AI models to estimate meal macronutrients from text or photo descriptions. These estimates are for personal reference only and are not medical, clinical, or nutritional advice. Always consult a qualified healthcare provider for clinical nutrition guidance.
5. Data sharing
Before the first AI meal analysis, ChangeStamp shows an in-app disclosure and asks for your explicit permission. If you agree, the meal description and any photos you selected for that analysis may be sent to the configured AI provider. You may decline and continue entering or editing macros manually. You may also withdraw permission at any time under Profile > Account > AI meal data sharing; future AI meal analysis is then blocked unless you grant permission again.
We do not sell your personal data. We share data only with:
- Supabase — cloud database and storage (EU/US infrastructure).
- OpenAI / Google Gemini — AI providers that receive your meal descriptions/photos for analysis. They process data under their own privacy policies.
- Apple / Google — processors for new Purchased Credit payments. We pass an account identifier needed to verify store ownership; the stores handle payment details.
- Stripe — processor for existing customer obligations and creator payouts while those services remain active.
- SMS provider (e.g. Twilio) — when SMS verification is required, your phone number is sent to our SMS provider solely to deliver the verification code.
- KYC provider — when identity verification is required for a separate Earned Reward offer, your ID image and selfie are processed by our KYC provider under its privacy policy. Documents are not retained by ChangeStamp.
- Reward fulfillment providers — if you choose a separate Earned Reward offer, we pass the minimum contact and reward-selection data needed to deliver it. Purchased Credits are never sent to a cash or gift-card fulfillment provider.
- Vercel — web and API hosting.
6. Data retention
Your data is retained while your account is active. When you delete your account, your profile, meal logs, weight entries, and body photos are permanently deleted within 30 days.
7. Your rights
You may request at any time:
- Access to the personal data we hold about you.
- Correction of inaccurate data.
- Deletion of your account and all associated data.
- Export of your data in a portable format.
- Withdrawal of AI meal data-sharing permission without losing manual meal logging.
To exercise these rights, email us at support@changestamp.com.
8. Security
All data is encrypted in transit via HTTPS/TLS. Body photos are stored in private, access-controlled storage buckets. We follow industry-standard practices to protect your information.
9. Children
ChangeStamp is not intended for users under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us data, contact us and we will delete it promptly.
10. Changes
We may update this policy. Material changes will be communicated via email or an in-app notice. Continued use after the effective date constitutes acceptance.