Last updated: 13 August 2026 · Effective: 13 August 2026
DataBody (“the app”) is operated by Cleveni Inc. (“we”, “us”). For privacy questions, contact cs@cleveni.com.
If you do not sign in, everything you record stays on your device. We do not receive it. Signing in is what enables cloud sync across your devices.
Account information (only if you sign in): your email address and an account identifier. If you sign in with Apple, we also store an Apple refresh token for the sole purpose of revoking your Apple sign-in when you delete your account. If you agree to health data processing when you sign in, we also record that agreement: the date and the version of this policy you agreed to.
When you sign in with Google or Apple, the provider also passes your name and profile picture to our authentication service as part of the standard sign-in exchange. DataBody does not use them — your avatar in the app is drawn from the first letter of your email address. They are deleted together with your account.
Sign-in records (only if you sign in): our authentication service stores the IP address and the app or browser identifier used for each sign-in, for as long as that session stays active. We use them only to keep your account secure and to manage your sessions. They are deleted together with your account.
Health and fitness information you enter: body weight and other body measurements, food and nutrition entries (including any notes you write), exercise entries, habits, water intake, step and activity figures, and profile details such as height and date of birth. When you are signed in, this is synced to your account so your devices stay in step.
Device and usage information: app events (for example, that a record was saved), screen views, device model, operating system version, app version, and crash diagnostics. These never contain your health values — we log that an action happened, not what you recorded.
Purchase information: subscription and purchase status, handled by RevenueCat.
If you turn it on, DataBody can read from and write to Apple Health or Health Connect. This exchange happens on your device only. We do not receive this data through the integration, and we never share it with third parties. You can turn it off at any time, and you can revoke permission in your device settings.
We use Google Analytics for Firebase (usage measurement), Firebase Crashlytics (crash diagnostics), and Google AdMob for advertising. RevenueCat processes purchases, and Resend delivers the sign-in code emails we send you.
AdMob works with mediation partners — other advertising networks that may compete to serve an ad. Because this list changes over time, we maintain it separately at our advertising partners page. Each partner listed there is included in the consent choices we present to you where consent is required.
Where consent is required, analytics and crash reporting are switched off until you consent, and we do not enable ad personalization signals for the data we send. We do not send your health information to any analytics or advertising provider, and we do not build advertising audiences from health-related activity.
Advertising partners receive what is needed to request and measure an ad — an advertising identifier, device and app information, and approximate location derived from your IP address. They do not receive the health and fitness information you record in DataBody.
Paid subscribers see no advertising.
Health and fitness data is a special category of personal data. We process it on the basis of your explicit consent, which we ask for separately when you sign in, and to provide the service you asked for. Analytics, diagnostics, and personalized advertising rely on consent, which you can withdraw at any time. Account and purchase processing rely on performance of a contract.
Our servers are hosted in Seoul, Republic of Korea. If you use DataBody from another country, your information is transferred to and stored in Korea.
Transfers from the European Economic Area and from the United Kingdom are covered by the adequacy decisions those authorities have adopted for the Republic of Korea, so no additional transfer mechanism is required. If you are in a country that has not recognised Korea as providing an adequate level of protection — Switzerland, for example — we rely on standard contractual clauses or another safeguard permitted under your local law.
Separately from our servers, your device may include DataBody’s data in the automatic backup your operating system makes to your own iCloud or Google account. That backup belongs to you, not to us, and Android encrypts it end to end with your device lock secret. You can turn it off in your device settings. You can also export a backup file yourself from within the app and keep it wherever you choose — that file never passes through our servers.
We keep your data while your account exists. When you delete your account from within the app, we delete your records and revoke the Apple sign-in token, if any. Deletion markers are retained for a limited period so that the deletion propagates to your other devices, then removed.
For legal compliance and to defend against or resolve claims, we keep a minimal record that an account agreed to health data processing — a one-way hash of your email address or sign-in identifier, the policy version, and the dates — after the account is deleted. It contains none of your health data and cannot be reversed to identify you; it is used only if you later raise a claim, and is deleted once the applicable limitation period ends.
Signing out is not deletion — data already on your device stays there.
You can: export a backup file at any time; change your consent choices from the app’s privacy settings; disconnect the health platform integration; and delete your account and data from within the app. Depending on where you live, you may also have rights to access, correct, port, or restrict processing of your data. Contact cs@cleveni.com.
DataBody is not directed to children. You must be at least 14 years old to use the app. If the law where you live sets a higher minimum age for consenting to the processing of your personal data — 16 in parts of the European Economic Area, and 18 or higher in some countries — that higher age applies to you, and a parent or guardian must consent on your behalf where their law requires it.
If we learn that we have collected personal data from someone below the applicable age, we will delete it. Contact cs@cleveni.com.
We will post changes on this page and update the date above. Material changes will be notified in the app.