Privacy policy for the Shredded app
Shredded is made by Boost Lab Digital LTD. This policy explains what the app collects, where it goes, and how long it stays there.
It is written to be read, not to be survived. Where the honest answer is less reassuring than the comfortable one, the honest answer is here.
The short version
- Your progress scan photos stay on your phone. A smaller copy of each one is sent to be analyzed, and that copy is subject to a 30 day retention window at the company that runs the model.
- There is no account and no password unless you choose to connect Apple.
- We never receive your name, and we only receive an email address if you connect Apple or contact support.
- Nothing you photograph is used for advertising, sold, or shared with anyone outside the services named below.
- We do not track you across other apps or websites.
Who we are
Boost Lab Digital LTD is the data controller for the information described here.
Contact: privacy@boostlabdigitalltd.com
What the app collects
Photographs. Progress scans of your torso, and photos of meals or nutrition labels, taken with the camera inside the app.
What you enter. Your age, height, weight, sex, training goal, where you train, which days you are available, meals you log by hand, and any correction you make to an estimate.
What the app calculates. Your Shred Score, an estimated body fat range, calorie and protein targets, your training programme, and your workout and meal history.
Technical information. An anonymous identifier created for your installation, your device model, your iOS version, and which version of the app you are running.
The app does not ask for your name, and it has no sign up screen.
Your photographs
This is the part worth reading closely, because the two kinds of photo are treated differently.
Progress scans
The scan you keep never leaves your phone. It is written to the app's own storage on the device. We cannot see it, and it is not uploaded to us or backed up to us.
To calculate your score, the app makes a separate, smaller copy with its metadata removed and sends that copy to be analyzed. The copy is deleted from your phone once the reading settles, whether it succeeded or failed.
Meal photos and nutrition labels
A meal photo is sent for analysis in the same way and the full photo is then deleted from your phone.
After a successful estimate, the app may keep a small preview, about 720 pixels wide, so the entry is recognizable in your food log. That preview stays on your phone, is never sent anywhere, is deleted when you delete the meal, and expires after 90 days. A photographed nutrition label is never kept as a preview.
Where an analysis copy travels
- The app writes a temporary file in its own storage on your phone.
- That file is sent over an encrypted connection to a small service we run, hosted by Supabase. The service reads it and passes it on. It does not save it, and it does not write it to any storage of ours.
- The service passes the image to Anthropic, who run the model that reads it.
The image is never given a public address, never written into a log, never attached to a crash report, and never included in analytics.
How long Anthropic keeps an analysis copy
Anthropic's standard commercial API terms allow them to retain what is sent and what comes back for up to 30 days, for trust and safety purposes. That applies to every photo copy your phone sends, for both scans and meals.
We have not arranged a shorter retention period, and we cannot recall a copy inside that window. If that ever changes, this page changes with it.
Anthropic states that data sent through their commercial API is not used to train their models.
Deleting a photo in the app deletes it from your phone. It does not delete a copy already sent, and nothing in the app claims otherwise.
If you connect Apple
Connecting Apple is optional. The app works fully without it.
Connecting it gives your progress a home that survives losing your phone. When you do:
- Apple provides a sign in token. Our authentication provider, Supabase, creates an account from it, identified by an Apple-provided identifier and the email address Apple supplies. If you chose to hide your address, Apple supplies a private relay address instead and we never see your real one.
- Your profile, plan, nutrition, workout history and scan scores are saved to that account.
- Scan photographs are not. Every backup has the photo file references removed before it is uploaded, so a backup can restore your history and never your pictures.
Signing out uploads your latest state, removes scan photographs from the phone, and clears local user data.
Purchases
Subscriptions are sold through Apple. We never see your card details, and Apple does not give them to us.
We use RevenueCat to tell us whether a subscription is active. They receive a purchase identifier and the receipt information Apple provides. They do not receive your photos, your body data, or your name.
Crash reports
When the app hits an error we send a report to Sentry, hosted in the European Union, so it can be fixed.
A report contains what went wrong and where in the code, the names of the screens you moved through beforehand, your anonymous identifier, your device model, your iOS version, and the app version and build.
A report never contains a screenshot, a screen recording, a session replay, the contents of any request, anything the app wrote to its logs, your name, your email address, your weight, your height, your body fat reading, or your score. These are switched off deliberately rather than left at their defaults.
Analytics
We use PostHog, hosted in the European Union, to understand which steps of setup people finish and where they stop.
What we send is narrow and fixed: which step of the funnel you reached, the outcome of a purchase attempt, and your anonymous identifier.
PostHog's automatic collection is switched off. It does not resolve your IP address into a location, does not record taps or screens automatically, does not build a profile of you, and does not record your screen. It never receives a photograph, any body measurement, or a name.
Support messages
If you contact support through the app, we receive your message and the reply address you type. Both are used to answer you and nothing else.
Barcode lookups
Scanning a barcode sends only the numeric product code to Open Food Facts, a public food database. No image is captured and nothing about you is sent.
Exercise videos
Exercise demonstrations are video files served from our own storage. Your device requests them the way it requests any file on the internet. They are the same files for everybody and nothing about your request identifies you.
What stays on your phone
Your scan photographs, your meal previews, your meals, your scores, your measurements, your training history and your plan all live on the device. If you have not connected Apple, that is the only place they exist.
Legal bases for using your information
Under UK GDPR we rely on:
- Contract, to give you the app you asked for: calculating your plan and your targets, analyzing the photos you choose to take, and keeping your history.
- Legitimate interests, to keep the app working and to improve it: crash reporting, the narrow analytics above, and limiting how many analyses one installation can run in a day.
- Contract, for purchases and subscription status.
A body fat estimate derived from a photograph may be treated as health data. We treat it carefully for that reason: it never reaches analytics or crash reporting, and it is never used for advertising.
Where your information is processed
- Sentry and PostHog: European Union.
- Anthropic: United States.
- Supabase and RevenueCat: may process outside the United Kingdom.
Where information leaves the United Kingdom, it is transferred under the safeguards those providers offer for international transfers.
How long we keep things
- Analysis copies of photos: deleted from your phone as soon as the reading settles. Retained by Anthropic for up to 30 days, as above.
- Meal previews on your phone: up to 90 days, or until you delete the meal.
- Scan photographs on your phone: until you delete them, or until you delete the app.
- Your account backup, if you connected Apple: until you delete your account.
- Crash reports and analytics: according to the retention settings of Sentry and PostHog.
Your choices and your rights
In the app you can:
- Delete any scan photograph. Your score history is kept, so deleting a photo does not cost you your progress.
- Delete your account and the data stored with it.
- Delete the app, which removes everything stored on the phone.
Under UK GDPR you also have the right to ask for a copy of your information, to have it corrected, to have it deleted, to restrict or object to how it is used, and to complain to the Information Commissioner's Office at ico.org.uk.
To exercise any of these, write to privacy@boostlabdigitalltd.com.
There is a limit worth stating plainly: we cannot recall an analysis copy already inside Anthropic's 30 day window, and if you have never connected Apple we hold nothing that identifies you beyond an anonymous installation identifier.
Children
Shredded is for people aged 13 and over. Someone under 13 cannot complete setup, create a profile, receive targets, or submit a photograph.
Tracking
We do not track you across other companies' apps or websites, and nothing in the app is used for advertising.
Changes to this policy
If this changes in a way that affects what happens to your photographs, the app will tell you rather than quietly updating this page.
Contact
privacy@boostlabdigitalltd.com
Boost Lab Digital LTD