Privacy Policy

Effective date: August 16, 2026
Last updated: August 16, 2026

This Privacy Policy describes how DuoTrack LLC ("DuoTrack," "we," "us," or "our") collects, uses, and shares information when you use the DuoTrack mobile application (the "App") and our website at duotrack.com (together, the "Services").

By using the Services, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Services.

1. Information We Collect

Information you provide directly

• Account information. Email address, username, display name, and optional profile photo. If you sign in with Apple, Google, or Facebook, we receive the name and email associated with that account as part of the sign-in process.
• Profile and goal data. Information you enter during onboarding and in the App, such as date of birth, height, weight, gender, activity level, fitness goals, and target calories and macronutrients.
• Nutrition data. Foods and meals you log, recipes, favorite foods, and related notes. If you photograph a nutrition label for AI analysis, the photo is processed to generate the result and is not stored on our servers.
• Workout and running data. Exercises, sets, reps, weights, personal records, workout notes, custom exercises, and — for outdoor runs — distance, pace, and GPS route data (see "Location" below).
• Progress photos and body measurements. If you use progress tracking, your photos are stored in private storage accessible only to you, along with associated measurements.
• Communications with the AI coach. Messages and images you send to DuoTrack's built-in AI coach. Your conversation history is stored in your account so the coach can maintain context across sessions. For images, we keep only a reference to the file on your device — never a copy of the photo itself.
• Voice recordings. If you use voice food logging, your audio is recorded and transcribed to create the log entry. Voice input may be processed by Apple's speech recognition service and/or our AI providers.
• Referral information. If you refer someone or are referred, we record the referral relationship to apply the associated offer.
• Marketing preferences. Whether you opt in to receive marketing communications from us.

Apple Health (HealthKit)

With your explicit permission, DuoTrack reads two types of data from Apple Health: sleep analysis, to show sleep insights and recovery information, and step count, to show your daily activity. These are the only Apple Health data types DuoTrack accesses, and DuoTrack never writes any data to Apple Health.

Our HealthKit commitments:

• Apple Health data is processed and stored on your device. The one exception is the AI coach: if you use it, the number of hours you slept last night is included in the coach's context so it can tailor its advice. That figure passes through our servers to the AI provider and is not stored on our servers. Your sleep stages, sleep efficiency, sleep history, and step counts are never transmitted.
• We never use HealthKit data for advertising, marketing, or similar purposes, and we never sell it or share it with data brokers.
• We never use HealthKit data to make eligibility determinations (such as for insurance, employment, or credit).

You can revoke HealthKit permission at any time in the iOS Settings app or the Health app.

Connected services (optional)

If you choose to connect a supported service, we access data from it to provide App features:

• Connected wearables — sleep and recovery data: sleep duration, sleep stages, sleep efficiency, and your sleep and readiness scores. We currently support Oura, and may add other wearables over time.
• Strava — activity data.

Sleep can reach DuoTrack from two places. If you connect a supported wearable, its data takes precedence on nights it recorded; Apple Health covers the rest. We collect only the figures the App actually shows you — wearables make considerably more available than we ask for, and we keep that request deliberately narrow.

Data from connected services is pulled to your device. Our servers store only the connection status (which service is connected and when it last synced) — not the underlying health or activity data. Your authorization tokens are stored securely in the device Keychain. You can disconnect these services at any time in the App or by revoking access in the third-party service's settings. As with Apple Health, if you use the AI coach, a short sleep summary — hours slept, plus your sleep and readiness scores — is sent to the AI provider through our servers, and is not stored there.

Location information

If you use outdoor run tracking (including Race Mode), we collect precise GPS location only during an active run session, including in the background while your run is in progress, to record your route, distance, and pace. Completed run routes are stored in your account so you can review your history. We do not collect location at any other time, and location data is never used for advertising or sent to analytics providers.

Information collected automatically

• Usage analytics. We use PostHog to understand how the App is used: app lifecycle events, screens viewed, interactions with interface elements, and product events (such as onboarding progress, feature usage, and milestones like personal records). After you sign in, this activity is associated with your account identifier and email address. Analytics payloads do not include your chat messages, food logs, health data, or location.
• Purchase data. Subscription status, product identifiers, trial status, and transaction receipts, processed through Apple and RevenueCat. We never receive your payment card details.
• Device data. Basic device and app version information needed to operate the App. We do not collect advertising identifiers (IDFA), do not use ad tracking, and do not display third-party advertising.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Services, including macro tracking, workout logging, run tracking, sleep insights, progress analytics, and gamification features (XP, levels, streaks, badges);
• Operate and personalize the App's AI coach (see below);
• Process and manage your subscription, including free trials and referral-based offers;
• Sync your data across sessions and keep your account secure;
• Send you service communications (such as account, security, or subscription notices);
• Send you marketing communications only if you have opted in, which you can withdraw at any time;
• Understand aggregate usage to improve the product;
• Comply with legal obligations and enforce our Terms of Service.

How the AI coach and other AI features process your data

OpenAI is the only AI provider DuoTrack uses. It powers coaching chat (including any photo you attach to a message), nutrition label scanning, and voice transcription. Every AI feature in the App routes to that single provider.

When you use an AI feature, the relevant content is sent securely to the provider to generate the result. For coaching, this includes your message, any photo you attach to it, and conversation context along with profile and progress information the coach needs to personalize its response — such as your first name, age, gender, height, weight and goals, daily nutrition totals, recent workout and running summaries, last night's sleep summary (hours slept, and sleep and readiness scores where a connected wearable provides them), streaks, and achievements. Requests to the AI provider are not accompanied by your account identifier, email, or contact information, and GPS coordinates are never included.

We do not permit our AI provider to use your data to train its models. Anything sent to the provider is then handled under its own API terms, which permit only limited retention for safety and abuse monitoring — a period the provider sets, not us. Photos submitted for nutrition label scanning are processed transiently and are not retained on our servers. A photo you attach to a coach message is sent once, with that message; we never store a copy, and your conversation keeps only a reference to the file on your device, so the photo is not re-sent with later messages and disappears from the chat if you delete it from your phone. If we add or change AI providers in the future, the same restrictions will apply and this policy will be updated before that happens.

The AI coach's responses are generated by artificial intelligence and are informational only — they are not medical, dietary, or professional advice (see our Terms of Service).

3. How We Share Your Information

We do not sell your personal information, and we do not share it with advertisers or data brokers. We share information only with:

• Service providers that help us operate the App, limited to what each needs:
  • Supabase — database, authentication, file storage, and backend infrastructure (hosted in the United States);
  • RevenueCat — subscription management and entitlement status;
  • OpenAI — AI processing as described in Section 2;
  • PostHog — usage analytics as described in Section 1;
  • Resend — transactional email delivery, such as password resets, which receives your email address;
  • Meta — only if you sign in with Facebook, to authenticate you. Meta receives your public profile and email for that purpose. DuoTrack keeps automatic in-app event logging to Meta switched off, so no purchase or usage data is sent to them;
  • Apple and Google — sign-in, payment processing, speech recognition (if you use voice features), and map services;
  • USDA, Edamam, FatSecret, and Open Food Facts — food and barcode database lookups (these receive only your search text or the barcode number, never your identity);
  • Oura and Strava — only if you connect them, to authorize and sync data as described above.
• Legal and safety. We may disclose information if required by law, subpoena, or legal process, or to protect the rights, safety, or property of DuoTrack, our users, or others.
• Business transfers. If DuoTrack is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Services. We retain certain information as necessary to comply with legal obligations, resolve disputes, and enforce agreements. When you delete your account, we delete your personal data from our production systems promptly. Residual copies may persist in encrypted backups for a limited period (up to 7 days) before being overwritten, and certain records may be retained where required by law.

5. Security

We use industry-standard safeguards to protect your information, including encryption in transit (TLS), encrypted storage, access controls, and row-level security on our databases. Progress photos are stored in private storage accessible only to your account. Connected-service tokens are stored in the secure device Keychain. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

6. Your Rights and Choices

Depending on your location, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your account and personal data;
• Export your data in a portable format;
• Withdraw consent to marketing at any time;
• Revoke HealthKit or location permissions in iOS Settings, and disconnect Oura or Strava at any time.

To exercise these rights, use the in-app options where available or contact us at support@duotrack.com. We will respond within the timeframe required by applicable law.

California residents: You have rights under the CCPA/CPRA, including the right to know, delete, and correct personal information, and the right to non-discrimination for exercising these rights. We do not sell or share personal information as defined by the CCPA.

7. Account and Data Deletion

You can delete your account directly in the App via Settings → Delete Account, or by contacting us at support@duotrack.com. Deleting your account removes your profile, nutrition logs, workout and run history (including GPS routes), progress photos, chat history, and other personal data from our servers, and clears the App's local data on the device where you request deletion, subject to the retention exceptions in Section 4. If you used DuoTrack on other devices, those devices can no longer access your account once it is deleted, and any locally cached data on them can be removed by deleting the App. If you connected Oura or Strava, you can additionally revoke DuoTrack's access in those services' settings.

8. Children's Privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe a child has provided us with personal information, contact us at support@duotrack.com.

9. International Users

The Services are operated from the United States, and your data is stored on servers located in the United States. If you access the Services from outside the U.S., you understand that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by email before the changes take effect. The "Last updated" date at the top reflects the most recent revision. Continued use of the Services after changes become effective constitutes acceptance of the revised policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices:

DuoTrack LLC
Houston, Texas, USA
Email: support@duotrack.com

See also: Terms of Service