Where your data lives
On your phone. Here is what that actually changes.
The short version: your logs, weight, measurements, meals, workouts and your twin are stored on your device, not in an account on our servers. Most of what follows is a consequence of that one architectural choice.
The formal document is the privacy policy and it is the one that counts. This is the plain-words version of what it says.
Photos are optional, and are never stored
Your twin is built from your own metrics. Nothing in the app makes you upload anything. If you do add the posed shots during setup, they are processed in memory only, are never stored on our servers, are never used to train AI models, and are discarded the moment your twin is built. Your photos are private and never posted publicly.
That is worth stating twice because it is the question people ask first, and because the honest answer to "how do I delete my photos" is that there is nothing to delete.
Apple Health is a one-way door you control
If you grant permission, steps, workouts and last night's sleep sync in automatically, and imported workouts de-duplicate themselves against anything you logged by hand. If you never connect Health, every one of those falls back to manual entry and nothing about the app stops working.
- The permissions live in iOS, not in our app — Health → Sharing → Apps → ftns.ai.
- You can revoke any category, at any time, without telling us.
- Apple Health data is used only to run your own experience. It is never used for advertising, never shared with data brokers, and never sold.
Analytics you can switch off, that never see a number
Anonymous usage analytics sit behind a switch in Settings → Privacy. They never include a health value in the first place — not your weight, calories, macros, measurements, or anything from Apple Health — and the switch is there anyway.
One tap deletes everything
Settings → Account → Delete everything. Profile, logs, twin, scores — gone from the device. No email to write, no waiting period, no retention offer, no five-screen flow designed to talk you out of it. It is permanent, so export anything you want to keep first.
Why it is built this way
Partly conviction, partly arithmetic. A product with no social layer has very little reason to hold your data centrally — there is no profile for anybody to look at and nothing to compare. Removing the feed removed the reason for the server. The longer version of that argument is here.
Anything that would need to leave the device for processing asks first, per feature, and you can revoke it later. If something in this article and something in the privacy policy ever disagree, the policy wins and we have a bug to fix — tell us and we will.