Privacy Policy for Form Focus Mobile Application

Effective Date: January 14, 2026

Last Updated: September 17, 2026

Scope and contact information

This Privacy Policy ("Policy") describes how Form Focus LLC ("Form Focus," "we," "us," or "our") handles information through the Form Focus mobile application ("App"). The App analyzes exercise videos, records workout information, and can provide optional AI-assisted feedback.

The App is intended only for adults aged 18 or older. Parental permission does not authorize a person under 18 to use the App.

You do not create a named Form Focus account. Some Firebase features create pseudonymous installation and anonymous authentication identifiers as described below.

Use the secure privacy request form for privacy questions, access, correction, deletion, or other privacy requests. Do not enter API keys, passwords, authentication tokens, or private recovery codes in that general contact form.

Registered office for legal notices only:

Form Focus LLC, 5900 Balcones Drive, Suite 100, Austin, Texas 78731, United States

Information kept on your device

Videos, audio, and local analysis

Workout videos you record with the App or select through Android's system picker are analyzed on your device.
Pose detection, object detection, repetition counting, movement measurements, and most workout processing happen on your device.
The App does not intentionally upload raw workout videos or their recorded audio to Form Focus, Firebase, or OpenAI.
Camera recordings are saved in user-visible Android media storage under Movies/Form Focus Video. Screen recordings of the App's analysis display are saved under Movies/AppRecordings.
A selected video can remain owned by the content provider from which you selected it, such as a device gallery or cloud-backed picker. The App may retain an Android read grant for a selected video when the provider supports that feature.

App-private data

Depending on the features you use, the App stores some or all of the following in its private storage:

workout names, notes, dates, times, thumbnails, and processing state;
pose and object landmarks, repetition data, form assessments, velocities, power estimates, and other workout measurements;
body height, body weight, equipment measurements and weights, units, detector settings, display preferences, and device capability or benchmark results;
generated workout plans, exercises, sets, weights, progress, completion notes, and links to recorded workouts;
AI conversation prompts and responses, selected workout context, plan-reanalysis history, and training-continuity reports;
images that you attach to workout plans or conversations and locally generated files or caches; and
a local record of Terms acceptance and pending delivery state.

Most of this information is stored in ordinary app-private databases, files, or preferences protected by Android's application sandbox. It is not separately encrypted by Form Focus unless this Policy says otherwise.

OpenAI API key

If you choose to use AI features, you provide an OpenAI API key. The App encrypts the key with an Android Keystore-backed AES-GCM key and stores only the encrypted payload in private preferences. If secure storage is unavailable, the App refuses to save the key as plaintext.

The key is read on your device and sent as an authorization credential directly to OpenAI when you make an OpenAI request. It is not sent to a Form Focus server. You can remove the stored key in the App's settings. Removing it locally does not delete information already processed by OpenAI under your OpenAI account or project.

Backups, exports, and shared-storage files

The production App is configured to disable Android-managed cloud backup and device-to-device extraction of App-private data. It sets Android's backup flag to disabled and supplies production-specific rules that exclude App-owned files, databases, and preferences from both cloud backup and device transfer. Android notes that backup behavior can vary on some manufacturers' devices, but the production configuration does not intentionally include any App data.

Form Focus also provides separate user-controlled export and backup features:

you can export workout reports, workout plans, CSV or PDF files, readable data archives, and restorable backup archives;
you can choose a document provider or folder for manual or scheduled backups; and
you can send supported output through Android's Sharesheet to an app or service you select.

These output files can contain workout details, plans, notes, fitness measurements, conversations, or AI responses. Form Focus backup archives, CSV files, PDFs, and other exported files are not encrypted by the App. A destination you choose may be a cloud-backed provider and may apply its own privacy and retention practices.

Files in public media storage, Downloads, a selected folder, or another provider are not necessarily removed when you delete an App record or uninstall the App. Manage those copies through Android or the destination provider. Scheduled backups use a Form Focus automatic-backup filename that is separate from manual backups. After a scheduled backup succeeds, the App retains the five newest files that match that automatic-backup filename and does not delete other files in the selected folder. A failed provider deletion can leave more than five automatic backups.

Information transmitted automatically or as part of required operation

Firebase Crashlytics, Installations, and Sessions

Firebase Crashlytics is enabled automatically and can initialize when the App process starts, including before onboarding is completed. It collects crash, Application Not Responding (ANR), and developer-recorded nonfatal error reports. Firebase Installations and Firebase Sessions are included with this diagnostic stack.

Diagnostic data can include:

stack traces, exception types and messages, native crash data, and relevant App state;
App version, operating system, device manufacturer and model, orientation, memory or storage state, and network connection type;
session and foreground-start timing used for crash-quality metrics;
a Firebase installation ID, Crashlytics installation UUID, and related session identifiers;
for App-recorded nonfatal reports, a fixed diagnostic schema containing only event type, area, operation, stage, error category, bounded retry values, HTTP status class, and an optional bounded item count; and
a generic device-security warning category and bounded signal count when local security checks find a risk or a probe cannot complete.

Form Focus does not send free-form Crashlytics breadcrumbs or process-global custom keys. Before an App-recorded nonfatal exception reaches the Crashlytics SDK, the App replaces the throwable and removes its original message, cause, suppressed exceptions, source filename, provider response, prompt, exercise or health notes, credentials, account identifiers, filenames, paths, URI values, and response body. Firebase-generated crash, ANR, native, device, installation, and session fields remain governed by Firebase's SDK behavior. Crashlytics is used for stability, security diagnostics, recovery analysis, and bug fixing, not advertising.

The current production App does not provide an in-App control to opt out of Crashlytics collection.

Form Focus does not include Firebase Analytics, Firebase Performance Monitoring, advertising SDKs, or an Advertising ID permission in the current production build. Firebase Sessions still records the limited session data described above for crash-quality metrics.

Firebase Installations and related SDK traffic include a Firebase user agent. Firebase's Android SDK disclosure states that this user agent can include the App's installer source, such as Google Play, and the Firebase SDKs included in the App and their versions. Google uses that information to measure platform and version adoption and to maintain and improve Firebase services.

Firebase App Check, Google Play Integrity, and device-security checks

The Google Play-distributed production release uses Firebase App Check with Google Play Integrity. App Check proactively requests an integrity token during process startup and attaches valid tokens to protected Firebase requests. Internal development and profiling builds can use Firebase's debug App Check provider for testing; those builds and debug tokens are not distributed through Google Play.

Google documents that Play Integrity can process request data, App package/version/signing metadata, Google Play license status for signed-in accounts on the device, and device attestation information. Form Focus uses these signals to confirm that requests come from an authentic App installation and to reduce abuse. We do not use Play Integrity to fingerprint or track users.

The production App also performs local security probes for root, emulation, debugging, developer options, USB debugging, sandbox or app-cloning environments, runtime instrumentation, and App-integrity risks. Those raw signal names remain local. If a finding or probe failure occurs, the App sends only a generic security event and bounded signal count to Crashlytics for fraud prevention, security, and compliance. The App does not request broad package-inventory access.

Anonymous Firebase Authentication

When the App needs to write a protected Firebase record, it signs in anonymously and obtains a Firebase Authentication UID. Firebase Authentication can also receive ordinary connection metadata such as IP address, user-agent information, SDK/platform information, and the Firebase Android App ID for security and service operation.

The App does not ask for a Firebase password, phone number, social login, or named profile. The anonymous UID is not a public profile, but it is a persistent pseudonymous identifier and is attached to the Firestore records described below.

Terms acceptance records

To record required Terms acceptance, the App sends Firebase Firestore:

the anonymous Firebase UID;
acceptance timestamp, Terms version, Terms and Privacy Policy URLs;
App version, device model and manufacturer, Android version, and Android SDK level; and
the list of clauses and acknowledgments accepted in the onboarding dialog.

These records use the anonymous Firebase UID, not Android ID. If delivery fails, a private on-device pending marker supports a limited number of automatic delivery retries; a later app session can retry pending delivery.

Automatic moderation-event records

When local moderation evaluates user input or an AI response, the App may send a moderation event to Firestore. An automatic event contains the anonymous UID, an event ID, a SHA-256 hash of normalized content, content length and type, category, matched-pattern metadata, severity, source, policy version, timestamp, App version, and device model.

The automatic Firestore event does not contain the raw text or image. The hash is still linked to the anonymous UID and must not be treated as fully anonymous data.

Information transmitted when you choose a feature

Feedback and content reports

If you submit feedback, the App sends Firestore the feedback text, optional email address, feedback type, timestamp, App version, device information, anonymous UID, and a report ID.

If you report AI or conversation content, the App sends the selected message text, a hash of that text, whether the message was AI-generated, report category, optional details, timestamp, conversation and model identifiers when available, device information, anonymous UID, and a report ID. Unlike automatic moderation events, an explicit content report includes the reported raw message text.

Data-deletion requests

If you select Request Data Deletion under Settings > Help & Legal, the App asks whether the request covers mobile App data, website submissions, or both. It saves the request securely on your device and submits a protected request containing a random request ID, the anonymous UID from the authenticated Firebase session, scope, timestamp, request version, and pending status. For website scope, it also includes the email you provide to locate submissions. You cannot type or replace the authenticated mobile UID.

The current request route writes to Firebase Firestore for authorized Form Focus administrators to process. A saved request is not confirmation of delivery, and a received request is not confirmation of deletion. The App retains the request so it can retry delivery without starting a different request. The current route does not provide in-app progress after receipt or private recovery-code issuance.

Submitting a mobile deletion request pauses affected Terms, moderation, feedback, and report uploads from this installation, including while offline and after completion. Local exercise analysis remains available. A website-only request does not pause mobile uploads. Submitting a request does not erase your local records, public recordings, exports, or provider-held copies.

Firebase Authentication establishes control of this installation's anonymous identity. An email address, typed UID, or public request reference alone does not prove ownership. Website requests require separate ownership verification. Use the secure privacy request form if protected submission is unavailable; do not enter secrets or unnecessary workout information there.

OpenAI Responses and Moderation APIs

AI features are optional. When you start an AI feature, the App sends your OpenAI API key and the applicable request directly to OpenAI. OpenAI also receives ordinary connection metadata such as the source IP address, request timing, and client/network metadata. A network recipient can use an IP address to infer a general or approximate location under its own policies. Depending on what you select or enter, OpenAI can receive:

prompts, questions, conversation history needed for the turn, and OpenAI-generated follow-up context;
workout names, dates, notes, repetition summaries, form assessments, pose/object measurements, velocities, power estimates, and other selected fitness data;
goals, concerns, experience, equipment, preferences, additional notes, and injury history entered in workout context;
generated workout plans, progress notes, completed-workout links, reanalysis context, and images attached to a plan;
images you attach to a conversation; and
filenames plus extracted or parsed PDF/CSV content. If a PDF has insufficient extractable text, the App can render pages as images for a vision-capable model.

The App does not append your Firebase UID to OpenAI requests. It does not intentionally send raw workout video or recorded microphone audio. Do not include personal, health, or other sensitive information in a prompt or attachment unless you want OpenAI to process it.

The App sends the completed text and applicable images to OpenAI's Moderation API as a separate request. The moderation request and the main model request run concurrently. If moderation flags the request, the App attempts to cancel the model request and suppress its result, but the content may already have reached OpenAI before cancellation.

Ordinary OpenAI Responses requests set store=false. Background workout-plan generation sets store=true because the App must retrieve and poll the background response. Under OpenAI's current standard controls, abuse-monitoring logs can be retained for up to 30 days and Responses data sent with store=true is stored for at least 30 days. Eligible account-level retention controls and legal or safety exceptions can change those periods. OpenAI states that API inputs and outputs are not used to train its models by default unless the account owner opts in. OpenAI also states that image and file inputs can be scanned for child-safety purposes and that material flagged by those systems can be retained for manual review even when another retention control would otherwise apply. Deleting a local conversation, workout plan, or API key does not delete OpenAI-side records.

Current OpenAI data controls: https://developers.openai.com/api/docs/guides/your-data

OpenAI privacy information: https://openai.com/policies/privacy-policy/

Markdown content and external links

Conversation and saved-analysis text is rendered as Markdown. The App supplies a restricted image loader that rejects every Markdown image request, including network, file, content-provider, and data URI sources, before a fetch can begin. Displaying user, stored, or AI-generated Markdown therefore does not automatically contact a host named in an embedded image.

Markdown links can take you to an external app or website only when you select them. Review the destination before continuing; the selected recipient's privacy policy applies.

User-directed sharing and external providers

When you choose a system picker, export destination, backup folder, Sharesheet target, or external link, Android or the selected third-party app/provider handles that transfer. The recipient's privacy policy applies. Form Focus does not control copies retained by a recipient.

How information is used

We use the information described in this Policy for:

App functionality: video analysis, workout history, reports, plans, AI feedback, backup/restore, authentication of Firebase writes, and support;
Personalization: tailoring optional AI feedback and workout plans to the context and fitness information you choose to provide;
Diagnostics and analytics: monitoring crashes, ANRs, failures, sessions related to crash quality, device compatibility, and performance;
Fraud prevention, security, and compliance: App attestation, abuse prevention, content moderation, Terms acceptance evidence, and legal obligations; and
Customer support: receiving and responding to voluntary feedback or support requests.

We use automatic moderation events and reported content for moderation, safety, abuse prevention, and handling reports.

We do not sell personal information. We do not use App data for advertising or cross-context behavioral advertising. The current production App contains no ad SDK or general product-usage analytics SDK.

Service providers and recipients

The App can involve these recipients:

Google Firebase: Crashlytics, Installations, Sessions, Authentication, App Check, and Firestore. Firebase privacy information: https://firebase.google.com/support/privacy
Google Play: Play Integrity processes App and device attestation information. Data-safety information: https://developer.android.com/google/play/integrity/terms#data-safety
OpenAI: Responses and Moderation APIs are called only with the API key you provide and when you use an AI feature. OpenAI's API/customer terms and data controls apply to your account or project.
Providers and apps you select: a content picker, backup/export destination, Sharesheet recipient, cloud-backed folder, or external link can receive data at your direction.

We may disclose information if legally required, to protect rights or safety, or in connection with a corporate transaction, subject to applicable law.

Third-party software

The App also contains third-party open-source libraries, on-device machine-learning runtimes, and bundled model files. These components ordinarily operate on the device unless a network recipient is expressly described in this Policy. Their software licenses do not determine whether data is collected; this Policy discloses data handling based on the behavior of each component and service. Applicable third-party license and attribution notices must be provided with the distributed App.

Retention and deletion

On-device data

App-private data remains until you delete the applicable item, clear App storage, or uninstall the App. The available deletion controls differ by feature. For example, deleting a workout record does not necessarily delete a separate video in public media storage, and deleting a local AI conversation does not delete OpenAI-side data.

Public recordings, exported reports, and backups in user-selected storage can remain after App data is cleared or the App is uninstalled. Delete those copies from Android storage or the destination provider. Scheduled-backup cleanup retains the five newest Form Focus automatic backups after a successful export and ignores unrelated and manual-backup files; provider deletion failures can leave additional automatic backups.

Firebase and Google Play Integrity data

Firebase currently states that Crashlytics keeps crash stack traces, extracted NDK minidump data, and associated installation identifiers for 90 days before starting removal from live and backup systems. Form Focus does not itself enforce that provider retention period.
Firebase states that Authentication keeps logged IP addresses for a few weeks and retains other authentication information until the Firebase customer deletes the associated user, after which removal from live and backup systems can take up to 180 days. The App does not directly delete its anonymous Firebase user; the authorized deletion process deletes that user after associated application records are handled and verified.
Sessions, Installations, and App Check data follow the applicable Firebase settings and service terms; the current App has no user-facing deletion control for those SDK records.
Google states that Play Integrity data is deleted after a fixed retention period, but its data-safety disclosure does not state the duration. Form Focus does not control that provider retention period or expose a user-facing deletion control for it.
Feedback and content reports are retained while needed to review and resolve the submission, operate the service, protect users, or meet legal obligations.
Data-deletion requests are retained while needed to verify ownership, process and document the request, resolve disputes, or meet legal obligations. The request can contain the authenticated anonymous App UID and a website email when relevant. We explain any retained records and the applicable reason and duration or criteria when responding to a request. This request intake does not promise automatic deletion or a fixed cleanup schedule.
Moderation events are retained while needed for security, abuse prevention, compliance, and investigation.
Terms acceptance records can be retained as legal and audit records.

The current client does not directly delete Firestore records, the anonymous Firebase Authentication user, or individual Crashlytics records. Its in-App control creates an authenticated deletion request for authorized Form Focus administrators to process. The current intake rules prevent ordinary clients from reading or deleting submitted requests.

OpenAI and other recipients

OpenAI retention depends on the account/project associated with your API key, the endpoint, request settings, and provider controls described under OpenAI Responses and Moderation APIs above. Removing a local conversation, plan, or API key does not delete OpenAI-side records. Use your OpenAI account controls or contact OpenAI for those requests. Other apps and storage providers apply their own retention rules.

Requests

For mobile server-data deletion, use Request Data Deletion under Settings > Help & Legal while you still have the original installation. For access, correction, deletion, or other privacy questions, use the secure privacy request form. Select "Delete or correct my data" for a deletion request, identify the mobile App, website, or both, and provide a reply email. The form does not automatically prove ownership of mobile or website records.

Keep the original installation and request receipt until your request is resolved. Uninstalling or clearing App storage can remove the anonymous identity and saved receipt. Reinstalling does not restore that identity. The current request route does not issue recovery codes, and the general contact form must not be used to submit a private code or authentication credential.

We aim to respond within 30 days and comply with applicable response deadlines. This is a response target, not a promise that every deletion, verification step, or provider backup expiry finishes within 30 days. We may request additional ownership evidence. Some diagnostic or pseudonymous records may not be reasonably linkable to your identity. Where retention is required for legal, security, fraud-prevention, or recordkeeping purposes, we explain the retained information and its handling in our response.

Security

We use reasonable safeguards appropriate to the information processed:

App-controlled Firebase and OpenAI traffic uses HTTPS/TLS, and the production manifest disables cleartext network traffic.
The OpenAI API key is encrypted with an Android Keystore-backed AES-GCM key; the App refuses to save it as plaintext when secure storage is unavailable.
App-private files, databases, and preferences are protected by Android's application sandbox, and production backup rules exclude them from Android cloud backup and device transfer.
Firebase Authentication, Firestore Security Rules, and App Check restrict the backend write paths described in this Policy.
The production App currently relies on the Android system trust store and does not use active certificate pinning.
User-visible recordings and exported ZIP, CSV, PDF, or text files are not encrypted by Form Focus.

No transmission or storage method is completely secure.

Android permissions and system access

The current production App does not request broad storage, READ_MEDIA_*, location, contacts, phone, or SMS permission. It uses Android system pickers and scoped content grants for selected videos, images, documents, backup files, and folders.

Feature-scoped permissions are:

Camera: requested only when you choose Record Video. Imported-video features remain available without it.
Microphone: optional for audio in camera or screen recordings. Recording can continue without microphone audio.
Notifications: optional for foreground progress and completion alerts for video preprocessing and workout generation. The App does not use Firebase Cloud Messaging.

The App also uses normal Android capabilities for internet access, network state, vibration, foreground services, boot rescheduling, and wake locks so it can make the disclosed network requests and complete user-started processing or backup work.

Your choices

You can:

use local video-analysis features without providing an OpenAI API key;
decline Camera, Microphone, or Notifications permission and use the remaining supported features;
choose which videos, images, documents, workouts, context, and backup/export destinations to use;
remove your OpenAI API key in settings;
delete supported local records and public files separately;
stop scheduled backups and revoke a provider's folder permission; and
use Request Data Deletion under Settings > Help & Legal or contact us about Form Focus server-side information.

California privacy rights

Depending on how you use the App, categories handled under California law can include identifiers (anonymous Firebase UID, installation identifiers, and optional email), approximate or general geolocation inferred by a network recipient from an IP address, internet or electronic activity (limited session, diagnostic, generic device-security, moderation, and Terms events), audio/visual information, fitness or health information, user-provided content, and inferences or analyses generated from workout data. Raw locally detected security-tool signal names are not sent in App-recorded nonfatal reports.

California residents may have rights to know, access, correct, or delete personal information and to receive information about its use, subject to exceptions. Form Focus does not sell personal information or share it for cross-context behavioral advertising. We will not discriminate against you for exercising an applicable right. Submit requests using the Requests instructions above.

Children's privacy

Form Focus is not intended for anyone under 18, consistent with the App's Terms of Service. We do not knowingly seek personal information from children. If you believe a child has provided information through the App, contact us so we can investigate and take appropriate action.

International processing

Form Focus operates from the United States. Firebase, OpenAI, and providers you select may process information in the United States and other countries under their terms and applicable transfer safeguards.

Changes to this Policy

We may update this Policy when the App, providers, or legal requirements change. We will update the date above and, when appropriate, provide an in-App notice or require renewed acknowledgment. We will provide any additional disclosure or consent required before introducing a new use of personal or sensitive data.

Questions

Registered office for legal notices only:

Form Focus LLC, 5900 Balcones Drive, Suite 100, Austin, Texas 78731, United States

This Policy describes the App's data practices; it does not replace the separate Terms of Service.