OCTANE
Download

Privacy Policy

Last updated: September 12, 2026

OCTANE HEALTH (“we”, “us”, or “our”) operates the OCTANE mobile application (the “App”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

1. Information We Collect

Personal Information

  • Name, email address, and password (hashed) when you create an account
  • Age or date of birth and body weight for fitness calculations

Health & Fitness Data

  • Workout logs including exercises, sets, reps, and weights
  • Meal logs including food descriptions, photos, and estimated macronutrients (calories, protein, carbs, fat)
  • Health metrics synced from Apple HealthKit or Google Health Connect (including activity, sleep, heart, respiratory, body, mobility and nutrition data, and optional cycle, symptom, mood, assessment and medication data) — only with your explicit permission
  • Macro goals and dietary preferences

Voice & Chat Data

  • Text messages sent to the AI coaching chat
  • Voice audio and transcripts sent during voice coaching sessions. OCTANE does not save raw voice audio in its own database, but the AI provider may retain limited service or abuse-monitoring logs as described below.
  • AI-extracted personality facts and preferences derived from your conversations

Photos

  • Meal photos submitted for AI-powered nutritional analysis

Optional Restaurant Context

  • If you tap the nearby restaurant option and allow location access, the App sends your approximate location to our backend and the OpenStreetMap Overpass service to suggest nearby places. We do not track location in the background or save location history to your account.
  • The App can identify a restaurant from your meal description, and you can correct it or enter a name and area yourself. That context may be sent to OpenAI and used for menu searches. Precise GPS coordinates are not sent to the AI model. You can enter a name manually or use meal analysis without location.

Device & Usage Data

  • Device type, operating system, and app version
  • Push notification tokens for delivering notifications
  • General usage patterns (features used, API request counts) for rate limiting and service improvement

2. How We Use Your Information

  • Provide personalized AI coaching, workout recommendations, and meal analysis
  • Track your fitness progress over time and generate progressive overload suggestions
  • Analyze meal photos and text descriptions to estimate nutritional content
  • Build a personalized AI coaching personality based on your interactions
  • Send push notifications (workout reminders, weekly summaries) based on your preferences
  • Manage your subscription and enforce usage limits
  • Improve and maintain the App

3. AI Processing & Third-Party Services

We use the following third-party services to power the App’s features:

  • OpenAI, your text chats, meal descriptions, meal photos, and relevant fitness context are sent to OpenAI’s API for AI processing. We send supported generation requests with response storage disabled, so OpenAI does not retain them as application state for later retrieval. This does not remove separate abuse-monitoring logs: by default, those logs may contain prompts and responses and may be retained for up to 30 days, unless a longer period is required for legal or safety reasons. OpenAI states that API data is not used to train or improve its models unless the customer explicitly opts in. See OpenAI’s data controls documentation.
  • Google Gemini, your live voice audio, voice transcripts, and relevant fitness context are sent to Google’s Gemini API to provide voice coaching. Google states that prompts and responses from paid Gemini API services are not used to improve its products, but it may keep limited logs for abuse monitoring. Gemini Live can retain conversation state for up to 24 hours when session resumption is enabled. See Google’s data retention documentation.
  • RevenueCat — Manages in-app subscriptions and purchase receipts. RevenueCat receives your anonymous app user ID and purchase data.
  • Apple HealthKit / Google Health Connect — Health data is read from these platform services only with your explicit permission. Additional Apple Health sharing is optional and selected by data type. Selected records, source information and daily statistics are stored with your OCTANE account, and relevant evidence may be sent to our AI providers for personalized coaching, voice conversations, Insights and weekly summaries. The initial sample import covers 90 days and then continues with new records and deletions. Removing a type from additional sharing removes its expanded history from OCTANE; it does not remove Apple Health records, information in earlier conversations, or data managed by the existing fitness connection. If you enable auto-sync, we also write workout sessions and body weight back to HealthKit/Health Connect so your data stays consistent across apps. You can disable this at any time in Settings.
  • Expo Push Notifications — Push notification tokens are sent to Expo’s push notification service to deliver notifications to your device.
  • Meal reference images, the App may display public images from pages returned by meal searches. Images load from their source websites, which receive normal connection information such as your IP address. If you confirm a reference, its image and source may be sent to OpenAI to help identify the food. Choosing to use it as your diary image saves its URL and source with the meal.
  • OpenStreetMap / Overpass, processes an approximate location only when you request nearby restaurant suggestions. Public place results are briefly cached to avoid repeated lookups. Map data is attributed to OpenStreetMap contributors.
  • Vercel — Hosts our backend API and serves the App’s web pages. Vercel processes API requests and may log request metadata (IP addresses, timestamps) for security and performance.
  • Neon — Provides our PostgreSQL database hosting. All user data (account information, workouts, meals, chat history) is stored on Neon’s infrastructure.
  • Upstash — Provides Redis-based rate limiting and usage tracking. Stores anonymised usage counters (not personal content).

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area or United Kingdom, we process your data under the following legal bases:

  • Contract performance — Processing necessary to provide the App’s core features (account management, workout/meal tracking, AI coaching) as part of our service agreement with you.
  • Consent — Health data from HealthKit/Health Connect, push notifications, and optional AI personality features. You can withdraw consent at any time through the App or your device settings.
  • Legitimate interest — Security measures (rate limiting, fraud prevention), service improvement, and usage analytics. We balance our interests against your rights and do not use this basis for sensitive data.

5. Data Storage & Security

Your data is stored in a PostgreSQL database hosted on Neon (cloud PostgreSQL). Passwords are hashed using bcrypt and are never stored in plain text. Authentication uses signed JSON Web Tokens (JWT). All data is transmitted over HTTPS.

We implement rate limiting and access controls to protect against unauthorized access. Subscription-related database tables are protected by Postgres-level triggers that prevent unauthorized modifications.

Temporary chats are not saved to OCTANE’s chat-history database and do not trigger personality-memory extraction. They are still sent to OpenAI to generate a response and may appear in the provider’s limited abuse-monitoring logs described above.

6. International Data Transfers

OCTANE HEALTH is based in England. However, our infrastructure providers (Vercel, Neon, OpenAI, Google, Upstash, RevenueCat, Expo) process data in the United States and other countries. When your data is transferred outside the UK or EEA, we rely on:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • UK International Data Transfer Agreements (IDTAs) where applicable
  • Provider-specific data processing agreements that include appropriate safeguards

By using the App, you acknowledge that your data will be processed in these jurisdictions. You can contact us at contact@asyncstudios.co.uk for more information about specific safeguards.

7. Data Retention

We retain your data for as long as your account is active. You can delete individual workouts, meals, chat conversations, and personality facts at any time through the App.

If you delete your account, all associated data is permanently and irreversibly removed from our database. This is a hard deletion — we do not soft-delete or retain data after account deletion.

8. Your Rights

All Users

  • Access, update, or delete your personal data through the App
  • Delete your entire account and all associated data
  • Opt out of push notifications at any time
  • Revoke HealthKit/Health Connect permissions through your device settings

GDPR Rights (European Economic Area)

If you are located in the EEA, you have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Request erasure of your data
  • Restrict or object to processing
  • Data portability
  • Lodge a complaint with your local data protection authority

CCPA Rights (California)

If you are a California resident, you have the right to:

  • Know what personal information is collected and how it is used
  • Request deletion of your personal information
  • Opt out of the sale of personal information — we do not sell your personal information
  • Non-discrimination for exercising your privacy rights

9. Children’s Privacy

The App is not intended for children under 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly. This age threshold applies globally and satisfies both the US Children’s Online Privacy Protection Act (COPPA) and the UK/EU General Data Protection Regulation requirements for health-related data.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy in the App and updating the “Last updated” date above.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

contact@asyncstudios.co.uk