Privacy Policy

1. Who we are

The Service is operated by UGC Mediakits, 1025 Veterans Memorial Highway SE, Mableton, GA 30126, USA. Under the EU General Data Protection Regulation ("GDPR"), the UK GDPR and similar laws, we are the controller of the personal information described in this policy, which means we decide why and how it is processed.

If you have a question about this policy or about your information, email us at support@ugcmediakits.com. Our full contact details are in Section 18.

2. Information we collect

We collect information you give us, information created when you use the Service, and technical information that your device sends when it connects to our server.

Account information

You create a Weight Class account with your first name, your email address and a password. Sign-in is handled by our own server with Better Auth, an open-source sign-in library that runs as part of our server software. We store your name, your email address and an identifier for your account.

Where the app offers it, you can instead continue with Apple or Google. Apple or Google then confirms who you are and shares your name (Apple only the first time) and your email address — with Apple you can choose to hide it behind a private relay address — together with an account identifier, which we store with your account. We do not receive your Apple or Google password. For Sign in with Apple we also keep a token from Apple so that, when you delete your Weight Class account, we can tell Apple to end Weight Class's access. If a Weight Class account already uses the same email address, the two are joined only when that address has been verified. Your use of Apple's and Google's sign-in is also subject to their privacy policies.

We never store your password itself. Your password is sent to our server over an encrypted connection and turned into a salted, one-way hash (using the scrypt algorithm), and only that hash is stored. When you sign in, we check the password you enter against the hash.

When you sign up, we email you a 6-digit code to verify your email address, and if you forget your password, you can ask for a code to choose a new one. Codes are stored on our server only as a one-way hash, work for 10 minutes and for a few attempts, and choosing a new password signs you out on your other devices. We send these emails through Resend (see Section 6). We only send emails you ask for or need for your account, never marketing emails. If you lose access to your account, you can also contact us at support@ugcmediakits.com.

Sign-in sessions

When you sign in, we create a session so that you stay signed in. A random session token is stored in your device's secure storage (the iOS Keychain or the Android Keystore) and on our server. On our server, the session is stored together with its expiry date and with the IP address and user agent of the request that created it (the user agent is a short technical description of the app or browser that made the request, which can include your device's operating system version). The app sends the token with each request so that our server knows the request comes from your account. A session expires after 30 days without use, and signing out ends it.

Onboarding answers and your plan

To create your plan, we ask for your gender, date of birth, height, current weight, goal (lose, maintain or gain weight), target weight, activity level, weekly pace and diet type (for example, vegetarian), as well as whether you prefer metric or imperial units. We also store your device's time zone so that your days, history and streaks follow your local time.

From these answers we create your plan: daily targets for calories, protein, carbohydrates and fat, a short summary, and a note of whether the plan was generated by AI or by a standard formula. Your daily fiber and water goals start at the official recommendations for your age and sex. If you change any of your daily goals in the app, we store the goals you choose together with the targets your plan suggested, so that you can go back to them. While you complete onboarding, your answers are kept on your device and are saved to your account when you sign up. To show you a plan before you sign up, your answers are also sent to our server and, from there, to our AI providers (see Section 4). At that point, they are not linked to an account.

Meal photos and your meal log

When you scan a meal, we collect the photo you take or choose from your gallery. For each meal we store the photo, the meal name, the estimated calories, protein, carbohydrates, fat and fiber, how confident the estimate is, the portion size you pick, whether you marked the meal as a favourite, the time it was logged, the status of its analysis and any changes you make to those values. You can add a short note to a photo (for example, how it was cooked), which we store with the meal. Instead of a photo, you can describe a meal in words; we store that description with the meal. You can also photograph a nutrition label on food packaging; we store that photo, the serving size printed on it and the number of servings you choose. You can also scan a product's barcode or pick a food from our food database search; we store the product or food, its barcode and the amount you choose. You can also add a meal by typing its calories and macros yourself (quick add), which does not use AI. You can also log an alcoholic drink by picking its type, size, strength and how many (and, for a cocktail, its shots and mixer); we store those choices with the meal, and our server works out its alcohol, carbohydrates, sugars and calories without AI. When you log a meal again or copy a day, we store a copy of those meals, including a copy of their photos. If you switch on the food-quality tag in Preferences (a test feature), the AI also estimates how processed each meal is and how much added sugar it has, and we store that with the meal. If a photo does not show food or cannot be analyzed, we delete the photo and keep only a short note about what happened (see Section 4). We use the days on which you logged meals to show your history and to calculate your streak (or, in calm mode, the number of days you logged).

Saved meals, repeats and your foods

You can save a meal to log it again later and choose days on which it is suggested. We store the saved meal (a copy of it, including a copy of its photo), the days and time you choose and, for each of those days, whether you logged it or chose "Not today". Nothing is logged unless you tap "Log it". When you correct a food in a meal, the app asks whether Weight Class should remember it. If you agree, we store it under "Your foods": the name the AI used for it, your name for it, the food or product it refers to (or its numbers), your usual amount and how often it was used. You can rename or delete these foods at any time in Profile → Your foods; meals you already logged keep their numbers.

Restaurant menus (What to order)

What to order ranks a restaurant's dishes for what's left of your day. When you open a chain's menu, we store which menu was your free try (if you don't have Weight Class Premium). When you scan a menu, we store the list of dishes you confirmed (or that were read from your photos), the restaurant's name if you typed one, and the estimates worked out for each dish, for 30 days, so you can open the menu again. On an iPhone, the phone reads the menu's text itself and the photo never leaves it; otherwise the photos are stored only until the dishes have been read from them (see Section 4). A dish you log or save becomes a meal in your meal log and keeps where its numbers came from: the chain's nutrition information and the day it was checked, or the estimate's range. Foods you choose to skip are stored with your preferences. If you report a wrong item on a chain's menu, we store your report (the reason, an optional note, the item and its numbers at that time) to check it against the chain's published information; reports are not shown to anyone else.

Plan tomorrow and the weekly check-in

If you use Plan tomorrow, our server drafts a day from your own meal log and saved meals, without AI. We store the draft: the meals it picked, their times and numbers, and whether you logged or removed each one. Nothing is logged unless you tap "Log it", and you can clear a draft at any time. If you turn on the weekly check-in that adjusts your calorie target, our server works it out from your meal log and weight history, without AI, and we store each week's result: the estimate, the proposed target and whether you used it or kept your own. Your target changes only when you choose it.

Reports about products

If you report a problem with a product you scanned by its barcode, we store your report: the reason you pick, an optional note you write, the product and where its data came from, and when you sent it. We use reports to check and correct product data. They are not shown to anyone else; when three people report the same product within 30 days, everyone who looks it up sees a note to check the label, without any of the reports or notes. You can withdraw your report on the product's screen.

Water log

If you log drinks, we store the amount and the time of each entry so that we can show your daily total. You can remove an entry at any time.

GLP-1 mode

If you turn on GLP-1 mode, we store the medicine you pick, its form (pen, vial or other), how often you take it and your dose day, and, when you switch medicine, each earlier medicine with the dates you took it. When you log a dose, we store the time, the dose, the injection site and side you enter and your note. If you track pens and vials, we store the counts you enter (doses per pen, vial or pack, doses left in the open one, unopened ones and how many days one can be used once opened), updated when you refill; the app counts down from the doses you log and never calculates doses or units. When you log how you feel, we store the side effects you pick, how strong they were, your note and the time. This is health information: we use it only to show you your schedule, supply and history, we never use it for advertising or share it with AI providers, and Weight Class never gives dosing advice. Supply reminders are scheduled on your device and never name your medicine. Turning GLP-1 mode off keeps your history; "Delete my GLP-1 data" in the app, or deleting your account, removes it permanently.

Weight history

Your weight history starts with the weight you entered during onboarding. Each time you log your weight, or change it in Personal details, we store the weight and the day. We use it to show your history and progress chart, and your latest weight becomes your current weight in your profile. You can remove any entry, and deleting your account removes all of them.

Body measurements and progress photos

If you log body measurements, we store each one (waist, hips, chest, arm, thigh or neck) and its day. If you take progress photos, we store each photo (front, side or back) and its day in private storage; the app removes a photo's metadata, such as its location, before uploading it. Your progress photos are shown only to you, through links that expire after 30 minutes. They are never sent to AI providers or used to identify people, and we keep them until you delete them. You can delete one photo or all of them in the app, and deleting your account removes all of them.

Supplements

If you add supplements, we store the name you give each one, the vitamin and mineral amounts per dose that you enter, how often you take it and the days on which you tick it as taken (with the dose as it was that day). We use this only to show your list and to add those amounts to your daily vitamins and minerals. We do not share it with AI providers, and Weight Class never gives dosing advice. Removing a supplement hides it from your list but keeps the days you already ticked; deleting your account removes all of it permanently.

Apple Health and Health Connect

If you turn on sync with Apple Health (iPhone) or Health Connect (Android), the app writes the calories, protein, carbohydrates, fat and fiber of the meals you log, the water you log and, on iPhone, the number of alcoholic drinks you log (as standard drinks) to that app on your device. If you also turn on "Read activity and sleep", the app reads your steps, active calories, workouts and sleep from that app to show them next to your meals. This data stays on your phone: our servers never receive it, it is never sent to AI providers, and nothing is added to your calorie goal. What is stored in Apple Health or Health Connect is managed by Apple or Google under their terms; you can delete it in those apps. Turning a switch off stops new writes or reads.

Reminders

Reminders are scheduled by the app on your device. Your reminder choices stay on your device; we do not receive them, and we do not use push notification services to send them.

Feedback and messages

Feedback you send from the app is delivered to us through Sentry (see below). We receive your message and, if you choose to add them, your email address and a screenshot. A screenshot contains whatever is on your screen at that moment, so please check it before sending. If you email us, we receive your email address and the content of your message.

Diagnostic and technical information

To keep Weight Class reliable, the app uses Sentry, an error monitoring service, when crash reporting is enabled in the version of the app you use. In that case, Sentry collects:

• Crash reports and errors: what went wrong and where, with technical details such as your device model, operating system and app version.
• Diagnostic logs: short records of important events in the app, such as a failed upload or a completed meal analysis. These can include limited details, such as the kind of scan, how long an analysis took or an error message, but not your meals' numbers.
• Performance data: how long screens and network requests take, collected for a sample of sessions.

Diagnostic data is linked to your Weight Class account ID and may include your IP address.

In addition, whenever the app or your browser connects to our server, or the app loads one of your meal photos from our storage, standard technical information, such as your IP address, the time of the request, the address requested and the user agent, is processed to handle the request. Railway, our hosting provider, keeps short-lived logs of these requests and of important events that our server records, such as a completed meal analysis or an error. These logs can include limited details, such as an account or meal identifier, but not your meals' numbers. Our server also holds IP addresses briefly in memory to limit how often sign-in attempts and plan requests can be made, which protects your account and the Service against abuse.

What we do not collect

We do not collect your precise location, your contacts, audio recordings, advertising identifiers or payment details, and our servers do not receive data from Apple Health, Health Connect or other health or fitness apps. We do not use your photos to identify people.

3. How we use your information

We use personal information only for the following purposes:

• To provide the Service: to create and manage your account, generate your plan, analyze your meal photos, descriptions and nutrition labels, rank restaurant menus for what's left of your day, show your meals, daily totals, weekly summaries, history and streaks, work out the day drafts and weekly check-ins you ask for, and let you edit your details, goals and meals.
• To keep the Service secure and working: to authenticate requests, keep you signed in, limit repeated sign-in attempts and other misuse, and detect, investigate and fix errors, crashes and performance problems.
• To improve the Service: to understand which features work well and which need attention, using diagnostic data and the feedback you send us.
• To communicate with you: to reply to your feedback and requests and to send important notices about the Service, such as changes to this policy. Weight Class does not currently send automated emails, such as marketing emails, email address confirmations or password reset emails. If we ever send marketing emails, we will ask for your consent where the law requires it, and you will be able to unsubscribe at any time.
• To meet legal obligations: to comply with applicable law, respond to lawful requests, and establish, exercise or defend legal claims.

We do not use your information for advertising, we do not sell it, and we do not use your photos, answers or meal log to train AI models.

Your plan, meal estimates, day drafts and check-in proposals are produced automatically, but they are suggestions that you can review and change at any time. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

4. How AI processing works

Weight Class uses artificial intelligence ("AI") in three places: your plan, your meals and the restaurant menus you scan. Our server accesses OpenAI's models through OpenRouter, a service that routes requests to AI model providers. The app never sends your data to an AI provider directly, and the requests our server sends do not include your name, email address, account ID or IP address.

Your permission comes first

Before anything is sent to an AI model, the app asks for your permission and names the companies involved (OpenRouter and OpenAI). If you choose "Continue without AI", your plan is calculated with the standard formula described below, and meal photos and descriptions are not analyzed; barcodes, food search and quick add still work. You can give or withdraw your permission at any time in Profile → Preferences → AI meal analysis. We record when you gave it, which companies were named and which wording you saw; if we ever switch to a different AI company, the app asks you again before sending anything to it. Menu scans need the wording that names menus: if you allowed AI before menus were added, the app asks once more before your first menu scan.

Creating your plan

When you finish the onboarding questions, the app sends your answers to our server, which sends them to an AI model through OpenRouter, together with instructions for calculating daily nutrition targets. The model receives your gender, age, height, weight, goal, target weight, weekly pace, activity level and diet. It receives your age, which our server calculates from your date of birth, not your date of birth itself. This happens before you create an account, so the request is not linked to an account. The plan is saved to your account when you sign up. If the AI service is unavailable, we calculate your plan with a standard formula (the Mifflin-St Jeor equation) instead.

Analyzing your meals

When you scan a meal, the app resizes the photo (to at most 1,280 pixels on its longest side) and uploads it to our server. Our server stores the photo in a private storage bucket hosted by Railway and sends a copy of it, as image data inside the request, to an AI vision model through OpenRouter. The model returns a name for the meal, estimates of its calories, protein, carbohydrates, fat and fiber, and how confident the estimate is. If the model decides that the photo does not show food or a drink, the photo is deleted right after the analysis, and only a short note on why it was not treated as food stays with the meal record. If the analysis cannot be completed, the photo is deleted as well. Photos of the meals you log are kept until you delete the meal or your account. If you added a note to the photo, the note is sent with it. Photos of nutrition labels are sent in higher resolution so that the model can read the printed values. You can add up to two more photos of the same meal from other angles; they are stored with the meal, sent together with the first photo in the same request and deleted with it.

Sometimes the model asks one short question about the meal, such as what it was cooked in or how big the portion was. The possible answers are worked out on our server when the meal is analyzed; the answer you tap is stored with the meal and changes its numbers on our server, without another request to an AI model.

When you describe a meal in words, our server sends your description (without your name or email address) to an AI language model through OpenRouter, which returns the same kind of estimate as for a photo.

If you asked Weight Class to remember foods ("Your foods"), up to 30 of their names are sent along with your meal photo or description, so that the model names those foods the same way. They are sent as plain food names, without your name, email address or other account information. The numbers for a remembered food come from our server, not from the AI.

The AI also lists the foods it sees with their weight. To look them up in the USDA food database (a public database stored on our server), our server sends those food names and weights, together with database entries that could match, to an AI language model through OpenRouter, which picks the matching entries. No photo, name or other account information is included in that request.

Restaurant menus

For the chains in Weight Class, the menus and their numbers come from our own table, copied from each chain's published nutrition information. Opening a chain's menu, ranking it for your day and logging a dish happen on our server and do not use AI.

When you scan another menu, an iPhone reads the text of your photo on the phone (Apple's text recognition) and shows you the dishes it found to check and correct; only that list and the restaurant's name, if you typed one, are sent, and the photo stays on your phone. Where the phone can't read the text, the app resizes up to three photos of the menu and uploads them; our server stores them in private storage only until an AI vision model, through OpenRouter, has read the list of dishes from them, and then deletes them. Our server sends the list of dishes and the restaurant's name to an AI language model through OpenRouter, which returns the foods and restaurant-size portions in each dish, a couple of changes you could ask for (such as dressing on the side) and, sometimes, one question about how a dish is made. The numbers then come from the USDA food database on our server, the same way as for a meal photo, and our own code ranks the dishes. The AI never receives your targets, your weight, what you have eaten, the foods you skip or your location.

Barcodes and food search (no AI)

When you scan or type a barcode, our server looks the number up in its own copy of product data first and, when needed, asks Open Food Facts (a public, open food database) and, if configured, USDA FoodData Central for the product. Only the barcode number is sent, from our server, never your name, email address or other account information, and the product data is kept on our server so that the next lookup is answered there. Searching foods and logging a barcode or a food from the search do not use AI.

What the AI providers do with your data

OpenRouter and OpenAI process the content we send only to return results to us. We do not permit them to use your content to train or improve their models, and our OpenRouter account is configured accordingly, with training on our requests and logging of their content turned off. Every request also tells OpenRouter to use only AI providers that do not collect the data they receive. Where other settings are available to us, we choose the ones that keep your content for the shortest time. Under their own terms, they may keep content for a limited period, for example to detect abuse.

Please do not include people, faces, documents, screens or other personal information in your meal photos.

AI results can be wrong

AI estimates can be inaccurate. Portion sizes, hidden ingredients such as oil or sugar, and the angle or lighting of a photo can all affect the result. Always review the estimates and correct them when needed. See Section 15.

5. Legal bases for processing

If you are in the European Economic Area ("EEA"), the United Kingdom or Switzerland, we rely on the following legal bases:

• Performance of a contract (Article 6(1)(b) GDPR): to provide the Service you ask for, including creating your account, generating your plan (including the steps we take at your request before you sign up), analyzing your meals, storing your meal log and deleting your account when you ask.
• Explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR): for information about your body and eating habits that may be considered health data, such as your height, weight, goals, diet and meal log. You give this consent when you choose to enter this information and use these features. You can withdraw it at any time by deleting the information or your account. Withdrawing consent does not affect processing that took place before, but without this information we cannot provide the core features of Weight Class.
• Legitimate interests (Article 6(1)(f) GDPR): to keep the Service secure and reliable, diagnose crashes and errors, understand performance, prevent abuse, improve the Service based on feedback and deliver this website. We rely on these interests only where they are not overridden by your rights and interests, and you can object at any time (see Section 11).
• Legal obligation (Article 6(1)(c) GDPR): where we must process information to comply with the law, for example to respond to a lawful request from a public authority.

6. Service providers

We use the following service providers (also called processors or sub-processors) to run Weight Class. They process personal information on our behalf under contracts that allow them to use it only to provide their services to us and that require them to protect it.

Railway

Hosts the Weight Class server (API), the PostgreSQL database where your Weight Class data is stored, the private storage bucket for meal photos, and this website, which the same server delivers. Railway Corporation is based in the United States, and your data is stored there, in Railway's US West regions. Railway's storage buckets run on infrastructure from its storage partner, Tigris Data.

Data involved: all the data our server stores and handles, including your account details (name, email address, password hash, and sign-in sessions with their IP address and user agent), onboarding answers, daily plan, time zone, meal log and meal photos, the requests that the app and your browser send (including IP address and user agent), and our server logs.

OpenRouter and OpenAI

AI models that create your plan and analyze your meal photos. Our server accesses OpenAI's models through OpenRouter.

Data involved: onboarding answers (with your age instead of your date of birth) and meal photos. The requests come from our server and do not include your name, email address, account ID or IP address.

Resend

Sends Weight Class account emails: the codes that verify your email address and reset your password. Resend, Inc. is based in the United States.

Data involved: your email address and the content of the email (a one-time code).

RevenueCat

Only where the app offers Weight Class Premium: manages subscriptions bought through the App Store or Google Play and tells our server whether your account has Premium. Payments themselves are handled by Apple or Google; we never receive your card details. RevenueCat, Inc. is based in the United States.

Data involved: your Weight Class account ID, the subscriptions you buy (product, price, currency, dates, renewal and store transaction details), and device and app details that the RevenueCat software sends from the app.

Sentry

Error monitoring: crash reports, diagnostic logs, performance tracing and in-app feedback. Used only when crash reporting is enabled in the version of the app you use.

Data involved: device and app details, IP address, Weight Class account ID, diagnostic data, and any feedback, email address or screenshot you choose to send.

We will update this list if we add or replace a service provider.

Apple (App Store) and Google (Google Play) distribute the app. They are not our service providers: we do not share your Weight Class data with them, and their own terms and privacy policies apply to your use of their stores. We may receive aggregated statistics from them, such as download numbers, and crash reports from people who have chosen to share them with app developers.

7. How we share information

We share personal information only in these situations:

• With our service providers, listed in Section 6, so they can run parts of the Service for us.
• For legal reasons: when we believe in good faith that disclosure is required by law, a court order or a lawful request from a public authority, or is necessary to protect the rights, property or safety of our users, the public or us, or to investigate fraud or security issues.
• In a business transfer: if we are involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, personal information may be transferred as part of that transaction. We will require the recipient to honor this policy, or we will notify you before your information becomes subject to a different privacy policy.
• With your consent or at your direction.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not let third parties track you across apps or websites for advertising.

8. International transfers

Our server, database and photo storage are located in the United States. We and our service providers may also process your information in countries other than the one where you live, and some of our providers operate globally distributed infrastructure. Data protection laws in these countries may differ from those in your country.

When we transfer personal information out of the EEA, the United Kingdom or Switzerland, we rely on an adequacy decision where one applies, such as the EU-U.S. Data Privacy Framework and its UK and Swiss extensions for providers certified under them, or on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents. You can ask us for more information about these safeguards using the details in Section 18.

9. How long we keep information

We keep personal information only for as long as we need it for the purposes described in this policy:

• Account, profile and plan (your name, email address, password hash, onboarding answers and daily plan): for as long as you have an account. They are deleted when you delete your account.
• Sign-in sessions (including the IP address and user agent stored with them): until you sign out, which deletes the session, or until the session expires after 30 days without use. An expired session is deleted the next time the app contacts our server with it, and all of your sessions are deleted when you delete your account.
• Meals and nutrition values: until you delete the meal or your account.
• Scanned restaurant menus (the list of dishes, the restaurant's name and the estimates): 30 days, then deleted automatically, or sooner when you delete your account. Menu photos, when the phone can't read the text itself, are deleted as soon as the dishes have been read from them, and at once if they can't be read.
• Reports about chain menu items: until you delete your account.
• Body measurements and progress photos: until you delete them or your account. Progress photos never expire on their own.
• GLP-1 data (medicines, doses, supply counts and side effects): until you delete it in the app ("Delete my GLP-1 data") or delete your account.
• Day drafts and weekly check-ins: a draft until you clear it or delete your account; the check-ins until you delete your account.
• Meal photos: until you delete the meal or your account. Photos that do not show food, and photos that could not be analyzed, are deleted automatically right after the analysis.
• Scans that did not show food or could not be analyzed: the meal record, without the photo and with only a short note on what happened, until you delete your account.
• Onboarding answers before sign-up: stored on your device until you create an account. If you never create one, they are not saved in our database.
• Server logs: Railway keeps our server's logs, including request logs with IP addresses and user agents, for a limited period set by our hosting plan, typically between 7 and 30 days, after which they are deleted automatically.
• IP addresses used for rate limiting: held only in our server's memory for a short time and never written to our database.
• Diagnostic data: if crash reporting is enabled, Sentry keeps crash reports, logs, traces and feedback for a limited period, typically no longer than 90 days, after which they are deleted automatically.
• Messages you send us: for as long as we need to handle your request, and for a reasonable period afterwards in case you follow up.

After deletion, copies of deleted data may remain in backups for a short time until those backups expire, which happens within 30 days. We may keep information for longer where the law requires it or where it is needed to resolve a dispute or enforce our agreements.

10. Security

We use technical and organizational measures designed to protect your information, including:

• encryption in transit: HTTPS (TLS) for connections between the app or your browser and our server, and encrypted connections between our server, our database, our photo storage and our other providers;
• passwords stored only as salted, one-way hashes (scrypt), never as the password itself;
• sign-in checks on every request, so that your profile and meals are available only to your account, and sessions that expire after 30 days without use and that you can end at any time by signing out;
• limits on repeated sign-in attempts and other requests, to slow down password guessing and abuse;
• meal photos kept in a private storage bucket that is encrypted at rest and is never made public;
• keeping secret keys on our server, never in the app, and limiting who can access production systems;
• no recordings of your screens or taps (session replays) in the production app.

The app shows your meal photos through signed links that our server creates only for your account and that expire after 6 hours. We do not publish these links, but anyone who obtained a link could open the photo until it expires. This is another reason not to include people or personal documents in your meal photos.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security incident affects your personal information, we will notify you and the relevant authorities where the law requires it.

11. Your privacy rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy of it;
• correct inaccurate or incomplete information (you can edit your personal details and any meal directly in the app);
• delete your information (you can delete individual meals, or your whole account, directly in the app);
• data portability, meaning to receive your information in a structured, machine-readable format and to have it sent to another service where technically feasible;
• restrict or object to certain processing, including processing based on our legitimate interests;
• withdraw your consent at any time, without affecting processing that took place before; and
• lodge a complaint with a data protection authority, in particular in the country where you live or work or where you believe an infringement took place. We would appreciate the chance to address your concerns first.

To exercise these rights, email support@ugcmediakits.com from the email address linked to your Weight Class account, or tell us how we can verify that the account is yours. We will respond within one month, or within the period required by the law that applies to you. Where the law allows, we may extend this period for complex requests, and we will tell you if we do. We do not charge a fee unless a request is manifestly unfounded or excessive.

12. California and other U.S. states

This section applies to residents of California and other U.S. states with consumer privacy laws. It supplements the rest of this policy.

Information we collect and disclose

In the past 12 months, we have collected the following categories of personal information, as defined by the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"):

• Identifiers, such as your name, email address, account ID and IP address;
• Customer records described in Cal. Civ. Code § 1798.80(e), such as your name and email address;
• Characteristics of protected classifications, such as your gender and age (from your date of birth);
• Internet or other electronic network activity, such as sign-in session details (IP address and user agent), server request logs, crash reports, diagnostic logs and performance data;
• Audio, electronic or visual information, such as your meal photos, your progress photos and any screenshots you attach to feedback;
• Inferences, such as the daily calorie and macro targets derived from your answers; and
• Sensitive personal information, namely your account log-in (your email address together with your password, which we store only as a hash) and information concerning your health, such as your height, weight, body measurements, progress photos, goals, diet, medicines, doses and meal log.

We do not collect precise geolocation, biometric information, financial account details or government identifiers. We collect personal information from you and from your device. We use it for the business purposes described in Section 3, keep it as described in Section 9, and disclose each category for business purposes only to the service providers listed in Section 6.

We do not sell or share personal information

We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16. Because we do not sell or share personal information, we do not provide a "Do Not Sell or Share My Personal Information" link. If your browser or device sends a Global Privacy Control signal, we treat it as a valid request to opt out of sale and sharing where the law requires it.

We use sensitive personal information only to provide the Service you request and for other purposes permitted by the CCPA, and not to infer characteristics about you. For this reason, we do not offer a separate right to limit its use.

Your California rights

Subject to certain exceptions, California residents have the right to:

• know the categories and specific pieces of personal information we have collected about them, the categories of sources, the purposes for collecting it and the categories of recipients;
• request that we delete their personal information;
• request that we correct inaccurate personal information;
• opt out of the sale or sharing of personal information (we do not sell or share it);
• limit the use of sensitive personal information (we use it only for permitted purposes); and
• not be discriminated against for exercising these rights. We will not deny you the Service, charge you a different price or give you a lower quality of service because you exercised them.

To make a request, email support@ugcmediakits.com or delete your account in the app. We will verify your request by matching the information you provide with the information in your account, and we will respond within 45 days or tell you if we need up to 45 more days. You may use an authorized agent to make a request for you; we may ask the agent for proof of your signed permission and ask you to confirm your identity directly with us.

California Civil Code § 1798.83 ("Shine the Light") lets California residents ask about disclosures of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

Other U.S. states

If you live in another state with a consumer privacy law, such as Colorado, Connecticut, Oregon, Texas, Utah or Virginia, you may have similar rights to access, correct, delete and obtain a copy of your personal information, and to opt out of targeted advertising, the sale of personal data and certain profiling. We do not engage in targeted advertising, we do not sell personal data, and we do not use profiling to make decisions that produce legal or similarly significant effects. Where these laws treat information about your health as sensitive data, we process it only with your consent, which you can withdraw at any time by deleting the information or your account.

You can exercise your rights by emailing us. If we decline your request, you can appeal by replying to our decision with the subject line "Appeal". If you disagree with the outcome of your appeal, you can contact your state attorney general.

Consumer health data

Some laws, such as Washington's My Health My Data Act and Nevada's consumer health data law, protect "consumer health data". Information such as your body measurements, progress photos, goals, diet, medicines, doses, alcohol intake and meal log may fall into this category. We collect it from you to provide the features you ask for (your plan, meal estimates, history and streaks) and use it only for the purposes described in this policy. We share it only with the service providers in Section 6 to provide the Service, we never sell it, and you can access or delete it, or withdraw your consent, at any time as described in this policy.

13. Deleting your account

You can delete your account at any time in the app: open Profile, tap Delete account and confirm. This immediately and permanently deletes:

• your Weight Class account, including your name, email address and password hash, and all of your sign-in sessions;
• your profile, onboarding answers and daily plan;
• every meal you have logged; and
• every meal photo.

Deletion cannot be undone. Residual copies may remain for a short time in backups and logs, as described in Section 9. Deleting the app from your phone does not delete your account.

Without the app, you can delete your account on our account deletion page with your email address and password. If you cannot sign in, for example because you have forgotten your password, email support@ugcmediakits.com and we will delete your account after verifying that it is yours.

Washington residents: our Consumer Health Data Privacy Policy explains how we handle consumer health data and how to use your rights under the My Health My Data Act.

14. Children

Weight Class is for adults. It is not intended for anyone under 18, and we do not knowingly collect personal information from them. The app asks for your date of birth during onboarding and accepts only users who are 18 or older. Where the age of majority is higher than 18, a parent or legal guardian must agree before a younger person uses Weight Class.

If you believe that someone under 18 has given us personal information, contact us at support@ugcmediakits.com and we will delete it.

15. Health information disclaimer

Weight Class provides estimates for general information and wellness purposes. It is not a medical device, and it does not provide medical advice, diagnosis or treatment.

The calorie and nutrient values in the app are estimated by AI from photos and may be inaccurate or incomplete. Your plan is a general target based on the information you provide and does not take your medical history into account.

Talk to a doctor or registered dietitian before making significant changes to your diet, especially if you are pregnant or breastfeeding, are under 18, have a medical condition (such as diabetes, heart disease or kidney disease), take medication, or have or have had an eating disorder. If tracking food makes you feel anxious or leads to unhealthy habits, stop using the app and reach out to a health professional.

16. Cookies and this website

This website

This website (the landing page and these legal pages) is delivered by our own server, which is hosted by Railway. It does not set cookies, it does not use analytics, advertising pixels or third-party scripts, and it does not track you. Like any web server, our server processes technical information about each request, such as your IP address, your browser's user agent and the page requested, in order to deliver the page and keep the site secure. Railway may keep short-lived logs of these requests (see Section 9).

The Weight Class app

The Weight Class app does not contain advertising or analytics SDKs and does not use advertising identifiers. To keep you signed in, it stores a session token in your device's secure storage (the iOS Keychain or the Android Keystore), together with a copy of your basic account details, such as your name and email address, so that the app opens signed in right away. Technically, the session token is a cookie: the app sends it with each request to our server so that we know the request comes from your account. It is used only for that purpose, never for tracking or advertising, and the token and the stored account details are removed from your device when you sign out.

The app also stores your onboarding answers on your device until you create an account.

17. Changes to this policy

We may update this policy from time to time, for example when we add features or change service providers. We will post the updated policy on this page and change the "Last updated" date at the top. If a change is significant, we will also let you know in the app or by email before it takes effect, and ask for your consent where the law requires it.

18. Contact us

If you have questions about this policy or want to exercise your rights, contact us: