Effective date: 12 October 2026. Operator and controller: Scultier Studios LTD trading as Scultier. Company number: 17497558. Business address: 66 Paul Street, London EC2A 4NA. Privacy contact: support@scultier.co.uk.
This policy covers the Scultier Android app in private testing, our public privacy-information page at privacy.scultier.co.uk, support correspondence and associated business records. The app is not yet generally released and paid subscriptions are not available. This notice explains current handling and separately identifies features still being prepared. We will update it before new processing starts. Scultier Studios LTD is responsible for the purposes and means of processing it determines.
Information used in the app
You can enter profile information, height, weight, other body measurements, goals, workout history, sets, routines, personal records, food and water logs, recipes, preferences and any supported progress photos. Nutrition calculations can use age and the sex-related input selected for the equation. Some entries and inferences can reveal information about your health.
The app calculates training XP, muscle ranks, nutrition totals, estimates and trends from your records. These are fitness features and game progression, not medical diagnoses or verified population rankings. We do not use these features to make decisions about employment, insurance or access to healthcare.
Core records are stored on your device using app storage. We cannot retrieve records held only on your device unless you choose to send them through a separate route, such as a support attachment. On supported Android devices, an eligible journal snapshot of up to 10 MB can be backed up by your enabled device backup service. It includes journal records, imported health records and ordinary preferences, and excludes progress photos, health/crash consent records and external account credentials. Cloud backup requires supported device encryption; Android 8 automatic backup is disabled. Restoring the journal does not enable health connections or crash reporting. Device transfer is subject to platform support. Your device provider controls backup timing and availability; retain a manual backup as well. Separate progress-photo backups use the manual password-protected export. Screenshots create separate copies under your control.
Automatic device-provider backups
If you enable your phone's backup service, eligible Scultier app data may be included in a backup handled by that device provider, such as Google on supported Android devices. This is separate from a Scultier account or sync service, which is not offered at launch. Your device settings and the provider's available storage, security and restore behaviour govern that backup. Scultier does not receive or administer the provider's backup copy.
The Android backup categories and exclusions are described above. This notice does not describe an iOS release. A device backup is not a guarantee that every journal entry or imported record can be recovered. Deleting local records does not necessarily remove an earlier device backup; use the provider's controls to manage that copy.
Manual backups and imports
You can manually export a Scultier backup file and later import a compatible backup into the app. The export contains the record categories identified by the export screen and can include private training, nutrition and health-related information. You choose where to save the file. The manual export/import feature does not upload a copy to a Scultier backup server.
New manual journal, recovery-data and separate progress-photo backup files are encrypted with a password you choose. Journal restore replaces existing records after you unlock the file, it passes validation, and you confirm replacement; it does not merge records. Separate photo restores merge by photo ID and can replace matching photos after confirmation. Older unencrypted backup files can still be imported with a warning. Workout PDF and calendar reports are unencrypted exports, rather than protected backup files. Keep that password separately and securely: you will need it to import the file, and Scultier cannot recover the file for you if you forget it. If you choose a supported cloud drive, shared folder, email or another destination, that service handles the additional copy under its own terms and privacy practices. Keep the file and password private. Giving someone both lets them read the backup. Supported destinations and export categories are explained in the export screen.
Importing can restore information that you previously removed from the app. Review the import warning, including whether existing records will be replaced or merged, and preserve a copy of records you want to keep. Deleting app records does not delete a backup file saved elsewhere.
Optional connected features
Ingredient-name search uses the reference data bundled with Scultier and runs on your device. When you request an online barcode lookup, the barcode and app details are sent to Open Food Facts, together with connection information such as your IP address. The lookup does not send your full diary or body measurements. The current food screens use bundled illustrations, including generic illustrations for branded products; they do not call the older retailer-image or online name-search helpers. Camera access for barcode scanning is optional; you can enter a barcode or food details manually. External links open the destination service, which has its own privacy practices.
The initial release is for Android. Health Connect import is optional and read-only, with its own explicit choice before Android permissions are requested. When you choose Connect or Sync and grant permission, Scultier reads steps, total calories burned (including resting energy, in kilocalories), body weight and body-fat percentage for the recent 30-day period. There are no health writes, background reads or extended-history permission. Imported calories do not set food targets; imported weights can inform the adaptive weight-trend estimate. Imports stay in your local journal and any backups you choose. In Profile → Health & device data, Stop imports withdraws the app's import choice immediately and attempts to revoke Android permission. A failed permission-revocation request is reported; app imports remain stopped, and you can revoke system permission in Health Connect settings. Previously imported records remain in your journal until removed. Delete imported records also stops imports and removes all imported health buckets, including legacy calorie entries, while keeping manually entered measurements. Source health-service records, external backups and food targets you previously applied are separate. The optional Wear OS companion exchanges current workout and rest information with the paired phone. Its separate heart-rate choice defaults off and precedes watch sensor permission. Live readings appear only on the open watch screen, are cleared when it pauses, and are neither saved nor sent to the phone or Scultier. Stop heart rate on the watch withdraws that separate choice; clearing phone data does not clear the watch's independent storage.
The initial release stores your journal on your device and does not offer a Scultier account, Scultier cloud backup or sync, friends or online leaderboards. We do not receive a server copy of your journal through a Scultier sync service. Food lookups, store purchases, messages you send to support, optional crash reports and any device-provider backups have the separate handling described in this policy. Choosing crash reporting allows the limited technical information described below to leave the device; it does not upload your journal. A future cloud or social feature will need updated notices and appropriate choices before it starts.
Optional technical crash reports
Crash reporting is off until you choose to enable it. Reports help us investigate app failures. They contain technical error types and stack traces (such as code filenames, functions, line numbers, library names and native memory addresses), app version, platform, operating-system information where available, failure timestamps, event identifiers and diagnostic SDK metadata. Each report includes the consent date, purpose, setting used and notice versions. Free-form error messages are replaced with “Technical error details redacted”. Reports exclude your name, email, private training and nutrition records, photographs, body measurements, imported health records and passwords. Session replay, activity logging and performance tracing are disabled. Stored reports reviewed during testing had empty location fields and no explicit raw IP address. Network delivery still involves IP-address processing; this is not a claim of complete anonymity.
Provider: Sentry (Functional Software, Inc.). We selected its EU region, Frankfurt, for crash-event storage. This does not mean all processing or support access takes place in the EU: account metadata and provider/subprocessor operations can involve the United States and other countries. See the transfer section below. We use reports to diagnose failures, not for advertising or general usage analytics. We rely on your consent for this optional reporting. You can refuse without losing app features, or switch off Optional crash reporting under Profile → Privacy & crash reporting. Switching off stops new reporting and clears the app's pending crash-report cache. Reports already delivered are not recalled by the switch; contact support about those reports and your rights.
Our current Sentry Business trial uses a 90-day error-event retention period. Switching off reporting stops new reports but does not recall reports already delivered. A later plan change will be reflected in this policy; we do not assume it shortens the period for earlier events. The event period covers error reports and their attached consent metadata. Provider account records, audit logs and protected residual copies follow separate operational and legal retention rules. We do not routinely keep downloaded crash reports. You can contact us about deletion of a delivered report; we may need its date or event identifier to locate it, and we do not require you to send your journal. Sentry explains its event periods at https://sentry.zendesk.com/hc/en-us/articles/27118913621019-How-Long-Are-Errors-Events-Stored-in-Sentry .
Website support and purchases
Cloudflare, Inc. hosts privacy.scultier.co.uk using Workers Static Assets and provides delivery and security services. When you open the page, Cloudflare processes connection and request information, including your IP address, requested URL, time, browser/request details, country derived from the connection, and response/security information. We use these services to deliver the page, prevent abuse and investigate faults. This public policy page contains no advertising, optional visitor-analytics scripts, forms or embedded third-party media. We do not use it to receive app journals. Its presentation does not require cookies or local storage; Cloudflare may use necessary security mechanisms when a request triggers protection. Any security cookies are governed by the relevant protection and its lifetime, rather than used by us for advertising. See https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/ .
Cloudflare provides sampled HTTP request analytics for our domain. Its documentation specifies at least 31 days of availability, depending on the plan and dataset; that is not a promise that every provider copy is deleted on day 31. We do not create an additional application request-log database or routinely export visitor logs. Provider operational/security records are retained according to the delivery, abuse-prevention, incident investigation and legal purposes for which they are needed, considering data sensitivity and whether less information can meet those purposes. Cloudflare describes those criteria at https://www.cloudflare.com/privacypolicy/ and dataset periods at https://developers.cloudflare.com/observability/logs/datasets/ . Any incident evidence we retain separately follows the incident-record rule below.
The main marketing website is still being prepared. This publication makes the privacy page available; it does not offer an app account, collect payments or make the unreleased website features available.
If you contact support, we receive the information in your message and any attachments. We use Google Workspace to receive, store and manage email sent to support@scultier.co.uk. This is separate from your journal stored in the app; contacting support sends the information you choose to include to our mailbox service. Please avoid sending passwords, full journals, medical reports or photographs unless genuinely needed. We use this information to respond, investigate the issue and keep an appropriate record of the case. Applicable processing locations and transfer safeguards are described below.
Google Play subscriptions are planned for a later Android release. This private-test version does not offer a verified store purchase or entitlement service. Before purchases become available, we will explain the purchase references, subscription-status information, recipients and retention used by that service. We do not collect payment-card details through this privacy page. We do not use advertising or general screen-view, feature-use or behavioural analytics in the current app. Optional technical crash reports have the separate handling above.
Purposes and legal grounds
We rely on consent under Article 6(1)(a) for the personal journal, optional health imports and optional crash reporting. Where health information is special-category data, we also rely on explicit consent under Article 9(2)(a), as described below. For ordinary support needed to provide a service you request, we rely on performance of a contract or steps at your request before entering it, under Article 6(1)(b). For general enquiries and proportionate website delivery, fault diagnosis and abuse prevention, we rely on our legitimate interests under Article 6(1)(f) in answering requests and operating a reliable, secure service. We limit this information to those purposes and do not use it to track you for advertising. Legal obligations under Article 6(1)(c) cover statutory financial records and legally required disclosures. If you send sensitive health details to support, we will limit their use and retention and obtain an appropriate explicit choice where required; please contact us before sending such attachments.
For the health-revealing personal journal and its calculations, the implemented choice uses consent under Article 6(1)(a) and explicit consent under Article 9(2)(a), where these provisions apply to processing controlled by Scultier. The scope covers the chosen or restored health-related body measurements, nutrition, workout and wellbeing records, progress photos and resulting fitness estimates. This precautionary design does not classify every workout field as special-category data in every context. A separate unchecked statement is shown before the personal journal opens. Refusal leaves an existing journal unopened and allows example-data mode and the exercise library. Profile → Health-data choices offers export before withdrawal and deletion. Confirming Withdraw & delete personal data stops personal journal use and removes this installation's journal, imported records, progress photos and local recovery copies. If deletion cannot finish, use stays blocked and the app retries on restart; external copies need separate handling. Health import has a separate explicit statement, and watch heart-rate display has a separate watch choice. System permissions and terms acceptance do not substitute for those choices. No choice permits cloud upload, public sharing or a new purpose. Availability of a health connection also depends on your device, system permissions and the installed build. Private testing of Health Connect and Wear OS is separate from a general release.
We do not use health information for advertising or sell it. Any future marketing feature will need appropriate notices, choices and an unsubscribe route before it starts. Refusing an optional health connection does not prevent use of unaffected local features. Withdrawing consent does not make earlier lawful processing unlawful.
Company financial records
We use Google Drive to back up company bookkeeping spreadsheets and supporting financial records. We keep company income, expenses, store payments and the evidence needed for financial administration. We do not maintain a routine customer name/email list for bookkeeping. Where purchase references or other personal information are necessary for reconciliation, refunds or disputes, we limit them to that purpose and the applicable retention period. Supporting reports, invoices and bank records can still contain personal information. We do not include your fitness or nutrition journal in bookkeeping backups. This is separate from the journal stored locally in the app; it does not provide a Scultier cloud-backup service for your journal. Applicable provider locations and transfer safeguards are described below.
Recipients and international transfers
We use the providers identified above for their stated purposes. We may disclose necessary information where required by law or to establish, exercise or defend legal rights. A business transfer involving personal data requires lawful handling and appropriate information to affected users.
Our providers use facilities, staff and subprocessors in the UK, the European Economic Area, the United States and other countries. We do not promise UK-only or EU-only processing. Transfers to EEA countries, including Germany and Ireland, can rely on UK adequacy regulations. For covered transfers to US recipients, the providers below participate in the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge). Their processing agreements also provide contractual safeguards, including the EU Standard Contractual Clauses with the UK Addendum, for transfers where the data bridge does not apply.
Cloudflare, Inc.: website delivery and security. Its Customer Data Processing Addendum, incorporated into its self-serve service agreement, addresses processor handling, subprocessors and international transfers. Covered US transfers use its Data Privacy Framework commitments; section 6 provides the UK contractual fallback. Sources: https://www.cloudflare.com/cloudflare-customer-dpa/ and https://www.cloudflare.com/gdpr/subprocessors/ .
Google Workspace: support email and company-record storage. Google and its affiliates process that content under the Cloud Data Processing Addendum accepted for our organisation. Google Cloud EMEA Limited is the current standard contracting entity for UK Workspace business customers; Google LLC is the certified US recipient. Google uses the UK data bridge for covered US transfers and the applicable UK-adapted contractual clauses for other restricted transfers. We have not selected a UK-only storage commitment. Sources: https://cloud.google.com/terms/data-processing-addendum and https://cloud.google.com/terms/alternative-transfer-solution and https://workspace.google.com/terms/subprocessors.html .
Sentry (Functional Software, Inc.): optional filtered technical crash reports. Our organisation has accepted its Data Processing Addendum and selected EU event storage. US processing or access within its service uses the UK data bridge where covered; Schedule 3 provides Standard Contractual Clauses with the UK Addendum as a fallback. EU event storage does not cover every account record or exclude overseas support access. Sources: https://sentry.io/legal/dpa/ and https://sentry.io/legal/subprocessors/ .
These safeguards require the relevant recipient, data and transfer to be covered; they are not a blanket permission for every destination or use. Provider administrative/service data can also be handled under the provider’s own privacy notice. We review changes to providers and safeguards and will update arrangements where necessary. Contact support@scultier.co.uk for information or a copy of the safeguards relevant to your data, subject to necessary redactions. Device backups and export destinations you choose are separate services under your control; this policy does not turn them into a Scultier cloud-journal service.
Retention and security
Device journal records and local photos remain until you remove them or clear this installation's storage; we do not erase long-term fitness history merely because you stop opening the app. Each successful health sync replaces step and current-platform calorie days with the newly read recent 30-day window. Imported weight and body-fat history keeps the latest 100 dates of each, combining successive syncs. These retained measurements do not automatically expire after 30 days. Older unclassified or other-platform calorie buckets remain until deleted; Delete imported records removes all imported buckets. No background timer purges imports while the app is closed. Independent backups, reports and exports may outlast local deletion and can restore previously removed data. Manage those copies through their provider or saved destination. Ordinary support correspondence is kept for up to 12 months after case closure and removed earlier when no longer needed. Minimal privacy-request and complaint records are kept for up to two years after closure, with unnecessary identity documents and sensitive attachments removed sooner. Necessary company financial records are normally kept for six years from the end of the last company financial year they relate to, with longer retention only where required by applicable law or a separately justified legal matter. If we retain a routine security-log copy under our own control, we delete it within 30 days of the event, or sooner when no longer needed; provider-controlled retention is separate. Actual incident evidence has a separately justified period. Crash reports and local consent records follow their specific sections. Any exceptional legal hold is limited to necessary information and reviewed separately.
Implemented safeguards include password-encrypted new manual backup files, limited read-only Android health permissions, optional crash reporting that defaults off, and filters that replace free-form diagnostic messages and exclude journal contents from reports. Access to business records is restricted, with two-step verification on the relevant business accounts. These measures do not mean that ordinary local app storage, PDF/calendar exports or older imported backup files are all encrypted. Device security and any backup service also affect protection. No system is completely secure; protect your device, credentials and exported files and report suspected compromise promptly.
Your choices rights and complaints
Depending on the information and legal basis, you may have rights to access, correction, erasure, restriction, portability and objection. Where we rely on legitimate interests, you can object to that processing on grounds relating to your situation. You can object to direct marketing at any time. Contact support@scultier.co.uk; you do not have to use a special form.
We usually respond to rights requests without undue delay and within one month, subject to lawful identity checks, permitted extensions and other applicable rules. Explain the account or service concerned; do not send your password. Records held only on your device may need to be accessed or deleted there, and we will explain the available help.
You can raise a privacy complaint by emailing support@scultier.co.uk. We acknowledge it within 30 days, investigate appropriately and communicate the outcome. You can also complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or seek a legal remedy. This does not require you to waive any rights.
Age and policy changes
The app is in private testing and is not open for general sign-up. The intended UK public release has a minimum age of 16; age-appropriate privacy information and controls must be in place before that release. Adult nutrition estimates are not suitable as personalised targets for children, pregnancy or breastfeeding. We will update this policy if the available service or audience changes.
We update this policy when practices change and identify the effective date. A materially different consent-based purpose requires a fresh choice before that processing starts. Privacy questions can be sent to support@scultier.co.uk.
Records after subscription access ends
There are no paid subscriptions in the current private-test service. Any later paid release will explain access, export and deletion after subscription expiry before purchases start. Deleting app data does not itself cancel any separate store subscription. Device loss or clearing app storage can remove local records; exports and device-provider backups are separate copies managed through their own controls.
Records of your consent
The current journal, health-import and crash-reporting choices, dates, purposes and notice versions are recorded locally, separately from the journal and its backups. Health choices also retain the exact affirmative statement and action used, with a local change marker to prevent a withdrawn in-flight import from saving. Previous choices are pruned after two calendar years as the app is used, with at most 100 history entries per consent ledger; the current choice stays while needed to apply it. Watch heart-rate choice records follow the same current-choice/two-year-history approach in the watch's non-backed-up storage. Clearing the relevant app's data removes its choices; a restored journal does not enable health imports or crash reporting. No central health-consent database is created. We keep dated master notices internally to explain each version. A chosen crash report carries limited consent metadata as explained above, without a name, email or fitness records. Terms acceptance is separate. Phone journal consent, refusal, persistence and deletion have been checked in private testing. This notice does not represent that every health connection or watch has completed release testing.
Records of data incidents
We keep a minimal record of data incidents or breaches, including what happened, our risk assessment, decisions, notifications and corrective action, for up to two years after the case closes. We remove unnecessary sensitive attachments sooner. Relevant evidence is kept longer only where a documented legal, regulatory or ongoing dispute need justifies it, with a separate review and retention rule.
Provider deletion and retained copies
Our retention periods describe the records we actively keep for the stated purpose. Deletion can involve provider recovery windows and protected backup copies. For Google Workspace customer content, its processing addendum allows up to 180 days to complete an irreversible deletion instruction, except where law requires storage; this is separate from our shorter periods for active support records. Cloudflare and Sentry apply their processing terms to deletion and any required residual retention. Provider account administration, security and audit records can have different periods from visitor or crash-event data. We do not use retained backup or incident copies for unrelated purposes. Contact us if you need a particular deletion or retention decision explained.