Privacy Policy

Last updated: 19 October 2026

This Privacy Policy explains what personal data SculptDiary collects, why, who it is shared with, and the rights you have over it. It covers the SculptDiary Telegram bot, the Telegram Mini App, the mobile app and the API behind them (together, the "Service").

1. Who we are

SculptDiary is operated by Sebastian Bila, a private individual based in Ukraine, who is the controller of your personal data. Contact: sebastianbila.sw@gmail.com.

2. Data we collect

• Account data: your Telegram user ID, username, first name and profile photo, your language, time zone, and, if you sign in with one, your email address.
• Profile and onboarding data: age, height, goals, experience level and your answers to onboarding questions. For coaches, also your bio, specializations and years of experience.
• Training data: training plans, workouts, exercises, sets, notes, comments, reactions, habits, check-ins and how you felt about a workout.
• Health and body data: body weight, body measurements and progress photos you choose to add.
• Messages to the bot: text and voice messages you send to log a workout, and feedback you send us.
• Subscription data: which plan you are on, its status and dates. Payments are handled by our payment provider; we never see or store your card details.
• Technical data: IP address, device and app version, push notification tokens, product usage events, error reports and server logs.

3. How we use your data

• To provide the Service: keep your training diary, show your progress and sync it across the bot and apps.
• To connect you with a coach you choose, and to let coaches manage their clients.
• To send notifications and reminders you have enabled, in Telegram or as push notifications.
• To run AI features, such as turning a voice or text message into a logged workout or generating a training plan.
• To manage subscriptions and give access to paid features.
• To keep the Service secure, prevent abuse, fix errors and improve the product.
• To answer your support and privacy requests.

4. Legal bases

Where the EU or UK General Data Protection Regulation (GDPR) or the Law of Ukraine "On Personal Data Protection" applies, we rely on:

• Contract: processing needed to provide the Service you signed up for.
• Consent: for health and body data, which you provide voluntarily by entering it, and for optional features such as notifications. You can withdraw consent at any time by deleting that data or turning the feature off.
• Legitimate interests: security, abuse prevention, error tracking and improving the Service.
• Legal obligation: where the law requires us to keep or disclose data.

5. Sharing with your coach

If you connect with a coach, that coach can see your profile, training data, check-ins, and the body data and progress photos you share. Coaches are independent users of the Service, not our staff. You can disconnect from a coach at any time; they then lose access to new data.

6. Service providers

We do not sell your personal data. We share it only with providers that help us run the Service, and only as far as each needs:

• Telegram: the bot and Mini App platform.
• Clerk: sign-in and account sessions.
• Railway: application hosting and databases.
• S3-compatible cloud storage: storing photos and other media.
• Cloudflare: network delivery and protection.
• OpenAI: transcribing voice messages, reading workout text and generating training plans.
• PostHog: product analytics and feature rollout.
• Sentry: error reports.
• Grafana: server logs.
• Expo: delivering push notifications to the mobile app.
• Tribute: processing subscription payments.

We may also disclose data if required by law or to protect the rights and safety of our users.

7. International transfers

Some of these providers process data outside Ukraine and the European Economic Area, including in the United States. Where this happens, we rely on the provider's legal safeguards, such as the European Commission's Standard Contractual Clauses.

8. How long we keep data

• Account, profile, training and body data: while your account is active.
• When you delete your account in the app, it is deactivated at once: you are signed out everywhere, your data is hidden and your coach connections end. To have the remaining data permanently erased, email us and we will do so within 30 days.
• Records of processed workout messages: 30 days. Payment notification records: 180 days.
• Logs, error reports and analytics: for the retention period of the provider concerned, typically no more than 90 days for logs and errors.

9. Your rights

You have the right to:

• access your personal data and get a copy of it (the app's data export gives you your training data);
• correct inaccurate data (most of it is editable in the app);
• delete your data (delete your account in the app, or email us for permanent erasure);
• restrict or object to processing, and to data portability;
• withdraw consent at any time, without affecting processing done before;
• complain to a data protection authority: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU, the authority of the country you live in.

To use any of these rights, email sebastianbila.sw@gmail.com. We answer within 30 days.

10. Children

The Service is not intended for anyone under 16. We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.

11. Security

We use encryption in transit, access controls and reputable providers to protect your data. No system is perfectly secure, so we cannot guarantee absolute security.

12. Changes to this policy

We may update this policy. We will change the "Last updated" date above, and for significant changes we will notify you in the Service.

13. Contact

Questions or requests about your data: sebastianbila.sw@gmail.com. See also our Terms & Conditions.