1. Who we are
OWLiFT is operated as a single-operator private beta by Kit Riños, based in the Philippines. The operator acts as the Personal Information Controller (PIC) and Data Protection Officer (DPO) for the service. Contact: jpr.kit@gmail.com.
OWLiFT is governed by the Philippine Data Privacy Act of 2012 (Republic Act 10173) and follows GDPR-aligned practices for users outside the Philippines.
2. What we collect
OWLiFT collects only the data you explicitly enter or upload. We do not run any analytics, advertising, or third-party tracking scripts. Specifically, we collect:
- Account identifiers - email address and password hash (managed by Supabase Auth; we never see your raw password).
- Profile data - name, age, sex, height, training goal, activity level, training split, starting weight + body fat, timezone, and any notes you choose to add.
- Body composition scans - date, weight, body fat percentage, lean mass, visceral fat level, skeletal muscle, BMR, biological age, BWI score, waist/hip/chest/arm/thigh measurements, water composition, scan method, and notes.
- Bloodwork - date, lab name, fasted state, lipid panel, metabolic markers, hormones (including testosterone variants), liver, kidney, inflammation, thyroid, hematology (CBC), and notes.
- Journal entries - date, entry type, free-text content, experiment metadata (protocol substance, dose, route, change-from), watched metrics, and Hoot's verdict outcomes.
- Goals - goal type, target weight, target body fat, target lean mass, deadline, status, and notes.
- Form-check videos - videos you upload for AI form review. These are processed transiently and not stored after the AI returns its analysis.
- Chat messages - your conversations with Hoot. Stored in your browser's localStorage by default; not saved server-side unless you explicitly enable it.
3. Sensitive data
Bloodwork, body composition, and journal entries about hormone replacement therapy or performance-enhancing drugs are sensitive personal information under the DPA. We treat them with the following minimums:
- Stored only in your authenticated, row-level-secured Supabase Postgres database. No other user can read your rows.
- Not used for any purpose other than rendering insights and AI coaching for you specifically.
- Never sold, rented, leased, or disclosed to any party other than the third-party processors listed in section 5.
4. How we use your data
Your data is used for one purpose only: to render your dashboard, generate Hoot's insights and verdicts, and let you review your own history. AI prompts include relevant snippets of your data (latest scan, active goal, recent journal entries, bloodwork) so Hoot can answer with context.
We do not aggregate, anonymize, or share your data for research, marketing, training of AI models, or any other secondary purpose.
5. Third-party processors
OWLiFT relies on these processors. Each processes data on our behalf under their own privacy agreements; we do not control their internal operations.
- Supabase (hosting + Postgres + Auth) - stores all your data at rest. supabase.com/privacy
- Render (web app hosting) - runs the Flask application. render.com/privacy
- OpenAI (GPT-4o for chat + insights + verdicts) - receives prompts containing your snapshot data when you interact with Hoot. openai.com/policies/privacy-policy
- Google (Gemini API) (form-check video analysis) - receives videos you upload for form review. policies.google.com/privacy
OpenAI and Google have committed to not training their models on API inputs from paid plans. We use paid API plans for both.
6. Data retention
Your data is retained for as long as your account exists. When you delete your account (see section 8), all rows associated with your user_id are permanently removed within 30 days. Backups roll forward and are overwritten within 90 days.
Form-check videos are processed transiently and discarded immediately after analysis.
7. Your rights
Under the Philippine Data Privacy Act (and GDPR, where applicable), you have the right to:
- Access - request a copy of all data we hold about you. OWLiFT provides a one-click data export from your account settings (or by emailing the DPO).
- Correct - every scan, bloodwork, journal, and goal record is editable from the UI.
- Delete - close your account and have all data permanently removed. Account deletion is one-click from settings (or by emailing the DPO).
- Withdraw consent - stop using OWLiFT at any time. We do not process your data after you delete your account.
- Object - to any specific processing. Email the DPO with the request.
- Lodge a complaint - with the National Privacy Commission of the Philippines (privacy.gov.ph) or your local data protection authority.
8. Account deletion
You can delete your account from the Settings page. Deletion is irreversible and removes:
- Your auth.users record (Supabase Auth)
- Your profile, scans, goals, bloodwork, and journal rows (cascade by user_id)
- Any cached AI conversation history
Backup snapshots containing your data roll off within 90 days.
9. Security
OWLiFT uses TLS 1.2+ for all traffic, Postgres row-level security to enforce per-user isolation, signed httponly session cookies, and Supabase Auth's bcrypt-hashed password storage. The operator has unique service-role access for administrative paths only (e.g. cron-style verdict evaluation).
OWLiFT is a private beta and has not undergone third-party security audit. Use at your own risk for sensitive health data. Industry-standard encryption is in place but no system is fully breach-proof.
10. Breach notification
In the event of a personal data breach affecting your information, the operator will notify you and the National Privacy Commission within 72 hours of becoming aware, as required by the Philippine DPA.
11. International transfers
OWLiFT's processors are located primarily in the United States (Supabase, Render, OpenAI, Google). By using OWLiFT you consent to your data being transferred and processed in those jurisdictions, which may have different data protection laws than your country of residence.
12. Children
OWLiFT is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact the DPO and the account will be deleted.
13. Changes
We may update this policy as the service evolves. Material changes will be communicated via email and reflected in the "last updated" date at the top of this page.
14. Contact
For privacy questions, data subject requests, or breach reports, contact the operator/DPO at jpr.kit@gmail.com.