Refactor Privacy Policy

Effective date: May 11, 2025

Refactor (“we,” “our,” or “us”) operates the Refactor mobile application and web platform (collectively, the “Service”). This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

By using Refactor you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

Information You Provide

  • Account information: name, email address, and password (if you claim an account).
  • Profile information: age, biological sex, height, weight, fitness goal, fitness level, daily activity level, workout location preferences, equipment access, dietary restrictions, and injury or limitation notes.
  • Meal logs: food names, macronutrient estimates, meal type, and optional photos of meals or receipts.
  • Supplement logs: supplement names, dosages, and frequency.
  • Blood work uploads: photos of lab result documents that you voluntarily submit for AI analysis.
  • Body scan photos: optional front, side, and back photos you submit for body composition estimates.
  • Biofeedback: self-reported daily ratings for energy, mood, hunger, stress, and muscle soreness.
  • Hydration and fasting logs: water intake records and fasting session times.
  • Coach chat messages: messages you send to and receive from the AI coaching assistant (“Ref”).
  • Workout data: exercise completions, sets, reps, and imported workout plans.
  • Feedback: ratings or text you submit through in-app feedback forms.

Health Data from Apple HealthKit

With your explicit permission, Refactor reads the following data categories from Apple HealthKit: step count, active energy burned, heart rate, resting heart rate, sleep analysis, body mass, and body fat percentage. We use this data solely to personalize your fitness and nutrition plan and to power recovery-aware coaching features.

We do not sell, share, or disclose Apple HealthKit data to third parties for advertising, marketing, or any purpose unrelated to providing the Service. HealthKit data is never used for advertising or sold to data brokers.

Data from Third-Party Wearables

If you connect a supported wearable device (Oura Ring, Fitbit, Garmin, or a Bluetooth scale), we receive activity, sleep, readiness, and body composition data from those services via their respective APIs. You may disconnect these integrations at any time from the Wearables settings screen.

Information Collected Automatically

  • Usage data: anonymized request logs including IP addresses, endpoints accessed, and response times — used for debugging and rate-limiting abuse.
  • Device identifiers: push notification tokens for delivering scheduled reminders (meal, workout, hydration, and coach check-in notifications). These are stored only as long as notifications are enabled.

2. How We Use Your Information

We use the information we collect to:

  • Generate and dynamically adjust your personalized diet and workout plan.
  • Power the AI coaching assistant with context about your goals and progress.
  • Track and display your macro and calorie intake against daily targets.
  • Provide recovery-aware plan adjustments based on wearable and biofeedback data.
  • Analyze blood work photos and supplement stacks for AI-generated insights.
  • Send scheduled push notifications you have opted into.
  • Sync your data across your devices (iOS app and web app).
  • Maintain and improve the reliability and security of the Service.
  • Respond to support inquiries.

We do not use your data for targeted advertising, and we do not sell your personal information to any third party.

3. AI Processing

Refactor uses Amazon Bedrock AI models (Amazon Nova) to generate meal analyses, workout plans, coaching responses, supplement analyses, blood work interpretations, and research answers. Data submitted for AI processing is sent to Amazon Web Services and is governed by AWS’s data processing agreements. AI-generated health insights are informational only and are not a substitute for advice from a licensed healthcare provider.

4. Data Sharing

We share your information only in the following limited circumstances:

  • Service providers: We use Amazon Web Services (data storage and AI), Vercel (hosting and serverless compute), and web push notification services. These providers process data only on our behalf and under confidentiality obligations.
  • Wearable integrations: If you connect Oura, Fitbit, or Garmin, we exchange data with those services according to your authorization. We do not share your Refactor data back to those providers beyond what is required for the connection.
  • Public profile: If you set a username and enable a public profile, your chosen display name, badges, and optionally your stats are publicly visible at https://refactor-one.vercel.app/u/[username]. You can set your profile to “Badges Only” or make it private at any time.
  • Legal compliance: We may disclose information if required by law, court order, or to protect the rights and safety of our users.

We do not sell, rent, or trade your personal information.

5. Data Retention

We retain your account data for as long as your account is active. If you request deletion (see Section 8), we will delete your personal data within 30 days, except where retention is required by law. Request logs are automatically purged after 90 days.

6. Data Security

All data is transmitted over HTTPS/TLS. Data at rest is stored in Amazon DynamoDB with server-side encryption. API access is protected by user-specific authentication tokens. We apply rate limiting to prevent abuse. No security system is perfect; we encourage you to use a strong, unique password.

7. Children’s Privacy

Refactor is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.

8. Your Rights and Choices

  • Access and correction: You can view and update your profile information at any time within the app.
  • Data deletion: You may request deletion of your account and all associated data by emailing support@refactor.app with the subject “Delete My Account.”
  • HealthKit data: You can revoke Refactor’s HealthKit permissions at any time in iOS Settings › Privacy & Security › Health.
  • Wearable connections: Disconnect any wearable integration from the Wearables screen in the app.
  • Push notifications: Disable notifications at any time in iOS Settings or within the app’s Notifications settings screen.
  • Public profile: Set your profile visibility to “Badges Only” or remove your username from the Social & Privacy settings screen.

9. California Privacy Rights (CCPA)

California residents have the right to know what personal information we collect, to request deletion, and to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at support@refactor.app.

10. International Users

Refactor is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Effective date” at the top of this page. Continued use of the Service after changes are posted constitutes acceptance of the updated policy. For material changes, we will provide additional notice (such as an in-app notification).

12. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

Refactor

Email: support@refactor.app

Website: https://refactor-one.vercel.app