Privacy Policy

This policy explains what data Corpus ("Corpus," "we," "us") collects when you use the Corpus iPhone app, why we collect it, and what control you have over it. We wrote it to describe what the app actually does, not a generic template, so if a section doesn't apply to how you use Corpus, it's because that data type genuinely isn't collected.

The short version: Corpus doesn't have user accounts. There's no name, email, or password tied to your data, only private identifiers generated on your device. We don't run ads, we don't sell data, and we don't link anything we collect to information from other companies. The app sends usage analytics and crash reports, tied to a random analytics ID, to PostHog, an analytics service hosted in the EU, so we can see how Corpus is used and where it breaks. Those analytics never include anything you enter or choose about yourself, such as your photos, body measurements, health data, onboarding answers, or Coach messages (see "App analytics" under section 1, and section 3 for the website's own cookieless analytics). Everything below explains the specifics.

1. What we collect, and why

Check-in photos

When you complete a check-in, your photo is sent to our backend to generate that check-in's analysis (your score, body fat percentage, FFMI, and muscle-group ratings). This is the one piece of data collection Corpus cannot function without, since the analysis has to happen somewhere, and it happens on our servers rather than entirely on your device.

Your check-in photos are stored locally in Corpus's protected app storage so you can browse, compare, and export them. Like the rest of the app's local data, completed check-in photos currently follow your device's normal backup behavior (for example, iCloud Backup, if you have it enabled) rather than being excluded from it. Corpus only writes an optional separate copy to your Photo Library if you turn on that setting.

We do not sell your photos, use them for advertising, or use them to train any model beyond generating your own check-in's analysis. We do not share them with anyone unless you explicitly use a sharing feature (like a Compare or Chapters share card) yourself.

Body composition and metrics

Body fat percentage, weight, BMI, FFMI, waist-to-hip ratio, composite scores, and muscle-group ratings are stored on your device so Corpus can show you trends over time and give the Coach context during a conversation.

Apple Health data (HealthKit)

If you connect Apple Health during setup, Corpus reads (never writes) the following, to power your Recovery score:

• Sleep analysis
• Heart rate variability (HRV, SDNN)
• Resting heart rate
• Wrist temperature during sleep
• Respiratory rate
• Body mass (used to prefill your check-in weight)
• Step count and active energy burned

Connecting Apple Health is optional. Corpus never writes any data back to Apple Health. Health data is used only to compute your Recovery score and, where relevant, to give the Coach context about your recovery when you ask it a question. It is not sold, shared with advertisers, or used for any purpose beyond the app's own functionality. This is consistent with Apple's requirements for apps that use HealthKit.

Device identifier

Corpus has no accounts, no sign-up, and no login. Instead, a private device identifier is generated and stored securely (in the device Keychain) the first time you open the app. Every request to our backend, including check-in analysis and Coach conversations, is associated with this identifier rather than with your name or email, because we don't collect either. It is separate from the analytics ID described under "App analytics" below, and the two are never joined.

Coach conversations

Messages you send to the Coach, plus the check-in history, trends, and recovery context used to answer them, are sent to our AI provider to generate a response. Corpus does not keep a Coach transcript in its own database. When you close Coach, the app requests deletion of the provider conversation; if that request cannot be completed, the provider's short retention period applies.

Push notification token

If you enable notifications, Apple issues a device token that we use solely to deliver check-in reminders and streak nudges. We do not use it for any other purpose.

App analytics

To understand how Corpus is used and where it breaks, the app sends a small, fixed set of events to PostHog, an analytics service, on its servers in the European Union (PostHog Cloud EU, in Frankfurt, Germany). PostHog's SDK (including its built-in crash reporter) is the only third-party SDK in the app. Apart from crash reports (described below), we've turned off all of its automatic capture, such as screen views and taps, so the app sends only the events described here. Session recording, surveys, and feature flags are off, and the SDK doesn't add device details to the profile itself; PostHog does copy a few basic ones from the events onto it, such as the app version, iOS version, and device type.

The analytics ID. The first time you open Corpus, the app generates a random analytics ID and keeps it in your device's Keychain (or, if the Keychain isn't available, in the app's own storage). It isn't an account, your Apple Account, or an advertising or device identifier, and it is separate from the device identifier described above: analytics events never carry that identifier, and we don't join analytics with your check-ins, photos, or Coach conversations. When you buy a subscription, Corpus attaches the analytics ID to the purchase (as the App Store's "app account token") so the purchase can be matched with the app's usage events. Because every event carries this ID, app analytics are pseudonymous rather than anonymous: we can see what one installation of Corpus did, but not who you are. The analytics ID is also PostHog's identifier for your installation, so PostHog keeps a pseudonymous profile under it, with that installation's events and its Apple Ads attribution result. iOS usually keeps Keychain items even after an app is deleted, so if you delete and reinstall Corpus, it usually continues with the same analytics ID. When you ask us to delete your analytics data (section 5), we delete the ID's profile and its events from PostHog; the ID itself stays on your device, so anything you do in Corpus afterwards is recorded under it again.

What the app sends:

• Usage: app opens, how long each session lasted, and which features you use (for example starting a check-in, opening Coach, or comparing check-ins).
• Purchases: when a paywall is shown, which plan you select, and whether a purchase or a restore succeeded, and, when you start a free trial, whether the app could schedule the reminder it sends before the trial ends. For a purchase, the product, its price and currency, and the purchase's original transaction ID; never your App Store receipt or payment details.
• Progress through the app's flows: which onboarding and check-in steps you reach or complete, whether something was cancelled or failed, error codes, how long the app's own operations take (such as a check-in analysis), and whether you allowed notifications when asked.
• Technical context with each event: app version and build, iOS version, device model, your device's language and region settings and the app's language, time zone, App Store country, whether it's a TestFlight (beta) build, when the app was installed, and a random ID for the current session, plus a few basic details PostHog's SDK adds, such as the device type, whether the app is running on a Mac or in a simulator, and the SDK's version.
• Apple Ads attribution: once, after you install Corpus, the app asks Apple's AdServices framework whether the install came from an Apple Ads campaign and sends the result (such as the campaign, ad group, and keyword, or that the install didn't come from an ad). This doesn't use your device's advertising identifier (IDFA) or App Tracking Transparency, and it isn't tracking.
• Crash reports: if Corpus crashes, the app sends a crash report through PostHog's error tracking, with the same analytics ID: the error type and message, a stack trace showing where in Corpus's code the problem happened, the app version and build, the device model, and the iOS version, plus the same technical details as other events and the names of the app's code libraries in the trace (used to make the trace readable). No screen content and nothing you typed.

What the app never sends: anything you enter or choose about yourself or your body. That means no onboarding answers, goals, or milestones; no photos, and no photo angles or per-check-in photo counts (an event only says that a check-in was completed or a pose added); no body measurements or body-composition metrics (weight, body fat, scores, and the like); no Apple Health data; no Coach messages, replies, topics, or what your feedback said; no name; and nothing you type. Events carry only fixed values such as a step name, a plan, or an error code.

Development builds of Corpus never send analytics. TestFlight (beta) builds and the App Store version do, and events from beta builds are marked as beta.

PostHog receives your IP address, because that's how data travels over the internet, but we've set our PostHog project to discard it, so it isn't stored. The app also turns off PostHog's location lookup for every event, so your IP address isn't used to work out where you are. The only location-related details we have are the ones listed above: your App Store country, your time zone, and your device's region setting (and, for an install from an Apple Ads campaign, that campaign's country).

Earlier versions. Versions of Corpus before 1.3 send their analytics and crash reports to the same PostHog project until you update, under a random ID that PostHog generates rather than the analytics ID. Their events are more detailed than the list above: besides app opens and the screens and steps viewed, they include which photo angles a check-in used or skipped and how each photo was taken (for example with the timer or from your photo library), how many photos were submitted, how closely the photos of a suggested comparison matched, whether Coach was opened about a check-in or a comparison and whether a question came from a suggested prompt, whether Coach feedback was positive or negative, and the approximate size of a Backstory import, including roughly how many of its days got a weight from Apple Health. They never include your photos, your body measurements, any Health values, Coach messages, your name, or anything you type. Because that ID isn't shown in the app, we can't find those events from your analytics ID. They're kept for up to 7 years like the rest. Version 1.3 sent its usage events to a database of ours hosted by Supabase; that collection has stopped, and that database has been deleted along with its data.

We use app analytics only to keep Corpus working and improve it: whether features work, where people drop off during onboarding, how the paywall and plans perform, and whether Apple Ads campaigns bring people who stay. We don't use it for advertising, sell it, share it with data brokers, or combine it with other companies' data. Where a law such as the GDPR or Brazil's LGPD requires a legal basis, we rely on our legitimate interest in keeping Corpus working and improving it. Section 4 explains where this data is stored, and section 5 how long we keep it and how to have it deleted.

Separately, if you've chosen to share analytics with app developers in your iPhone's settings (Privacy & Security, then Analytics & Improvements), Apple may also share crash reports and usage statistics with us, under Apple's privacy policy.

2. What we don't do

• No advertising SDKs and no third-party ad-attribution SDKs. The only install attribution is Apple's own AdServices check described under "App analytics," which uses no advertising identifier.
• No cross-company tracking SDKs, and no session recording or screen recording. The app's only third-party SDK is PostHog's (including its built-in crash reporter), for app analytics and crash reports, with session recording turned off (see "App analytics" above). The website's analytics are separate (see "Website analytics" below).
• No selling, renting, or trading your data to anyone, for any reason.
• No linking your data to information from other companies for advertising purposes (i.e., no "tracking" as defined by Apple's App Tracking Transparency framework), and no data brokers.
• No joining the app's analytics ID with the website's analytics, with the device identifier used for check-ins and Coach, or with any account.

3. Website analytics (getcorpus.app)

This website separately uses PostHog, hosted in the EU, to measure aggregate traffic and which pages and links are useful. The website's analytics is entirely separate from the app's: a different PostHog project, a different identity, and never joined together. It runs in cookieless mode with no persistent visitor id and no person profiles, and only sends a small set of deliberately defined events (page views, App Store button clicks, FAQ opens, and similar) with no free-form content. We configure PostHog to discard your IP address and skip location lookup. We don't run a cookie banner because the site's analytics doesn't use tracking cookies or build cross-site profiles; instead, one first-party preference cookie remembers it if you turn analytics off below. That preference cookie is the only cookie this site sets for analytics purposes.

4. Where your data is stored and processed

Check-in photos and Coach messages are processed through Corpus's backend and AI provider to provide the requested analysis or response. Corpus keeps no photos, metrics, or Coach transcripts in its own backend database. It retains limited operational records, such as a device identifier, endpoint, timestamp, and token-use metadata, for up to 14 days to operate the service and prevent abuse. Local photos, metrics, and preferences remain in protected, app-managed on-device storage; as noted above, completed check-in photos currently follow your device's normal backup behavior. App analytics and crash reports (see "App analytics" in section 1) are stored by PostHog in the European Union (PostHog Cloud EU, in Frankfurt, Germany), in a PostHog project separate from the website's.

These service providers process data on our behalf:

• Supabase, Inc. hosts Corpus's backend, which receives check-in and Coach requests and keeps the operational records described above. Supabase processes this data under its Data Processing Agreement, which includes the European Commission's Standard Contractual Clauses for international transfers. See Supabase's privacy policy.
• Our AI provider generates check-in analyses and Coach replies from the photos, metrics, and messages sent to it, as described in section 1.
• Apple processes purchases, App Store downloads, push notifications, Apple Ads attribution, crash reports you choose to share, and any iCloud backups you make, under Apple's privacy policy.
• PostHog, Inc. processes the app's analytics and crash reports (section 1) and this website's cookieless analytics (section 3) in the EU, in separate projects, under its Data Processing Agreement. See PostHog's privacy policy.

5. Data retention and deletion

Your check-ins, photos, and metrics remain on your device until you delete them in the app or delete the app. Because Corpus has no account, there is no cloud profile or server-side photo library to delete. Operational records are automatically deleted after 14 days. A Coach conversation is deleted when you close Coach when possible, with the provider's short retention period as the fallback.

App analytics events and crash reports are kept in PostHog for up to 7 years, the retention period of our PostHog project. You can ask us to delete them sooner at any time: email support@getcorpus.app with the analytics ID shown in the app's Settings, and we'll delete that ID's profile and its events from PostHog. Deleting the app doesn't delete analytics that were already sent.

6. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Because Corpus doesn't collect your name or email and has no account, most of this is already in your hands: your check-ins, photos, and metrics live on your device, and you can remove them at any time by deleting them in the app or deleting the app, as described above. For the operational records and app analytics described in section 5 (for analytics, include the analytics ID shown in the app's Settings), or for any request those don't cover, contact us at support@getcorpus.app.

7. Children's privacy

Corpus is not directed at children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect data from children under that age.

8. Changes to this policy

If this policy changes in a material way, we'll update the "Last updated" date above and, for significant changes, notify you inside the app.

9. Contact

Questions about this policy or your data can be sent to support@getcorpus.app.