Privacy Policy

Last updated: 16 October 2026

3AF Fitness Club provides a fitness planning, food logging, coaching, and progress service. This policy explains what information 3AF handles, when information leaves your device, who processes it, and the choices available to you.

Information that can stay on your device

You can use the guest-first core app without creating an account. Guest plans, workouts, food and water logs, recovery check-ins, body updates, progress, and settings are stored locally on your device. This local information is not sent to 3AF unless you sign in and use sync, connect to a trainer, or use an online feature such as Meal Scan, Ask 3AF, or personalised meal ideas.

Information we may collect

• Account and contact information such as name, email address, user ID, role, authentication records, profile information, and an optional phone or WhatsApp number submitted with a coaching request.
• Fitness and wellness information such as goals, experience, workout availability, workout plans, exercises, sets, reps, load, RPE, rest time, bonus training, estimated workout energy, body measurements, check-ins, daily activity, food and water logs, menstrual-cycle context when entered, and progress notes.
• Trainer-client information such as connection status, assigned trainer, trainer-created plans, trainer notes, and plan approvals.
• Coaching-request information such as coaching format, an optional city or area for in-person coaching, preferred start timing, contact method, and the message you choose to send.
• User content such as meal descriptions, questions sent to Ask 3AF, food preferences, halal-friendly or other ingredient requirements, recorded allergies, foods to avoid, and a meal photo you select for analysis.
• Launch-waitlist information such as your name, email address, selected interest, consent time, and campaign source when you choose to join.
• Technical and product information such as authentication events, feature usage, service performance, estimated service cost, fallback use, and error information.

How we use information

We use information to provide and personalize the app, authenticate accounts, sync records, show assigned plans, connect clients with trainers, contact users who request coaching, generate user-requested AI estimates, enforce usage limits, maintain security and reliability, understand feature quality, respond to support requests, and send updates that you explicitly requested.

AI nutrition features

3AF AI features are optional. Before the first AI request, the app asks for explicit permission to share the relevant content with the service providers described below. You can decline and continue using manual food logging.

• Meal Scan: When you tap Analyze, the selected meal photo is resized and compressed, then sent with the meal type, optional notes, and saved food preferences.
• Meal corrections: When you ask 3AF to fix an estimate, your correction, the current editable food items and nutrition estimates, meal type, and saved food preferences are sent for that adjustment.
• Ask 3AF: When you send a question, 3AF may send the question, relevant recent conversation history, your current food log, nutrition and water targets, current workout and completion context, plan and progress summaries, food preferences, and recorded allergies so the answer can be personalized.
• Personalised meal ideas: When enabled, 3AF may use your remaining nutrition targets, recent and confirmed foods, saved food preferences, recorded allergies, and today's training context to select or generate practical meal suggestions. Suggestions are estimates and are not added to your food log.
• Who processes it: Supabase receives the request to authenticate your account and run 3AF’s server processing. Alibaba Cloud, through its Model Studio service, is the AI processor and receives the relevant content listed above to produce the requested estimate or answer. It may also process relevant submitted text and generated answers for safety checks. If it is unavailable, the AI request does not complete and manual food logging remains available.
• User control: AI nutrition output is an estimate and appears as an editable draft. Nothing is added to your food log until you review and confirm it.

Provider policies, contractual terms, and account settings govern the handling of submitted content. Service providers may retain request information for security, abuse prevention, legal compliance, and service operation. 3AF does not promise zero provider retention.

AI storage and retention

• 3AF does not save the submitted meal photo in its cloud file storage or an image database field. Provider request processing, temporary on-device drafts, and confirmed on-device meal photos described below are separate.
• An unfinished Meal Scan can retain a compressed photo, notes, and editable estimate on your device for up to 24 hours so you can return to it. This draft is separate from confirmed food logs, is not synced or included in device backups, and clears when you confirm or discard it, withdraw AI consent, or delete its account. Expired drafts are removed when the app next launches or checks saved drafts.
• When you add a scanned meal, 3AF retains a compressed photo with the confirmed meal on this device. You can also attach an optional photo to a manual food entry. Confirmed meal photos remain until you remove the photo, delete the meal, or delete its account. They are account-isolated, are not synced or included in device backups, and remain with confirmed food records if you withdraw AI consent.
• For Meal Scan reliability and duplicate suppression, 3AF stores a one-way hash derived from the photo and request context together with the structured nutrition response. This cache is marked to expire after 48 hours, is ignored after expiry, and expired rows are removed during service cleanup or account deletion.
• Ask 3AF questions and conversation text are not stored in 3AF product telemetry. They are sent to service the request.
• Recent Ask 3AF messages are saved on your device for the signed-in account so you can continue a conversation. Starting a new conversation clears that local chat while keeping confirmed food logs. Account deletion also removes the account's local chat on the device used to complete deletion.
• To deliver completed requests and handle retries, 3AF stores request status and generated responses with your account, without the raw photo or submitted chat history. Meal Scan job records become eligible for cleanup after 48 hours without an update; completed or failed Ask 3AF job records become eligible after one day. Cleanup runs when the service processes subsequent requests, so records can remain longer until cleanup or account deletion.
• Validated meal-suggestion recipes may be stored without your account identity in a reusable 3AF suggestion library. Your daily suggestion set and recent suggestion identifiers may be stored with your account so 3AF can avoid repeatedly showing the same meals.
• AI request telemetry may retain service usage, estimated cost, latency, and fallback status. Outcome telemetry may retain the feature action, short food labels, item counts, macro estimates, and edit or clarification counts. This information is linked to the signed-in account and used for reliability, limits, cost control, and quality review.

Launch and marketing updates

If you join the 3AF launch waitlist, we use your email address and selected interest to send relevant launch, 3AF Plus, or coaching information. Campaign-source details may be stored so we can understand which public communication led you to 3AF. You can withdraw your consent or ask to be removed at any time by contacting hello@3afitnessclub.com.

Sharing and service providers

Client data may be visible to the client’s assigned trainer and authorized 3AF personnel when needed to provide the service. Supabase provides authentication, cloud data storage, sync, and server processing. Alibaba Cloud (Model Studio) provides AI processing as described above. We also use service providers for email delivery. We share only what is needed to provide and protect the service. We do not sell personal information, use it for third-party advertising, or track you across other companies’ apps and websites.

Storage, security, and international processing

We use access controls, row-level security, encrypted network connections, and other reasonable safeguards. Our service providers may process information in countries outside Malaysia. Those locations may have different data-protection rules. If you believe information has been exposed, sent to the wrong person, or accessed without authorization, contact hello@3afitnessclub.com promptly.

Retention and deletion

Local guest information remains on your device until you remove it, delete an authenticated account from that device, or delete the app. Synced account, fitness, trainer, and AI telemetry records are generally retained while your account is active or as needed to provide, secure, and support the service. You can delete your account inside the app. Successful account deletion removes the cloud account, customer-owned cloud records configured to be deleted with it, and 3AF fitness data saved locally on the device used to complete deletion. It does not control information a service provider must temporarily retain for security, legal, or abuse-prevention purposes.

Your choices and permissions

• You can withdraw AI consent under You > Privacy & data. This blocks future AI analysis for Meal Scan, Ask 3AF, and personalised meal generation, and does not remove confirmed local food logs.
• Camera permission is requested when you choose to take a meal photo. The camera captures a photo only when you choose to take one.
• Apple’s photo picker lets 3AF receive only the photo you select. 3AF does not request broad access to your photo library for this flow.
• 3AF does not request device location permission. A city or area leaves your device only when you type it into a coaching request and send that request.
• Notifications are requested only when you choose to enable reminders during onboarding or in app settings. Rest alarms are enabled separately in Notifications settings.
• You can manage system permissions in iOS Settings.
• You may request access, correction, export, or deletion by contacting hello@3afitnessclub.com.

Health and safety

3AF stores fitness and wellness information entered by users or trainers. Nutrition values, workout energy, forecasts, and AI results are estimates. 3AF is a general wellness and fitness product, not a medical device, and does not provide diagnosis or medical advice.

Children

3AF is not presented as a children’s app and is not directed to children under 13. If you believe a child has provided personal information without appropriate permission, contact us so we can review and remove it.

Malaysia PDPA

We aim to handle personal data in accordance with Malaysia’s Personal Data Protection Act 2010 (Act 709), applicable amendments, and related requirements. This policy should be read with any applicable notices or consent forms.

Changes to this policy

We may update this policy as the product, providers, or legal requirements change. The latest version and effective date will be published on this page. If an AI data-sharing change is material, the app can require consent again before another AI request.

Contact

For privacy questions, contact hello@3afitnessclub.com.