Legal
Privacy Policy
Last updated 27 October 2026
The short version. We collect what we need to coach you. Your health data, photos and food logs are used for your coaching and nothing else. We never sell your data, never use it for advertising and never use it to train AI models. Physique photos are private and you can delete them in one tap. Delete your account and everything goes within 30 days.
1. Who we are
DARCYCO Active (the “app”) and this website are run by DARCYCO, a sole trader in Australia (ABN to be added), trading as DARCYCO Studio (“we”, “us”). We are responsible for your personal information under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you are in the European Economic Area, the UK or Switzerland, we are the “controller” of your personal data under the GDPR (or UK GDPR). Contact: support@darcyco.com.au.
2. What we collect
You give us
- Account details: name, email, sign-in method (Apple, Google or email), handle, profile photo, bio.
- Profile and goals: birth date (to confirm you are 16 or over), sex, height, weight, training experience, schedule, where you train, goals and target dates.
- Health information: body measurements, weight history, readiness check answers (PAR-Q style), injury notes you type, workouts, sets, effort ratings, stretch sessions, and anything you tell DC about how you feel. Under Australian law this is “sensitive information” and we only collect it with your consent.
- Physique and goal photos: optional front, side and back photos, and an optional reference “goal” photo. Not available under 18.
- Gym and equipment photos: photos of your training space so DC can list the equipment.
- Nutrition: foods, meals, portions, barcodes you scan, meal photos, water and targets.
- Crew content: posts, captions, comments, Props, follows, reports and blocks.
- Gym price submissions you choose to make.
- Messages to DC and to our support email.
With your permission, from your device
- Apple Health (HealthKit) or Health Connect: workouts, steps, heart rate, resting heart rate, heart rate variability, sleep, active energy and body mass. We write workouts, stretch sessions and body mass back if you allow it. You choose each data type in the system permission screen and can turn it off at any time.
- Location: used on your device to show gyms near you in the gym finder. We do not store a history of your location. If you search by suburb instead, we do not use location at all.
- Camera and photos: only when you take or choose a photo.
- Contacts: only if you use Find friends by contacts. We match contacts to existing accounts and do not keep the contacts you did not match.
- Notifications: a push token so we can send the reminders you turn on.
Collected automatically
- Device type, operating system, app version, language, time zone, crash reports and pseudonymous feature usage.
- Subscription status from Apple or Google, via RevenueCat. We never see your card details.
- On this website: standard server logs (IP address, browser, pages requested) kept for security. This site does not use advertising or tracking cookies.
3. How we use it
- To run the app: your account, logging, timers, graphs, Crew and the gym finder.
- To coach you: DC uses your goals, stats, history, equipment and (if you choose) photos to write and adjust your program, nutrition targets and reports.
- To manage your membership, trial reminders and support requests.
- To keep Crew safe: reviewing reports, removing content and suspending accounts that break the Terms.
- To fix bugs, keep the service secure, and understand which features help (using pseudonymous analytics, not health values).
- To send the notifications and emails you opt into. Marketing emails only with your consent, with an unsubscribe link in every one.
What we never do
- We never sell or rent your personal information.
- We never use your health data, HealthKit or Health Connect data, photos or food logs for advertising or marketing.
- We never use your data or photos to train AI models, and our AI provider is contractually not permitted to either.
- We never show physique or goal photos in the feed or to anyone else.
- We never share HealthKit or Health Connect data with third parties except the processors that host and process it for your coaching.
4. Legal bases (EU, UK and Swiss users)
- Contract: to provide the app and your membership.
- Explicit consent: for health data, physique photos, device health data and location. You can withdraw consent at any time in the app or in your device settings; this does not affect processing before withdrawal.
- Legitimate interests: security, fraud prevention, moderation and improving the app, balanced against your rights.
- Legal obligation: tax records and responding to lawful requests.
5. AI processing
DC runs on Claude, made by Anthropic, PBC. When you use a DC feature, we send Anthropic only the information that request needs, from our servers (the app never talks to Anthropic directly). Equipment and meal photos are turned into text lists; physique photos are only sent if you ask for a physique analysis. Anthropic acts as our sub-processor: it processes this data to return a response, does not use it to train its models, and keeps it only for a limited time for safety and abuse monitoring under its commercial terms. See the AI Disclosure.
6. Who processes your data for us
We use these service providers. Each is bound by a contract to use your data only to provide their service to us.
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Database, sign-in, file storage (including private photo storage) | Account, profile, training, nutrition, body and progress data, photos |
| Anthropic | AI processing for DC (sub-processor) | The information DC needs for a request: goals, stats, schedule, equipment lists, training history, and photos you choose to have analysed |
| RevenueCat | Subscription status across Apple and Google | An anonymous app user id, purchase and renewal events. No card details |
| Apple and Google | App stores and payments | Payment and subscription details, handled under their own privacy policies |
| Sentry | Crash and error reports | Device model, OS version, app version, error traces. We strip health data and photos |
| PostHog | Product analytics (how features are used) | Pseudonymous usage events. Never health values, photos or food logs |
| Expo | App updates and push notification delivery | Push token, app version, device type |
| Google Maps Platform | Maps and gym listing details | Map tiles load on your device. Your precise location is not sent to us for this |
| Resend | Account and service emails | Your email address and the email content |
We also disclose information if the law requires it, to protect someone from serious harm, or as part of a sale of the business (in which case this policy would continue to apply and we would tell you first).
7. Overseas disclosure
Some of our providers store or process data outside Australia, mainly in the United States, and may also use facilities in the European Union and other countries where they operate. Where we can choose a region, we choose Australia or the nearest available region for our main database. Before disclosing your information overseas we take reasonable steps, as APP 8 requires, to make sure the provider handles it consistently with the APPs. For EU and UK users, transfers rely on adequacy decisions or the European Commission's Standard Contractual Clauses (and the UK addendum).
8. Photos
- Physique and goal photos are stored in a separate private bucket, encrypted, with no public link and no CDN. Only you can view them, through short-lived signed links.
- Each photo has a delete button. Deleting removes it from storage immediately and from backups within 30 days.
- Under 18: physique and goal photos and photo analysis are switched off.
- Photos you post to Crew are visible according to your profile and post settings.
9. Crew and what others can see
Profiles are private by default. A public profile shows your handle, name, photo, bio, goal badge, streak, PR board and public posts, and may appear on a share page on this website. Followers you approve can see a private profile. Your weight, measurements, nutrition, health data and progress photos are never shown to others unless you post them yourself.
10. How long we keep it
- Account and training data: while your account is open.
- After you delete your account: removed from live systems straight away where possible and from all systems, including backups, within 30 days.
- Subscription and tax records: kept for 5 years, as Australian tax law requires. These hold no health data.
- Moderation records for content that broke the rules: up to 2 years, to stop repeat abuse.
- Crash reports and analytics: up to 90 days and 12 months respectively.
- Support emails: up to 2 years after the conversation ends.
11. Your choices and rights
- Access and export: download your data as a file at Me → Settings → Export data, or ask us.
- Correction: edit most details in the app, or ask us to correct anything else.
- Deletion: Me → Settings → Delete account, or email us. See account deletion.
- Withdraw consent: turn off Apple Health or Health Connect, location, camera, contacts or notifications in the app or device settings at any time.
- Turn DC off: Me → Settings → DC. The app then works as a manual logger.
- EU, UK and Swiss users also have the rights to restrict or object to processing and to data portability, and to complain to their local data protection authority.
Email support@darcyco.com.au for any request. We may need to confirm your identity first. We respond within 30 days and there is no charge.
12. Security
We use encryption in transit and at rest, row-level security so each person can only reach their own data, signed short-lived links for files, the least access necessary for our providers, and audit logs for admin actions. No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
13. Children
The app is for people aged 16 and over. We do not knowingly collect information from anyone younger. If you believe someone under 16 has an account, email us and we will delete it.
14. Anonymity
You can browse the libraries, gym map and public feed without an account. You can use a handle instead of your real name. We need an email or Apple or Google sign-in to save your data and manage a membership.
15. Changes
If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect. The date at the top shows the latest version.
16. Questions and complaints
Email support@darcyco.com.au. We will acknowledge a complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992. EU, UK and Swiss users can contact their local supervisory authority.