Your data stays yours.

What we collect

We keep data collection to what the app actually uses:

• Account details. Your email address, plus how you sign in: either a password you choose, or a sign-in identifier from Sign in with Apple or Google. A password you choose is stored only as a one-way hash by Supabase, our authentication provider — we never see the password itself and can’t recover it, only email you a reset link. If you use Apple or Google instead, no password reaches us at all.
• The fitness & nutrition data you enter. Food and macros, training routines and sets, body weight, water, and any body-scan numbers you choose to import. This is yours; you add it, you control it.
• App usage & diagnostics. Basic, app-level usage signals and crash reports that help us keep the app stable. Your health and nutrition data is scrubbed out before any crash report or telemetry leaves your phone.
• If you sign up for emails on this website. The address you type, plus a one-way hash of your IP address and your browser’s user-agent string. Those two are kept as proof of when and how you asked — Canada’s anti-spam law requires us to be able to show it — and are used for nothing else. Until you click the link in the single confirmation email we send back, your entry stays unconfirmed and you are not on the list. Unconfirmed entries are kept until you confirm them or ask us to remove them; email privacy@zabeau.app and we’ll delete yours.

We do not collect data from third-party advertising networks, and we don’t build advertising profiles about you. If you opt in, we do send you our own emails about Zabeau — that is first-party marketing from us, and it never involves sharing your data with an advertiser or an ad network.

How we use your data

We use your data to:

• Run the tracker — save your logs and show your calendar, streaks, and trends.
• Power the AI coach — read your real numbers so it can propose plan changes you approve, answer questions, and log on your behalf.
• Keep your account working across your devices and back it up safely.
• Diagnose crashes and improve reliability, using health-scrubbed diagnostics.

We do not sell your personal data, and we do not use your fitness or nutrition data to train third-party AI models.

AI coaching & model processing

The coach is built on Claude, the AI assistant from Anthropic. When you use a coaching feature, the relevant numbers from your log — and, for photo-to-macros, the photo you submit — are sent to our AI provider purely to generate that response. This processing happens only when you trigger a coaching action; the free tracker runs without it.

Image analysis for food and body-scan import uses Claude vision, by Anthropic. Diagnostics and crash logs are never sent to the AI provider, and the zero-health telemetry scrub means your health data is excluded from crash reporting entirely.

Your consent, your choice. Before any of your data is sent to Anthropic, Zabeau asks for your explicit permission the first time you use an AI feature, and names Anthropic as the provider. You can decline and keep using the entire free tracker, and you can turn AI features on or off at any time in Settings → AI features & privacy. While AI is off, nothing is sent to the AI provider.

Where your data lives

Your account and logged data are stored on Supabase, our managed database and backend provider, protected in transit and at rest. The tracker is also designed to work fully offline — much of your data lives on your device and syncs when you’re back online.

Cross-border processing. Some of our providers process data outside your country. In particular, email we send you is delivered through Resend, which processes your email address and the message content on servers in the United States, where it may be accessible to authorities under local law.

How long we keep it. We retain your data for as long as your account is active. When you delete your account, your personal data is removed from our systems (limited billing records may be retained by Apple or Google and their payment processors as required by law). One deliberate exception: if you unsubscribe from our emails, one of our emails bounces, or you report one as spam, we keep a one-way hash of that email address so the outcome sticks — even after account deletion. The hash is not reversible by us, and it is used only for suppression: checking an address against that list before anything is sent, and nothing else.

Coach conversations. Your chat with the AI coach is stored so the conversation is still there when you reopen the app and on your other devices. Those messages are deleted automatically twelve months after they are sent, and deleting your account removes them immediately.

This website: cookies, analytics & embedded media

This site sets no cookies. Not for analytics, not for advertising, not to run the pages. The one thing we store on your device here is your answer to the banner: the key zabeau-cookie-consentin your browser’s local storage, holding the single word accepted or declined. It is not a cookie — it is never sent to a server, and it identifies nothing about you. Clearing your browser’s site data removes it and the banner asks again. (If you sign in to your account through this site, Supabase also stores your session in local storage.)

Website analytics. If you press Accept, we load Vercel Web Analytics — a cookieless page-view counter served from this site’s own domain by Vercel, our website host. It records aggregate things like which page was viewed, the referring site, and coarse device and country information. It does not set a cookie, it does not build a profile of you across sites, and it never touches your Zabeau account or any health data — that lives in the app, not on this website. If you decline, or simply never answer, the script is never loaded at all.

The demo video. The demo on our home page is a click-to-load placeholder: no YouTube script, no iframe, not even the preview image comes from Google — the still is served from this site. Nothing is requested from YouTube until you press play. When you do, the video loads in YouTube’s privacy-enhanced youtube-nocookie.commode, and at that moment your browser contacts Google/YouTube directly and their terms apply to that playback. If you haven’t accepted, we tell you that before loading anything and ask you to confirm.

The email sign-up box. Where this site offers an email sign-up, the form is protected by Cloudflare Turnstile, an anti-bot check loaded from challenges.cloudflare.com. Cloudflare receives the technical data it needs to tell a human from a bot; it is used for nothing else and does not track you across sites.

Changing your mind. Withdrawing is as easy as consenting: use Cookie & analytics settings — it is in the footer of every page — to re-open the banner and choose again. Declining stops analytics from loading on any page you open afterwards.

The assistant on this website

What it is. A chat assistant sits in the corner of this site. It is an AI, and it says so. It answers questions about Zabeau — what’s free, what the plans cost, how the coach works, how your data is handled. It is not the coach in the app: it has no access to any account, any log, or any photo, and it never gives personal fitness or medical advice.

What happens to your messages. When you send a message, it goes to our servers and on to Google (Gemini, on Google Cloud’s Vertex AI), in the United States, to generate a reply. It is processed to answer you and nothing else. We do not store chat transcripts. Your messages are not saved to a database, not attached to an account, and not emailed to us. One thing we won’t dress up: this assistant runs on Google’s free tier, and Google’s terms for that tier let Google use what is sent to improve its own products, and let human reviewers read it. That is exactly why we ask you below not to type anything private into it. What we keep is one row of counters per message — how many messages the assistant handled, how long each took, how much text went in and out, and a rough category (a pricing question, a support question, or general) worked out from the words you used, never the words themselves.

Your IP address, one-way hashed. Stored alongside those counters is a one-way hash of your IP address — the same kind we keep for the email sign-up box, and for the same narrow reason: it is how the assistant tells one browser’s messages apart from another’s so an automated script can’t run up a bill. It is used for nothing else, it is never linked to a Zabeau account, and the rows are deleted after 180 days.

Nothing is stored on your device. We set no cookie for the chat and write nothing to your browser’s storage — no transcript, no draft, no identifier. The conversation lives in the page while it is open and disappears when you close or reload the tab. (The anti-bot check below is loaded from Cloudflare and is covered in its own paragraph.)

The human check. The first time you open the chat, we load Cloudflare Turnstile — the same anti-bot check as the email sign-up box — so an automated script can’t run up a bill on a free assistant. Cloudflare receives your IP address and basic browser information to make that judgement. It loads when you open the chat, never on page load, and never if you don’t.

Please don’t tell it anything private. The assistant can’t act on personal details, we’d rather you kept them, and — per the free-tier terms above — a reviewer at the AI provider could read what you type. Don’t send your health history, symptoms, medications, account password, payment details, or anyone else’s information. For anything about your account, email us at support@zabeau.app instead — that reaches a person, and nothing you write there goes to an AI provider.

Service providers we rely on

We share the minimum necessary data with a small set of providers that help us run the app:

• Apple & Google — sign-in (we receive an email and identifier, not your password).
• Supabase — database, authentication, and backups.
• Anthropic (Claude) — the app’s AI provider; generates coaching responses and photo/scan estimates from the data you submit, only after you consent, as described above. Anthropic does not use your data to train its models. It is not used by the website assistant.
• Google (Gemini on Vertex AI)— the AI provider behind the chat assistant on this website, in the United States. It receives the message you type so a reply can be generated. The assistant runs on Google’s free tier, whose terms let Google use what is sent to improve its products and let human reviewers read it — which is why the chat section above asks you not to type anything private. It is not used for the coach or for anything in your account.
• RevenueCat, Apple & Google — handle subscription billing. Payment card details are processed by Apple or Google; we never see your card number.
• Sentry — crash reporting, with your health and nutrition data scrubbed out before it’s sent.
• Vercel — hosting for this website, and the cookieless web analytics described above, which run only if you accept them.
• Google / YouTube — hosts our demo video. Nothing is requested from YouTube until you press play, and it loads in privacy-enhanced mode.
• Cloudflare — the Turnstile anti-bot check on this site’s email sign-up form and chat assistant.
• Resend — email delivery. Resend receives your email address and the contents of the message we send you (account emails, and marketing emails if you opted in) so it can deliver them. It never receives your food, training, or weight logs beyond what a message you asked for contains.

These providers act on our behalf under their own security and privacy commitments. We don’t allow them to use your data for their own advertising.

Email communications

We send two different kinds of email, and they follow different rules:

• Account emails. Messages you need in order to use your account — confirming your email address, resetting your password, a receipt or a failed-payment notice. These are part of the service, so we send them whenever they apply.
• Marketing emails. Coaching tips, a note when your Weekly Review is ready to read in the app (the review itself stays in the app — we don’t put it in your inbox), product news, and occasional messages about your subscription if you have cancelled or lapsed. We send these only if you asked us to — by ticking the optional box in the app (during onboarding or in Settings → Email), or by confirming your address from a link we email you after you sign up on this site. The box is never pre-ticked, and nothing in Zabeau is withheld if you leave it unticked.

Withdrawing consent. You can withdraw your consent at any time and it takes effect right away: turn the toggle off in Settings → Email, or use the unsubscribe link at the bottom of every marketing email we send you. You can also write to unsubscribe@zabeau.app. Account and security emails — confirming your address, resetting your password, a failed-payment notice — don’t carry an unsubscribe link and can’t be switched off while you have an account: they are part of the service, not marketing.

We record when you gave or withdrew consent, and the wording you agreed to, so we can prove your choice was yours. Zasenami identifies itself in every message, and we never sell or rent your address to anyone.

Your rights & controls

You stay in control of your data:

• Access & export. You can review and export the data you’ve logged.
• Delete. Zabeau includes in-app account deletion — deleting your account removes your account and personal data from our systems. You can do this yourself, anytime, without emailing us. See how to delete your account and data.
• Correct. You can edit or remove any log entry directly in the app.

If you have a privacy request or question, reach us at privacy@zabeau.app and we’ll help.

Children

Zabeau is not directed at children. You must meet the minimum age required by your region and the app stores (at least 13, or 16 where local law requires) to create an account. We do not knowingly collect data from children under that age; if we learn we have, we’ll delete it.

Safety resources

Zabeau includes guardrails against under-eating and surfaces region-aware eating-disorder and crisis support resources where appropriate. These resources are provided for your safety and are not a substitute for medical care. Zabeau is a fitness and nutrition tracking tool, not a medical device, and does not provide medical advice.

Changes to this policy

If we make material changes to this policy, we’ll update the effective date above and, where appropriate, notify you in the app. Continuing to use Zabeau after a change means you accept the updated policy.

Contact us

For anything about your privacy or data, email privacy@zabeau.app. For general help, reach support@zabeau.app or help@zabeau.app. Zabeau is operated by Zasenami.