Effective 14 April 2026
ScaleSignal ("we", "us", "our") is the data controller for personal data processed through the ScaleSignal mobile application and website (the "Service"). We are based in the United Kingdom. This policy explains, for the purposes of the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR), what personal data we collect, how we use it, who we share it with, and the rights you have.
We do not sell your personal data. We do not use your health or fitness data for advertising. We do not use your data to train third-party AI models.
The mobile app uses Expo SecureStore to hold your session token on-device. It does not use advertising identifiers or cross-app tracking. The website uses only strictly-necessary storage to keep you signed in; no advertising cookies are set. Under PECR, no consent banner is required for strictly-necessary storage.
Each processor is bound by a written data-processing agreement.
Some providers are located outside the United Kingdom (including the United States). Where data is transferred outside the UK we rely on one of: the UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses. A copy of these safeguards is available on request.
We keep your data for as long as your account is active. You can delete your account at any time from Settings → Delete Account. Deletion removes your profile, logs, measurements, photos, and subscription link from our active database within 30 days. Backup snapshots expire within a further 35 days. Records we are required to keep for tax, accounting, or fraud-prevention reasons are retained in anonymised or minimised form for up to 7 years.
All traffic is encrypted in transit with TLS. Session tokens are stored in the device Secure Enclave via Expo SecureStore. Our database is encrypted at rest. Access is limited to authorised personnel under contractual confidentiality. In the unlikely event of a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly.
To exercise any of these rights, email [email protected]. We will respond within one month.
The Service is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with data, contact [email protected] and we will delete it.
The Service is a tracking tool and is not a medical device under UK MDR 2002 or the EU MDR. It does not diagnose, treat, cure, or prevent any disease. Any supplement or medication feature is for personal record-keeping only and does not constitute medical advice. Consult a registered medical practitioner before starting, stopping, or changing any regimen.
Nutrition estimates from photos are produced by an AI model. These estimates are informational and do not produce legal or similarly significant effects on you within the meaning of Article 22 UK GDPR. You can choose not to use the photo-estimate feature.
We may update this policy from time to time. Material changes will be notified in-app or by email. The "Effective" date at the top reflects the latest revision.
Data protection enquiries and rights requests: [email protected]. You can also contact the UK Information Commissioner's Office at ico.org.uk or on 0303 123 1113.