Privacy Policy | Tallevate

Tallevate ("we", "us", "our") builds an AI height-prediction and growth-coaching service available at tallevate.com and through our mobile app (collectively, the "Service"). This policy explains what data we collect, why, how we use it, and the choices you have.

1. Information we collect

1.1 You provide directly

Account data: email address (used for sign-in via one-time code or third-party identity providers).
Profile and biometrics: sex, age, current height, current weight, parent heights — needed to compute the height prediction.
Daily logs (optional): sleep hours and quality, nutrition checkpoints (protein, dairy, water), exercise type and duration, and height measurements over time. Used to power the Today / Journey tabs and the AI Coach.
Selfie photos (web app, optional): if you use the "Future You" viral flow on the web, we send your selfie to AI services to generate a prediction-styled portrait. Selfies are not retained for training and are deleted from our object storage after generation.
Coach conversations: messages you send to the AI Coach, plus a compact context summary of your prediction and recent logs, sent to the model to produce a reply.

1.2 Collected automatically

Device and usage: device type, OS version, app version, language, crash reports, basic analytics (page views, button taps). We do not use third-party advertising trackers.
Rate-limit identifier: a random cookie or device ID (tlv_did) so anonymous users get a daily quota.

2. How we use information

To compute height predictions from the data you provide.
To personalize the AI Coach so its replies reflect your actual numbers.
To send transactional emails (sign-in codes, account deletion confirmations).
To prevent abuse (rate limiting, cost caps).
To improve the Service through aggregated, non-identifying analytics.

We do not sell your personal information. We do not use your data to train third-party foundation models.

3. Service providers we share with

Tallevate runs on infrastructure operated by third parties. Each is bound by its own privacy commitments; we share only what each provider needs to operate the Service.

Supabase — database, authentication, file storage. Hosts your account, predictions, and logs.
Amazon Web Services (SES) — sends email sign-in codes and transactional email.
Vercel — hosts our web and API surfaces.
OpenAI — generates Future You portrait images and powers AI Coach replies. Inputs are processed per OpenAI's API data-use terms (not used to train their models).
Cloudflare — DNS, CDN, and image delivery.
Apple App Store / Google Play — distribution and (when active) in-app purchase processing.
RevenueCat (when paid plans launch) — receipt validation and subscription state.

4. Data retention

Account data, predictions, logs: retained while your account is active. Deleted on account deletion (see Section 6).
Uploaded selfies: deleted from object storage after generation (typically within minutes).
Coach messages: retained for context across sessions; deleted with your account.
Analytics and crash logs: retained for up to 13 months in aggregated form.

5. Children

Tallevate is designed for users 13 and older. If you are under 13, please do not use the Service without verified parental consent. Parents may use the Service to track a child's growth on their own account. If you believe a child under 13 has provided us personal information without consent, contact us and we will delete it.

6. Your rights and choices

Access & export: request a copy of your data by emailing us.
Correction: update your prediction inputs and logs directly in the app.
Deletion: the mobile app provides in-app account deletion under Profile → Settings → Delete Account. This permanently removes your account, predictions, daily logs, subscriptions, and Coach history. You can also email us to request deletion.
Marketing: we do not currently send marketing email. If we add it, you will be able to opt out.
EEA / UK / California residents: you have the rights afforded by GDPR / UK GDPR / CCPA, including the right to lodge a complaint with a supervisory authority.

7. Security

We use industry-standard transport encryption (TLS), row-level security in our database (so users can read only their own rows), and least-privilege access for our team. No system is perfectly secure; we encourage strong, unique passwords and caution sharing of sign-in codes.

8. International transfers

Our infrastructure is primarily hosted in the United States and the Asia-Pacific region. If you are using the Service from another jurisdiction, you understand that your data may be transferred to and processed in these regions.

9. Changes to this policy

We may update this policy from time to time. Material changes will be communicated in the app or by email. The "Effective" date at the top reflects the current version.

10. Contact

Questions, requests, or complaints? Email hello@tallevate.com.