Privacy policy

Privacy is the deal. This policy explains what we collect through the IMIGZ iPhone app and imigz.com, why, who we share it with, and the choices you have. The short version: your numbers are yours, the most personal items never leave your phone, and we never sell any of it.

• Who we are
• What we collect
• What stays on your phone
• How we use it
• Who we share it with
• Health & biometric data
• Biometric retention policy
• Retention & deletion
• Your rights
• The website
• Security, children, changes, contact

Who we are and what this covers

IMIGZ, LLC ("IMIGZ", "we") is a Virginia limited liability company at 3100 Clarendon Blvd, Ste 200, Arlington, VA 22201. This policy covers the IMIGZ iPhone app and the imigz.com website.

IMIGZ is a fitness and wellness app. It is not a medical device and does not diagnose, treat or prevent any condition. Body measurements and calorie estimates are estimates for tracking your own progress.

You must create an account to use the app, and you must be 18 or older.

Information we collect

We collect what you enter, what the app measures with your permission, and a small amount of technical data needed to run the service.

What stays only on your phone

Some of the most personal data never reaches our servers, by design:

• Progress photos stay on your phone, excluded from iCloud and device backups.
• Your 3D body models are stored on your phone only, excluded from backups, so you can compare two scans. A model is deleted when its scan is deleted from your account, when you sign out, delete your data or withdraw your biometric consent, and in any event no later than one year after you leave the beta.
• Meal photos are held in memory only long enough to estimate the meal, then discarded. Neither we nor the app save them. Google, which analyzes them, keeps them for up to 55 days only to detect misuse of its service (see below).
• Support moments you log when you use the in-app support button stay on your phone.
• Face ID. If you keep the app lock on, your phone checks Face ID, Touch ID or your passcode itself. Nothing about that check is sent to us.

Because these items are not on our servers, we cannot recover them if you lose or reset your phone.

Your account on our servers. Your profile, goals, food log, weigh-ins, scan numbers and consent records are saved to your IMIGZ account on our servers (hosted by Supabase in the United States) and copied to any phone you sign in on, so they survive a new phone. Only your account can read them. The copy on a phone is removed when you sign out of that phone.

How we use information, and what we never do

We use your information for one purpose: helping you track progress toward your goal, and running and improving the app that does it. That means:

• creating and securing your account;
• working out your calorie target and showing your progress, meals, weigh-ins and scans;
• estimating meals from photos and looking up nutrition values;
• processing body scans and showing your results and 3D model;
• sending the reminders you turn on;
• keeping records of your consents;
• fixing errors and keeping the service secure.

We never:

• sell your personal information or share it for cross-context behavioral advertising;
• use your health or body data for advertising;
• use body scans or photos to judge or score your appearance;
• show your weight, meals, scans or photos to other users. If you join a clique, members see your display name, the event the clique is counting down to, whether you showed up each day, your streak and weekly rate, boosts, the emoji reactions and replies you add, and any photo you choose to post with a caption. If you turn on the two Apple Health options in Settings, members also see that you trained that day and, with the second option, the kind of workout, its length and any note you write; nothing else from Health is shared, and both options are off until you turn them on. Clique photos are stored on our servers in a private area only your clique can open, with location and camera details removed; they are deleted when you delete the post or your account. Progress photos, your IMIGZ before-and-after, and body scans are never shared by the app. You can report a card or reply to us, which keeps a copy of it so we can review it even if it is later deleted, or mute a member so their posts no longer appear for you; nobody is told either way. We keep reports only as long as needed to review and act on them, and reports you make are deleted when you delete your account.

Who we share it with

We share personal information only with service providers that process it on our behalf, under contracts that limit their use to providing the service, and where the law requires it.

Body scans. When you do a body scan through IMIGZ, your phone sends images of you, and our server sends other data about you (sex, birth year, height and weight, but not your name or contact details), to Prism Labs Inc. ("Prism") to make a 3D scan of you from head to toe and calculate insights like body composition. Prism returns the 3D model and body measurements, which the app shows you; the model is kept only on your phone. Because the 3D scan includes rough measurements of face geometry, some of this data may be a "biometric identifier" under laws such as the Illinois Biometric Information Privacy Act (BIPA), even though neither Prism nor IMIGZ uses it to identify you. IMIGZ does not share your scans with anyone else. Separately, and only if you agree on Prism's "Improve future body scan insights" screen in the app, Prism may keep your images, scans and the data above in its research database to improve its technology; you can withdraw that at any time in Settings → Body scan, and Prism then deletes them from the research database. For known residents of Illinois, subject to any exception under BIPA, Prism permanently destroys scans of face geometry when the first of the following occurs: the purpose for collecting them has been satisfied, or three years have passed since your last interaction with IMIGZ. Prism's collection, use, disclosure and storage of the 3D scans and related data is governed by Prism's policy for partner user data, not this policy; our retention schedule for what IMIGZ holds is in the biometric retention section below.

Coach access. If you join a clique led by an IMIGZ coach, that coach can see your weigh-ins, plan adherence and scan results to support you. A coach never sees your photos, 3D model or support moments. We will tell you before this applies to you.

We may also disclose information if required by law, to protect someone's safety, or as part of a merger or sale of the business, in which case this policy continues to apply.

Consumer health data and biometric information

Much of what IMIGZ handles is consumer health data: body measurements, weight, food intake and fitness goals. Two things are biometric information, and we treat them that way under Illinois' Biometric Information Privacy Act, Texas' and Washington's biometric laws and similar laws: the body-scan capture (the video of you turning, which Prism Labs processes) and the 3D body model Prism builds from it, because the model contains the geometry of your face.

• Written consent first. Before your first progress photo or body scan, you sign a consent form that names Prism Labs as the processor, and the app records which version you acknowledged. The full text is published at imigz.com/consent. When we change what we do, we ask again. No scan is taken without it.
• Limited purpose. Biometric and health data are used only to provide the app's tracking features to you: measuring your body composition and showing you your own model. We do not sell, lease or trade them, and we do not use them to identify you.
• Where it is. The capture goes from your phone directly to Prism Labs and is never stored by us. The 3D model is stored only on your phone, excluded from backups and protected while the phone is locked; it is never uploaded to our servers.

Biometric data retention and destruction policy

This is our public retention schedule and destruction guideline for biometric data:

• 3D body models are destroyed, by deleting the files from the phone, at the earliest of: the scan being deleted from your account; you signing out of the app; you deleting your data in the app; you withdrawing biometric consent; or one year after you leave the beta. Deletion is immediate in each case.
• Body-scan captures and the data Prism Labs derives from them are held by Prism Labs under our data processing agreement. When you delete your account, our server tells Prism Labs to delete your record and every scan under it. You can also ask us to request that deletion at any time without closing your account.
• Scan results (the numbers, not the capture or model) are kept in your account while it is open and for 90 days after the beta ends, then deleted unless you ask otherwise.
• Nothing biometric is kept past the purpose it was collected for. The one-year outer limit above applies even if you never return to the app, and is within the limits set by the Illinois, Texas and Washington statutes.

Residents of Washington and Nevada: our Consumer Health Data Privacy Policy is part of this policy. It covers the categories, sources, purposes and recipients described in the sections above, and your rights below.

Retention and deletion

We keep your information while your account is open and delete it when you delete your account.

• Delete everything. Settings → Delete everything removes your data from your phone and deletes your account and its data from our servers. Server deletion completes within 30 days; backups held by our hosting provider expire on their own schedule.
• Usage counts are deleted after 30 days, or straight away when you delete your account.
• Prism Labs. Deleting your account also deletes your record and scans at Prism Labs automatically; we can request that deletion separately if you ask.
• Consent and terms records may be kept after deletion where we need them to show what you agreed to, for as long as the law requires.
• Inactive accounts. During the beta we do not delete accounts for inactivity.

Your rights and choices

You can do most of this yourself in the app; for the rest, email info@imigz.com.

• See and correct your profile, goals, meals and weigh-ins in the app.
• Get a copy of your data as a file from Settings → Export my data.
• Delete your account and data in Settings.
• Withdraw consent for photos and scans in Settings.
• Turn off reminders in Settings or iPhone settings.

Depending on where you live (including California, Colorado, Connecticut, Virginia, Washington, Nevada and other states with privacy laws), you may also have the right to know what we collect, to access, correct or delete it, to get a portable copy, to withdraw consent for health data, and to appeal our decision on a request. We will not treat you differently for using these rights. We respond within the time the law sets; we may need to verify your identity, normally through your signed-in account. An authorized agent may act for you where the law allows.

To appeal a decision on your request, reply to our response with "Appeal" in the subject line.

The website: imigz.com

The website collects almost nothing. If you only visit imigz.com and never create an account, this is the whole list:

• Waitlist email. If you join the waitlist, we store the email address you give us and the time you joined. We use it for exactly one thing: telling you when the app opens. It is never sold, never shared for marketing, and deleted on request.
• One consent cookie. A single first-party cookie (imigz_consent) remembers your cookie choices for up to 180 days. It contains your choice, a random identifier, and a timestamp — no tracking, no profile.
• Consent receipts. When you make a cookie choice, we record it (the random identifier, the choice, and a server timestamp) so we can demonstrate your consent was real. We deliberately do not store your IP address or browser details with it.
• Visitor identification — only with your opt-in. If (and only if) you allow the "analytics & visitor identification" category, we use VisualVisitor, a third-party service that can identify visiting organizations and business contacts, which we use for partnership outreach. It does not load before you consent, it never loads if you decline or send a Global Privacy Control signal, and you can revoke consent at any time from the footer. VisualVisitor may set its own cookies once allowed; its processing is described in its own privacy policy.
• Infrastructure logs. Our host, Cloudflare, processes IP addresses transiently to serve the site and defend against abuse, as every website host does.

Nothing non-essential runs before you consent: no tracking script, identification service or analytics tool loads unless you opt in, and the consent controls enforce this on every page load. No advertising cookies, no retargeting pixels, no fingerprinting. Fonts are served from our own domain, so no third-party font or CDN call leaks your IP before consent.

Cookie choices: change them any time via "Cookie preferences" in the footer, or clear the imigz_consent cookie in your browser. Global Privacy Control: if your browser sends a GPC signal, we honor it automatically as an opt-out of non-essential cookies.

Website body-scan beta

Before the app, a small private body-scan beta ran on this website at /scan. If you took part, the terms in effect at the time still govern those scans: the derived numbers imigz holds for that beta are tied to your tester code rather than your name, are kept for twelve months after your last scan and then deleted, and can be deleted sooner by emailing info@imigz.com. Scans containing face geometry were created and held by Prism Labs, never received by imigz; for known residents of Illinois, Prism will permanently destroy such scans when the purpose for collecting them has been satisfied or three years have passed since your last interaction with imigz, whichever comes first. Prism's handling is subject to its own privacy policy and consumer health data privacy policy.

Security, children, changes and contact

Security. Data is encrypted in transit. On our servers, access rules in the database let each account read only its own records. On your phone, data is protected by iOS. No system is perfectly secure; if a breach affects your information we will notify you as the law requires.

Children. IMIGZ is for adults 18 and over. We do not knowingly collect information from anyone under 18; if we learn we have, we delete it. The website is not directed to children under 13.

Where data is stored. Our servers and providers are in the United States.

Changes. If we change this policy in a way that affects how we use your health or biometric data, we will ask for your consent in the app before the change applies to you. Other changes are posted here with a new date. We won't quietly weaken it.

October 31, 2026 (version 1.0): first version covering the IMIGZ app and imigz.com.

Contact. IMIGZ, LLC, 3100 Clarendon Blvd, Ste 200, Arlington, VA 22201 · info@imigz.com