Tahada
Privacy Policy
Tahada is a body-composition competition app: you log body scans and weigh-ins, join leagues with friends or a coach, and get scored on progress toward your goals. This policy explains what we collect, why, who can see it, and the choices you have. We don't sell your data, we don't show ads, and we don't use your health data for marketing.
1. Who we are
Tahada is operated by Khalid Al Sudairy, Riyadh, Kingdom of Saudi Arabia ("we", "us"). We are the controller of your personal data. Contact: [email protected].
2. What we collect
| Data | What it is | Why |
|---|---|---|
| Account | Email address, username, password (stored only as a secure hash by our hosting provider), language and theme settings. | To create and secure your account and let you log in. |
| Profile | Sex, date of birth, height, country, city, main goal, account type (individual or coach), scan device, optional profile photo. | To confirm you are 18 or older, to calculate fair targets (they depend on sex and height), and to show your profile in your leagues. |
| Body scans | Date, weight, skeletal muscle mass, body fat mass, body fat %, visceral fat level, device model, and the photo of your result sheet if you upload one. | To set your starting point and targets, score your progress, and let league admins check results. |
| Weigh-ins & activity | Weekly weigh-ins, and — only if you connect Apple Health or Health Connect — your weight, daily steps and active calories. | To show your activity in your leagues and, where the league admin has chosen it, to include it in scoring. |
| League activity | Leagues you create or join, scores, approvals, feed posts and reactions, reports and blocks. | To run leagues, standings and the activity feed, and to keep the community safe. |
| Purchases | Whether you have Premium and when it renews. Payment is handled by Apple or Google; we never see your card details. | To unlock Premium features. |
| Technical | Basic server logs (for example time of request and error messages) kept by our hosting provider. | To keep the service working and secure. |
Body scans, weight, activity and related measurements are health data, which Saudi Arabia's Personal Data Protection Law (PDPL) treats as sensitive. We process it only with your explicit consent, which you give when you create your account, and only to provide the app. We do not use third-party analytics, advertising or tracking tools.
3. Apple Health and Health Connect
- Connecting is optional and you choose exactly what to share in your phone's settings. You can switch it off at any time.
- We only read weight, steps and active calories. We never write to Apple Health or Health Connect.
- Data read from Apple Health or Health Connect is used only to provide Tahada's features. It is never used for advertising or marketing, never sold, and never shared with data brokers or other third parties except the service providers listed in section 5 that we need to run the app.
4. Who can see your data
- You can see everything you've entered.
- League admins can see the scans and result-sheet photos you submit to their league, so they can approve or reject them.
- Other members of a league see what that league's admin allows: only your score and rank; or your progress toward each goal; or chosen body numbers. The league's setting is shown in the app before you join.
- Your username and profile photo are visible to people in your leagues. We don't publish your data anywhere else.
- If you share a season result card, you choose where it goes.
5. Service providers
We use a small number of providers who process data on our behalf, under contracts that limit them to providing their service:
- Supabase — database, login, file storage and server functions. Data is stored in Frankfurt, Germany (EU).
- Anthropic — when you upload a photo of your result sheet, the image is sent to Anthropic's Claude API to read the numbers. You check and correct the values before saving. Under Anthropic's commercial terms, this data is not used to train its models. If you prefer, you can type the numbers in instead.
- Email delivery provider — to send account emails such as confirmation and password reset.
- Apple and Google — app distribution and in-app purchases.
6. Transfer outside Saudi Arabia
Your data is stored and processed outside the Kingdom, mainly in Germany (EU), and by service providers that may process data in other countries, including the United States. We only use providers that apply appropriate safeguards, and we transfer only what is needed to provide the app. By agreeing at sign-up you consent to this transfer, as permitted by the PDPL.
7. How long we keep it
We keep your data while your account is open. When you delete your account (Profile → Delete account), we delete your profile, scans, photos, weigh-ins, activity and scores. Leagues you created are handed to another member or deleted. Copies in our hosting provider's backups are removed when those backups expire, normally within 30 days. We may keep limited records longer where the law requires it.
8. Your rights
Under the PDPL (and similar laws where you live) you have the right to:
- be told how your data is used (this policy);
- access your data and get a copy of it;
- correct inaccurate data — most of it you can edit in the app;
- have your data deleted — you can do this yourself in the app;
- withdraw your consent at any time — by disconnecting Apple Health or Health Connect, or by deleting your account. Withdrawal doesn't affect processing done before it.
To use any of these rights, email [email protected]. We reply within 30 days. If you're not satisfied, you can complain to the Saudi Data & AI Authority (SDAIA).
9. Security
Data is encrypted in transit and at rest by our hosting provider. Database rules limit every user to the data they're allowed to see, result-sheet photos are kept in private storage, and secret keys never leave our servers. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.
10. Age
Tahada is for people aged 18 and over. We don't knowingly collect data from anyone younger. If you believe a minor has an account, contact us and we'll delete it.
11. Changes
If we change this policy we'll update the date above and, for significant changes, tell you in the app before they apply.