Your back. Your data.

Posture AI is a posture and back-care service: a posture scan that runs in your browser, exercise programs, and a coach that helps you keep going. This policy explains what we collect, why, and what you can do about it.

Questions go to support@joinpostureai.com.

When you turn on the posture camera, every frame is analyzed in memory on your device and discarded in the moment. Nothing is recorded. No video is saved or sent anywhere, not to Posture AI and not to anyone else.

Still frames are different, and we would rather write every case here than have you find one. When a still frame leaves your device it goes to our own server, which passes it to Google’s Gemini model and returns the answer. We do not store the frame, and Google processes it under the Gemini API terms for paid services, which do not let Google use it to train or improve its models. Here are the three cases.

In the posture app. When the camera cannot work out whether you are sitting, standing or lying down, it sends a single still frame to be looked at, and gets back one word. This happens at most once a minute, only when the app is stuck, and the answer is remembered so that standing at the same desk asks once rather than all day. You can turn it off in the posture app’s settings, under the camera; with it off nothing leaves this device and the app asks you instead.

On the /live page. This page scores your posture with no setup, and it can only do that by asking the model. Every 25 seconds or so during your first five minutes, and after that when it meets a posture it has not had scored, when it is unsure, after you stand up or sit down, when it has not been able to read you for a while, or after two quiet minutes, it sends one still frame (sometimes three, two seconds apart), never closer than 15 seconds apart. It may add one earlier frame of you sitting well so the model can compare. Each frame is shrunk to 512 pixels on its longest edge. The page says so on the camera view itself. You can turn the AI check off in the page’s Privacy sheet; the page then scores on this device with a general model and nothing leaves it. Two things keep frames, and only on purpose: the signed-in “Keep my taps as samples” switch in the developer details (each tap’s frame, its pose points and the page’s report, under your account), and, for our own test accounts only, a Save button that keeps five minutes of pose points and the AI exchanges of that session as a test case.

The scan and the side view. The posture scan on our website, and the side view portrait in the app, start from one photo of you. That photo goes to the same Google model to draw your black and white side view. We do not store the photo. The drawing is kept in your browser and, if you sign in, on your account.

The posture app’s camera page cannot reach the network at all: it is served with a Content Security Policy that blocks every connection except loading the page. The still frame above is handed to the surrounding Posture AI tab, which is the only thing that can make that call. The /live page is served with a policy that lets it reach exactly one address, our own server. You can check us on either: open your browser’s network tab while the camera runs, and the only requests you will ever see are those occasional single frames.

What the camera keeps is numbers: how long you sat well, how long you slouched, when you stood up, and the five posture measurements it uses to recognise positions you mark as Right or Wrong. These live in your browser’s storage on your device (or in the desktop app’s local database). “Forget marked positions” and “Delete calibration” in the posture settings erase them, and “Export summary” hands you a copy.

The camera works without an internet connection for the same reason: it never needed one.

Outside the camera, Posture AI stores what it needs to run your account and your program:

• Account details. Your email address, the name you give us, and a login identifier. Sign-in is handled by Google Firebase Authentication.
• What you tell us about your back. Assessment answers such as where it hurts, for how long, and what it limits. This is health-related information and we treat it as sensitive.
• Program activity. Which program you enrolled in, sessions completed, check-in answers, streaks, and minutes.
• Coach conversations. Messages you send the coach and the replies you get.
• Posture summaries. If you choose to sync posture numbers from the camera to your account, we store those numbers (never images). On /live, the numbers are ten daily totals, such as time sitting well and time slouching, and they are sent only after you sign in.
• Kept taps on /live. Off unless you turn it on. A signed-in person can choose, in the developer details on /live, to keep their taps. Then each press of “I’m slouching” or “I’m not slouching” stores that one frame and its posture measurements under their account, only while the switch is on, so the model can be checked against what they said was true.
• Website analytics. On our marketing pages we measure which pages are visited and which buttons are used, so we can make the site better. This never includes camera data. Our analytics provider also works out an approximate location from your IP address, to the level of country, region and city, and records your browser, operating system, device type, screen size, timezone and the site or campaign you arrived from. It is never a precise location, and we do not store your IP address ourselves. On the /live page we may also record how the page itself is used, the buttons pressed and the words on screen, as a replay of the page’s own screen. The camera picture is blocked from that recording. The “Usage numbers” switch on that page turns it off.

The coach is built on an AI language model that sits between deterministic safety checks. When you send a message, it is sent to our AI model provider to generate the reply, together with the context the coach needs (your program, recent sessions, and your recent messages).

Exercises and doses come only from our physical-therapist-authored exercise graph, and safety verdicts come only from our symptom screening, never from the model on its own. If the screening flags something serious, the coach pauses and a human reviews it.

We do not use your conversations to train models, and our providers are bound by contract to process your data only to provide the service.

• To run the service: match you to a program, track progress, and keep your account working.
• To keep you safe: symptom screening and escalation depend on what you tell us.
• To coach you: reminders, check-ins, and the messages you asked for.
• To improve the product: aggregate, de-identified usage patterns.
• To contact you about your account, and never for third-party marketing.

What you consent to. The camera runs only after you turn it on, and on the /live page only after you tap Got it, start on the card that explains it. That tap is your consent to what this section and the one above describe: posture read on your device, and still frames sent to Google’s Gemini model as listed. You withdraw it by turning the camera off or leaving the page; nothing keeps running. We never use the microphone, so no sound, call or conversation is ever captured, recorded or intercepted, by us or by anyone we work with.

Not a biometric. The pose points the camera computes are positions of your shoulders, ears and nose in the picture, used to measure posture. They are not used to identify you, they are not a faceprint or a template of your face, and they are never matched against anyone.

California (CCPA / CPRA), notice at collection. What we collect, and why: your email and sign-in identifiers, to run your account; posture numbers and pose positions, on your device, to coach you; still frames, in the cases above, sent once and dropped, to score posture; taps you choose to keep on /live, under your account, only when you switch that on; usage numbers, to see whether detection works, which since 16 September 2026 include the approximate location our analytics provider works out from your IP address (country, region and city, never a precise location) along with your browser, operating system, device type, screen size, timezone, referring site and campaign. We do not sell your personal information. Since 12 October 2026 our marketing pages and the signup and checkout steps use the Meta Pixel, which tells Meta that a page was viewed, that checkout was opened, that an account was created or that a trial started, together with Meta's own cookie identifiers, so we can measure and show our ads. Under California law that counts as sharing for cross-context behavioral advertising. It never includes camera frames, posture scores, your answers or anything about your health, and it is not loaded on the monitoring page itself. To opt out, turn on Global Privacy Control in your browser, which we honor by not loading the pixel at all, or email us. We do not knowingly collect information from anyone under 16. Retention is in the section below. You have the right to know what we hold, to correct it, to delete it, and to limit how sensitive information is used, without being treated differently for asking. Email support@joinpostureai.com from your account address, or have an authorized agent do so; we answer within 45 days.

Pennsylvania. Pennsylvania’s Wiretapping and Electronic Surveillance Control Act concerns the interception of communications. We intercept none: there is no microphone, no audio, and no recording of video. The camera reads posture with your consent, given as described above, and only while you keep it on.

We do not sell your data and we do not run ads. We share data only with:

• Service providers who process it for us under contract: Google Firebase (hosting, sign-in, database), Google’s Gemini API (the still frames described above), our AI model provider (coach replies), our email delivery provider (account emails), and website analytics.
• Our reviewers, when they look at a flagged conversation or a program.
• Legal requests when we are required to by law, and only what is required.

Camera video is never shared with anyone because it never exists outside your device. The still frames listed above go to Google’s Gemini API and nowhere else, under terms that do not let Google use them to train or improve its models.

Account and program data are kept while your account is active. When you ask us to delete your account (email support@joinpostureai.com from your account address) we delete your profile, assessment answers, program activity, and coach conversations within 30 days, except where we must keep a record to meet a legal obligation.

Posture numbers stored in your browser or desktop app are under your control and are removed when you delete them in the posture settings or clear your browser data.

Still frames sent to Google are not stored by us and are dropped once the answer comes back. Taps you chose to keep on /live, and test cases saved from our own accounts, stay until you ask us to delete them, which the same request covers.

Wherever you live, you can:

• See and correct what we hold about you from your Account page.
• Export your posture summary from the posture settings.
• Turn the camera off at any time. It never runs without your permission.
• Switch off the coach and use programs on their own.
• Delete your account and data by emailing support@joinpostureai.com from the address on your account.

If your local law gives you additional rights, such as access, portability, restriction, or objection, we honour them. Email us and we will respond within 30 days.

Data in transit is encrypted. Cloud data is stored with Google Firebase under access controls limited to the people who need it to run the service. The camera pipeline is isolated by browser policy as described above. No system is perfect; if we ever learn of a breach affecting you, we will tell you promptly.

Posture AI is for adults. It is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has created an account, email us and we will remove it.

When we change this policy we update the date at the top and, for anything that changes how your data is handled, we tell you in the app or by email before it takes effect. The camera promise does not change: video stays on your device, and every still frame that leaves it is listed above.

support@joinpostureai.com. For the rules of using the service, read the Terms of Service.