Privacy Policy

What happens to your information.

Last updated: 14 September 2026

Posh Tunnel Ltd (“Posh Tunnel”, “we”, “us”) provides The Light in Me mobile app and this website. We are responsible for the personal information described in this policy.

1. Information that stays on your phone

Exact Apple Health or Health Connect records and identifiers, selected and generated Future Me pictures, meal-camera previews, private kitchen inventory, reminder schedules, and detailed adaptive-learning records normally stay on your device. Receipt images and full recognised text are not saved; a sanitised item draft exists only in active app memory while you review it and is removed when you cancel, leave review, reset, or sign out.

Your food, water, training, weight, profile, and game progress are also stored locally. If you sign in and choose account backup, an approved progress snapshot can be stored with your account. Current snapshots exclude photos, raw Health records, provider-derived exercise and weight rows, a current profile weight imported from Apple Health or Health Connect, passwords and sign-in codes, analytics queues, private kitchen inventory, and current free-form Rescue Log text. Manual exercise and weight entries remain eligible.

2. Information we process away from your device

Accounts, backup, and purchases

If you create an account, we process your verified email address when available, random account and device identifiers, device name, app version, sign-in security state, signed-in devices, and the progress you choose to back up. If you choose Sign in with Google, The Light in Me sends a fresh random nonce and Google's short-lived ID token to our server for verification. We retain a keyed digest of Google's stable account identifier, the public OAuth audience, any email Google marks as verified, and bounded sign-in timestamps. We do not store the raw Google identifier, ID token, nonce, or account-chooser details, and none of those values enters product analytics.

A Google email claim never merges The Light in Me accounts. If the email may already belong to an account, you must sign in with that account's existing method and explicitly link Google. Google sign-in is separate from Firebase notifications, Google Play purchases, and Health Connect.

Apple App Store or Google Play gives us purchase status such as the product, entitlement, renewal, and expiry state. We do not receive your payment-card details. For Google Play, we keep a SHA-256 token fingerprint for ownership checks and an encrypted, account-bound copy of the purchase token only while needed for scheduled provider reconciliation. Terminal or superseded evidence immediately drops the decryptable token material while retaining the fingerprint and bounded lifecycle evidence. Restricted versioned keys support rotation; the token is never placed in logs or account exports and account deletion removes account-owned evidence under our retention controls. We keep limited AI usage and cost records so we can apply allowances, reconcile provider costs, and prevent abuse.

Rescue Circle and cooperative play

Optional social features can store your display name, rotatable friend code, invitations, friend relationships, mute and block choices, sharing settings, preset encouragements, daily summaries, cooperative party progress, boss and quest labels, contribution records, and trophies.

Sharing starts off. Friends do not receive your email, account backup, food names, weight, photos, raw Apple Health or Health Connect data, AI usage, billing information, or product analytics. Before cooperative play, the app shows the limited boss-related information that will be shared.

Beta engine learning

During Beta, after the current participation notice, we send the suggestions you see and how you respond to our server to improve and evaluate the rescue engine. These records use random identifiers, suggestion categories and broad context; they exclude photos, recordings, private notes and exact health measurements. We do not upload previously saved local learning history. Optional research check-ins remain separate. Derived candidate models are kept for up to 90 days and invalidated when an account is deleted; source events follow the analytics retention and deletion rules below.

Product analytics

The Light in Me sends first-party analytics to help us find setup problems, crashes and failures, understand which features help, and measure whether players return. We do not use an advertising analytics service or session replay.

These events may include random identifiers, app and build version, platform, locale, timezone offset, broad device class, screens and actions, success or failure category, coarse timing, reminder state, broad route, water or weight ranges, and a derived workout category, provider source, reviewed duration band, reviewed calorie band, and completion-time range. Exact workout duration and calories are not sent.

They do not include photos, raw Apple Health or Health Connect records, exact weight or water, meal calories or macros, free-form notes, custom quest text, email, credentials, raw barcodes, recordings, full transcripts, or keystrokes.

Anonymous food-search trends

We keep a separate trend dataset containing exact food searches and the food name selected or logged. It may also include brand, category, meal, source, method, result position, and a random identifier that lasts for one search flow only. It is deliberately not connected to your account, installation, device, email, IP address, photo, or raw barcode.

We use this dataset to improve food coverage and search results. Because the dataset is not linked back to a person, we cannot include it in an account export or remove an individual row in response to an account deletion request.

Website, support, and security

If you email us, we receive what you choose to send. Our hosting and security providers can process ordinary request information such as IP address, time, requested page, response status, and abuse signals. We do not use your IP address as a product-analytics identity and do not place advertising cookies.

Information comes from you, your app or device, Apple, Google, providers you ask us to use, and friends who invite or interact with you.

3. Health providers, widgets, notifications, AI, voice, and food

Apple Health, Health Connect, and phone features

Health access is optional and controlled by your phone. On iOS, The Light in Me may read the Apple Health categories shown in the permission sheet for activity rings, body weight, sleep, walking and running distance, flights climbed, mindful minutes, and workouts. On Android, The Light in Me requests read-only access only to Steps, Active Calories Burned, and Exercise Sessions from Health Connect. These records are used on the phone for today’s activity summary, an activity calorie allowance, quests, and rescue progress. The Light in Me does not write Health records, request Android background or historical access, or provide a Wear OS app. Only the categorical derived workout analytics described above may be sent to us; exact duration and calorie values remain on the phone. You can change access in Apple Health, Health Connect, or system settings.

The optional iOS/Android widget receives a small device-local quest and boss summary. Exact calories/water and the local Future Me portrait are separate choices that start off hidden. Activity-ring percentages are available only in the iOS widget; Android does not invent Health Connect goals or ring percentages. The widget has no Health-provider, account-database, analytics, or network access. The iOS Live Activity or Android Live Update/ordinary ongoing notification receives only the bounded local session summary needed for its controls. Android Live Update promotion depends on device and system eligibility; the ordinary notification remains the fallback.

Only after you tap Enable Circle alerts may signed-in Circle notifications register an Apple push token or Firebase Cloud Messaging installation address for your current device. Ordinary reminder or Rescue Now notification permission does not enable Circle remote alerts. Lock-screen text is generic and excludes names and private wellness details. We suppress native delivery and remove or disable the server address after sign-out, device revocation, account deletion, or provider invalidation.

Meal Photo and Future Me

When you tap Analyse or Create, a compressed image is sent through The Light in Me’s server to OpenAI. We temporarily hold it only to complete that request, then delete it. We do not add the source or result image to server logs, analytics, account backups, or exports.

Voice logging

After you tap Stop, a recording of up to 30 seconds is sent through our server to OpenAI for transcription. Temporary audio is deleted after processing. We do not retain the recording or full transcript, and you review the suggestion before saving anything.

Extended food search and barcode lookup

Food search may send the words you type, a broad Australia, GB, or US market, app language, and a random request identifier to The Light in Me, DietlyAPI, USDA FoodData Central, and Open Food Facts. Barcode lookup sends the code needed to find a product. Product analytics does not retain the raw barcode or nutrition values.

Normalized provider results may use bounded shared and device caches, and a confirmed copy may remain in your private food history. Loading an Open Food Facts image sends an ordinary network request to its reviewed image host. Community food information and images can be incomplete, wrong, changed, or removed, so you should check the package and review an entry before saving it. Food data from Open Food Facts (ODbL) via DietlyAPI.

Sourced AI food help

After you tap Use AI allowance, a missing food request may send the words you typed, broad Australia/UK/US market, and app language through The Light in Me to OpenAI for public web research. We do not send your account identity, Health data, precise location, personal foods, or photos. Provider response storage is disabled, source links are shown, and every result remains an editable estimate.

A sourced candidate stays private to your account for up to 30 days and cannot appear in ordinary search. Saving or editing it queues it for restricted human review for up to 180 days. It is never published automatically, is included in account export, and is removed with account deletion.

4. Why we use information and our legal bases

• To provide an account, backup, purchases, social play, and requested AI features: to perform our contract with you or take steps you request.
• For optional permissions and sharing: with your choice or consent where consent is the appropriate basis. You can turn these features off.
• For service analytics, reliability, security, fraud prevention, and improvement: our legitimate interests in running and improving a safe, useful service, balanced against your rights.
• For tax, accounting, lawful requests, and disputes: legal obligation or our legitimate interests in establishing and defending legal rights.

Health information may receive extra protection under data-protection law. Where this applies, we also identify and document the additional legal condition required for that processing. The Light in Me does not make automated decisions that have legal or similarly significant effects. Device-local adaptation only changes optional game suggestions, and you can pause or reset it.

5. Who receives information and international transfers

We do not sell personal information. We do not use it for third-party advertising, cross-company tracking, data-broker sharing, insurance decisions, or employment decisions. Health and fitness information is not used for advertising or marketing.

Only when needed, information may go to hosting and security services, email delivery providers, Apple, Google/Firebase, OpenAI, DietlyAPI, USDA FoodData Central, Open Food Facts, professional advisers, or public authorities where law requires it. Each service receives only what it needs for its role. If information is processed outside the United Kingdom, we use an applicable adequacy decision, approved contract, or other lawful safeguard where required. Contact us for details relevant to your information.

6. How long we keep information

• Current account progress stays until it is replaced or your account is deleted. Up to 10 replaced safety snapshots are kept for 30 days.
• Circle daily summaries are kept for 30 days, preset encouragement history for 90 days, and pending invitations for 14 days.
• Cooperative run records are kept for 90 days.
• Unsaved sourced AI food candidates expire after 30 days. Candidates saved for human review expire after 180 days unless your account is deleted sooner.
• Pseudonymous product events and journeys are kept for up to 24 months. Durable installation, session, and onboarding identifiers are then removed.
• The separate anonymous food-search trend dataset may be kept indefinitely because it is deliberately not linked to a person.
• Device analytics queues are limited to seven days and 500 events.
• A linked Google identity remains until it is no longer needed or the account is deleted. Keyed token and nonce replay digests prevent reuse through the short-lived credential's expiry. At expiry they become eligible for deletion and are physically removed afterward by bounded opportunistic or daily retention cleanup, rather than being claimed to vanish at the exact expiry instant.
• Security, billing, fraud, legal, backup, and deidentified provider-cost records are kept only as long as needed for those purposes.
• We do not retain Meal Photo or Future Me source or result images on our server.

Signed-in users can open Menu → Profile → Account & devices to export account information or delete the account after a fresh ownership check. The export can show non-secret Google linkage, public audience, verified email, and timestamps, but excludes provider subjects, ID tokens, nonces, and replay digests. Deletion removes direct identity, including a linked Google identity, sessions, devices, snapshots, social records, push tokens, and entitlements, subject to limited legal, security, and backup retention.

Deleting the app removes The Light in Me information stored only on that phone, subject to platform backup behaviour; The Light in Me disables Android Auto Backup. Health records remain under your control in Apple Health or Health Connect. Before deleting your The Light in Me account, cancel or manage any subscription in the store that owns it. Account deletion does not cancel store billing, and any remaining paid period or renewal cannot be restored or attached to a newly created The Light in Me account.

7. Your choices and privacy rights

You may decline optional Health, camera, microphone, photo, notification, AI, social, and account features and continue using available manual or local features. You can change iOS or Android permissions at any time.

Depending on where you live, you may ask us to access, correct, erase, restrict, or provide a portable copy of personal information. You may object to processing based on legitimate interests and withdraw consent where we rely on consent. Withdrawing consent does not affect earlier lawful processing. We may need to verify account ownership.

You can complain to the UK Information Commissioner’s Office or your local data-protection authority. We would appreciate the chance to help first.

8. Security, age, and wellbeing

We use transport encryption, restricted access, short-lived and hashed credentials, iOS Keychain or Android Keystore-backed secure storage, strict analytics allowlists, rate limits, deletion controls, and separate environments. Android Auto Backup is disabled so secure or local app state is not silently restored by that mechanism. No internet service can promise perfect security.

The Light in Me is for adults aged 18 or older and is not directed to children. The Light in Me is a wellness game, not medical diagnosis, treatment, or emergency care. Stop using a feature and seek qualified help if it is unsuitable or distressing for you.

9. Changes and contact

We may update this policy when the app, website, providers, law, or our practices change. The date above identifies the current version. We will explain material changes where required.

Return to Posh Tunnel