Last updated: 29 August 2026
This policy explains how Mustafa Emre Taflan ("Glutely", "we", "us") handles information when you use the Glutely mobile application (the "App"). It's written to describe what the App actually does, in plain language.
Controller: Mustafa Emre Taflan
Contact: appterrastudio@gmail.com
Glutely does not have sign-up, login, usernames, or passwords. When you first open the App it creates an anonymous identifier — a random string with no connection to your identity — using Firebase Anonymous Authentication. That identifier is what links your scans and your subscription to your device.
Because there is no account, we generally cannot tell who you are, and if you delete the App and reinstall it, you will typically receive a new identifier and your previous history will not follow you.
Subscriptions are processed by Apple or Google and managed through RevenueCat. We never receive or handle your card number, billing address, or payment credentials. We receive only your subscription status — whether it's active, when it renews, and which product you bought.
Photos of your body are the most sensitive thing the App touches, so this section is deliberately specific.
| Data | On your device | On our servers |
|---|---|---|
| First name | Yes | No — never transmitted |
| Onboarding answers | Yes | No — sent as context during a scan, not saved |
| Scan photos | Yes | No — processed then discarded |
| Scan results (scores, notes) | Yes | Yes, under your anonymous ID |
| Workout and food logs | Yes | No |
| Subscription status | Yes | Yes, under your anonymous ID |
| Scan usage counters | No | Yes, under your anonymous ID |
| Payment details | No | No — held by Apple or Google |
We do not sell your personal information. We do share limited app-activity data for advertising measurement, described in section 7 — never your photos. We use these service providers, each acting on our instructions:
| Provider | What it receives | Why |
|---|---|---|
| Google Firebase (Authentication, Firestore, Cloud Functions, Hosting) | Anonymous ID, scan results, subscription status, usage counters | Runs our backend and stores your history |
| OpenRouter, and the AI model provider it routes your request to | Your scan photos and the limited profile context listed in section 4 | Performs the visual analysis that produces your score |
| RevenueCat | Anonymous ID and subscription events | Manages subscriptions and verifies purchases |
| Apple / Google | Payment and billing information | Processes the purchase itself |
| Meta (Facebook / Instagram) | App events, device info, and an advertising identifier only if you allow tracking. Never photos. | Measures which ads bring people to the App |
Our AI provider processes your images to return a result and is contractually restricted from using them to train models. Their own handling is governed by their terms and privacy policies. We may also disclose information if we are legally required to, or to investigate abuse of the service.
We advertise Glutely on Meta (Facebook and Instagram). To know which ads actually bring people to the App — and therefore which ones are worth paying for — we use Meta's SDK, which receives:
Our subscription provider RevenueCat also reports purchase and trial events to Meta so a subscription can be matched to the ad that led to it.
Your photos are never shared with Meta or any advertising partner, under any circumstance.
You can change your tracking choice at any time in iOS Settings → Privacy & Security → Tracking.
If you are in the UK or European Economic Area, our legal bases are:
You can erase everything yourself: open the App, go to You → Reset all data, and confirm. This deletes your on-device data and stored photos, and instructs our servers to permanently delete your anonymous account, your scan history, and your usage records.
Depending on where you live, you may also have the right to access, correct, export, restrict, or object to our processing of your data, and to complain to your local data protection authority. Because our records are keyed to an anonymous identifier and contain no name or contact details, we may be unable to locate your data from an email alone — if you want to make a request, contact us at appterrastudio@gmail.com and we will explain what identifier we need.
Glutely is intended only for people 18 years or older. We do not knowingly collect information from children. The analysis automatically rejects photos where the subject may be a minor. If you believe a child has provided us with information, contact us and we will delete it.
All traffic between the App and our servers is encrypted in transit. Our database rules are configured so that a device can only ever read its own records and cannot write to them directly — all writes happen through our server. Subscription status is verified server-to-server rather than trusted from the App. API credentials are held in a managed secret store and are never included in the App.
No system is perfectly secure, and we cannot guarantee absolute security.
Our infrastructure and service providers are located in the United States and other countries, so your information may be processed outside the country where you live. Where required, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
If we change this policy we will update the date at the top of this page, and for significant changes we will notify you in the App. Continuing to use Glutely after a change means you accept the updated policy.
Questions about privacy? Email appterrastudio@gmail.com.