Brioday
Privacy policy
Last updated 15 October 2026
Brioday is a workout and nutrition tracker, available at brioday.app and as an Android app. It's made by Black Ops Solutions IT Pty Ltd, an Australian company ("we", "us"). This policy explains what Brioday collects, why, where it's kept, who it's shared with, and how you can see or delete it. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Using Brioday is also covered by our terms of use.
- Without an account, what you log stays on your phone.
- With an account, it's also kept on Brioday's servers in Australia, so your devices share it.
- We never sell your data, show ads, or track you across other apps or sites.
- Health data is used only to show you your own numbers in Brioday.
- Some features send data to a service that does the work for us (for example an AI look-up). They're all listed below.
- To keep accounts safe and stop abuse, we log a random ID for each device and a coded form of your IP address (never the address itself) for 90 days. That's all it's used for: see Devices and networks.
- You can delete your account and everything in it at any time.
What we collect
Your account
- Your email address, your name, and your password (stored only as a salted hash; we never see it).
- Your bodyweight, height and units, which the app needs to work out things like kilograms lifted and food targets.
- If you sign in with Google: your name, email address and Google account ID (see Google sign-in).
- When you were last signed in on each device, and each device's browser or app name, so sessions can be kept and ended.
What you log
- Training: your plans, workouts, sets (exercise, weight, reps, notes) and form checks.
- Food: meals and foods, targets, water, supplements, things you avoid and reactions you record.
- Body: weigh-ins, measurements, body composition, sleep, blood pressure, activities, swims and period tracking.
- Photos you choose to keep: meal photos, and progress photos if you choose to back them up.
Health data
If you connect Health Connect on Android (for example to bring in data from Samsung Health), Brioday reads only the types you allow: steps, distance, active and total calories burned, heart rate and resting heart rate, sleep, exercise sessions, weight, body fat, body water, bone mass, lean body mass, basal metabolic rate, blood pressure and menstruation. It only reads; it never writes to Health Connect. See Health Connect.
Challenges
When you join a challenge you choose the name you're shown as. Your progress in it (workouts done, kilograms lifted, or progress toward its goal) is worked out from what you log. In a gym's challenge you can join anonymously. A challenge's name, host and photo are shown to anyone who opens its invite.
Payments
If you buy a Premium plan, payment is handled by Stripe. Your card details go to Stripe and never reach us. We keep your Stripe customer ID, which plan you have, its status and renewal date, and whether a payment failed. We also keep a record of each AI look-up (when, what kind, and what it cost us) so each plan's AI allowance works.
Notifications
If you turn on alerts (for example when someone overtakes you in a challenge), we keep your device's push address and time zone, so alerts reach you and don't arrive at night.
Technical information
Like any website, our servers and our network provider (Cloudflare) see your IP address and basic request details. We use them to keep the service running, to stop abuse (for example limiting sign-in attempts) and to fix problems. What we keep from them, and why, is under Devices and networks. The website uses one cookie, only to keep you signed in, and the app keeps a random device ID on your phone (see the same section). There are no advertising or analytics cookies.
How we use it
- To run Brioday for you: show your plans, history, progress and targets, and sync them between your devices.
- To run challenges, including telling you when someone overtakes you, if you've asked for that.
- To create your account, check that your email is yours, and let you reset a forgotten password (we email you a code).
- To provide the features you ask for, such as AI look-ups and barcode look-ups.
- To take payment for Premium plans and apply each plan's allowance.
- To answer you when you contact us, and to keep the service secure.
- To keep accounts safe and the service fair: spotting someone else using your account, abuse of the AI features, or several accounts used to get around limits or a suspension, and enforcing our terms (see below).
We don't sell personal information, use it for advertising, or use it to build profiles for anyone else.
Devices and networks (security logging)
When you sign in, create an account or use an AI look-up, Brioday records two things alongside it, so we can keep accounts safe and the service fair.
What we record
- A device ID. The first time you use the app, it makes a random code and keeps it on your device. It identifies that copy of the app, nothing more. It isn't your phone's hardware ID, serial number or advertising ID, and it can't be used to find you in other apps or websites. Clearing the app's data or the site's data makes a new one.
- A coded network ID. We don't store your IP address. We store a one-way code made from it with a secret key (a keyed hash): the same address always gives the same code, so we can tell when two sign-ins came from the same network, but the code can't be turned back into the address.
- With each of these: when, what happened (for example "signed in", "wrong password", "AI meal look-up"), the account, and your browser or app name.
What it's for
Only to protect your account and keep Brioday fair for everyone:
- to spot when someone else may be using your account, for example sign-ins from many devices or networks in a short time;
- to stop abuse of the AI features, such as automated use or attempts to get around the daily allowance;
- to find several accounts used by one person to get extra allowance or get around a limit or a suspension;
- to enforce suspensions and device blocks under our terms of use, and to look into problems you report.
What it's never used for
Advertising, marketing, tracking you across other apps or websites, or building a profile of you, and it's never sold or shared with anyone except where the law requires.
How long we keep it, and who sees it
These records are deleted automatically after 90 days. Only Brioday's administrator can see them, in an admin page protected by their own sign-in, and only to look after the service as described above.
Where it's kept
Everything you log is kept on your device. With an account, it's also kept on Brioday's servers in Australia. Without an account nothing you log leaves your phone, except when you use a feature that needs one of the services below.
Services that do work for us
These services process data only to do their job for Brioday. Some are outside Australia.
| Service | What it gets | Why | Where |
|---|---|---|---|
| Anthropic (Claude) | What you type to describe a meal, meal photos, supplement label photos, still frames from a form-check video, photos of gym machines or still frames from an exercise video you ask about, and the things you avoid | AI look-ups, only when you ask for one. Under Anthropic's commercial terms, this data isn't used to train its models. | United States |
| Open Food Facts | A barcode number | Looking up a packaged food | France |
| Stripe | Your email and payment details | Paying for Premium plans | United States and other countries |
| Microsoft Azure | Your email address and a one-time code | Sending sign-up and password-reset codes | Australia |
| Sign-in requests; push addresses for Android alerts | Sign in with Google; delivering alerts to Android phones | United States and other countries | |
| Your browser's push service (Google, Apple or Mozilla) | An encrypted alert it can't read, and your device's push address | Delivering alerts to your browser or iPhone home-screen app | United States and other countries |
| Cloudflare | Network traffic, including IP addresses | Delivering brioday.app quickly and protecting it from attacks | Worldwide |
Saying what you ate uses your phone's own speech recognition, and form-check and exercise look-up videos stay on your phone: only the still frames above are sent.
Who can see your data
- You, on your devices.
- People in a challenge with you see the name you chose and your progress in that challenge, nothing else. If you join a gym's challenge anonymously, they see "Anonymous" instead of your name.
- A challenge's creator sees the names of everyone in it, including anyone anonymous, so they can tell who won.
- Brioday's administrators can see each account's email, name, plan and AI usage, to run plans and billing and to help when you ask (for example setting a new password), and the security records above, to protect accounts and the service. They don't browse what you log.
We'll only disclose personal information otherwise if the law requires it.
Google sign-in
If you choose "Continue with Google", Google tells us your name, email address, whether Google has verified that email, and your Google account ID. We use them only to create your Brioday account or sign you in to it. We don't ask for access to anything else in your Google account, we don't share this information, and we don't use it for advertising. Brioday's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Brioday's access at any time in your Google account's security settings.
Health Connect
Brioday reads the Health Connect data types listed above only when you grant permission, and only to show you your own activity, sleep, body and cycle data in Brioday. With an account, it's kept with the rest of your data so your devices share it. It's never sold, never shared with anyone else, and never used for advertising or to decide on credit, insurance or employment. You can disconnect in Brioday (Me › Health) and change what's allowed in Health Connect's settings at any time. Brioday's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.
How long we keep it, and deleting it
We keep your data for as long as you have an account. When you delete something in the app, it's removed from all your devices. To delete your account and everything in it, email [email protected] from the address on your account. We'll delete it within 30 days, including its photos, and cancel any Premium plan. Stripe keeps payment records as the law requires. Our daily backups are kept for 14 days, so a deleted account is gone from them 14 days later. Data kept only on your phone is removed when you uninstall the app or clear the site's data. The steps, and what's deleted and kept, are on Delete your Brioday account.
If we suspend an account for breaking our terms of use, its data is kept while it's suspended (it can't be signed in to or synced), so it can be restored if the suspension is lifted. If we queue a suspended account for deletion, it and everything in it, including its photos, is deleted 7 days later unless the suspension is lifted first; backups follow 14 days after that. A short record that an account was deleted, without its email address, is kept with the security records above until they expire.
Your choices and rights
- You can use Brioday without an account, or without connecting health data, AI look-ups or alerts.
- You can ask us for a copy of the personal information we hold about you, or ask us to correct it.
- If you're unhappy with how we've handled your information, contact us first. If we don't resolve it, you can complain to the Office of the Australian Information Commissioner.
Security
Data travels over HTTPS. Passwords and emailed codes are stored only as hashes, sign-in attempts are limited, and access to the servers is restricted. No system is perfectly secure, but we take care to protect your information, and we'll tell you and the regulator if a data breach is likely to cause you serious harm.
Children
Brioday isn't meant for children under 16, and we don't knowingly collect their information. If you think a child has given us information, contact us and we'll delete it.
Changes to this policy
If we change this policy, we'll update the date at the top. If a change is significant, we'll tell you in the app before it takes effect.
Contact
Black Ops Solutions IT Pty Ltd, Australia
[email protected]