Privacy Policy

Effective date: 10 November 2026

Who we are

Sombrey is operated by Jerrell Kent Johnson, who is responsible for the personal information described in this policy. Business address: 130 Thimbirigasyaya Road, Colombo 00500, Sri Lanka. Contact for privacy, support and account-deletion requests: support@sombrey.com.

Sombrey has not appointed a representative in the United Kingdom. People in the UK can contact us directly at the address and email above, and can complain to the Information Commissioner's Office (see Your rights and complaints).

Sombrey is intended for adults aged 18 or older. Contact us if you believe a child has provided personal information so we can investigate and take appropriate action.

Information we use

What we collect depends on the features you use and permissions you give.

• Account information: verified email, account identifier, sign-in provider details and optional name, from you and the sign-in provider; used to authenticate, secure and manage your account.
• Profile and goals: date of birth, height, weight, sex, goals, experience, equipment, schedule and preferences you enter; used for requested planning and personalisation.
• Fitness and health: workouts, sets, effort, whether a session caused concerning symptoms, sleep and heart measurements you enter or permit us to import; used for requested records, progress and supported calculations.
• Wearable records: supported Apple Health and Sombrey Band records, timestamps, source and device details, workout duration, distance and energy; used for integration, source attribution and duplicate handling.
• Food and meal photos: food entries, portions, dietary preferences, restrictions and allergies, and meal photos you submit for analysis; used for requested logging, suggestions and estimates. A meal photo is deleted from Sombrey's storage as soon as its analysis finishes or you discard it.
• Body scans: the front, side and back photos you take, and the measurements calculated from them. Body proportions are measured on your phone; the photos are also uploaded to Sombrey's storage and kept with the scan so you can compare scans over time. Only you can view them, and they are not sent to any AI provider. They are deleted when you delete the scan or your account; uploads from an unfinished scan are removed automatically.
• Coach conversations: messages, responses, details you save for the Coach and relevant permitted context; used for requested coaching, saved history and proposals.
• Purchases and permissions: Apple transaction identifiers and signed records, account links, credit and allowance records, consent versions and timestamps; used for access, accounting, fraud prevention and your choices. We do not receive full card details from Apple.
• Service and location information: support requests, limited purchase-flow events and technical logs; used to resolve faults and protect the service. For weather, your approximate location (to about 1 km) is sent to the Norwegian Meteorological Institute (MET Norway) and only the town name and weather are kept. GPS routes from outdoor workouts are stored as workout history.

Health information includes estimates and inferences, not only readings you enter. We do not require every optional data category to create an account. Missing permissions or inputs can make dependent features unavailable. Membership requirements still apply.

Providers and disclosures

• Clerk manages sign-in and account identity.
• Convex supports application records, processing and storage.
• OpenAI, when you allow Sombrey AI Coach and the service is available, receives your messages, your onboarding answers, and relevant profile, goal, training, nutrition, Sombrey Band and body-composition context, and details you've saved for the Coach. Onboarding answers are what you told Sombrey when you joined — your goals, any event you're preparing for, the difficulties you chose and which comes first, the station you'd like to practise first, your current training as you described it, your routine, available days and session time, equipment, movements or foods you avoid, eating preference, and your own description of your sleep. We share only the categories of onboarding answers covered by the Coach permission you accepted. New categories require your permission before they are shared. You can withdraw permission in Settings. Your town name and local weather may be included. Body-composition context contains dated numerical estimates and their limitations, not body-scan photos.
• Google Gemini, when you allow meal-photo analysis and it is available, receives your submitted meal photo and analysis instructions to identify food and estimate portions.
• Edamam receives the text you type when you search for a food, and, when you allow meal-photo analysis, the names and preparation of the foods identified in your photo (such as "cooked pasta"), to return nutrition values. It does not receive your meal photo, portion sizes, name or account details.
• MET Norway receives your approximate location to provide local weather.
• WorkoutX receives exercise names searched in Sombrey's exercise library, sent from Sombrey's servers without your name or account details.
• Cloudflare hosts the sombrey.com website and receives visitors' IP addresses and request details.
• Zoho hosts the support@sombrey.com mailbox, so it receives the emails you send us.
• Apple provides sign-in, protected platform permissions, purchases and subscription management according to the services you use.

Apple Health data is used for the connected features inside Sombrey. This version of Sombrey does not send imported Apple Health data, or summaries, scores or insights derived from it, to OpenAI or any other AI provider. If that changes, we will explain the change and obtain the required permission before any sharing begins. See AI & Data Use.

Providers receive information needed for their role under the applicable arrangements. We may also disclose necessary information where law requires it, to respond to lawful requests, or to establish or defend legal rights. We do not treat this as permission for unrestricted sharing. Any business transfer involving your information must remain subject to applicable privacy duties and appropriate notice.

Your permission and control

Terms acceptance, optional AI sharing and marketing are distinct choices. Optional choices are not preselected. We retain your valid choices so we do not repeatedly ask for the same permission. You may change them in Settings. A material change in purpose or recipient may require a new explanation and permission.

Where required, we obtain explicit consent to process sensitive health information for the requested feature. Apple's Health, camera and photo-library permissions are separate system controls. You may stop future Health access in Apple's settings and use Sombrey's disconnect-and-delete control for imported information. Withdrawal stops processing that relies on that consent; it does not invalidate previous lawful processing.

Declining marketing does not prevent account creation. Declining an AI feature leaves that feature unavailable without cancelling your subscription automatically. Legal pages, support, account deletion and subscription management remain accessible without membership.

Personalisation and improvement

We use your permitted records to personalise your own service. Limited operational and purchase-flow information helps diagnose failures and improve usability. Purchase-flow events do not include health records, goal text, meal photos or Coach messages.

We do not use your health records, body photos or meal photos to train shared or general-purpose models, sell health data, or build advertising audiences from it. A later research or cross-user algorithm-improvement programme would require its own assessment, explanation and appropriate permission; a general agreement to this policy does not authorise it.

Provider storage and model training are different. Sombrey asks OpenAI not to keep copies of Coach conversations for later use, but that is not a promise of zero retention by the provider. Provider processing and retention follow the arrangements described in the retention and transfer information below.

UK lawful bases

For ordinary account administration and delivery of requested services, we rely on performance of our contract. For necessary security, fraud prevention and proportionate technical diagnostics, we rely on legitimate interests in keeping the service reliable and protecting accounts, subject to your rights and appropriate balancing. Where law requires records, we rely on legal obligation.

For optional AI disclosures, marketing and sensitive health-feature processing where consent is required, we rely on your consent; sensitive health processing additionally relies on explicit consent under the applicable special-category rules. Contract alone does not authorise sensitive-data processing. We keep those purposes and choices separate.

Right to object: you may object to processing based on legitimate interests and may object to direct marketing at any time. You may withdraw consent in Settings or by contacting us without affecting the lawfulness of previous consent-based processing.

International processing

The operator is based in Sri Lanka. Information may be processed by service providers or accessed for support in other countries:

• Sombrey's application records and files are stored and processed by Convex, a US-based provider; Convex and its sub-processors may process them in the United States.
• Sign-in data is stored by Clerk in the United States.
• With the Coach permission, OpenAI processes Coach requests in the United States.
• With the meal-photo permission, Google processes meal photos for the Gemini API and may store them transiently or cache them in any country where Google or its agents have facilities.
• Edamam processes food names in the United States. Requests are sent from Sombrey's servers with no name, email or account identifier.
• Support emails are stored by Zoho in the United States.
• Weather requests go to MET Norway in Norway.
• The website is delivered by Cloudflare's worldwide network.

For people in the UK, transfers to providers in the United States rely on the UK–US data bridge where the provider is certified to it (Clerk and Cloudflare are). Convex and OpenAI apply the Standard Contractual Clauses with the UK Addendum through their data processing terms. Google's data processing terms for paid services apply to meal-photo analysis. Edamam, WorkoutX and MET Norway receive no account details, and Norway is covered by UK adequacy regulations. Contact us for a copy of the relevant safeguards.

Support emails are the exception: the United States has no UK adequacy regulation covering Zoho, and we have not yet put a transfer agreement with Zoho in place for the support mailbox. Until we do, please include only what we need to help you, and avoid sending health details by email. You can change permissions and delete your account in the app's Settings without emailing us.

Where UK transfer rules apply and a transfer mechanism is in place, we explain it here and how to obtain a copy. We do not treat an ordinary AI checkbox as a substitute for required ongoing transfer safeguards.

How long information is kept

We decide retention by the purpose of the record, whether you still request the service, a deletion request, necessary dispute and fraud-prevention needs and applicable legal obligations:

• Account profiles, saved workouts, nutrition, scan results and conversations support your requested account history until deleted or no longer needed for that purpose.
• Coach memory and conversation history have their own controls in Settings. Withdrawing AI consent stops future sharing; use the deletion controls or contact us to remove stored material.
• Meal photos are deleted once analysed or discarded. Body-scan photos are kept with their scan until you delete the scan or your account.
• Diagnostic and purchase-flow records are kept only for investigation and service reliability, and are deleted with your account. They are not health archives.
• Support records are kept while resolving the request and for the necessary follow-up or dispute period.
• After account deletion, a minimal set of records remains, without your profile, email, health records or photos: Apple purchase records no longer linked to you (so a purchase is never granted twice and can be restored to a new account), closed records of purchased packs, AI usage records without content or account, and a record of the deletion itself.

Specific periods the service applies today: Coach conversation messages are deleted after 365 days; records used only to prevent duplicate Coach requests after 7 days; superseded or forgotten Coach details after 30 days; AI usage records (which contain no message content and are used for service accounting) after 400 days; records of refused AI requests after 30 days. Meal-photo duplicate checks are cleared after 24 hours. An unfinished body-scan upload is removed after an hour, an abandoned scan after a day, and an onboarding scan that never became part of a membership after 30 days.

Other records are kept by purpose rather than for a fixed period: purchase-flow events while your account exists; Apple notification and transaction records, which contain no profile or contact details, for as long as they are needed to prevent duplicate purchases, handle refunds and reconcile accounts; the record of a completed account deletion for as long as it is needed to show that the request was carried out; and support emails while needed to resolve the request and any follow-up or dispute. You can ask us to delete support correspondence that we no longer need.

Account deletion closes access and starts deletion of account-associated records, files and your sign-in identity in stages. The app reports progress. Removing Sombrey's Sign in with Apple access is handled separately where applicable, with instructions if you need to finish it yourself. We do not say Apple access has been removed until Apple confirms it. Deleting the account does not cancel your Apple subscription.

Your rights and complaints

Depending on your location and applicable law, you may request access, a copy, correction, deletion, restriction or portability; object to relevant processing; withdraw consent; and exercise applicable appeal rights. Email support@sombrey.com or use the Settings controls. We verify identity proportionately and respond within applicable legal timeframes. A missing export button does not remove a statutory access right. You do not need paid membership to exercise privacy rights.

UK users may complain to the ICO: https://ico.org.uk/make-a-complaint/. US users may have additional state rights; see our Washington and Nevada Consumer Health Data notices. We do not penalise you for exercising protected rights, although stopping a necessary data use can make a dependent feature unavailable.

Marketing, tracking and security

Marketing emails require the separate choice described at signup and include an unsubscribe route. Service and security messages are separate. We do not use health information for targeted advertisements. The Sombrey app does not track you across other companies' apps or websites, and it contains no advertising or third-party analytics tools. The sombrey.com website sets no cookies and uses no analytics or advertising tools. Cloudflare, which hosts it, processes visitors' IP addresses and request details to deliver and protect the site. If Cloudflare needs to check that a visitor is not automated, it may set a strictly necessary security cookie; it is not used for advertising or to track you across websites.

We use access controls and safeguards appropriate to the information. No service guarantees absolute security. Do not send passwords, verification codes or unnecessary health photos to support.

Changes

We publish the current policy and explain material changes. A notice-only update does not itself grant new AI or marketing permission. Where new permission is required, we ask before the changed processing begins.