Privacy: Exactly What Leaves Your Phone, and What Does Not

This page is organised by destination rather than by data type, because "what leaves the phone" is the only question it exists to answer and grouping it any other way buries the two answers that matter.

What stays on your phone

Your whole log lives in a SQLite database on the device: food, workouts, sets, bodyweight, measurements, habits, endurance sessions and progress photos. The app is fully usable offline and nothing is needed from the network to read or write any of it.

Progress photos are never uploaded and never sent to the server. A copy of each one is saved to a "Base Progress" album in your own photo library, for one specific reason: iOS and Android both erase everything an app stores when the app is deleted, so a photo that lived only in the app's storage is guaranteed to be lost on the next reinstall. That copy is what survives.

It is your album, not the app's. If you have iCloud Photos turned on, those photos sync to iCloud the same way the rest of your camera roll does — that is your setting, not ours. Turn the backup off entirely by denying photo access in your system settings; the app will say what that costs rather than failing silently.

What goes to the server

So your log survives losing your phone, everything except the progress photos themselves syncs to a private Postgres database under your account.

Every table is protected by row-level security, which means the database itself refuses any request that does not carry your own signed-in session. This is enforced at the data layer rather than in application code — the distinction matters, because an application-layer check is one bug away from being bypassed and a row-level policy is not.

Your email address and password are handled by the authentication provider. The app never sees or stores your password.

Health data

With your permission, Base reads: sleep analysis, heart rate variability, resting heart rate, walking heart rate, respiratory rate, active and basal energy, steps, bodyweight, and workout records including their distances and routes. With your permission it also writes back the bodyweight and the nutrition you log, so your platform's health store stays the single accurate copy.

Health data is never used for advertising or marketing, never sold, and never shared with a third party. It is used only to compute the numbers shown in the app. You can revoke access at any time in your platform's health settings.

Location data from workout routes never leaves the device. There is no server-side processing of it and no map service call.

The AI food scanner

This is one of two features that sends data off the device, and it only does so when you use it.

If you scan a plate with the camera, that photo is sent to Google's Gemini API to be identified, using an API key you supply yourself in Settings. No health data, no account details and no other part of your log goes with it. Leave the API key blank and the feature is off — the photo never leaves the phone and you enter the food by hand instead.

Supplying your own key is deliberate rather than lazy. It means the request is between you and Google under your own terms, there is no intermediary server that could log your photos, and the feature cannot quietly change what it sends.

Barcode lookups

Scanning a barcode sends just that barcode number to Open Food Facts, an open food database, to fetch the product. Nothing identifying you is sent. If the lookup fails or you are offline, the manual entry form opens instead — the goal was always to log the food, not to show you an error.

What is not collected

No analytics. No telemetry. No crash reporting. No advertising identifier. No fingerprinting. No session recording. No third-party SDK doing any of those things.

There is no usage data to hand over because none is gathered. This is a product decision with a cost — it means genuinely not knowing which features get used — and it is made anyway, because a training log is a record of your body and the correct amount of ambient surveillance for that is zero.

Deleting your data

Delete account permanently erases your account and everything in it, from the phone and from the server. It is immediate and it cannot be undone.

Sign out is different and much less drastic: it clears the local copy on that phone only. Signing back in downloads it again.

Export produces your entire database as a single file, plus a CSV bundle. There is no lock-in mechanism here to defend; if you want to leave with your data, the export exists so you can.

Not a medical device

Base is a personal training log. It is not a medical device, it makes no diagnostic claim, and it gives no medical advice. Recovery scores, sleep scores and readiness assessments are training tools built on consumer wearable data, and consumer wearable data is not clinical data. If a number here worries you, the correct next step is a doctor, not an app.

What to do next

If the interesting question is not what Base collects but why it computes what it computes, why every number shows its math covers the reasoning, and the screen-by-screen walkthrough shows the arithmetic in place.