Trophy Privacy Policy

Effective Date: October 27, 2026

Trophy (“Trophy,” “we,” “us,” or “our”) is a fitness and nutrition tracking service operated by Seneco Holdings LLC, a limited liability company based in Florida, United States.

This Privacy Policy explains how we collect, use, share, store, and protect personal information when you use the Trophy iPhone application, our website at https://www.trophystate.com, our hosted web application at https://set-setter-app.lovable.app, and related services (collectively, the “Service”).

Our separate Consumer Health Data Privacy Policy describes the collection, use, sharing and rights relating to consumer health data.

If you have questions about this Privacy Policy or your personal information, contact us at contact@trophystate.com.

1. Information We Collect

We collect information you provide, information generated through your use of Trophy, and certain technical information necessary to operate the Service.

Account information

When you create or use an account, we may process your name, email address, account identifier, and information associated with your chosen sign-in method. We also record the document versions, acknowledgment choices, eligibility attestation and time associated with your explicit legal acknowledgment.

If you sign in through a supported third-party authentication provider, we may receive information needed to authenticate you and associate your sign-in with your Trophy account.

Fitness and nutrition information

Depending on the features you use and the information you choose to provide, Trophy may collect and store:

• Age or date of birth, sex, height, and weight.
• Fitness goals and calorie settings.
• Workout plans, exercises, sets, repetitions, and weights.
• Workout history and performance records.
• Food entries, nutrition logs, and calorie or macronutrient information.
• Activity records, energy-expenditure estimates, and weigh-ins.
• Progress information and calculated fitness estimates.

Some of this information may be considered health-related or sensitive personal information under applicable privacy laws.

Photos, files, and other content

When you use optional features, you may submit meal photographs, workout files, pasted text, food descriptions, activity descriptions, or answers to follow-up questions.

We process this information to provide the features you request.

AI-assisted features

Trophy offers optional AI-assisted features for food estimation, activity estimation, and workout importing.

Depending on the feature, information submitted for AI processing may include:

• Selected meal photos, food descriptions, and follow-up answers.
• Activity descriptions and responses, together with available weight, age, height, and sedentary-calorie settings.
• Pasted workout text and selected files.

These requests are routed through Lovable’s AI gateway. Food and activity estimation use OpenAI models; workout importing uses Google Gemini.

AI-generated estimates may be incomplete or inaccurate. Manual tracking remains available. Before an optional AI request, Trophy identifies the information and provider involved and asks for permission. You can cancel that request; choosing not to use AI does not prevent manual tracking. Trophy does not train its own AI models on your fitness records. Provider processing is subject to the providers’ applicable service and privacy terms; we do not promise that AI requests have zero retention.

Technical and device information

When you access Trophy, technical information may be processed to authenticate your session, deliver the Service, maintain security, or diagnose problems.

Depending on the systems involved, this may include IP addresses, request information, browser or device characteristics, timestamps, and error information.

Trophy’s optional Lovable visitor analytics and AI app-context capture settings are disabled. Lovable still records AI request summaries, such as the model, status, time, and usage cost. Turning off these settings does not erase historical records or disable necessary infrastructure logs or AI-provider processing.

2. How We Use Information

We use personal information as reasonably necessary to:

• Create and authenticate accounts.
• Save and retrieve fitness and nutrition information across supported devices.
• Display workout history, progress, and goals.
• Calculate estimated calorie, activity, nutrition, and weight-related values.
• Process optional AI requests initiated by users.
• Maintain and secure the Service.
• Respond to support and privacy requests.
• Investigate technical problems and prevent misuse.
• Comply with applicable legal obligations.

We may introduce optional promotional communications in the future. We are not currently sending promotional marketing emails.

If we introduce marketing emails, we will provide the notices, consent choices, and unsubscribe mechanisms required by applicable law before sending them.

We do not currently use personal information for third-party advertising or cross-company advertising tracking.

3. How We Share Information

We use service providers to help operate Trophy.

These include:

Lovable Cloud: Provides managed account, authentication, database, hosting and related infrastructure, using a backend built on Supabase technology.

Authentication providers: When you choose a supported third-party sign-in method, the relevant provider processes information necessary to authenticate your account.

AI processing providers: When you use optional AI-assisted features, information required for the request is transmitted through Lovable’s AI gateway to OpenAI for food and activity estimation or Google Gemini for workout importing.

The website loads font styles and font files from Google Fonts. Requests for these assets expose connection information, such as your IP address and browser request information, to Google. Infrastructure and diagnostic providers may also process technical information to deliver and maintain the Service.

We may also disclose information where required by applicable law, to respond to valid legal requests, or where reasonably necessary to protect the security and rights of users and the Service, subject to applicable law.

If Trophy is transferred to a company or another operator in the future, personal information may be transferred as part of that transaction where legally permitted, with any required notice or consent.

We do not currently share user information with advertising networks for cross-company advertising tracking.

4. Cloud and Device Storage

Trophy stores account-associated information using Lovable Cloud infrastructure.

Your fitness and nutrition records are associated with your account and may be retrieved on supported devices after signing in.

Saving changes currently requires an internet connection.

Trophy also uses storage on your device, including localStorage and IndexedDB or other local caching mechanisms, for sessions, temporary authentication state, cached information, and certain recovery copies. Some unfinished drafts may exist only temporarily in application memory.

This means that information may exist both on your device and in cloud systems, depending on the feature and its state.

5. Data Retention

We keep account information and saved fitness and nutrition records while your account is active so you can retrieve your history. When you permanently delete your account, the deletion process removes the account and associated records from active account systems, subject to applicable legal obligations and permitted exceptions. Support correspondence, security records and information needed to resolve a dispute may be retained for the relevant purpose or applicable legal period.

Retention may differ depending on the type of information, whether your account remains active, whether you request deletion, and whether information must be retained for legal, security, or operational reasons.

Certain information may also exist in private database backups or exports. Lovable documents daily database backups retained for up to roughly 14 days. This is not a guarantee that every copy, log, storage file, or manually created export is deleted within that period.

Manual recovery exports are used for documented recovery or incident work. Our operational target is to dispose of those copies within 30 days after the relevant incident is resolved, unless a documented continuing recovery need or legal obligation requires retention. This target does not control provider-managed backups or logs.

Infrastructure logs, AI request summaries, and records held by service providers may follow separate schedules. Turning off an optional feature does not erase prior records. We do not promise immediate deletion from every backup or storage system; contact us with questions about a specific deletion request.

6. Your Choices and Account Deletion

You can review and modify certain information through Trophy’s available account and tracking features.

Trophy provides two distinct data-management options.

Factory reset

Factory reset removes the fitness information covered by that feature while retaining your login account.

Factory reset is not the same as permanent account deletion.

Permanent account deletion

You can initiate permanent account deletion using the deletion feature available within Trophy.

Permanent deletion removes your account and associated records from active account systems, subject to applicable legal obligations and permitted exceptions. You may be asked to sign in again to verify the request. If a supported sign-in method needs additional deletion steps, contact us for assistance; a failed or unavailable deletion attempt is not confirmation that your account was deleted.

Certain information may remain temporarily in backups or be retained where legally required or permitted.

You may also contact contact@trophystate.com to request assistance with deletion or other privacy matters.

7. Security

We use cloud-based infrastructure and take measures intended to protect personal information against unauthorized access, disclosure, alteration, and loss.

No internet-based service or storage system can guarantee absolute security.

You should protect your account credentials and contact us if you believe your account has been accessed without authorization.

8. International Data Processing

Trophy is operated from the United States and is initially offered only to residents of the United States, through both the iPhone application and the website. We may expand to additional countries in the future and update this Privacy Policy before doing so.

Our project database is hosted in US East (Ohio), as shown in Lovable’s project settings. This identifies the database location, not every location used for hosting, authentication, logs, backups, or AI processing.

Even during our United States-only launch, personal information may be stored or processed outside the United States, depending on the location of our infrastructure and service providers. Limiting where the Service is offered does not mean that all information is stored or processed in the United States.

Where international transfers are subject to legal restrictions, we will use an applicable transfer mechanism or safeguard where required.

9. Your Privacy Rights

Depending on where you live, you may have rights to:

• Request access to personal information held about you.
• Correct inaccurate personal information.
• Request deletion of personal information.
• Request a portable copy of certain information.
• Object to or restrict certain processing.
• Withdraw consent where processing relies on consent.
• Opt out of certain uses or disclosures of personal information.
• File a complaint with an applicable privacy regulator.

These rights are subject to applicable legal conditions and exceptions.

To exercise a privacy right, contact contact@trophystate.com.

We may request information reasonably necessary to verify your identity before fulfilling a request. Do not send your password or sign-in codes. Where applicable, an authorized agent may submit a request with appropriate proof of authority.

We will respond within applicable legal deadlines. If we decline your request, you can appeal by contacting the same email address with “Privacy appeal” in the subject. We will explain the decision and provide any applicable regulator complaint options. We will not unlawfully discriminate against you for exercising privacy rights.

You can withdraw permission for future optional AI sharing by declining subsequent AI requests and contacting us for help with a broader withdrawal request. Withdrawal does not undo processing already completed. To stop all account-based collection, you can stop using the Service and request account deletion.

Where applicable law requires additional information about the purposes or legal grounds for processing, we will provide it in accordance with that law.

10. Minors

Trophy is intended for people aged 18 or older.

Users confirm that they meet the minimum age requirement when registering.

You must also meet any higher age-of-majority or other eligibility requirements that apply where you live.

Trophy is not intended for people under 18.

If we learn that an account belongs to a person who does not meet the applicable age or consent requirements, we may restrict the account and take appropriate steps regarding its personal information.

Parents or guardians may contact contact@trophystate.com with privacy concerns.

11. Processing Requested by You

We process the records you choose to enter to provide the tracking, history and calculation features you request. Optional AI requests use separate permission before the relevant information is shared. Acceptance of the Terms or acknowledgment of this Privacy Policy does not itself authorize marketing, advertising tracking or all future optional AI requests.

Where additional consent or another legal condition is required for a particular use of personal information, we will meet that requirement before that use. Trophy is initially offered only in the United States; this Policy does not represent that the Service has launched in other jurisdictions.

12. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our features, information practices, service providers, or applicable legal requirements.

When required by law, we will provide notice or obtain consent before material changes take effect.

The effective date at the top of this Policy will indicate when the current version became effective.

13. Contact

For privacy questions, requests, or concerns:

Trophy

Operated by Seneco Holdings LLC

Florida, United States

Email: contact@trophystate.com

Website: https://www.trophystate.com