Privacy policy

This policy explains how Burnly (“we”, “us”) handles your information when you use burnly.com.au and the Burnly app. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth). If you have a question, email hello@burnly.com.au.

The short version

• Tracking with Burnly is free, and you need a free account to use it. We ask only for your name and email (and your phone if you choose to give it). For Burnly Plus we keep whether your account has it, how it was opened (a code, or the Burnly team), and the times of any wrong codes (a lock after three); it's deleted with your account.
• Marketing emails are optional and off unless you tick the box; you can turn them off any time in My account.
• We only ask for your name and contact details when you choose to book a session or contact us.
• Some features send information to AI providers to work, including what you say or type to Kiko, our assistant. When you open Kiko with her voice on, she greets you and then turns on your microphone by herself to listen, only after you've tapped her and only while she's open; she stops after a few quiet seconds. For languages your phone can't turn into text (such as Punjabi or Urdu), your voice message is sent to our AI provider to be written down, and where your device has no voice for a language, the text of Kiko's reply is sent to our AI provider to be read aloud (the audio streams back as it's made, and neither we nor our AI provider keep it). While Kiko works, her window shows a short line about what she's doing, like “Finding the foods…”; only that one word is sent to your browser, nothing new about you. To make her answers personal, each message to Kiko from a signed-in member also sends their first name, their My plan answers (goal, diet, foods they avoid, cuisines, meal and exercise habits, injuries) and a short summary of their recent logging, steps and workouts to our AI provider for that reply only. When a member asks Kiko how they're doing or about a pattern, a summary of up to their last 4 weeks compared with the weeks before (average calories, protein, carbs and fat against your goals and targets, meal timing, steps, workouts and sleep, and their five most-logged food names) is also sent for that reply only; nothing new is stored. Data from Withings, Oura, Polar, WHOOP and Strava is never included. Meal photos you choose to keep are stored encrypted for 90 days and only you can see them; other photos, “how I feel” text, voice messages and conversations with Kiko aren't stored by Burnly.
• We don't sell your information or use it for advertising.
• You can delete what you've saved from inside the app.

What we collect

Your account

• Your name, email address and, if you give it, your phone number.
• Whether you'd like tips and offers from us (off unless you choose it).
• When you joined and last signed in, and one-time sign-in codes (stored only in coded form and deleted after use).

Things you save in Burnly

• Your food log (foods, portions, calories and nutrients, dates and meals), favourites and daily goal.
• How much water you log each day and your water goal.
• Meal photos you keep with foods you add from a photo (untick “Keep this photo with my log” to not keep one): stored encrypted for 90 days, only shown to you, never sent to an AI provider again and never shared.
• If you set up My plan: sex, age, height, weight, goal, activity, diet, foods you avoid, favourite cuisines, whether you're pregnant or breastfeeding, your answers to the exercise health check, your fitness preferences and injuries, and your cooking habits. This includes health information, which we treat as sensitive. Your foods to avoid and injuries are also used, on our servers, to check every food and exercise suggestion for them; nothing extra is stored.
• The meal and exercise plans and recipes made for you.
• Activities guides you save: the place or event, its date, how fit you feel, any injuries you mention, and the guide made for you.
• If you connect one of the connected apps (Fitbit / Google Health, Withings, Oura, Polar, WHOOP or Strava): your steps, sleep, workouts and weigh-ins, depending on the app. See Connected apps.

Things you send us

• Session requests: your name, email, optional phone number and best time to call, session preferences, your message and, if you tick the box, a summary of your plan.
• Contact-form messages: your name, email, topic and message.

Technical information

• A random visitor ID in a cookie (kept for up to a year) so Burnly can show you your own data.
• A one-way code made from your IP address, used to stop spam and abuse and kept for no more than 2 days. We don't store your IP address itself.
• Preferences saved in your browser, such as your country or chosen supermarket.
• Walk mode: while you walk, Burnly checks your speed on your phone to tell walking from riding in a vehicle. In Walk mode your location stays on your phone: it isn't saved or sent to us.
• Shopping cost: when you tap Estimate the cost, the store, your country and the items on your shopping list are sent to our AI provider to find prices on the web. Prices are kept for 3 days and shared by everyone who checks the same item at the same store, with nothing about you attached. Stores near me works like Eating out: your location, rounded to about 110 m, goes to OpenStreetMap only when you tap, and isn't stored. Swaps you use stay on your device.
• Barcode scanning: the camera picture stays on your device; only the barcode number is sent to us, and we look it up in Open Food Facts, a free public food database. Product data is kept for up to 30 days to make scans faster and isn't linked to you. If you take a photo of a nutrition label or the front of a pack, it goes to our AI provider to be read and isn't kept.
• Eating out: only when you tap Near me (or pick a place you typed), your location, rounded to about 110 m, is sent to OpenStreetMap services (Overpass, Nominatim and Photon) to find restaurants and cafés nearby. To suggest dishes, our AI provider gets the area name, the places' names, the meal, your calories left, your diet and the foods you avoid, never your location or name. Nothing about it is stored. Places © OpenStreetMap contributors.
• Kiko and your location: only when Kiko's answer depends on where you are (for example brand foods, delivery, experts or support lines), your device asks you first. Your location is rounded to about 11 km and turned into just your country and city with OpenStreetMap's lookup service (Nominatim); only the country and city are kept, on your device, for 30 minutes, and during that time they go with your Kiko messages to us and our AI provider. Burnly never stores your location. Location data © OpenStreetMap contributors.
• Near me (Activities): only when you tap it, your approximate location (rounded to about 10 km) is sent to us and to our AI and web-search providers to find places near you. It's never stored.
• Place suggestions (Activities): as you type a place, only the letters you've typed are sent to a place search built on OpenStreetMap (Photon, run by Komoot), without your account, name or location, to suggest matching places. Nothing is stored. "Tell me about this place" sends the place name to our AI and web-search providers, like making a guide does.
• Burnly Sense (off unless you turn it on in My account): on your device, it counts how you use Burnly (for example typing speed and deletes, late-night use, quick searches for sweets, a food removed right after adding it, late snacks and, with a connected device, last night's sleep) and turns that into a few hint words such as "late nights". What you type, your key presses and timings are never kept or sent. Only the hint words are kept, on your device, for 14 days, and they go with your Kiko messages to us and our AI provider so Kiko can be kinder; Burnly never stores them. It never uses your camera or microphone and never diagnoses anything. Turning it off deletes everything it kept.
• Daily message (Today): worked out on our server from what's already in your account (your food log, steps, workouts, sleep and weigh-ins from connected apps, My plan and your Activities guides) each time you open Today. No AI is used and nothing new is stored on our side. Your device remembers the last few lines it showed you (with a one-way code for your account, so someone else signing in on the same device never sees yours).
• Share my progress: a progress picture (streak, your week, training or a milestone) is made from your account when you ask for it and isn't stored. It only shows habits, never your weight, calories, sleep, name or photo. Burnly doesn't post it anywhere and there's no public link: you choose where it goes from your device. Once you share it, the app or person you shared it with handles it under their own terms.

How we use it

• To show your log, work out your targets, and make your meal plan, recipes and exercise plan.
• To create your account, email you sign-in codes, and keep you signed in.
• To arrange a one-to-one session you ask for, and to reply to your messages.
• To email you a confirmation when you book a session or send us a message or feedback, and when your session request's status changes. If the address you type isn't your account's, we don't include what you wrote.
• If you opt in, to send you tips and offers. Every marketing email has a way to stop them.
• To keep Burnly secure and working, including limits that prevent misuse.

We don't use your information for advertising, and we don't sell it.

Who we share it with

We use trusted service providers to run Burnly. They process information for us under their own privacy and security terms:

• Vercel (hosting the website and app).
• Turso (our database).
• Google (Gemini AI) and Perplexity: to recognise foods in photos, estimate nutrition, search for foods and professionals, check places and make activity guides, find places near you, and make plans, recipes and supportive suggestions. We send only what the feature needs, such as the photo, the words you typed, your plan details, or your rounded location for Near me.
• OpenStreetMap Foundation (Nominatim): when Kiko needs to know where you are, your location rounded to about 11 km is sent to find your country and city. Location data © OpenStreetMap contributors.
• YouTube (Google): when you tap Watch on a training session or exercise, the how-to video plays from YouTube in its privacy-enhanced mode, and YouTube's own privacy policy applies to it. Nothing loads from YouTube until you tap. To pick a video, Burnly sends only a short, general description of the exercise (like “push-up”) to YouTube's search, never anything about you.
• Komoot (Photon place search): the letters you type into the Activities place box, to suggest places. Place data © OpenStreetMap contributors.
• Resend (sending sign-in codes, confirmations and email notifications).
• Instacart (United States and Canada only): if you choose “Add all to a cart with Instacart”, we send the ingredient list to Instacart to build your cart.
• Voice search uses your browser's built-in speech recognition, which may be processed by your browser or device provider.

When you book a session, we share your request with the professional we arrange for you. When you open a supermarket or delivery link, the store receives only the search in that link. These providers may store or process information outside Australia, including in the United States.

How long we keep it

• Your account, food log, favourites, goal (and the history of your calorie goal and macro targets, one entry for each day they changed, used by Progress), preferences (units, macro split, and meal names, which are encrypted), plan details, plans, steps, water and saved Activities guides: until you delete them or your account.
• Session requests and contact messages: up to 12 months.
• Meal photos you keep: 90 days, then deleted automatically.
• Connected apps (Fitbit / Google Health, Withings, Oura, Polar, WHOOP or Strava): the connection keys and imported data, until you disconnect or delete your account, except Oura and WHOOP data, kept for 30 days, and Strava data, kept for 7 days. See Connected apps.
• Saved recipes: up to 90 days. They're shared between people with the same meal and preferences and don't identify you.
• Anti-abuse records, including IP codes: up to 2 days.

Your choices and rights

• Delete food entries from Today, fix or clear a day's steps and water on Today (Edit), delete a meal photo (tap it, then Delete photo) or all of them in My account, remove your plan details in My plan, delete guides in Activities, and delete session requests in the booking form.
• In My account you can update your details, turn marketing emails on or off, and delete your account, which permanently removes everything saved under it.
• To ask about, correct or delete information, you can also email us from the address on your account.
• Clearing your browser's cookies disconnects you from your saved data.

Children

Burnly is for people aged 13 and over. If you're under 18, please use it with a parent or guardian, and talk to a doctor before changing how you eat or exercise.

The Burnly phone apps

The Burnly apps for iPhone and Android (being tested before they go into the App Store and Google Play) use the same account and the same data as the website: nothing extra is collected because you use an app.

The apps ask for a permission only when you first use the feature that needs it, and you can say no or change it later in your phone's settings:

• Camera: to recognise your meal or scan a barcode. Barcode pictures stay on your phone.
• Microphone: only while you're talking to Kiko or searching by voice.
• Speech recognition: your words are turned into text so Kiko and Search can understand you. The apps use your phone's own speech recognition (Apple's on iPhone; your phone's speech service on Android, usually Google's), which may process your voice under that company's privacy terms. Burnly only receives the words.
• Location while using the app: only when you tap Near me, or to tell walking from driving in Walk mode. It isn't stored.

Kiko speaks with your phone's own voices where it has one for your language. When you share a progress card or a PDF, your phone's share sheet opens and you choose where it goes. The apps have no ads and don't track you across other apps or websites.

Apple Health and Health Connect

In the Burnly app on your phone you can choose to connect Apple Health (iPhone) or Health Connect (Android). Your phone asks you first, and you choose what Burnly may read. Burnly reads your steps, sleep, workouts (type, time, length, calories and distance) and weigh-ins: the last 30 days when you connect, then what's new each time you open the app. Burnly never writes to Apple Health or Health Connect.

What Burnly reads is saved in your Burnly account so it shows on Today, in Progress and on the website, with workout types and weights encrypted. It's kept until you disconnect, which deletes all of it. It's never sold, never used for advertising or marketing, not given to AI (Kiko, the plan maker or Burnly Sense) and never on a progress card you share. Nothing goes to iCloud.

To stop Burnly reading: disconnect in My account → Connected apps, and on iPhone also open the Health app → Sharing → Apps → Burnly; on Android, Health Connect → App permissions → Burnly.

Connected apps

If you choose to connect an app (all in beta): Fitbit / Google Health (steps, workouts, weight, sleep), Withings (steps, sleep, workouts, weigh-ins), Oura (steps, sleep, workouts), Polar (steps, sleep, workouts), WHOOP (sleep, workouts), Strava (workouts). These are shown on Today and Activities; a newer weigh-in can update My plan when you tap it. We never sell any of it or share it with anyone else.

What goes to the AI: only Fitbit / Google Health data can help Kiko tailor her tips. Data from Withings, Oura, Polar, WHOOP and Strava is only shown to you and is never sent to the AI (Kiko, the plan maker or Burnly Sense).

Oura and WHOOP data is kept for 30 days and Strava data for 7 days, then deleted; the others until you disconnect or delete your account. Strava data is only ever shown to you: never on a progress card you share, never sent to AI. If you remove Burnly in your Strava settings, Strava tells us and we delete your Strava data straight away.

We read this data, never write to it, and store the connection keys and what we import encrypted at rest. Disconnecting (My account → Connected apps) deletes the keys and everything imported from that app, and asks the app to end the connection; deleting your account does the same for every app. You can also remove Burnly's access in each app's own account settings. Burnly's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Security and encryption

Your data is protected with encryption in transit and at rest:

• Everything between your device and Burnly travels over encrypted connections (HTTPS).
• Before it's saved, your personal information is encrypted with AES-256: your food log and favourites, your plan details and health answers, your plan, your saved Activities guides, meal photos you keep, your name, email and phone, weight from a connected scale, and messages and session requests you send us. The key is kept separately from the database, so a copy of the database on its own can't be read.
• Burnly's servers decrypt your information to show it to you and to run features such as your plan and daily totals, and some features send information to AI providers to work (see above). Calorie and nutrient numbers, dates and step counts are stored without this extra encryption.
• Burnly's pages tell your browser which sites they may load from, and the browser blocks anything else. When it blocks something, it sends us a short report: which rule, which website was blocked and the page's path. It has no personal details, is kept briefly in our server logs and isn't saved with your data.

Your account is protected too:

• After too many wrong sign-in codes, codes for that email address are paused for 24 hours.
• If your account's email address is changed, we email your old address to tell you, and every other device signed in to your account is signed out.
• You can sign out on every device at once from My account (Sign out everywhere).

We keep access to data limited and protect admin tools with strong passwords. No system is perfectly secure, so please don't put information you don't want to share into free-text boxes.

Changes and complaints

We'll update this page if our practices change and show the date at the top. If you have a concern, email hello@burnly.com.au. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.