Last updated: July 24, 2026
Carbyne Lab ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Carbyne Lab website, progressive web application (PWA), or locally bundled iOS or Android client (collectively, the "Service"). Feature availability differs by client. Please read this policy carefully. By accessing or using the Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.
If you do not agree with the terms of this Privacy Policy, please discontinue use of the Service immediately.
When you create an account, we collect your email address and any profile information you choose to provide, such as your display name, avatar image, and preferred language setting. Authentication is handled through Supabase Auth, which supports email-based login and social sign-in providers. We store your user profile data in our Supabase PostgreSQL database.
As you use the Service, we collect and store fitness-related data that you voluntarily input, including:
Progress photos that you add within the app are stored locally in your browser on the device where they were added. They are not uploaded to Carbyne Lab servers or Supabase Storage, and they are not shared with trainers through trainer-facing views. If you choose to use an AI analysis feature, the selected photo may be sent to an AI service provider to estimate fitness-related metrics such as body fat percentage.
When you use the AI motion analysis feature, your device camera captures video of your movements. This video is processed entirely on your device (client-side) using computer vision models running in your browser. No video footage, images, or raw camera data is transmitted to our servers or any external service. The only data derived from the motion analysis that may be stored are aggregate metrics such as rep counts, movement quality scores, and form feedback summaries, which are stored as part of your workout logs.
At gym locations where facility cameras are activated, cameras may be used for safety, security, access-control investigations, and checking whether occupancy is consistent with confirmed bookings. The people-counting system may store aggregate entry, exit, and occupancy counts with server receipt times and an advisory link to the applicable booking window. It is not used for facial recognition or automated disciplinary decisions. A notice will be displayed at the location before camera monitoring is activated. Facility camera access is separate from the device camera used by Motion Lab.
Live facility-camera viewing is restricted to authorized Carbyne Lab super-administrators. Franchise administrators receive only operational aggregates and alerts and cannot view live streams or customer contact details. The Carbyne Lab application does not record or persist live stream URLs or facility-camera footage.
If you use the in-app messaging feature to communicate with your trainer or trainees, the content of those messages is stored in our database. Messages are only accessible to the sender and intended recipient. If you submit feedback through our contact form, we collect your name, email address, phone number (optional), and message content.
When you access the Service, we may automatically collect certain information about your device and usage, including your IP address, browser type, operating system, referring URLs, pages visited, and timestamps. This information is collected through standard web server logs and analytics tools to help us improve the Service.
We use the information we collect for the following purposes:
Your account data, workout logs, nutrition records, body metrics, messages, and trainer relationships are stored in a Supabase PostgreSQL database. Supabase provides enterprise-grade security with row-level security (RLS) policies, meaning your data is only accessible to you and users you have explicitly authorized (such as your assigned trainer). All data transmissions between your device and our servers are encrypted using TLS (Transport Layer Security).
The Service is deployed on Cloudflare Workers, which provides additional security benefits including DDoS protection, SSL/TLS encryption, and edge caching for performance.
Progress photos are kept in browser storage on the device where they were added. Clearing site data, changing browsers, or using a different device may remove access to those local copies inside the app.
While we implement industry-standard security measures to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but will promptly notify affected users in the event of a data breach as required by applicable law.
We use the following third-party services that may collect information as described in their respective privacy policies:
We use Supabase for authentication, database storage, and backend services. Supabase processes your account data and application data in accordance with their privacy policy. For more information, visit Supabase Privacy Policy.
Our application is deployed on Cloudflare Workers. Cloudflare may process certain request data (IP addresses, request headers) for security and performance purposes. For more information, visit Cloudflare Privacy Policy.
If you request AI analysis of a progress photo, the selected image may be sent to Google Gemini for processing. The analysis is used to generate an estimated fitness metric and should not be treated as medical advice or a clinical measurement. For more information, visit Google Privacy Policy.
We use Google Ads (conversion tracking ID: AW-17952919821) to measure the effectiveness of our advertising campaigns. Google may use cookies and similar technologies to collect information about your interactions with our ads and website. This data helps us understand how users find and engage with our Service. You can manage your Google ad preferences at Google Ad Settings. For more information, visit Google Privacy Policy.
We use the Meta Pixel (ID: 664571836718432) for advertising analytics and conversion tracking on Meta platforms (Facebook and Instagram). The Meta Pixel may collect information about your browsing behavior, device information, and interactions with our Service to help us measure ad effectiveness and deliver relevant advertising. You can manage your Meta ad preferences in your Facebook settings. For more information, visit Meta Privacy Policy.
We may display advertisements through Google AdSense. Google AdSense uses cookies to serve ads based on your prior visits to our website and other websites. You may opt out of personalized advertising by visiting Google Ads Settings.
At locations where facility cameras are activated, Dahua camera equipment and the Dolynk cloud platform may process device metadata and video streams. An authorized super-administrator may receive a short-lived encrypted live stream directly from Dolynk in their browser. Carbyne Lab does not expose this stream to franchise administrators and does not persist the stream URL or footage in the application database. Aggregate people counts and advisory occupancy alerts may be retained in the application database under restricted access. For more information, visit the Dahua Privacy Policy.
The Service uses cookies and similar technologies for the following purposes:
You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service, particularly authentication and session management.
If you are a trainee assigned to one or more trainers, an authorized trainer may have access to workout logs, nutrition logs, body metrics, and in-app messages exchanged within that coaching relationship. Trainers may also log workouts and nutrition data on your behalf when the applicable coaching authorization is active. Trainers do not have access to your progress photos or account credentials.
If you are a trainer, you will have access to the data described above for each of your assigned trainees. You are responsible for handling your trainees' data in accordance with applicable privacy laws and maintaining the confidentiality of their information.
Franchise administrators can view booking counts, payments, and operational statistics for locations they manage, but they cannot view gym-goer names, email addresses, phone numbers, or other customer contact details through the franchise dashboard. Any exceptional disclosure request is reviewed by Carbyne Lab and must have an appropriate purpose and legal basis.
We retain account and associated fitness data while an account is active and for only as long as it remains necessary for the purposes described in this policy, including legal, payment, security, and dispute-resolution obligations. You may request account closure and deletion by contacting us. After verifying the request, we will delete or anonymize personal data that is no longer required, subject to any applicable retention obligation.
Progress photos remain on the device where they were added and are not removed by a server-side account request. To remove those local copies, use the app's photo controls or clear the relevant browser storage on that device. Feedback submitted through our contact form is retained for customer service and product improvement purposes and may be deleted upon request.
The live-view integration does not store facility-camera recordings in the Carbyne Lab application. If recording is enabled on a camera, recorder, or provider service in the future, the applicable location notice and this policy will be updated before activation to state the purpose and retention period. When people-counting is enabled, raw count readings are retained for up to 30 days. Resolved or dismissed alerts are stripped of booking and user links, notes, and source identifiers after 90 days; the resulting anonymized summaries and related operator notifications are deleted after 365 days. Open alerts remain available for investigation until an operator resolves or dismisses them. People-counting will remain disabled at a location until its operating notice, field of view, access review, and purge operation are approved.
Depending on your location, you may have the following rights regarding your personal data:
To exercise any of these rights, please contact us at support@carbynelab.com.
The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal information, please contact us at support@carbynelab.com.
Your data may be processed and stored in locations outside your country of residence, including the United States. Our service providers (Supabase, Cloudflare, Google, Meta) operate globally and may transfer data to their facilities in various countries. By using the Service, you consent to the transfer of your information to these locations. We ensure that appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you through the Service or via email. We encourage you to review this Privacy Policy periodically.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Email: support@carbynelab.com
Website: carbynelab.com/contact