Privacy policy

This Privacy Policy ("Policy") describes how MaxDex Services ("Company", "we", "us", "our"), based in Melbourne, Victoria, Australia, collects, uses, stores, and protects personal information when you use the MaxDex mobile application (the "App"). We operate as the Data Controller in respect of personal data collected through the App.

This Policy is designed to comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the General Data Protection Regulation (GDPR) (for users located in the European Economic Area), and the California Consumer Privacy Act (CCPA) (for California residents). By using the App, you consent to the data practices described in this Policy.

Our Data Protection contact: maxdexaiservices@gmail.com

A. Account Information (Stored in Firebase Cloud)

When you create an account, we collect your email address, a unique User ID (UID) generated by Firebase Authentication, your chosen display name, account creation timestamp, and subscription / entitlement status. This information is necessary to authenticate you, restore your account across devices, and enforce usage limits.

B. Health & Wellness Data (On-Device Records + Cloud Personalisation Summary)

The App collects health metrics using on-device sensors, Apple Health on iPhone (where you grant permission), and manual entry: step count and activity; sleep duration and quality estimates; manually logged workouts; meal and calorie logs after AI analysis; and weight you choose to log. On Android these metrics come from your phone’s own motion sensor and on-device sleep detection; the App does not read or write Android Health Connect.

Detailed history stays on your device. Your full day-by-day logs remain in local app storage.

Why we share a summary with cloud processors: Scheduled voice calls (Morning Briefing / Evening Debrief), in-app AI chat, roadmaps, and meal analysis need context about you. The App syncs a replaceable personalisation snapshot (current vitals summary, active goals, today's planner/tasks, and related profile targets) to a private Firestore document under your account. That snapshot is overwritten as your data updates. It is never sold, rented, or used for advertising, and is disclosed only to the processors in Section 5.

C. Goal, Task & Planner Data (On-Device Records + Cloud Personalisation Summary)

Goals, daily tasks, planner schedules, chat history, and AI roadmap data are stored primarily in local application storage. A summary of active goals, tasks, and planner blocks is included in the Firestore personalisation snapshot so Max can personalise coaching and scheduled calls. Full chat transcripts are not uploaded as a permanent archive.

D. Generative AI Data Processing (Gemini / Vertex AI — Request-Scoped)

When you use AI features — including Chat, Morning Briefing, Evening Debrief, Goal Chat, Roadmap generation, Meal Logging, and live voice calls — the relevant input for that request (text, voice audio stream, meal photo, and/or personalisation context) is transmitted to Google Gemini / Vertex AI via Firebase Cloud Functions for real-time processing.

Retention of AI request content: MaxDex Services does not permanently store raw voice audio, full chat turn logs, or meal photos from those AI exchanges in a MaxDex-controlled database. They are processed to generate a response for that session and are subject only to Google's short-lived session / operational retention for the model APIs we use. Such processing is governed by Google's Enterprise / Cloud Data Processing terms and is prohibited from being used to train Google's foundational AI models under those terms.

Reporting Content: Users may report AI-generated content that is offensive, harmful, or inaccurate via the Help Center in the App or by emailing maxdexaiservices@gmail.com.

E. Usage & Analytics Data

We use Firebase Analytics and Crashlytics to collect pseudonymised event data (feature interactions, session duration) and crash reports. Advertising ID (ADID / IDFA) collection is disabled. This data is used solely to understand feature usage and improve App stability.

F. Website Waitlist / Marketing Forms (Stored in Firebase Cloud)

If you join a waitlist or submit a form on this website, we collect your email address and submission date. This is stored in Firebase Firestore and used solely to respond to your request. You may request removal at any time by contacting maxdexaiservices@gmail.com.

We use the information we collect for the following purposes:

(a) To create and manage your account and verify your identity; (b) To provide personalised AI coaching, goal strategy, health insights, scheduled briefings/debriefs, and meal analysis; (c) To sync a personalisation snapshot to Firebase so scheduled calls and cloud AI features have the context they need; (d) To process individual AI requests by transmitting request-scoped data to Google Gemini / Vertex AI; (e) To improve App performance and diagnose crashes through analytics; (f) To communicate critical security or service notices; (g) To comply with legal obligations.

We do not use your personal information for marketing to third parties, profiling for advertising, or any purpose beyond those listed above.

For users located in the European Economic Area, we rely on the following legal bases for processing personal data:

(a) Performance of a Contract: Processing your account information is necessary to provide the Service you have contracted us to deliver; (b) Consent: For processing audio data during AI voice calls and sensor data for health tracking, we rely on your explicit consent, which you provide at the point of granting the relevant device permissions; (c) Legitimate Interests: For Firebase Analytics data collection, we rely on our legitimate interest in understanding App usage to improve the Service, balanced against your privacy rights; (d) Legal Obligation: Where required by applicable law.

We engage the following third-party service providers who act as Data Processors under our instruction. Sharing with them is limited to what is required to operate the Service:

(a) Google LLC (Firebase Authentication & Firestore): Stores account identity and the private personalisation snapshot (Sections 2B–2C) so authentication, entitlements, and scheduled AI calls can function. Governed by Google's Cloud Data Processing Addendum.

(b) Google LLC (Firebase Cloud Functions): Hosts backend logic that routes AI requests. Request payloads are not kept as a permanent MaxDex archive in Cloud Functions.

(c) Google LLC (Gemini / Vertex AI): Processes request-scoped text, audio, images, and context to generate coaching responses and analyse meals. Subject to Google's Enterprise / Cloud privacy terms prohibiting use of your data to train foundational models.

(d) Google LLC (Firebase Analytics & Crashlytics): Processes pseudonymised usage events and crash reports. ADID / IDFA collection is disabled.

(e) Apple Inc. / Google Play / Stripe (as applicable): Process purchases and subscription status through their billing systems.

We do not sell, rent, or trade personal data. We do not share personal information with other third parties except as required by law or as described above.

Cloud Account Data: Firebase Authentication records (email, UID, display name) and subscription metadata are retained while your account remains active. Upon account deletion, this data is permanently removed from Firebase within 30 days, subject to any applicable legal retention requirements.

Personalisation Snapshot (Firestore): The replaceable snapshot under your account is retained while your account is active so scheduled calls and AI features can work. It is continuously overwritten with newer summaries and is permanently deleted with your account within 30 days of deletion. It is not an indefinite archive of raw Health samples or chat history.

Local Device Data: Detailed health metrics, goals, planner data, and chat history on your device are retained until you uninstall the App, clear App data, or exercise your right to erasure.

AI Request Content (Gemini / Vertex AI): Voice audio, chat turns, and meal photos sent for a specific AI request are processed for that session. MaxDex Services does not permanently retain those raw payloads in a MaxDex-controlled database. Any short-lived operational retention by Google is governed by Google's API / Cloud terms.

Analytics Data: Firebase Analytics event data is retained by Google for up to 14 months under standard retention settings.

MaxDex Services is based in Victoria, Australia. Google's infrastructure — including Firebase, Cloud Functions, and Gemini / Vertex AI — operates across multiple regions, including the United States. When AI features or cloud sync are used, data may be transferred to and processed in these jurisdictions under Google's Standard Contractual Clauses and related safeguards.

Subject to applicable law, you have the following rights regarding your personal data:

(a) Right of Access: You may request a copy of the personal data we hold about you; (b) Right to Rectification: You may request correction of inaccurate personal data; (c) Right to Erasure: You may request deletion of your account and associated cloud data via Settings > Profile > Delete Account, or by contacting us directly; (d) Right to Restriction: You may request that we restrict processing of your data in certain circumstances; (e) Right to Data Portability: Where technically feasible, you may request a copy of your data in a portable format; (f) Right to Object: You may object to processing based on legitimate interests; (g) Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at maxdexaiservices@gmail.com. We will respond within 30 days. Australian users may also lodge complaints with the Office of the Australian Information Commissioner (OAIC). EEA users may lodge complaints with their relevant national Data Protection Authority.

We implement industry-standard technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. Account data stored in Firebase is protected by Firebase Authentication access controls and HTTPS encryption in transit. Firebase Firestore security rules restrict access to authenticated users viewing only their own data.

While we take reasonable precautions to secure your data, no method of electronic storage or transmission over the internet is 100% secure. We cannot guarantee the absolute security of your data and are not responsible for security breaches that are outside our reasonable control, including breaches occurring within Google's infrastructure.

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal data from a child under 13 without parental consent, we will take immediate steps to delete such information. If you believe we have collected information from a child under 13, please contact us at maxdexaiservices@gmail.com.

We reserve the right to update or amend this Privacy Policy at any time to reflect changes in our practices, applicable law, or the features of the App. The date of the most recent revision is indicated at the top of this Policy. Where changes are material, we will endeavour to provide prominent notice within the App or via email. Your continued use of the App following notice of amendments constitutes your acceptance of the updated Policy.

For all privacy-related enquiries, data subject access requests, or complaints, please contact MaxDex Services at: maxdexaiservices@gmail.com. We aim to respond to all enquiries within 30 calendar days.