Privacy Policy

Last Updated: September 21, 2026

1. Introduction

Flagship Digital LLC ("Company," "we," "us," or "our") operates the Lexi AI nutrition and performance coaching platform. This Privacy Policy covers both the Lexi mobile app and our website at meetlexi.ai, and describes how we collect, use, disclose, and protect personal information when you use either. Where a practice applies to only one of the two, we say so. We designed Lexi with privacy and security as foundational concerns.

2. Quick Summary

• We do NOT sell your personal information.
• We do NOT use your data for targeted advertising.
• We do NOT use your personal data to train third-party AI models.
• We do NOT share your data with advertisers or data brokers.

Your rights: Access, correct, delete, or export your data at any time by emailing privacy@meetlexi.ai. We respond within 30 days.

3. Information We Collect

Information you provide: Name, email, password (stored as a salted hash — never plain text), date of birth, sex, height, weight, goals, body composition data, food logs, chat messages with Lexi, journal entries, mood check-ins, coaching preferences, and progress photos (with separate biometric consent).

Voice input: Audio is transmitted to Deepgram (live conversation) or OpenAI Whisper (recorded messages) for transcription. The audio bytes are transient — they are not stored by Lexi at any point. Only the resulting text transcript is retained.

Message understanding: The text of your messages is sent to OpenAI to generate embeddings — numerical representations that let Lexi recall relevant past conversations. Only text is sent: your messages and, for memory, a short summary of your stated profile (such as height, weight and macro targets). No audio, photos or HealthKit data.

Automatically collected: Device type, OS version, app version, session tokens (server-side revocable), IP address (for security and error diagnosis; not linked to your health data), and crash and error reports (sent to Sentry — see Section 6).

Website (meetlexi.ai): If you apply for the beta, we collect your email address, optionally which phone platform you use (iPhone or Android), your confirmation that you are 18 or older, and optionally your consent to receive launch emails. Our hosting provider also keeps standard server logs — IP address, browser, and pages requested — which we use to keep the site secure and running. We do not use analytics or advertising trackers on the site.

Third-party sources: If you grant permission, Lexi may read health data from Apple HealthKit (such as step count, active energy, or workout data). This data remains on your device. We do not share HealthKit data with third parties or use it for advertising. You can revoke this permission at any time in your iOS Settings.

4. How We Use Your Information

• Deliver personalized coaching conversations with Lexi.
• Calculate macro targets, body composition metrics, and hydration goals.
• Generate Lexi's voice responses via ElevenLabs text-to-speech.
• Transcribe your recorded voice messages via OpenAI Whisper.
• Transcribe live voice conversations via Deepgram.
• Generate message embeddings via OpenAI so Lexi can remember relevant context.
• Store and display your progress photos (encrypted, via Cloudflare R2).
• Send transactional emails: account confirmation, password reset, onboarding nudges, and subscription receipts.
• Send launch emails about the Lexi app only to people who asked for them. If you did not opt in when you applied for the beta, we do not send them. Every launch email includes an unsubscribe link, and unsubscribing stops them immediately.
• Detect crisis language and provide appropriate professional referrals.
• Comply with applicable laws and enforce our Terms of Service.

5. Legal Bases for Processing

We include this section for GDPR forward-compatibility, though Lexi is currently operated from the United States and primarily serves U.S. users.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

6. Sub-Processors and Third-Party Service Providers

We share personal information with the following providers solely to deliver the Services:

• Anthropic (Claude API) — AI coaching conversation generation. Conversations are not used to train Anthropic models.
• OpenAI — Whisper voice-to-text for recorded messages, and text embeddings for conversation memory. Audio and text transmitted under TLS; not used to train OpenAI models.
• Deepgram — Live voice transcription for real-time conversation. Audio transmitted under TLS; not retained by Deepgram beyond processing the request and not used to train Deepgram models.
• ElevenLabs — AI voice synthesis. Only response text is sent; no user health data.
• Railway — Backend hosting and PostgreSQL database.
• Vercel — Website hosting and request logs. Website only; the Lexi app does not use Vercel.
• Neon — Database for beta applications submitted through the website. Website only; the Lexi app does not use Neon.
• Cloudflare R2 — Progress photo storage. AES-256 encrypted at rest; presigned URL access only.
• SendGrid (Twilio) — Transactional email delivery.
• Sentry — Crash and error reporting so we can fix defects. Receives error details, stack traces, device and app version, and technical request context. We configure Sentry not to receive message content, health data or credentials, and we do not use it to identify you. Sentry data is not used to train any model.

Payment processing will be handled via Apple In-App Purchase (iOS) and Stripe (web) when billing is enabled. No payment data is currently collected.

7. How Long We Keep Your Data

• Active account data: retained for the duration of your account.
• Deleted account: soft-deleted immediately; hard-deleted within 30 days.
• Inactive account (no login ≥ 24 months): email notification sent; hard-deleted 30 days after if no response.
• Voice audio: NOT retained — transient only, discarded after transcription.
• Progress photos: retained while account is active; individually deletable.
• Beta applications submitted on meetlexi.ai: 180 days from the date of application, or sooner if you ask us to delete it.
• Website server logs (IP address, browser, pages requested): retained for 1 day.
• Audit and security logs: retained for 1 year.
• AI usage records (which services were used, token and character counts, computed cost — never message content): detailed records for 90 days, then monthly aggregates. Aggregates for deleted accounts are anonymised.

8. How We Protect Your Data

• All data in transit: TLS 1.2 or higher.
• Database at rest: encrypted by Railway.
• Progress photos: AES-256 at rest via Cloudflare R2.
• Authentication: short-lived JWT sessions, server-side revocable.
• Rate limiting on all authenticated endpoints.
• Parameterized queries only — no raw SQL string concatenation.
• Affected users notified within 72 hours of a confirmed breach.

9. Your Privacy Rights

Regardless of where you live, you may exercise the following rights by emailing privacy@meetlexi.ai:

• Access: request a copy of the personal information we hold about you.
• Correction: request correction of inaccurate data.
• Deletion: request deletion of your account and associated personal data.
• Portability: request an export of your data in a machine-readable format.
• Opt-Out of Communications: unsubscribe from non-essential communications at any time.
• Consent Withdrawal: withdraw consent for features that require it (photos, voice, HealthKit) at any time in Settings.
• Complaint: lodge a complaint with a data protection authority or state regulator.

We will acknowledge your request within 5 business days and respond fully within 30 days.

10. State-Specific Privacy Rights

California (CCPA/CPRA): You have the right to know, delete, correct, and opt out of the sale of personal information (we do not sell). Contact: privacy@meetlexi.ai.

Washington (My Health My Data Act): You have the right to confirm, access, delete, and withdraw consent for consumer health data collection. We do not sell consumer health data.

Illinois (BIPA): We obtain separate written consent before collecting biometric information. Illinois residents may sue for statutory damages for BIPA violations ($1,000 per negligent violation or $5,000 per intentional violation).

Connecticut, Colorado, Virginia, Utah: You have rights to access, correct, delete, and port personal data, and to opt out of targeted advertising (we do not engage in it) and the sale of personal data (we do not sell).

Texas (CUBI): Texas residents have rights under the Texas Capture or Use of Biometric Identifier Act (CUBI) related to biometric data.

11. International Users

Lexi is operated from the United States. If you access the Services from outside the United States, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

If you are located in the European Economic Area (EEA) or United Kingdom, you have rights under the GDPR or UK GDPR, including access, rectification, erasure, restriction, objection, portability, and the right not to be subject to automated decision-making. For data transfers from the EEA or UK to the United States, we rely on Standard Contractual Clauses or other lawful transfer mechanisms.

12. Children's Privacy

Lexi is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If you believe we have collected information from a minor, please contact us at privacy@meetlexi.ai.

13. Changes to This Policy

For material changes, we will send an email notification to your registered address at least 30 days before the changes take effect and display an in-app notice on your next login. Your continued use after the effective date constitutes your acceptance of the changes.

14. Contact Us

Flagship Digital LLC

7901 4th St N STE 300, St. Petersburg, FL 33702

Email: privacy@meetlexi.ai