BodyTide Security Overview

Last updated: September 30, 2026

BodyTide is operated by GoodHive LLC. We treat account and consumer health data as sensitive and design the service to limit access and exposure. This overview describes current controls; it is not a security certification or warranty.

Data in transit and at rest

Traffic between BodyTide apps and service providers is encrypted in transit with TLS.
Account, health, coaching, and consent records are stored in a production Supabase PostgreSQL project with provider-managed encryption at rest.
Progress photos use a private Supabase Storage bucket rather than public URLs.
The public site and provider web application are delivered as static assets over HTTPS through Cloudflare.

Authentication and authorization

Supabase Auth handles authentication and password hashing; BodyTide does not store plain-text passwords.
Database row-level security applies to every public application table.
An individual can access their own records. A connected coach can read only the categories that individual chose to share and cannot change the individual's logged signals.
Provider access is issued through a server-side administrative capability rather than a browser-selected role.
Privileged actions such as durable account deletion run in server-side functions; privileged service keys are not shipped in the apps.

Health imports and photos

Apple Health and Health Connect imports are read-only, optional, and initiated by the individual.
Menstrual-flow permission is requested separately from general health categories.
Imported records retain their source and external identifier so repeated syncs can be deduplicated.
Progress-photo access is private by default and is separately controlled for any connected coach.

Health-data collection, optional analytics, and coach sharing are separate choices.
Coach sharing is category-specific and can be withdrawn from the app.
Consent events are recorded in an append-only, owner-scoped ledger with a server-generated timestamp and policy version.
Ending a connection removes the coach's future access immediately.

Analytics and diagnostics

Product analytics is opt-in and off by default.
Mobile events use a fixed anonymous identifier; provider events create no person profiles.
Event and property allowlists exclude measurements, notes, messages, photos, imported Health values, client identifiers, URLs containing client identifiers, and free text.
Crash reports use a closed schema containing only a support code, broad failure type and location class, and whether the failure was fatal.

Account deletion

In-app account deletion locks new writes while storage, processor, database, and authentication cleanup completes.
Completion is not reported until private stored files and live account records have been removed.
Retried work continues the same deletion request, and partial cleanup is not presented as success.

See the Privacy Policy for retention criteria and privacy choices.

Incident response

We maintain a process to investigate security and privacy incidents, contain access, preserve evidence, and provide notices required by applicable law. An unauthorized disclosure can be a reportable incident even without an external intrusion.

Reporting a security concern

Email support@bodytide.app with the subject "Security concern." Please avoid including health details, passwords, access tokens, or other sensitive content in the first message.