Privacy Policy

1. DATA WE COLLECT

Account data: email address, name, and password (stored securely by our authentication provider, Supabase). If you sign in with Apple or Google, we receive your name and email address from them. Profile data: display name, username, bio, city, division, weekly goal, club, avatar photo, and — if you choose to add them — weight, sex and year of birth. Workout data: workouts you log, including stations, times, and derived statistics (calories, load, recovery estimates), and any races you record. Photos: whiteboard photos you scan and training photos you attach. Both are stored in our cloud storage and are visible to other users as part of your feed posts. Social data: likes, comments, follows, direct messages, blocks, and reports you create. Watch data (optional): recordings from your watch that you choose to attach to a workout, including heart rate. See section 3. Device data: a notification token if you turn on push notifications, which mobile platform you use, and your device's advertising identifier (see section 4). Usage data: which screens and features you use, crash and performance reports, and, on iPhone, recordings of how you move through the app (see section 2).

2. HOW WE USE YOUR DATA

To provide the service: showing your workouts in the feed, computing statistics, powering social features and notifications. AI processing: whiteboard photos and your workout data are sent to OpenAI to read the board, summarise the session and analyse your progress. Photos are used only for extraction, not for AI training by us. Product analytics: we measure which features are used, with PostHog, so we can improve the app. Session recordings (iPhone only): for a sample of sessions, PostHog records how you move through the app, such as the screens you open and where you tap and scroll, so we can see where it is confusing or breaks. Before anything leaves your phone, every piece of text and every image is covered with a solid block, so a recording never shows your name, messages, numbers, photos or whiteboards. Screens with watch and health data, messages and your account details are hidden entirely. Nothing outside HY AI is recorded, and there is no sound. Recordings are linked to your account, kept for 30 days, and never used for advertising or shared with Meta. Watch data: if you choose to connect a watch, we use its recordings to complete the workouts you pick. See section 3. Stability: crash and error reports go to Sentry.

3. WATCH AND HEALTH DATA (APPLE HEALTH, HEALTH CONNECT, COROS, .FIT FILES)

Connecting a watch is optional. You can use HY AI without it.

• What we read: only after you connect Apple Health (iOS) or Health Connect (Android) and pick a recording to attach to one of your saved workouts, we read that recording's start and end time, duration, distance, laps, heart rate during it, and active calories. We do not read any other health data, we never write to Apple Health or Health Connect, and we never read in the background.
• .fit files: if you share a workout file exported from your watch app (for example COROS or Garmin), we read the same information from it and keep the original file in private storage linked to your account.
• COROS: if you connect your COROS account in the app, you sign in on COROS's own page; we never see your COROS password. COROS gives us an access token, which we keep encrypted on our servers and never send to your phone. About every 20 minutes we ask COROS for your new activities and download their activity files (.fit), which hold the same information as above plus the activity type and watch model. We keep each file in private storage linked to your account. Nothing is added to a workout until you pick the recording yourself, and a recording you never attach is deleted after 30 days.
• How we use it: to fill in your workout's real times, splits, distance and calories, and to show your heart-rate graph, heart-rate zones and heart rate per station. Your heart rate and zones are shown only to you, never to other users. Times, distance and calories from Apple Health, Health Connect or a .fit file from another brand become part of the workout you post, just as if you had typed them. Those from COROS (synced or a COROS .fit file) are shown only to you: everyone else sees the workout as you logged it.
• Where it is stored: with your workout on our servers (Supabase, European Union), protected so that only your account can read the heart-rate data.
• What we never do with it: we never sell it, use it for advertising or marketing, share it with Meta or any advertising partner, send your heart-rate data to OpenAI, or use it to train AI models. Analytics events only record that an import happened, never a health value. Times and calories that became part of a workout are included when the AI features in section 2 read that workout.
• Deleting it: "Remove watch data" on a workout deletes it and restores what you logged; "Disconnect" in Settings stops all reading; when you disconnect COROS, or COROS ends our access, we delete our tokens and all data we received from COROS within 24 hours: every synced recording and its file, and the heart rate, laps, times and calories it added to your workouts, which go back to what you logged; deleting your account deletes all of it. You can also revoke access at any time in the Health app (iOS) or Health Connect (Android).
• HY AI's use of information received from Health Connect adheres to the Health Connect Permissions policy, including its Limited Use requirements. Data from Apple Health is used only to provide the features above and is never used for advertising or sold.

4. ADVERTISING

We advertise HY AI on Instagram and Facebook. The app includes Meta's SDK, which reports installs and app launches to Meta along with your device's advertising identifier, so we can see which ads actually bring people to HY AI. We do not show ads inside the app, and we do not sell your data.

• On iOS, this is only linked to you if you allow tracking when asked. If you decline, Meta receives aggregate, delayed measurements only.
• On Android, you can reset or delete your advertising ID in your device settings under Privacy → Ads.

5. WHO WE SHARE DATA WITH

• Supabase — database, file storage and authentication, on our behalf.
• OpenAI — whiteboard photos and workout data, for the AI features in section 2. Heart-rate data is never sent to OpenAI (see section 3).
• Meta — install and launch events plus your advertising identifier, for the advertising measurement in section 4.
• COROS — only if you connect your COROS account: we receive your activities from COROS (section 3). We send COROS nothing about you beyond the sign-in and our requests for your activities.
• PostHog and Sentry — usage data, session recordings (section 2), crash and performance data, on our behalf.
• Other users: your profile, workouts, photos and social activity are visible inside the app. Your public profile page at hyrox-ai.me/p/your-username, and photos in feed posts, can be opened by anyone with the link.

6. WHERE YOUR DATA LIVES

Your account, workouts and photos are stored with Supabase in the European Union, and crash reports with Sentry in the European Union. Product analytics are hosted by PostHog in the United States, and OpenAI and Meta (section 5) also process data in the United States.

7. YOUR RIGHTS

• Access and edit your profile data in the app at any time.
• Delete individual workouts, comments, and photos.
• Delete your account from Settings → Delete Account: this permanently removes your profile, workouts, photos, comments, messages and social data.
• If you no longer have the app installed, you can request deletion at hyrox-ai.me/delete-account.
• You can also ask us for a copy of your data, or to correct or delete it, by emailing support@hyrox-ai.me.

8. DATA RETENTION

Data is kept while your account is active. Session recordings are deleted after 30 days. Deleting your account removes your data from our systems; short-lived copies may persist in backups and provider logs until those expire.

9. CHILDREN

HY AI is not directed at children under 13 (or the minimum age in your country). Do not use the service if you are under that age.

10. CHANGES

We may update this policy and will reflect the date above.

11. CONTACT

Privacy questions? Contact us at support@hyrox-ai.me.