This Privacy Policy explains how Hevra Labs ("Hevra", "we", "us") processes personal data when you use the Hevra mobile apps, related websites, and coach tools (together, the "Services").
1. Who we are
The data controller for the Services is Hevra Labs, the operator of the Hevra product brand. If you need our registered legal-entity name, address, or other formal controller details for a regulatory request, email privacy@hevra.fitness and we will provide them.
Privacy contact: privacy@hevra.fitness.
2. Data we collect
- Account data — email address, display name, and sign-in identifiers from your auth provider (for example Google).
- Workout & fitness data — exercises, sets, sessions, programs, personal records, body measurements, recovery inputs, and related training history you create in the app.
- Health platform data (optional) — only if you connect Apple Health (HealthKit) or Android Health Connect. We request:
- Write: workout sessions and active energy burned, so completed Hevra workouts can appear in your health app.
- Read: body weight (to prefill or sync your profile weight) and heart rate (to show live BPM / session averages during a workout).
- Coach sharing (optional) — when you connect a trainer, they can see the training data described in section 5. Recovery check-ins are shared only if you turn on recovery sharing for that trainer.
- AI chat content — messages and related context you send to Hevra AI features (see section 4).
- Social profile and posts (optional) — only if you set up a social profile: your username, name, bio and profile photo, whether your account is private and whether people can find you in search, who you follow and who follows you, the posts you share (photos, caption, and the workout summary you attach), 24-hour stories, likes, comments, story views, blocks, reports, and posts you mark “Not interested” (see section 5a).
- Purchase / subscription status — App Store or Google Play entitlements needed to unlock Elite features (we do not store full payment card numbers).
- Device & diagnostics — crash and performance data (for example via Sentry) to keep the Services reliable. Session replay is not enabled.
3. Why we process data (legal bases)
We process personal data to:
- Provide the Services you request (contract / performance of a contract).
- Secure accounts, prevent abuse, and meet legal obligations (legitimate interests / legal obligation).
- Process optional health-platform access and coach sharing only with your consent. How to withdraw consent is explained in section 9.
4. AI features
When you use Hevra AI (for example AI Coach chat or related fitness assistance), your messages and the minimum workout/profile context needed to answer are sent to our AI providers — currently OpenAI and Anthropic (Claude) — so the model can generate a response. That processing is for providing the AI feature you requested, not for selling your data. Do not include information you do not want an AI processor to handle. Hevra AI asks before anything is first sent to them, and you can turn it off any time in Profile → Settings → Hevra AI → Share with AI providers. While it is off, nothing is sent to OpenAI or Anthropic and your weekly report is written without AI. Existing chat history remains in your account until you delete it or delete your account.
If a Hevra AI reply seems offensive, harmful or wrong, tap ••• next to it and choose Report. The reply and the reason you pick are sent to the Hevra team for review.
5. Coach sharing — what a coach receives
If you accept a trainer connection, that trainer (and, where you separately consent, a gym/group they invite you into) may access:
- Your profile basics used for coaching (display name, avatar, training goal, experience level, days/week, session length, unit system).
- Recent workout sessions (typically about the last 90 days), including exercises, sets, weights, reps, effort, notes, duration, and session heart-rate summaries when available.
- Recent personal records.
- Assigned programs/workouts, messages, and media exchanged in the coaching relationship.
- Recovery check-ins (sleep quality, soreness, illness flag, and recovery notes) only if you enable “share recovery” for that trainer in Profile → Your trainers.
Coaches do not receive your full Apple Health / Health Connect history, payment details, or unrelated account credentials. Ending the trainer relationship immediately stops further access to your training data.
5a. Social features — who sees what
Social features are optional. Nothing you log is posted unless you choose to share it.
- Your profile — your username, name, bio, profile photo and follower counts can be seen by anyone signed in to Hevra, except people you block. With Who can find you set to No one, you do not appear in search, but people with a link to your profile can still open it.
- Posts — each post has an audience. Everyone on a public account means anyone signed in to Hevra can see it, and it may appear in the For you feed. Followers means only your followers; with a private account, only followers you approve. Only me keeps it to you. A post shows the workout summary you attach (for example exercises, sets, volume, duration and records), not your full history or health data.
- Stories — can be seen by anyone signed in to Hevra if your account is public, or only by followers you approve if it is private, and disappear 24 hours after they go live. You can see who viewed your story.
- Likes, comments and follows — are visible to the people who can see the post or profile, and the person you like, comment on or follow gets a notification.
- Safety checks — before a photo, caption or comment is shown to others, it is checked automatically for nudity, violence, hate, self-harm and similar content. Photos are checked by OpenAI (moderation) and Amazon Rekognition; text is checked by OpenAI. Anything flagged is held and reviewed by the Hevra team, as are posts people report. The person you report is not told who reported them.
6. Sharing with processors & third parties
We do not sell your personal data. We use service providers (“processors”) to run the Services, including categories such as:
- Hosting & database / auth — e.g. Supabase and cloud infrastructure (AWS) to store account data and operate APIs.
- Authentication — sign-in providers you choose (e.g. Google) and Supabase Auth.
- AI processing — OpenAI and Anthropic, to generate AI Coach responses and weekly reports from your prompts/context, once you allow it.
- Content safety checks — OpenAI moderation and Amazon Rekognition, to check photos and text you post before others see them.
- Crash / error monitoring — e.g. Sentry.
- Push notifications — Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) for delivery.
- Email delivery — e.g. Amazon SES for transactional mail such as invites.
- App stores — Apple App Store and Google Play for distribution and subscriptions.
Trainers only see data as described in section 5 after you connect (and, for recovery, after you opt in).
7. International transfers
Your data may be processed in countries outside your own (including where our processors operate). Where required, we rely on appropriate safeguards such as standard contractual clauses with our providers.
8. Retention
- Account, workouts, PRs, measurements, recovery, and AI chat history — kept while your account is active.
- After account deletion — we erase or anonymize personal data from active systems within 30 days. Backups may retain residual copies for up to 90 days before automatic expiry.
- Posts, comments and profile photos — kept until you delete them or your account; deleted photos are removed from storage shortly after. Stories are removed about 24 hours after they go live.
- Automatic safety-check records — about 30 days after the check. Reports — typically up to 12 months, longer only where needed for a legal claim.
- Coach relationship records — ended when you remove a trainer or delete your account; related media is revoked/removed as part of that process.
- Subscription / purchase records — limited store receipts or entitlement logs may be retained longer where required for accounting, tax, fraud prevention, or legal disputes (typically up to 7 years where applicable law requires).
- Security / abuse logs — typically up to 12 months.
9. Withdrawing consent
Where processing is based on consent, you can withdraw it without affecting other Services:
- HealthKit / Health Connect — Profile → Connections → disconnect Apple Health / Health Connect (you can also revoke access in iOS/Android system settings).
- Recovery sharing with a coach — Profile → Your trainers → turn off recovery sharing for that trainer.
- Coach access overall — Profile → Your trainers → remove the trainer (ends the relationship and their access).
- AI features — Profile → Settings → Hevra AI → turn off Share with AI providers; optionally delete chats in-app or delete your account.
- Social features — make your account private or set Who can find you to No one in Profile → Settings → Privacy, delete posts, or delete your account.
10. Security
We use industry-standard measures appropriate to the sensitivity of the data, including TLS encryption in transit, access-controlled cloud hosting, authenticated API access, and least-privilege service credentials. No method of transmission or storage is 100% secure; please use a strong sign-in method and keep your device updated.
11. Your rights (including GDPR)
Depending on where you live, you may have the right to:
- Access and receive a copy of your data — use Profile → Account → Export my data in the app for a JSON export, or email privacy@hevra.fitness.
- Correct inaccurate data (edit profile/settings in the app, or contact us).
- Delete your account and associated personal data (see section 12).
- Object to or restrict certain processing.
- Withdraw consent where processing is consent-based (section 9).
- Lodge a complaint with your local supervisory authority.
12. Account deletion
You can delete your account:
- In the app: Profile → Account → Delete account (requires an internet connection; permanently erases cloud account data and clears local app data).
- On the web: follow the instructions at Delete account, or email privacy@hevra.fitness from your account email with the subject “Delete my Hevra account”.
We complete deletion from active systems within 30 days (see retention above). Cancel any App Store / Google Play subscription separately in store settings — deleting Hevra does not cancel store billing.
13. Children
The Services are not directed to anyone under 18. Do not create an account if you are under 18.
14. Changes
We may update this policy. Material changes will be reflected by the "Last updated" date on this page.
15. Contact
Privacy questions: privacy@hevra.fitness.
Support: support@hevra.fitness.