Privacy Policy

Data we collect

We collect only what the service needs to work:

• Account data — your email address, display name, password (stored as a salted hash, never in plain text), and preferred language.
• Profile and goal data — details you choose to enter such as weight, height, target goal, and onboarding answers.
• Fitness and nutrition data — your workouts, sets, exercise notes, food entries, measurements, and progress analytics derived from them.
• Progress photos — photos you upload are stored privately and are visible only to you and anyone you explicitly share them with (such as a coach you invite).
• Wearable data — if you connect a supported wearable (e.g. Garmin), the activity metrics you authorize it to share.
• Payment data — subscriptions are processed by Stripe. We never see or store your card number; we keep only the subscription status, plan, and billing references Stripe returns.
• Referral and coaching data — referral links you create or use, commission records, and coach–member relationships you enter into.
• Technical data — timezone, device timestamps used for offline sync, and server logs kept for security and troubleshooting.

How we use your data

We use your data to run the service: syncing your workouts and meals across devices, computing your progress analytics, generating your workout summaries, sending the emails the service requires (verification, password reset, invitations), processing subscription payments, operating the referral and coaching programs, and preventing abuse.

We do not sell your personal data, and we do not use it for third-party advertising.

AI-generated summaries

Some features (such as the workout day report) generate text summaries of your training data using a third-party AI provider. The content sent for processing is the training data needed for the summary; it is not used by us to train AI models.

Who we share data with

We share data only with the processors needed to operate the service:

• Stripe — payment and subscription processing.
• Our email delivery provider — transactional emails such as verification and password reset.
• Our hosting provider — the servers and database that run the service (hosted in the European Union).
• Our AI provider — generation of the optional training summaries described above.

Cookies

We use essential cookies only: a session/refresh cookie that keeps you signed in, and a language cookie that remembers your locale. We do not use advertising or cross-site tracking cookies.

Retention and deletion

Your data is kept for as long as your account exists. You can delete your account from Settings; deletion is scheduled with a short grace period during which you can cancel it, after which your personal data is removed from the live systems and expires from backups on their rotation schedule.

Your rights

You can access and correct your data in the app, export your data from Settings, and delete your account at any time. For any other request about your personal data — including access, correction, or erasure requests — contact us at info@himah.app and we will respond as required by applicable law.

Children

The service is not directed at children under 16, and we do not knowingly collect their data.

Changes to this policy

If we make material changes to this policy we will update this page and the date above, and where appropriate notify you in the app or by email.

Contact

Himah — info@himah.app