Privacy and data

What we store

When you sign in, your plan, lifts, cardio entries (including treadmill time, distance, and incline), appearance choice, meals, reminders, notes, household names, and weekly scale check-ins (weight, date, and a clothes-fit reading — not the photos) are saved to your account so another phone can open the same log. A copy also stays in this browser so the app still works if the network drops.

Sign-in uses Clerk. Depending on the options enabled there, you may use email, a passkey, or a connected identity provider. Clerk supplies the account identifier, name, email, and profile photo used to find your log.

The People switcher is extra lockers under your account for a shared phone. It is not a second login. Someone who wants their own log on their own phone should create their own account. Sharing this week's kitchen (copy, share sheet, or email) sends dish names and cook notes — not lifts, weight, or photos. The cook's page is a public link to that kitchen template. It is not their account.

In-progress cardio timers stay in this browser. They store a start timestamp, elapsed time, and pause state so a reload can recover the timer. Completed minutes are saved with your workout; an unfinished timer does not follow you to another device.

Third parties and what we do not collect

Hosting is Vercel. The account locker is Postgres (Supabase). Hosting and the database still see normal operational logs. HEFT sends a small set of product events to PostHog so we can see whether onboarding, workouts, and the rest timer are understandable. Those events use a one-way account identifier; IP and geolocation are disabled, and HEFT never sends exercises, weights, meals, photos, notes, or contact details. There is no advertising identifier, session replay, or AI training on your log. Gym-prep alerts use the browser’s own notification permission. If you allow device alerts, a Web Push subscription is stored for each registered device so reminders can reach you even when the app is closed. If you opt into SMS, the number and reminder choice are stored in your locker and sent through OneSignal and carrier infrastructure. Reply STOP to opt out or HELP for help.

A separate iPhone reminder app is being built. If installed, it keeps its weekly schedule on that iPhone and asks you to save an imported HEFT time before scheduling local alarms on iOS 26, or local notifications on older iPhones. It has no account sync yet and is not distributed through HEFT today.

Weekly progress photos stay on this phone unless you tap Read this week. Then they are sent once to xAI so Grok can comment on clothing fit. They are not saved to your locker. Kit-scan photos or a still from a short clip work the same way: sent once, not stored. A recording is reduced to one still on this phone first. The kit scanner only describes gym equipment — it will not identify anything else in the frame.

Creator content and your choices

Creator pages, program and recipe drafts, published versions, training schedules, enrollments, saved/cooked recipe flags and creator recipe portions are separate account records. Published descriptions and the creator's selected portrait can be shown publicly. A portrait uses a verified creator-owned photo and a short-lived link; it is not the creator's private account photo. Your enrolled program stays on its saved version until you explicitly accept an available update. Acceptance changes future program sessions, not completed workouts. Free follows are separate from financial referrals. Dated recipe plans, selected servings, ingredient snapshots, scaled shopping quantities/checkmarks, cooking steps and optional timer end times are private account records. Food creators cannot read that individual planning or cooking history. A saved cook timer restores a countdown; it does not schedule a background alarm. Own saved recipe snapshots and existing cooking/shopping state remain accessible after expiry or blocking; new paid recipe saves and cooking starts need current access.

Completion sharing starts off. If you enable it, that instructor can see completed workouts linked to their program, your member identifier/display name, dates and completed set counts. Weights and repetitions need a separate sharing choice. Private notes, body photos and unrelated workouts are excluded. Turning sharing off or blocking the creator stops subsequent progress reads; it cannot recall copies already received. Food creators see aggregate saved/cooked counts for their recipes, not your private meal history.

When creator uploads are enabled, original exercise videos, food photos and optional cooking videos go to configured private S3 storage, with metadata, descriptions and captions in Postgres. They are separate from the optional xAI scans. Playback uses short-lived signed links; an issued link may work for its remaining two-minute lifetime. Erase my log does not delete creator media. The separate creator-data erasure control revokes new playback links and queues deletion of storage versions, described below.

Membership and billing data

Billing is available only when configured. Stripe handles hosted payment and billing management information. HEFT stores account/customer/subscription and checkout references, acquisition/referral rules, paid periods, currency amounts and refund/dispute references, not full card details. The webhook inbox stores provider pointers and processing status, not full payment/contact payloads. Direct subscriptions have no creator allocation; following, cooking, enrolling or sharing progress does not create one. A later link cannot reassign an existing bound or paid subscription.

Creator payment setup uses Stripe Connect when enabled for an approved country. Stripe collects identity, tax and bank information through its own onboarding and account tools. HEFT keeps the creator's contact email, display name, country, provider account reference, verification/capability state and transfer records on the server. This information is separate from member progress sharing. Transfer release depends on configured country support, verification, available funds and a release/reserve policy. A transfer to a Stripe recipient balance is not proof of payment to a bank. Paid launch and real-provider checks remain on hold; a created payment product or account does not enable charging.

Training and food are not medical advice

Programs, films, recovery bars, stay-steady sessions, weekly check-ins, and meal plates are training companions. They are not diagnosis, treatment, a detox, or a substitute for a doctor, dietitian, or qualified coach. Photos do not measure body fat. Stop and get help if a lift hurts or a meal plan does not fit your health needs.

HEFT does not know what weight you can safely lift. It leaves a first-time loaded exercise blank until you enter the load you chose. Later suggestions use the sets you actually log and remain editable.

HEFT does not receive data from Apple Health, Health Connect or the ChatGPT Health connector. FoodData Central values are bundled reference data; HEFT does not send your meals or profile to USDA. Opening a nutrition source link visits USDA directly.

Your rights and delete

Account offers separate controls for your training log and creator/kitchen data. Download JSON exports your training profile, sessions, check-ins and notes. Download creator data exports your own creator content, kitchen history, sharing choices, submitted reports and billing/recipient/transfer records, excluding other members' private records and storage credentials. Erase my log removes the training locker and server-side push registrations; it does not cancel a subscription.

Creator-data erasure requires the typed confirmation ERASE CREATOR DATA. It permanently removes your private creator/kitchen records, withdraws and redacts authored content, removes associated program enrollments and revokes new media playback. Other members keep their own saved meal and workout snapshots. Minimal billing, attribution, recipient, transfer, moderation and deletion records remain for financial, fraud and safety needs. Active or canceling subscriptions, unresolved checkout attempts and creator financial obligations must be resolved before erasure. Contact privacy support for financial closure or retained-record requests; no fixed statutory retention period is asserted here.

Media cleanup first becomes eligible 25 hours after erasure. The worker confirms deletion of object versions and repeats daily checks for late uploads. Failed cleanup stays pending and retries; the account control shows pending objects. This delay is a technical cleanup safeguard, not a promise that every file is deleted at exactly 25 hours. Issued links may work until expiry and downloaded copies cannot be recalled. Reload after erasure to clear open creator pages. These controls leave your Clerk sign-in account separate. A native iPhone reminder app, if installed, must be removed on that phone to clear its local schedule. Sign-out does not erase records; clearing site data only clears this browser's copy. Privacy requests: privacy@justicebridgetechnologies.com.