Privacy policy
Draft, pending legal review. This policy takes effect at Hyprcoach's first public release and may change before then.
Effective date: Hyprcoach's first public release.
Who we are
Hyprcoach is a nutrition and training coaching app. It is sold by [to be completed: the company's name], a company registered in [to be completed: the company's country]. That company is the controller of your personal data: it decides why and how your data is used. In this policy, "we" means that company.
- Contact: [to be completed: the privacy contact's email address].
- EU representative and data protection officer: [to be completed: whether an EU representative (GDPR Art. 27) or a data protection officer (Art. 37) is needed, and how to reach them].
What we hold about you
- Your account: your first and last name, your email address, and the user id our sign-in provider gives your account.
- Your sign-in: your password, which only our sign-in provider holds, and only as a hash; and your sessions.
- Your settings: units, language, check-in day, time zone and nickname.
- Your health data, the five kinds the consent screen names:
- body stats: facts, measurements and photos, such as your height, birth date, sex, weight and body measurements; photos only once the app offers photo upload;
- check-in answers: sleep, energy, hunger and stress;
- lifestyle habits, including alcohol and performance enhancers;
- training and nutrition records: workouts, meals and plans;
- your coach's conclusions: what your coach concludes from this data.
- Change records: each change your coach makes to your data or your plans, with the value before and after, and the reason.
- Diagnostics: the phone's error reports and startup times; the errors and logs of our backend and of the coaching dashboard; and the coaching dashboard host's record of each request (see "Diagnostics").
- Support emails: what you write to support.
Why we use it, and on what legal basis
- Your account and settings: to give you the coaching service you signed up for: sign-in, the app, and the emails about your account. Basis: our contract with you (GDPR Art. 6(1)(b)).
- Your health data: to coach you. Your coach plans your training and nutrition from it, reviews your check-ins and follows your progress. Basis: your explicit consent (GDPR Art. 9(2)(a)), which you give on the consent screen right after you sign in, before any health data is saved, and [to be completed: the Art. 6(1) basis that goes with it]. You can withdraw your consent at any time (see "Your rights").
- Diagnostics: to find and fix errors in the app, our backend and the coaching dashboard, and to see how fast the app starts. Basis: [to be completed: the legal basis for the diagnostics, and whether storing the installation's id on the phone needs consent].
- Support emails: to answer you. Basis: [to be completed: the legal basis for support emails].
- The deletion log: to prove each erasure was done, and on time. Basis: [to be completed: the legal basis for the deletion log].
Who receives it
| Provider | What it does | What it holds about you | Where | Contract and transfer basis |
|---|---|---|---|---|
| Convex | Our database and file storage, behind the app and the coaching dashboard | Everything the app and the coaching dashboard store about you | United States: US East, Northern Virginia | Convex's data processing addendum, part of its agreement. Transfers from the EU: the standard contractual clauses, Module Two (§6.2). [to be completed: whether the addendum covers our Convex plan] |
| Clerk | Sign-in | Your email address, password hash, first and last name, whether your email is verified, your sessions, and sign-in records (attempts, IP address, browser or device). No health data: Clerk's agreement forbids it | United States, in Google Cloud and Cloudflare data centres | Clerk's data processing addendum ("Last updated: November 26, 2024"), part of its agreement. Transfers from the EU: the EU-U.S. Data Privacy Framework (§11.2), with the standard contractual clauses as a fallback |
| Vercel | Hosts the coaching dashboard your coach uses | Records of each request: its address, which can hold your client and plan ids, and the requester's IP address, browser, time and status; and your email address if you sign in to the coaching dashboard with your client account. None of your health data: its addendum forbids it | United States: Vercel's iad1 region, Washington, D.C.; Vercel's main processing is in the United States |
Vercel's data processing addendum for Pro plans (§1). Transfers from the EU: the standard contractual clauses (Schedule 3) |
| Expo (EAS Observe) | Receives the phone's error reports and startup times | Each error report: the error with its stack and component stack, the time and the session, the app's version, build and environment, the device's model, OS and OS version, a country code, and the installation's id, easClientId; and how long the app took to start and to draw its first screen (see "Diagnostics") |
United States. [to be completed: EAS Observe's storage region] | Expo's terms (§3.2, "Last updated May 29, 2025"): Expo processes the reports for us under the standard contractual clauses, Module Two. Expo is self-certified under the EU-U.S. Data Privacy Framework (its privacy policy, "Last updated October 21st 2025"). [to be completed: whether Expo's terms meet every duty of GDPR Art. 28(3)] |
| Resend | Sends the emails about your account: the deletion emails and the inactivity reminder | Your email address and first name, and each email's content and metadata | United States | Resend's data processing addendum ("Last update: December 31st, 2025"), which binds when we accept its terms. Transfers from the EU: the standard contractual clauses, Module Two (§6.2.2) |
| Sentry | Receives the errors of our backend and of the coaching dashboard | Ids and error codes; never health data | United States: Sentry's US data region | Sentry's data processing addendum, accepted before the first error is sent. Transfers from the EU: the EU-U.S. Data Privacy Framework, with the standard contractual clauses as a fallback (Schedule 3) |
| Axiom | Stores our backend's logs | Ids and error codes; never health data | [to be completed: Axiom's data region] | Axiom's data processing addendum, accepted before the first log. Transfers from the EU: [to be completed: the transfer basis, read with the region] |
| Cloudflare (R2) | Stores a weekly encrypted copy of our database, outside Convex | Encrypted data only: the copy is encrypted before it leaves our backup job, with a key whose private half only Hyprcoach's owner holds, offline | Eastern North America | Cloudflare's data processing addendum, part of its agreement. Transfers from the EU: the standard contractual clauses, Module Two, which apply where we are the controller |
The support mailbox holds what you write to support, which may include health facts: [to be completed: the support mailbox's provider, its country and its transfer basis].
How long we keep it
- Your record (profile, plans, workouts, check-ins, and photos once the app offers photo upload): while your account is open. Withdrawing your consent erases its health data and keeps your settings.
- Change records, with their before and after values and reasons: while your account is open, then erased with it. Withdrawing your consent erases them too.
- Consent records: while your account exists.
- After you ask to delete your account: frozen until the erasure date. On that date your account and all its data are erased from our database and file storage, and your account at our sign-in provider is deleted. What the rows below keep for a set time (the deletion log, backups, sign-in records at Clerk, error reports, email records, the dashboard host's logs) expires at the end of that time.
- The deletion log: 12 months after the erasure. It holds only ids that do not name you, dates, and each provider's confirmation.
- An inactive account, when you have not used the app while signed in for 12 months and, once memberships exist, hold no active membership: one reminder email at 11 months, then erased at 12 months unless you use the app before then.
- Database backups at Convex: daily backups 7 days, weekly backups 14 days. After a restore, every erased account is erased again. [to be completed: whether a restore also erases again the health data of clients who withdrew their consent]
- The weekly encrypted copy at Cloudflare: each copy is kept 5 weeks from the day it is made, so a deleted client's data, or the health data of a client who withdrew consent, is gone from this Cloudflare copy within 5 weeks of its erasure. [to be completed: how long Convex keeps its own internal backup copies]
- An unfinished workout on your phone: 7 days. The app checks when it loads and when it comes back on screen. Withdrawing your consent erases it.
- A finished workout not yet sent when your session ends without your choosing (its 30-day lifetime runs out, or it is revoked): kept on the phone in the app's private storage, protected by the phone's own encryption, and tied to your account. It is sent when that account signs back in, and erased when another account signs in on the phone, when you withdraw your consent, or when your account is deleted.
- Sign-in records at Clerk (attempts, IP address, browser or device): [to be completed: how long Clerk keeps them, also after your account is deleted].
- Error reports: 90 days at Expo; 30 days at Sentry and at Axiom.
- The coaching dashboard host's logs: Vercel's period, 1 day, or 30 days with Vercel's Observability Plus. [to be completed: which of the two applies]
- Emails at Resend: content and metadata 30 days. Our backend's copy of each email: 4 weeks.
- A copy of your data sent to you: the link expires after 7 days, and no copy is kept.
- Support emails: deleted with your account, or 12 months after the last reply.
- Files our build system keeps (test data only, never a client's): 7 days.
- Invoices, once payments exist: as long as tax law requires in [to be completed: the company's country].
Your rights
- A copy of your data (GDPR Art. 15 and 20): write to support. Within one month we send you a private link to a machine-readable copy. The link works for 7 days, and the copy is never an email attachment. It keeps what you supplied apart from what your coach concluded, and lists who receives your data.
- Correction (Art. 16): change it in the app, in Profile, Account settings, or write to support.
- Erasure (Art. 17): tap Delete account in Account settings or on the consent screen, or use the signed-in page on our website, [to be completed: the website's deletion page address]. You first sign in again in full: your password, and your code if you turned on a second factor. Your account is erased on the date shown: the day before the same date the following month or, when that month has no such date, the day before its last day (a request on 31 January is erased on 27 February, or on 28 February in a leap year). An email gives the same date. Signing in before then cancels the deletion. A second email confirms the erasure. You can also write to support: we start the same deletion for you.
- Withdrawing your consent (Art. 7(3)), which stops all collecting, using and sharing of your health data: in Profile, Account settings, "Health data consent". Coaching stops, and we start erasing your health data at once: from our database, change records included, and from your phone, with any unfinished workout or workout waiting to be sent. Our backups at Convex and at Cloudflare keep it until they expire, within 5 weeks (see "How long we keep it"). Your account, name, email and settings stay. The consent screen then offers to agree again or to delete your account.
- Restriction and objection (Art. 18 and 21): write to support to restrict how we use your data, or to object to a use based on our legitimate interests.
- A complaint (Art. 77): you can complain to a supervisory authority, in particular in the EU country where you live or work. Our lead authority: [to be completed: the lead EU supervisory authority].
- Residents of Washington and Nevada: read our separate consumer health data policy, at hyprcoach.io/consumer-health-data.
To write to support, use Contact support in the app's Profile, or [to be completed: the support email address].
Age
Only people of 18 and over hold a Hyprcoach account.
Diagnostics
When the app meets an error, the phone sends a report to Expo's EAS Observe. Each report carries the installation's id, easClientId, which identifies one installation of the app. It lists the error with its stack and component stack, the time and the session, the app's version, build and environment, the device's model, OS and OS version, and a country code. The phone also tells EAS Observe how long the app took to start and to draw its first screen. Expo keeps the reports 90 days. They hold no health data and expire on their own, so they are not deleted one installation at a time.
The errors of our backend and of the coaching dashboard go to Sentry, and our backend's logs to Axiom. Both keep them 30 days. They carry ids and codes, never health data. The coaching dashboard's host, Vercel, records each request to the dashboard: its address, which can hold your client and plan ids, and the requester's IP address, browser, time and status (see "Who receives it" and "How long we keep it").
A suspected breach
If you think your data has been exposed, tell us at [to be completed: the address for reporting a suspected breach]. We follow our breach procedure, which sets who decides, whom we tell and by when.