Privacy policy

This policy describes the hapibit-fitness app operated by ZIKLAG HOLDINGS, LLC (Hapibit). Contact daniel@hapibit.com with privacy questions or requests.

Information we process

• Account: email address, account identifier, sign-in information and, if supplied by your sign-in provider, profile information. Authentication uses the common Hapibit account.
• Fitness records you choose to enter: workouts, sets, repetitions, weights, meals, nutrition values, body measurements, goals, available time, equipment and workout-place names.
• Profile and preferences: age, physical characteristics, units, language, country, time zone, allergies, exercise restrictions and eligibility answers when you provide them.
• Consent choices, data export/deletion requests and, when store subscriptions are enabled, purchase identifiers, products and entitlement status. Payment card details are handled by the app store.
• Technical requests and security information, such as IP addresses, request times, response status and authentication events, handled by our hosting and authentication providers.

How we use it

We use this information to authenticate your account, save and synchronize your records, display your progress, apply your preferences, protect accounts, answer support requests and carry out exports and deletion. The app stores account-specific records locally for offline use and sends queued changes to the Fitness service when you synchronize.

Photos and automated coaching

When photo analysis is available and you separately consent and request it, Fitness sends the selected normalized photos through Vercel AI Gateway to the OpenAI API to check image quality or suggest visible features, foods and equipment. The request includes the photo, the analysis purpose and language; it does not include your account credentials. Processing may occur outside your country, including in the United States. We configure the request to disallow training and require zero data retention for routine analysis. Legal and safety exceptions, including retention for suspected illegal image content, can apply. Vercel data retention · OpenAI data controls.

Declining or withdrawing external AI consent leaves manual records, exports and deletion available. Withdrawal stops new external requests and removes stored analysis results; it does not recall data already processed. You can remove individual photos, or withdraw photo-processing consent to delete all your stored photos.

When enabled with consent, only photos you select or capture for a check-in, goal, meal or equipment record are uploaded. Photos remain private; the service normalizes uploaded images and removes embedded metadata. Photos are not measurements of body fat, muscle mass or bone density. We do not use your private photos for model training. The app does not read your contacts or track GPS location.

Service providers and disclosures

Vercel hosts our Fitness API and public information pages. Supabase provides the Fitness database and the common Hapibit authentication service. They process information to deliver these services for us. Google or Apple handles sign-in or store purchases when you use those options. Provider infrastructure may process information outside your country, including in the United States. We do not sell your personal information, use health records for advertising or include advertising trackers. We may disclose information when required by law or to protect service security.

Retention and deletion

Your synchronized Fitness records remain associated with your account until you delete them or your Fitness account. Successful in-app account deletion removes the active Fitness records, uploaded photos, related analysis, plans and subscription links from the Fitness database. Minimal hashed deletion boundaries and request receipts remain to prevent old sessions or queued writes from recreating deleted data. Provider backups and security logs can remain until their normal retention expires; deletion from the active service does not instantly erase provider backups. Store transaction history is retained separately by the relevant store.

Deleting Fitness does not automatically delete your common Hapibit login or records in other Hapibit apps. Contact us if you also want to delete the common account. See account deletion for in-app steps and an outside-app request option. Deleting an account does not cancel an app-store subscription. Exported files you save or share are under your control and cannot be recalled by account deletion.

Your choices and security

You can update your profile, delete individual records, revoke photo consent when available, and export synchronized records in JSON or CSV. You can deny camera or photo-selection permissions and still use manual logging. Connections to our production API and authentication service use HTTPS. We restrict access by account ownership; no system can guarantee absolute security. Contact us to request access, correction or deletion, or to ask about applicable privacy rights.

Adults and policy changes

This app is intended for adults aged 18 or older. If you believe a child has provided information, contact us. We will publish changes here with an updated date and obtain new consent where a changed feature requires it.