App Privacy Policy

Last updated: 5 August 2026

This policy explains how the HyperFlow app for iOS and Android ("HyperFlow", "we", "us", "our") collects, uses, stores and protects your personal data, in compliance with the EU General Data Protection Regulation (GDPR) and the Apple App Store and Google Play requirements. HyperFlow is operated from Belgium, European Union.

By using HyperFlow, you agree to the collection and use of information in accordance with this policy. We process your data only when we have a lawful basis to do so.

At a glance — data shared with third parties

1. Data controller

HyperFlow is the data controller for personal data processed by the app. For any data-protection inquiry or request, contact [email protected].

2. Data we collect

Account information

• Email address (required for authentication)
• Password (securely hashed by our authentication provider, never stored in plain text) — only if you sign up with email
• If you use "Continue with Google" or "Sign in with Apple", we receive your email address and an account identifier from Google or Apple. We never see your Google or Apple password

Profile data (optional)

• Username, training experience level, and app settings
• Your exact weight, height, age and sex are stored only on your device and are never stored on our servers
• Only a general weight class and age group (derived from your weight and age) sync to our servers and may be used for AI personalization
• If — and only if — you grant AI consent and use an AI feature, your sex is transmitted from your device with that request (see AI features below). It is used to answer the request and is not stored on our servers

Workout data

• Exercises performed, sets, reps and weights
• Workout duration and timestamps
• Custom exercises you create; workout templates, favorites and training streaks
• Post-session feedback (how a session felt, soreness, sleep, nutrition, notes) and per-exercise feel ratings

Health data — Apple Health / HealthKit (iOS, optional)

• With your permission, HyperFlow saves your completed workout sessions to Apple Health (HealthKit)
• HealthKit data stays on your device and in Apple Health — we never upload it to our servers, and we do not read your other Apple Health data
• HealthKit data is never used for advertising or marketing and is never shared with third parties, except as you direct
• If you use the Apple Watch companion app, workout data (sets you log, rest timers) syncs directly between your watch and phone
• You can revoke Health access at any time in the iOS Settings or Health app

AI features (optional — consent required)

• Which features. Parsing a workout you paste in, personalized weight/rep suggestions, workout order optimization, and creating or completing an exercise with AI.
• What is sent. The text you submit to the feature, plus limited training context: exercise names and categories, your derived weight class and age group, your sex, your experience level, recent exercise history, and your app language.
• Who receives it. The request goes to our own server function, which relays it to OpenRouter. OpenRouter routes it to a Google Gemini model for inference. Both act as our processors.
• What is never sent. Your name, email address, exact weight, exact height, exact age, precise location, health data from Apple Health, and your full workout history. We do not use your data to train AI models, and we do not keep your AI requests after the response is returned. Our processors handle them under their own published policies, linked below.
• Automatic use while consent is granted. Once you grant consent, some AI assistance may run without a further prompt — for example filling in missing details of a suggested session, or completing an exercise you created while offline. This only ever sends the categories listed above, and it stops the moment you withdraw consent. Requests are rate-limited.

Product analytics (optional — you can turn it off)

• We use PostHog (EU-hosted, eu.i.posthog.com) to understand which features are used so we can improve the app
• What is sent: your user ID, app usage events (screens and features used, counts and derived ratios), app version, device type and OS version, and language
• What is not sent: workout content, exercise names, body measurements, health data, your email address, and precise location
• This is first-party product analytics only. It is not advertising, not cross-app tracking, and it does not use the Advertising Identifier (IDFA)
• You can turn analytics off at any time in Settings → Privacy. When you do, collection stops and PostHog is instructed to opt you out
• Your analytics profile is purged when you delete your account

Subscription information

• Subscription status, product, and renewal/expiry dates
• Purchases are processed by Apple (In-App Purchase) on iOS or Google (Google Play Billing) on Android — we never receive or store your payment card details

Exercise demonstration media

• Exercise demo videos and images are licensed content delivered from our content network (Cloudflare) via short-lived, signed links
• Fetching media involves standard technical request data (IP address, user agent); media is cached on your device for offline viewing

Technical data (automatically collected)

• IP address and approximate region (server-side logs)
• Device platform, app version, and device language
• A random per-install identifier used to sync your data across devices and detect conflicts (not a hardware ID, never used for advertising)
• Security and audit events, and rate-limit records

Diagnostics & crash reports

• In production builds, crashes and errors are reported to Sentry (EU-hosted): error messages, stack traces, recent in-app events, your user ID, app version and platform
• Crash reports are scrubbed and do not include your workout content or profile measurements

Push notifications (optional)

• If you enable notifications, we store a push token and your device platform to deliver them via Expo and the Apple Push Notification service (APNs) on iOS or Firebase Cloud Messaging (FCM) on Android
• Weekly workout reminders are scheduled locally on your device
• Your push token is removed when you sign out and deleted with your account

Biometric unlock (optional)

• Face ID, Touch ID, Android biometrics, or your passcode can protect sensitive actions (data export, account deletion)
• Only an on/off preference is stored, in the iOS Keychain or Android secure storage. Your biometric data never leaves your device's secure hardware and is never accessed by the app

3. Legal basis for processing

• Contract performance — processing necessary to provide the HyperFlow service you signed up for, including account sync and subscription management.
• Legitimate interest — improving our service, security, and preventing fraud and abuse.
• Consent — for optional features you turn on, such as push notifications (via the system permission), Apple Health access, and AI personalization. AI features require explicit, informed opt-in consent before any data leaves your device, and consent can be withdrawn at any time.
• Legitimate interest, with an opt-out — first-party product analytics (PostHog) to understand feature usage and improve the app. You can object at any time by turning analytics off in Settings → Privacy.
• Legal obligation — compliance with financial regulations for subscription billing.

4. Third-party data processors

We use trusted third-party services to operate HyperFlow. Each is bound by a data processing agreement.

5. Data retention

• Account data — retained until you delete your account.
• Workout history — retained until you delete your account or specific workouts.
• Subscription records — kept while active and as needed afterwards to meet accounting and legal requirements.
• AI feature inputs — processed to answer your request; not retained by us as training data.
• On-device data — remains on your device (including cached exercise media) until you sign out, delete your account, or uninstall the app.
• Product analytics — retained by PostHog under its retention window; collection stops as soon as you turn analytics off in Settings → Privacy.
• Security & audit logs — retained about 30 days; rate-limit records about 1 hour.
• After account deletion — your database records are erased and your analytics profile (PostHog) is purged as part of deletion. Crash reports (Sentry) age out under that service's retention window, and subscription records (RevenueCat/Apple) are kept only as long as accounting and legal rules require. Support emails you sent us are kept until you ask us to delete them.

6. Your rights under the GDPR

• Access — request a copy of all personal data we hold about you.
• Rectification — correct inaccurate personal data via your Settings page.
• Erasure ("right to be forgotten") — delete your account and all associated data directly in the app, from Settings.
• Data portability — export your data in a machine-readable format (JSON) directly in the app.
• Object — object to processing based on legitimate interests.
• Withdraw consent — withdraw AI consent in Settings → AI Personalization, turn product analytics off in Settings → Privacy, or disable notifications and Health access at any time in Settings. Withdrawal takes effect immediately.

To exercise any of these rights, use the in-app tools in Settings or contact [email protected]. We respond within 30 days. You may also lodge a complaint with your local Data Protection Authority — in Belgium, the Autorité de protection des données / Gegevensbeschermingsautoriteit.

7. US privacy rights

If you are a US resident (including under the California Consumer Privacy Act), you have similar rights to know, access, correct, and delete your personal information, and the right not to be discriminated against for exercising them. We do not sell or share your personal information for advertising, and we do not use it for cross-context behavioral advertising. To exercise these rights, use the in-app tools or contact [email protected].

8. Security measures

• All data encrypted in transit (TLS)
• Passwords are handled and hashed by our authentication provider; we never store them
• Database access restricted per user via Row-Level Security (RLS)
• Session tokens and encryption keys stored in the iOS Keychain or Android secure storage
• On-device app data encrypted with a 256-bit key
• Your exact weight, height, age and sex kept on your device only
• Exercise media served via short-lived signed links from private storage
• Temporary lockout after repeated failed sign-in attempts

9. International data transfers

Your core data is stored in the EU. Some processors may handle data outside the EU/EEA. Where that happens, we ensure adequate protection through Standard Contractual Clauses (SCCs) with all processors, EU-US Data Privacy Framework certifications where applicable, and data processing agreements with all third-party services.

10. On-device storage

As a native mobile app, HyperFlow does not use browser cookies, localStorage or service workers. It stores data on your device using:

• Local database (SQLite) — your offline copy of workouts, exercises and your profile, including the exact weight, height, age and sex that never leave your device.
• Encrypted key–value store (MMKV) — app settings, preferences and cached subscription status, encrypted with a 256-bit key.
• Secure storage (iOS Keychain / Android Keystore-backed) — session tokens, the encryption key, and your biometric-unlock preference.
• Media cache — exercise demo videos and images cached for offline viewing.
• No advertising or cross-app tracking — we do not use advertising trackers, the Advertising Identifier (IDFA / Android Advertising ID), or cross-app tracking. We show no ads and never sell your data. We do use privacy-focused, EU-hosted first-party product analytics (PostHog) to understand feature usage — you can turn this off anytime in Settings → Privacy.

11. Children

HyperFlow is not directed to children under 13, or under the minimum age of digital consent in your country if higher. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.

12. Language

This Privacy Policy is provided in English. Any translations are for convenience only — the English version controls.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice in the app. The "last updated" date above reflects the current version.

14. Contact

For any question about this policy or to exercise your data rights: [email protected] · Response time: within 30 days · Brussels, Belgium.