Privacy Policy for HesaFit
1. Who is responsible
HesaTech, Hesam Salehi, Torfbruchstraße 83, 40625 Düsseldorf, Germany. Contact for all privacy questions: info@hesatech.de.
2. In short
- No advertising, no tracking, no analytics tools, no sale of data.
- Your data stays on your device unless you create an account and turn on sync.
- Camera images and photos are processed only on your device and never uploaded.
- You can delete your account and all data at any time in the app.
3. Data we process, purposes and legal bases
Use without an account. Profile, training, nutrition, body and sleep data are stored only on your device. We receive none of it.
Account. Email address, name and a hash of your password (never the password itself), to provide your account and sync across devices. Six-digit codes are emailed to confirm your address and to reset your password. Legal basis: Art. 6(1)(b) GDPR (contract).
Health and fitness data. Body measurements, weight, body fat estimate, sleep diary, training, nutrition, steps and camera-coach results. They are stored on your device and, only if you use an account with sync, on our server in Germany. Because this is health data (Art. 9 GDPR), we process it on our server only with your explicit consent (Art. 9(2)(a) GDPR), given at sign-up and revocable at any time, e.g. by deleting your account.
Camera and photos. The camera coach detects your posture and the plan scan recognises text entirely on your device. Images and videos are never stored or transmitted.
Location (optional). If you allow it, your location is used to show the weather for your workout and training places nearby. It is sent to the services in section 4 and not stored by us.
Motion sensors. Steps and activity are counted on your device.
Purchases. On the web, subscriptions are paid via Stripe; we receive your email address and the subscription status, never card data. In the Android and iOS apps, subscriptions are purchased via Google Play or the Apple App Store; they process the payment and the app checks the subscription status on your device. Legal basis: Art. 6(1)(b) GDPR; payment records are kept as required by tax law (Art. 6(1)(c) GDPR, up to 10 years).
AI features (optional). Only with your consent we send data without your name or email (e.g. age, goal, training days, exercise list, your question) via our server to AI providers, which may be located outside the EU, e.g. in the USA. Legal basis: Art. 6(1)(a) and Art. 49(1)(a) GDPR.
Server logs. When the app contacts our server, the IP address, time and request are processed for a short period to keep the service secure. Legal basis: Art. 6(1)(f) GDPR.
Free period: To make sure the free period is used only once per person and device, we create a non-reversible fingerprint (SHA-256) from a device identifier (on Android the app's device ID, on iPhone the vendor identifier, in the browser a random identifier) and store it with the account ID and start date on our server in Germany. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR); access to the device identifier is required for the free period you request (Section 25(2) No. 2 TDDDG). Entries are deleted 24 months after the period started, even if the account was deleted earlier.
4. Recipients
- Hetzner Online GmbH, Germany: hosting of our server (processor).
- Stripe Payments Europe, Ltd., Ireland: web payments.
- Google Ireland Ltd.: purchases via Google Play.
- Apple Distribution International Ltd., Ireland: purchases via the App Store.
- Porkbun LLC, USA: delivery of our system emails (verification codes); the transfer is necessary to provide the service (Art. 49(1)(b) GDPR).
- Open-Meteo, Switzerland: weather for the chosen location.
- OpenStreetMap Foundation, UK, and the Overpass API: map tiles and training places.
- Open Food Facts, France: barcode and food search.
- radio-browser.info and the radio station you start: radio streams; these receive your IP address.
- AI providers: only with your consent, see section 3.
5. Storage period
Data on your device stays until you delete it or the app. Account data is kept until you delete your account; it is then removed from our server, and backups are overwritten in the regular backup cycle. Payment records are kept as long as tax law requires.
6. Your rights
You have the right of access, rectification, erasure, restriction, data portability, objection and to withdraw consent at any time. Write to info@hesatech.de. You may lodge a complaint with a supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW).
7. Deleting your account
In the app: Profile → “Delete account and all data”. Or request deletion by email: see delete-account.html.
8. Children
HesaFit is not directed at children under 16. We do not knowingly collect data from children.
9. Security
All connections use TLS encryption. Passwords are stored only as a hash. We collect only the data needed for the features you use.
10. Changes
We update this policy when the app changes. The current version is always available at this address.