Privacy Policy

Last updated: September 18, 2026

1. Information We Collect

This policy covers Hyprform’s website and our iOS and Android mobile apps (together, the “Service”).

Personal Information

• Account Information: Username, email address, password (encrypted)
• Profile Information: Fitness goals, experience level, preferences, and optional profile photos
• Workout Data: Generated workout programs, exercise preferences, training history, and logged sessions
• Goals Conversation & Training Roadmap: Messages you send in our goals conversation (text or voice converted to text), including fitness goals, event dates, training history, injury or limitation notes, schedule preferences, and AI-generated year plans, phase summaries, and monthly check-in responses
• Injury & Limitation Information: Health-related constraints you choose to share (for example prior injuries, movements to avoid, or medical clearance notes) to help tailor programs safely
• Usage Information: How you interact with our service, features used, time spent
• Trainer Information: For trainer accounts, we collect professional bio, photos, documents, training methodology preferences, and program generation history
• Coach Selection & Referral Data: If you select a trainer as your coach, join via a coach invite or referral link, or link to a coach at signup, we store that relationship and related attribution metadata to filter programs and support coach features
• Gym Account Information: For gym accounts, we collect gym or facility name, class programming preferences, uploaded past workout documents or pasted programming history, generated class weeks, and related gym portal settings
• Messages: Coach–athlete messages, Community direct messages between members, and related content you send through the Service (including voice dictation converted to text on your device when you use the microphone)
• Coach Hub chats: Messages you send in Coach Hub (Ask, Adjust, and related roadmap chats), including text and voice converted to text. We keep the raw chat for about 90 days. From those chats we also save shorter notes — such as a constraint, preference, commitment, or summary — so later replies can remember them. Those notes can include limits you mention (for example an injury or a movement to avoid). We do not build these notes from Community posts or direct messages. Optional HealthKit / Health Connect recovery metrics are not included.
• Community: If you use Community, we collect what you choose to post or send: text, photos, videos (including form clips), workout summaries you attach, comments, reactions, saves, challenge participation, crew membership, follow and friend connections, and reports you file. Each post can be public, visible to followers, visible to friends, or only you. Your account can be public (searchable, and eligible for the public feed) or private (limited to people you allow). Your name and profile photo appear with content you publish.
• Email Preferences: Your choices about product and reminder emails (account-critical messages may still be sent)
• Billing Identifiers: Stripe customer/subscription/invoice IDs for web payments, and App Store transaction identifiers / subscription status when you subscribe via Apple In-App Purchase. We do not store full card numbers.

Automatically Collected Information

• Technical Data: IP address, browser type, device information (such as platform and app version)
• Device Identifiers: A device ID we generate or store to manage secure sign-in, session refresh, and push notification delivery
• Push Notification Tokens: When you allow notifications, we store a push token (for example via Apple Push Notification service or Firebase Cloud Messaging) bound to your account and device
• Crash and Diagnostic Data (mobile): Crash logs, performance metrics (such as launch timing and hang signals), and related technical diagnostics used to keep the app stable. On mobile this is collected through Sentry.
• Analytics Data: Page views, click patterns, session duration, and session recordings on the website and in our mobile apps. Microsoft Clarity (essential session analytics) loads on website visits and is built into the iOS/Android apps. Google Analytics cookies load only with your consent via our cookie banner on the website.
• Cookies: Essential cookies for login, preference cookies, analytics cookies
• Timezone Information: We automatically detect and store your timezone (e.g., "America/Los_Angeles") and timezone offset to ensure accurate date and time display for your workout logs and activity. This is collected from your device's system settings and does not require permission. You can update or override your timezone in your profile settings.

Mobile App Permissions and On-Device Data

• Health and Fitness Data (optional, HealthKit / Health Connect): If you turn on Apple Health (HealthKit) on iOS or Health Connect on Android in the mobile app (Settings → Recovery), Hyprform reads limited data from the Health app on your device: (1) recovery metrics — step count, sleep duration, resting heart rate, and active energy (calories); and (2) workouts lasting about 10 minutes or more (for example runs, rides, yoga, or other classes), including type, start/end time, duration, and when available distance, active calories, and the source app. We use recovery metrics for informational Home and workout hints (for example, a note that sleep was short). We import qualifying workouts into your Hyprform workout history and Progress calendar, and we use mobility/yoga-style sessions for Recovery & mobility summaries on coach assessment. Imported cardio can also inform existing sport-assessment conditioning signals where those already exist. This is not medical advice, diagnosis, or monitoring. Hyprform does not write workouts or any other data back to Apple Health or Health Connect. When Recovery is on, we save the latest recovery snapshot (and a short recent history) plus imported external activities to your Hyprform account so they are available across your devices. We do not send this health data to your coach, do not include it in AI workout-generation prompts, and do not use it for advertising or tracking. Bare strength workouts from Health (with no exercise list) are not imported. You can turn this off in the app at any time (we then stop reading and delete the on-device cache) or revoke access in iOS Settings → Health → Data Access & Devices → Hyprform (or Android Health Connect permissions). Account deletion removes stored recovery snapshots and imported external activities with your other account data.
• Photos, camera, and media library: With your permission, to set a profile photo, attach photos or videos to Community posts (including form clips), or import a photo of a workout or gym board. Community photos and videos you upload are stored so we can show them to the audience you choose. Uploaded Community photos and videos may be scanned for safety, as described under Amazon Rekognition below.
• Microphone: With your permission, so you can dictate messages to your coach or speak in the goals conversation; audio is sent for transcription to create message text and is not retained by Hyprform as a separate voice archive beyond normal message content
• Biometric Unlock (Face ID / device biometrics): Optional local unlock of the app. Biometric templates stay on your device and are not sent to Hyprform
• On-Device Storage: The app may store workout drafts, program snapshots, and cached profile data locally (for example in on-device databases or secure storage for refresh tokens) to support offline use and faster loading

2. How We Use Your Information

• Service Provision: Generate personalized workout programs using AI; sync and display workouts, programs, and messages on web and mobile
• Account Management: Create and maintain your account, authentication (including mobile session and device registration)
• Communication: Send service updates, support responses, important notices, and product emails (such as onboarding reminders, workout absence check-ins, and optional daily workout previews). You can manage most reminder preferences in your account settings; billing and security notices may still be sent
• Push Notifications: Deliver workout reminders, Community activity (such as comments, reactions, and messages), coach alerts, and other in-app alerts you enable
• Coach Hub: Answer Ask and Adjust questions using AI, and use the shorter notes described above so later replies can stay consistent with what you already said. If you are linked to a trainer, that trainer can see those notes, not the raw chat.
• Community: Show posts, profiles, challenges, crews, and messages to the people allowed by your settings; review reports; and scan uploaded photos and videos for content that breaks our rules
• Recovery Guidance and outside-activity history: Use optional HealthKit / Health Connect recovery metrics for informational hints in the mobile app, and show imported outside workouts in your history, Progress calendar, Recovery & mobility summaries, and (for cardio) existing sport-assessment conditioning signals. These health imports are stored on your account and are not used to generate or rewrite your training program.
• Improvement: Analyze usage patterns to improve our AI algorithms and product experience
• Legal Compliance: Meet legal obligations and protect our rights
• Date and Time Accuracy: Use your timezone information to ensure workout logs, activity dates, and scheduled notifications display correctly according to your local time
• Trainer Profiles: Display trainer profiles in our public catalog when activated, generate AI summaries of trainer programming styles
• Coach Matching: Enable users to select trainers as coaches and filter programs by trainer focus
• Program Analysis: Analyze trainer-generated programs to create AI summaries and identify programming patterns

3. Third-Party Services

We use the following third-party services that may process your data:

• OpenAI: Your workout preferences, goals conversation content, Coach Hub messages, the shorter notes we save from those chats, and related prompts are sent to OpenAI's API to generate personalized workouts, training roadmaps, coach replies, and summaries. OpenAI's privacy policy applies to this processing. Trainer information and programs are also analyzed by OpenAI to generate AI summaries. Community posts, Community direct messages, and optional HealthKit / Health Connect metrics are not included in these prompts.
• Google Gemini: When you use voice input in the goals conversation or related voice features, audio may be sent to Google Gemini for transcription. Google's privacy policy applies (policies.google.com/privacy).
• MongoDB Atlas: Secure cloud database hosting for your account and workout data
• Amazon Web Services (AWS): Cloud hosting and infrastructure services
• AWS S3: Trainer photos and documents, Community photos and videos, and other user media we store for the Service are stored in AWS S3 with access controls
• Amazon Rekognition: Photos and videos you upload to Community may be sent to Amazon Rekognition, an image-analysis service, to detect content that breaks our rules (for example explicit nudity or graphic violence) before or after it is shown. We store the moderation result with the post. Amazon’s privacy notice applies (aws.amazon.com/privacy).
• Amazon SES: Transactional and product emails (for example account notices and training reminders) are sent using Amazon Simple Email Service
• Stripe: Payment processing for Hyprform platform subscriptions purchased on the web, coach access fees, invoices, and trainer payouts. When you subscribe via Stripe, pay a coach fee, or onboard as a trainer, payment and payout data are processed by Stripe (including Stripe Connect for trainers). We store billing-related identifiers such as Stripe customer, subscription, and invoice IDs—not your full card number. Stripe’s privacy policy applies (stripe.com/privacy).
• Apple (In-App Purchase / App Store): When you subscribe to Hyprform on iOS through Apple In-App Purchase, Apple processes the payment. Apple may share limited purchase data with us (such as transaction identifiers, product ID, and subscription status) so we can unlock and renew your membership. We do not receive your full card number from Apple. Apple’s privacy policy applies (apple.com/legal/privacy).
• Microsoft Clarity: We use Microsoft Clarity for session recordings, heatmaps, and usage analytics on our website and in our iOS/Android apps (taps, screen visits, and reconstructed session replays). On the website, Clarity is classified as essential session analytics and loads on every visit, including before you log in. In the mobile apps, Clarity runs as part of the app binary. Google Analytics loads only if you choose “Accept all” in our website cookie banner. Microsoft’s privacy policy applies (privacy.microsoft.com/privacystatement).
• Google Ads: After you create an account on the website, we send a signup conversion ping to Google Ads so we can measure advertising. This does not wait for a cookie-banner click. We also send the main signup, trial, and subscribe button clicks used to measure conversion funnels. Google’s privacy policy applies (policies.google.com/privacy).
• Google Analytics: We use Google Analytics to understand how our website is used (page views, usage patterns). Google Analytics cookies load only if you choose “Accept all.” Google's privacy policy applies (policies.google.com/privacy).
• Apple / Google push services: Push delivery uses Apple Push Notification service (APNs) and/or Firebase Cloud Messaging (FCM), which process device push tokens
• Sentry: Mobile crash reports, performance traces, and related diagnostics (device/OS info, app version, and optionally a user id/email for support). Sentry’s privacy policy applies (sentry.io/privacy).
• Expo / app distribution tooling: Build and over-the-air update infrastructure may process limited technical metadata related to app versions and updates (not your workout content as a primary purpose)

4. Data Sharing and Disclosure

We do not sell your personal information. We may share data only in these limited circumstances:

• Service Providers: With trusted third parties who help operate our service
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In case of merger, acquisition, or sale of assets
• Consent: When you explicitly consent to sharing
• Public Trainer Profiles: When trainers activate their trainer card, their profile information (name, bio, photo, AI summary, training focus, methodology) becomes publicly visible in our catalog. This is done with explicit trainer consent through the activation process.
• Coach Selection: When you select a trainer, their training focus is used to filter programs. That selection does not give them your email address or phone number.
• Coach insight for a linked trainer: If you are linked to a trainer, that trainer can see the shorter notes from your Coach Hub chats (constraints, preferences, commitments, summaries, and serious flags such as an injury you described). They do not receive the raw chat, your Community posts, your direct messages, or optional HealthKit / Health Connect metrics. They can turn a note off or clear active notes. This is not medical advice and does not by itself create a personal-training or clinical relationship.
• Community: Content you post is visible to other members according to the audience you choose and whether your account is public or private. Direct messages are visible to the people in that thread. We do not sell Community content. We may review a post, message, or profile when someone reports it, or when an automated safety scan flags uploaded media.
• HealthKit / Health Connect: Optional recovery metrics and qualifying imported workouts read from Apple Health or Health Connect are stored on your Hyprform account. They are not shared with coaches, advertisers, or other third parties, and are not included in AI generation prompts.

5. Data Security

• Encryption: Data in transit and at rest is encrypted
• Access Controls: Limited access to personal data on a need-to-know basis
• Regular Audits: Security practices are regularly reviewed and updated
• Secure Infrastructure: Hosted on enterprise-grade cloud platforms
• Secure File Storage: Trainer photos and documents, and Community photos and videos, are stored in AWS S3 with restricted access policies and presigned URLs for secure uploads
• Profile Privacy: Trainer profiles are only publicly visible when explicitly activated by the trainer

6. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal data (email support@hyprformai.com from your registered address, or use in-app / account deletion flows when available). We verify ownership, stop recurring billing where applicable, and purge personal workout data according to this policy
• Portability: Export your data in a machine-readable format
• Objection: Object to certain types of data processing
• Restriction: Request restriction of data processing
• Email and notification controls: Adjust product email preferences and mobile notification settings where offered; revoke OS-level permissions (Health, microphone, photos, notifications) in your device settings
• Community controls: Delete your own posts, choose who can see a post, switch your account between public and private, block another member, and report content or a person. Email support@hyprformai.com if you want Community content tied to your account removed and you cannot delete it in the app.
• Coach memory: Shorter notes saved from Coach Hub are deleted when you delete your account. Your linked trainer can disable or reset active notes. Email support if you want those notes removed sooner.
• Trainer-Specific Rights: Trainers can deactivate their public profile at any time, update their AI summary, and request removal of uploaded photos or documents

7. Data Retention

• Active Accounts: Data retained while your account is active
• Inactive Accounts: Deleted after 3 years of inactivity
• Deleted Accounts: Profile, workout, and billing-related personal data are purged within 30 days of account deletion. Coach Hub raw chats and the shorter notes from those chats are deleted when the account is deleted (raw chats also expire after about 90 days if you keep the account).
• Community content: Kept while it remains on the Service and has not been deleted. You can delete your own posts in the product. If you delete your account, email support@hyprformai.com and we will remove Community content we still control within 30 days. A message already delivered to another member can remain in their thread until they delete it. We may keep a report, and the content it concerns, for as long as needed to review abuse or meet a legal duty.
• Legal Requirements: Some data may be retained longer for legal compliance
• Analytics Data: Anonymized after 2 years
• On-device HealthKit / Health Connect cache: Replaced each time the app refreshes recovery metrics. Deleted when you turn Recovery off in Settings, or when you uninstall the app.
• Account health recovery snapshots and imported activities: Latest recovery snapshot plus up to 14 days of recovery history, and imported external workouts, retained while your account is active and purged with account deletion.

8. International Data Transfers

Your data may be processed in countries other than your residence. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by relevant data protection authorities
• Other legally recognized transfer mechanisms

9. Children's Privacy

Our service is not intended for users under 18 years of age. We do not knowingly collect personal information from children under 18. If you become aware that a child has provided us with personal information, please contact us immediately.

10. Cookies and Tracking

On our website, we use cookies and similar technologies to:

• Essential: Enable core functionality like login sessions
• Session analytics (Microsoft Clarity): Essential — loaded on all website visits (including before login) and in our iOS/Android apps to help us understand how the product is used.
• Google Ads signup conversion and conversion clicks: Sent after a successful website signup, and for primary signup / trial / subscribe clicks, without waiting for a cookie-banner choice. Full Google Analytics page-view measurement is separate and loads only when you choose “Accept all.”
• Analytics cookies (Google Analytics): Optional cookies to measure website usage, loaded only when you choose “Accept all” in our cookie banner
• Preferences: Remember your settings and preferences

You can manage cookie preferences through our cookie banner (including the footer “Cookies” link) or browser settings. Clarity, Google Ads signup conversion, and primary conversion-funnel clicks run without waiting for a cookie choice. Choosing “Accept all” additionally enables full Google Analytics (page views and broader usage). Our mobile apps do not use the website cookie banner. Mobile session analytics (Microsoft Clarity) and crash reporting (Sentry) are disclosed in this policy; OS-level permissions (notifications, Health, microphone, photos) remain controllable in device settings.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Sending an email notification to registered users
• Displaying a prominent notice on our service

12. Contact Us

If you have questions about this privacy policy or your personal data, please contact us:

• Email: support@hyprformai.com
• Address: Hyprform LLC. Mailing address available upon request to support@hyprformai.com.
• Data Protection Officer: support@hyprformai.com

13. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Consent: For non-essential cookies, optional health-data access, push notifications, photo or camera access, and optional product emails where consent applies. Posting in Community is your choice; the audience you pick controls who can see that post.
• Contract: To provide our workout generation service and related account features
• Legitimate Interest: For service improvement, security, fraud prevention, and certain product reminder emails (subject to your preference controls)
• Legal Obligation: For compliance with applicable laws

14. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), subject to applicable exceptions:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect, use, and disclose
• Right to Delete: Request deletion of personal information we hold about you, subject to legal exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt Out of Sale/Sharing: Hyprform does not sell your personal information and does not share it for cross-context behavioral advertising
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, email support@hyprformai.com from your registered address. We will verify your request before responding. Authorized agents may submit requests on your behalf where permitted by law.