Privacy Policy

Last updated: August 25, 2026

1. Information We Collect

This policy covers Hyprform’s website and our iOS and Android mobile apps (together, the “Service”).

Personal Information

• Account Information: Username, email address, password (encrypted)
• Profile Information: Fitness goals, experience level, preferences, and optional profile photos
• Workout Data: Generated workout programs, exercise preferences, training history, and logged sessions
• Goals Conversation & Training Roadmap: Messages you send in our goals conversation (text or voice converted to text), including fitness goals, event dates, training history, injury or limitation notes, schedule preferences, and AI-generated year plans, phase summaries, and monthly check-in responses
• Injury & Limitation Information: Health-related constraints you choose to share (for example prior injuries, movements to avoid, or medical clearance notes) to help tailor programs safely
• Usage Information: How you interact with our service, features used, time spent
• Trainer Information: For trainer accounts, we collect professional bio, photos, documents, training methodology preferences, and program generation history
• Coach Selection & Referral Data: If you select a trainer as your coach, join via a coach invite or referral link, or link to a coach at signup, we store that relationship and related attribution metadata to filter programs and support coach features
• Gym Account Information: For gym accounts, we collect gym or facility name, class programming preferences, uploaded past workout documents or pasted programming history, generated class weeks, and related gym portal settings
• Messages: Coach–athlete messages and related content you send through the Service (including voice dictation converted to text on your device when you use the microphone)
• Email Preferences: Your choices about product and reminder emails (account-critical messages may still be sent)
• Billing Identifiers: Stripe customer/subscription/invoice IDs for web payments, and App Store transaction identifiers / subscription status when you subscribe via Apple In-App Purchase. We do not store full card numbers.

Automatically Collected Information

• Technical Data: IP address, browser type, device information (such as platform and app version)
• Device Identifiers: A device ID we generate or store to manage secure sign-in, session refresh, and push notification delivery
• Push Notification Tokens: When you allow notifications, we store a push token (for example via Apple Push Notification service or Firebase Cloud Messaging) bound to your account and device
• Crash and Diagnostic Data (mobile): Crash logs, performance metrics (such as launch timing and hang signals), and related technical diagnostics used to keep the app stable. On mobile this is collected through Sentry.
• Analytics Data: Page views, click patterns, session duration, and session recordings on the website. Microsoft Clarity (essential session analytics) loads on all website visits. Google Analytics cookies load only with your consent via our cookie banner.
• Cookies: Essential cookies for login, preference cookies, analytics cookies
• Timezone Information: We automatically detect and store your timezone (e.g., "America/Los_Angeles") and timezone offset to ensure accurate date and time display for your workout logs and activity. This is collected from your device's system settings and does not require permission. You can update or override your timezone in your profile settings.

Mobile App Permissions and On-Device Data

• Health and Fitness Data (optional, HealthKit / Health Connect): If you turn on Apple Health (HealthKit) on iOS or Health Connect on Android in the mobile app (Settings → Recovery), Hyprform reads limited metrics from the Health app on your device: step count, sleep duration, resting heart rate, and active energy (calories). We use those numbers to show recovery metrics and informational hints on Home and during workouts (for example, a note that sleep was short). This is not medical advice, diagnosis, or monitoring. Hyprform does not write workouts or any other data back to Apple Health or Health Connect. When Recovery is on, we save the latest snapshot (and a short recent history) to your Hyprform account so it is available across your devices. We do not send this health data to your coach, do not include it in AI workout-generation prompts, and do not use it for advertising or tracking. You can turn this off in the app at any time (we then stop reading and delete the on-device cache) or revoke access in iOS Settings → Health → Data Access & Devices → Hyprform (or Android Health Connect permissions). Account deletion removes stored recovery snapshots with your other account data.
• Photos / Media Library: With your permission, to set or update a profile photo
• Microphone: With your permission, so you can dictate messages to your coach or speak in the goals conversation; audio is sent for transcription to create message text and is not retained by Hyprform as a separate voice archive beyond normal message content
• Biometric Unlock (Face ID / device biometrics): Optional local unlock of the app. Biometric templates stay on your device and are not sent to Hyprform
• On-Device Storage: The app may store workout drafts, program snapshots, and cached profile data locally (for example in on-device databases or secure storage for refresh tokens) to support offline use and faster loading

2. How We Use Your Information

• Service Provision: Generate personalized workout programs using AI; sync and display workouts, programs, and messages on web and mobile
• Account Management: Create and maintain your account, authentication (including mobile session and device registration)
• Communication: Send service updates, support responses, important notices, and product emails (such as onboarding reminders, workout absence check-ins, and optional daily workout previews). You can manage most reminder preferences in your account settings; billing and security notices may still be sent
• Push Notifications: Deliver workout reminders and other in-app alerts you enable
• Recovery Guidance: Use optional HealthKit / Health Connect metrics to show recovery numbers and hints in the mobile app. These metrics are stored on your account and are not used to generate or change your training program.
• Improvement: Analyze usage patterns to improve our AI algorithms and product experience
• Legal Compliance: Meet legal obligations and protect our rights
• Date and Time Accuracy: Use your timezone information to ensure workout logs, activity dates, and scheduled notifications display correctly according to your local time
• Trainer Profiles: Display trainer profiles in our public catalog when activated, generate AI summaries of trainer programming styles
• Coach Matching: Enable users to select trainers as coaches and filter programs by trainer focus
• Program Analysis: Analyze trainer-generated programs to create AI summaries and identify programming patterns

3. Third-Party Services

We use the following third-party services that may process your data:

• OpenAI: Your workout preferences, goals conversation content, and related prompts are sent to OpenAI's API to generate personalized workouts, training roadmaps, and summaries. OpenAI's privacy policy applies to this processing. Trainer information and programs are also analyzed by OpenAI to generate AI summaries. Optional HealthKit / Health Connect metrics are not included in these prompts.
• Google Gemini: When you use voice input in the goals conversation or related voice features, audio may be sent to Google Gemini for transcription. Google's privacy policy applies (policies.google.com/privacy).
• MongoDB Atlas: Secure cloud database hosting for your account and workout data
• Amazon Web Services (AWS): Cloud hosting and infrastructure services
• AWS S3: Trainer photos and documents (and other user media we store for the Service) are stored securely in AWS S3 buckets with appropriate access controls
• Amazon SES: Transactional and product emails (for example account notices and training reminders) are sent using Amazon Simple Email Service
• Stripe: Payment processing for Hyprform platform subscriptions purchased on the web, coach access fees, invoices, and trainer payouts. When you subscribe via Stripe, pay a coach fee, or onboard as a trainer, payment and payout data are processed by Stripe (including Stripe Connect for trainers). We store billing-related identifiers such as Stripe customer, subscription, and invoice IDs—not your full card number. Stripe’s privacy policy applies (stripe.com/privacy).
• Apple (In-App Purchase / App Store): When you subscribe to Hyprform on iOS through Apple In-App Purchase, Apple processes the payment. Apple may share limited purchase data with us (such as transaction identifiers, product ID, and subscription status) so we can unlock and renew your membership. We do not receive your full card number from Apple. Apple’s privacy policy applies (apple.com/legal/privacy).
• Microsoft Clarity: We use Microsoft Clarity for session recordings, heatmaps, and usage analytics on our website. Clarity is classified as essential session analytics and loads on every website visit, including before you log in. Google Analytics loads only if you choose “Accept all” in our cookie banner. Microsoft’s privacy policy applies (privacy.microsoft.com/privacystatement).
• Google Analytics: We use Google Analytics to understand how our website is used (page views, usage patterns). Google Analytics cookies load only with your consent. Google's privacy policy applies (policies.google.com/privacy).
• Apple / Google push services: Push delivery uses Apple Push Notification service (APNs) and/or Firebase Cloud Messaging (FCM), which process device push tokens
• Sentry: Mobile crash reports, performance traces, and related diagnostics (device/OS info, app version, and optionally a user id/email for support). Sentry’s privacy policy applies (sentry.io/privacy).
• Expo / app distribution tooling: Build and over-the-air update infrastructure may process limited technical metadata related to app versions and updates (not your workout content as a primary purpose)

4. Data Sharing and Disclosure

We do not sell your personal information. We may share data only in these limited circumstances:

• Service Providers: With trusted third parties who help operate our service
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In case of merger, acquisition, or sale of assets
• Consent: When you explicitly consent to sharing
• Public Trainer Profiles: When trainers activate their trainer card, their profile information (name, bio, photo, AI summary, training focus, methodology) becomes publicly visible in our catalog. This is done with explicit trainer consent through the activation process.
• Coach Selection: When a user selects a trainer as their coach, the trainer's training focus is used to filter programs, but no personal contact information is shared.
• HealthKit / Health Connect: Optional recovery metrics read from Apple Health or Health Connect are stored on your Hyprform account. They are not shared with coaches, advertisers, or other third parties, and are not included in AI generation prompts.

5. Data Security

• Encryption: Data in transit and at rest is encrypted
• Access Controls: Limited access to personal data on a need-to-know basis
• Regular Audits: Security practices are regularly reviewed and updated
• Secure Infrastructure: Hosted on enterprise-grade cloud platforms
• Secure File Storage: Trainer photos and documents are stored in AWS S3 with restricted access policies and presigned URLs for secure uploads
• Profile Privacy: Trainer profiles are only publicly visible when explicitly activated by the trainer

6. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal data (email support@hyprformai.com from your registered address, or use in-app / account deletion flows when available). We verify ownership, stop recurring billing where applicable, and purge personal workout data according to this policy
• Portability: Export your data in a machine-readable format
• Objection: Object to certain types of data processing
• Restriction: Request restriction of data processing
• Email and notification controls: Adjust product email preferences and mobile notification settings where offered; revoke OS-level permissions (Health, microphone, photos, notifications) in your device settings
• Trainer-Specific Rights: Trainers can deactivate their public profile at any time, update their AI summary, and request removal of uploaded photos or documents

7. Data Retention

• Active Accounts: Data retained while your account is active
• Inactive Accounts: Deleted after 3 years of inactivity
• Deleted Accounts: Data purged within 30 days of account deletion
• Legal Requirements: Some data may be retained longer for legal compliance
• Analytics Data: Anonymized after 2 years
• On-device HealthKit / Health Connect cache: Replaced each time the app refreshes recovery metrics. Deleted when you turn Recovery off in Settings, or when you uninstall the app.
• Account health recovery snapshots: Latest snapshot plus up to 14 days of history, retained while your account is active and purged with account deletion.

8. International Data Transfers

Your data may be processed in countries other than your residence. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by relevant data protection authorities
• Other legally recognized transfer mechanisms

9. Children's Privacy

Our service is not intended for users under 18 years of age. We do not knowingly collect personal information from children under 18. If you become aware that a child has provided us with personal information, please contact us immediately.

10. Cookies and Tracking

On our website, we use cookies and similar technologies to:

• Essential: Enable core functionality like login sessions
• Session analytics (Microsoft Clarity): Essential — loaded on all website visits (including before login) to help us understand how pages are used. Google Analytics is optional and loads only when you choose “Accept all.”
• Analytics cookies (Google Analytics): Optional cookies to measure website usage, loaded only when you choose “Accept all” in our cookie banner
• Preferences: Remember your settings and preferences

You can manage cookie preferences through our cookie banner (including the footer “Cookies” link) or browser settings. Clarity runs as essential session analytics on every visit; choosing “Accept all” additionally enables Google Analytics. Our mobile apps do not use the website cookie banner; mobile analytics or crash reporting, if enabled in a future release, will be disclosed here and controllable where required.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Sending an email notification to registered users
• Displaying a prominent notice on our service

12. Contact Us

If you have questions about this privacy policy or your personal data, please contact us:

• Email: support@hyprformai.com
• Address: Hyprform LLC. Mailing address available upon request to support@hyprformai.com.
• Data Protection Officer: support@hyprformai.com

13. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Consent: For non-essential cookies, optional health-data access, push notifications, and optional product emails where consent applies
• Contract: To provide our workout generation service and related account features
• Legitimate Interest: For service improvement, security, fraud prevention, and certain product reminder emails (subject to your preference controls)
• Legal Obligation: For compliance with applicable laws

14. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), subject to applicable exceptions:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect, use, and disclose
• Right to Delete: Request deletion of personal information we hold about you, subject to legal exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt Out of Sale/Sharing: Hyprform does not sell your personal information and does not share it for cross-context behavioral advertising
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, email support@hyprformai.com from your registered address. We will verify your request before responding. Authorized agents may submit requests on your behalf where permitted by law.