Privacy Policy

HealthForge is a fitness app for following training programs, logging workouts and understanding your recovery. In this policy, “HealthForge”, “we” and “us” mean the team that runs it, and “you” means anyone who uses it.

This policy covers the HealthForge app for iPhone and Android, its Apple Watch and Wear OS companion apps, the service those apps connect to, and this website. You can reach us at support@healthforge.app.

Your account

• When you sign in, our sign-in provider, Auth0, gives us your email address and an account identifier. We never see your password.
• The profile details you add: first and last name, date of birth, sex, height, weight, profile photo, and daily step and distance goals.

Your training

• The workouts you log, on your phone or your watch: which workout, when and for how long, and for each set the reps, weight and time you record. We work out the calories a workout burned from its sets and your weight. A workout logged on your watch reaches us through the app on your phone.
• Workouts you save to start again: the name you give each one, and its exercises with their sets, reps, time and rest.
• Measurements saved with a workout: average and maximum heart rate for the session and for each set, and the steps and distance recorded during it.
• The programs you start, your progress through them and when you finish.
• The workout reminders you set up, your notification preferences, quiet hours and time zone.

Notifications

• If you allow notifications: a push token for each device, with the device’s name, platform and app version.
• A record of the notifications we send you, which is what fills your in-app inbox.

How the app is running

• With each request, the app tells our servers whether it runs on iOS or Android, its version, and whether notifications are allowed. We keep the latest of these and when you were last active.
• Auth0 records when you sign in, how often, and the IP address of your most recent sign-in.

Social features

If you use them: your handle, display name and bio, your profile number, which version of the community rules you agreed to and when, who you follow and block, your settings for who can mention you and for read receipts, your activity, posts, comments, reactions and messages (with any photos, videos, GIFs and voice notes in them), and any reports you make. Section 6 explains each.

If you ask us to delete your account on this website

The email address you enter and any reason you give.

What we don’t collect

We don’t collect your location, contacts or browsing history. The app contains no advertising, analytics or tracking tools, and we don’t follow you across other companies’ apps or websites.

A photo or video can record where it was taken. The app removes that before it uploads one. Older versions of the Android app kept it in a profile photo. If you added yours from an Android phone, update the app and add your photo again: the new one carries no location, and the old one is deleted. The app uses your camera, photos and microphone only when you choose to take or add a photo or video, or record a voice note.

HealthForge uses health data only with your permission, which you can change at any time in the Health app on iPhone or in Health Connect on Android.

What the app reads

• From Apple Health: heart rate, resting heart rate, heart rate variability, VO₂ max, respiratory rate, blood oxygen, sleep, sleeping wrist temperature, steps, and walking and running distance.
• From Health Connect: heart rate, resting heart rate, heart rate variability, VO₂ max, respiratory rate, oxygen saturation, sleep, steps and distance.
• During a workout: live heart rate from your Apple Watch, your Wear OS watch or a Bluetooth heart-rate monitor you connect. The Apple Watch app also reads active and resting energy, steps and your Activity rings. Bluetooth is used only to connect to that device, never to work out where you are.
• From a Wear OS watch you choose as your health source: on Android you can use your watch instead of Health Connect. It then collects your heart rate, steps, distance and whether you’re asleep or awake in the background, and sends them to the HealthForge app on your phone. They’re never written to Health Connect.
• Counting reps: your watch reads its motion sensors during a set to count reps. The movement itself never leaves the watch: only the count goes to your phone, with how sensitive counting should be for each exercise, and none of it reaches us.

What the app writes

A workout recorded on the Apple Watch app is saved to Apple Health, where it counts towards your Activity rings. The Wear OS app saves the workout and its heart rate to Health Connect. Deleting that session in HealthForge removes the workout it saved.

What stays on your phone

Your recovery score, your fitness age and the daily readings behind them are calculated on your phone, and stay there unless you ask for an AI summary. The app keeps a year of those daily scores to draw their trends, and, with a Wear OS watch as your source, 90 days of its heart-rate readings and two years of its daily totals. Signing out doesn’t remove these from the phone; deleting the app does.

Health data that reaches our servers

Only two kinds: the heart rate, steps and distance saved with a workout, and the figures you choose to send for an AI summary (section 5). That’s true whichever source they come from, including a Wear OS watch.

We never use health data for advertising or marketing, never sell it, and share it only as this policy describes.

• To run the app: your programs, workout history, progress, goals and profile.
• To send the notifications you’ve allowed, and emails about changes to your account, such as premium access starting or ending.
• To write the AI summaries you ask for and to make search understand what you mean.
• To keep the community safe: screening the text you write on your profile, in posts, in comments and as a group chat’s name, and the photos, videos and GIFs sent in messages, reviewing reports and acting on accounts that break the rules.
• To protect the service: limiting how many requests an account can make, and finding and fixing errors.

We don’t use your information for advertising, and we don’t sell it.

HealthForge uses OpenAI for four things. OpenAI processes what we send and returns a result; its terms for this kind of use say it doesn’t train its models on that data.

AI summaries

• A summary is written only when you tap to ask for one.
• What’s sent: the scores and figures already on your screen, such as your recovery score and the readings behind it, how they compare with your usual levels, and your age, sex and program type. Your name, email and account identifier are not sent.
• We don’t save what you send, or the summary, in our database. A summary is held briefly in our server’s memory so that asking again the same day doesn’t write it twice.

Search

The words you type into exercise or program search are sent to OpenAI to understand what you mean. Nothing that identifies you goes with them.

Screening what you write

When you set or change your handle, display name or bio, write a post or a comment, or name a group chat, the text is checked by OpenAI’s moderation service before it’s saved. If the check can’t run, it isn’t saved. Text that passes but comes close to the line may be queued for a moderator to look at.

Checking what you send in messages

A photo, video or GIF you send in a message, including the picture on a link preview, is checked by OpenAI’s moderation service before anyone else can see it. For a photo, OpenAI is given a link that works for two minutes; for a video, our server takes still frames from it and sends those; for a GIF, it’s GIPHY’s still image. Only whether it passed is kept. If the check can’t run after three tries, the message isn’t delivered.

Voice notes aren’t checked, and neither is a photo on your profile or a photo or video in a post: reports and moderators deal with those.

The words of your messages are never sent to OpenAI.

Social features are optional and are arriving in the app gradually, so this section applies once they’re available to you. To use them you create a social profile, which is kept separate from your private profile details.

Your social profile

Anyone signed in to HealthForge can see your handle, display name, bio, profile photo, profile number, when you joined, how many posts you’ve written, and how many people you follow and are followed by. Apart from the photo, nothing from your private profile, such as your date of birth, height or weight, is part of it. Your profile number is nine digits picked at random when you join, so it says nothing about you or how many people joined before you.

Creating a social profile means agreeing to the community rules, and we record which version you agreed to and when. If the rules change, you’ll be asked to agree again before you can follow people, accept requests, react, post, comment, send messages or edit your handle, name or bio. Blocking and reporting always work.

Finding people

• People with a social profile can find you by your handle or display name, or by your exact profile number.
• They can also find you by your exact email address, unless you turn off Find me by email. Search results never show anyone’s email address.
• People you’ve blocked, or who have blocked you, can’t find you.
• The app keeps a list of the people you’ve opened from search on your phone, so you can find them again, but never what you typed. You can remove people from it one at a time or all at once, and signing out clears it.

Following

Following someone is a request until they accept it. Your lists of followers and people you follow are visible only to followers you’ve accepted.

Activity

When you save a workout, start a program or finish one, your accepted followers can see it and react to it. It says which workout or program it was and when, and nothing else: never your heart rate, weights, duration or anything you typed. You can turn activity sharing off at any time, which stops new activity and hides past activity, and your posts, from everyone but you.

Posts

• A post is up to 1,000 characters, with up to four of your own photos or one video. It’s for the followers you’ve accepted, unless you make it public, which you can choose when you post it or change afterwards.
• A public post can be seen in the app by anyone signed in who can see your profile, and on our website by anyone with its link, but only followers you’ve accepted see it in their feed.
• In the app, a post is never shown to someone you’ve blocked or who has blocked you. Anyone who can see a post there can react to it and report it.
• The words are screened before the post is saved. The photos and video aren’t.
• Anyone who can see a post in the app can comment on it, reply to a comment and react to one. A comment is up to 500 characters, is screened like a post before it’s saved, can be reported, and can be deleted by whoever wrote it or by the post’s author; a moderator can remove one too. You don’t see comments from someone you’ve blocked or who has blocked you. Deleting a post deletes its comments. Comments stay in the app: our website doesn’t show them.
• You can mention someone by their @handle in a post or a comment. They’re linked, and notified, only if they can already see what you wrote. You choose who can mention you: everyone, people you follow, or no one. If you’re under 18, or your profile has no date of birth, “everyone” works as “people you follow”.
• Deleting a post removes it and its photos or video. A moderator can remove one too: it stops being shown to everyone, including you, its photos or video are deleted, and we keep a record that it was removed.

Links to you and your posts

• Anyone with the link to a public post can see it on our website without signing in: its words, photos or video, when it was posted, and your display name, handle, profile number and profile photo.
• A link to your profile, or to one of your posts that isn’t public, shows your display name, handle and profile photo on our website to anyone with the link.
• Our website can’t tell who’s reading, so blocking someone doesn’t hide these pages from them.
• These pages ask search engines not to list them in search results.

Messages

• Messaging is only for people 18 or over, going by the date of birth in your profile. We never tell anyone whether someone else can be messaged because of their age.
• A first message from someone you don’t follow arrives as a request, which you can accept or decline.
• Messages are stored on our servers so they can reach both of you. They’re encrypted on the way, but they are not end-to-end encrypted.
• A message can carry photos, a video, a GIF or a voice note. Photos, videos and voice notes are uploaded as soon as you add them, so sending is instant; anything you don’t send is deleted within an hour. A photo, video or GIF is checked before anyone but you sees it (section 5), and from someone you don’t follow it’s blurred until you tap it.
• GIFs are searched through our servers, so GIPHY gets the words you search for but nothing that says who you are. The GIFs themselves load from GIPHY, which sees your phone’s IP address, as any website you visit does.
• When you type a link into a message, the app reads that web page itself, without signing in to it, to build a preview, so the site sees your IP address as it would if you opened the link. The preview’s title, description and a copy of its picture are sent with the message, and the picture is checked like any photo. Our servers never visit the link. For a link that arrives without a preview, the other person’s phone reads the page only if they tap to load one.
• You can edit a message for 15 minutes. We keep the earlier versions with the message, and only a moderator ever sees them, if someone reports it. You can unsend a message within 24 hours, which erases it, and anything it carried, for everyone.
• Deleting a message or a conversation removes it from your side only. Once nobody in a conversation can see a message any more, we delete it and anything it carried.
• In a conversation you’ve both accepted, the other person can see when you’re typing, which we pass on but never store. Read receipts show how far you’ve read, but only while you both have them turned on; you can turn yours off in settings. We still record how far you’ve read, to keep your unread count right.
• Muting a conversation stops its notifications and nothing else.
• A notification tells you a message has arrived, but never includes what it says.
• So conversations open quickly, the app keeps your recent ones on your phone, encrypted with a key that never leaves it, and clears them when you sign out.
• HealthForge staff don’t read conversations. If someone reports messages, a moderator sees only the messages that person chose to report.

Group chats

• A group chat holds up to 32 people, you included. Someone you follow can add you straight in; from anyone else, being added arrives as an invitation in your requests, which you can accept or decline.
• Everyone added has to meet the same age requirement as messaging. If someone can’t be added, we don’t say why, so a group can’t be used to learn anyone’s age.
• A group’s name is optional. If it has one, it’s checked like your profile text before it’s saved (section 5); a group’s photo isn’t checked, just as a profile photo isn’t. Anyone in the group can report its name or photo.
• The group’s owner and admins can add and remove people and change its name and photo. When the owner leaves or deletes their account, the group passes to the longest-serving admin, or member.
• Group messages are stored, edited, unsent and deleted like any other message. Read receipts work as they do between two people: you see how far someone has read only while you both have them turned on.

Blocking and reporting

• Blocking someone hides you from each other in the app, stops messages between you (in a group chat you share, it hides you from each other there without removing either of you), and removes the reactions you’ve left on each other’s activity. Reactions on posts and comments are hidden from the two of you rather than deleted, so what everyone else sees doesn’t change.
• A report keeps a copy of what was reported, so a moderator can review it even if it’s changed or deleted afterwards. The person reported isn’t told about the report or who made it.
• Moderators can remove reported content or suspend an account. A suspended account is hidden from everyone else and can’t send messages.

We don’t sell your information. We share it only with the services that run HealthForge for us, with other people as section 6 describes, and when the law requires it.

We may also disclose information when the law requires it, or where it’s needed to protect the safety of our users or the public.

Our database and stored files are in Sydney, Australia. The HealthForge service runs in the United States, and several of the services in section 7 handle data in the United States or elsewhere, so your information may be processed outside the country you live in.

• Your account, training history, saved workouts and social data: until you delete them or your account.
• Notifications you’ve received: for as long as you have your account, so your inbox stays complete. Notifications we held back because of your settings, or never sent, are deleted after 90 days.
• Notifications about messages: they aren’t part of your inbox, and are deleted after 90 days.
• AI summaries: not stored in our database.
• Messages: until their sender unsends them or deletes their account, a moderator removes them, or nobody in the conversation can see them any more. Earlier versions of an edited message go with it. Photos, videos and voice notes you add to a message but don’t send are deleted within an hour.
• Profile photos: when you change yours, the old one is deleted.
• Removed messages: when a moderator removes a message, or its sender deletes their account, the text is erased and an empty placeholder stays in the conversation.
• Reports and moderation decisions: kept as the record of what happened. Reports about you are deleted with your account; reports you made stay, no longer linked to you.
• On your phone: so it opens quickly, the app keeps a copy of what it last showed you for up to a day, your recent conversations (encrypted) and the people you’ve opened from search. Signing out clears all three. A workout you finish without a connection waits on the phone until it reaches us; it stays through signing out so it can upload when you sign back in, deleting your account removes it, and once another account signs in on that phone it’s let go after 30 days. Your health trends, and data from a Wear OS watch, stay on the phone until you delete the app (section 3).
• Our website’s pages for shared links: what they show can be up to a minute old, so a post you delete, or a change to your profile, can take that long to reach them.
• Deletion requests made on this website: the address and reason stay until the request is completed or dismissed, the emailed link expires unconfirmed after 48 hours, or your account is deleted. After that, all that remains is a record of the request and what happened to it.

Delete your account in the app, on the You tab, with Delete account. It’s deleted straight away.

Without the app, use our delete-account page. We email a link to the address your account uses; once you confirm it, we delete every account that uses that address (signing in with Google and with a password makes two) and email you when it’s done. We never say on the page whether an account uses the address you enter. You can also email support@healthforge.app from the address you sign in with.

Deleting your account permanently removes your profile, training history, saved workouts, photos, reminders, notification records and social profile, with your posts, comments, activity, reactions and follows, and deletes the Auth0 sign-in account you used. If you also signed in another way (Google and a password make two accounts), delete that one as well, or use our website, which deletes both. It can’t be undone.

What stays behind

• Messages you sent: the text and anything they carried are erased, but an empty placeholder stays in the other person’s conversation.
• Reports you made: kept for the moderation record, no longer linked to you.
• Notifications that mention you and that other people have already received, such as a follow request, stay in their inbox.
• Copies held by the services in section 7 follow their own retention terms.
• What the app kept on your phone: deleting your account signs you out, which clears most of it, and deleting the app removes the rest.

• Your information: see and change your profile, training history and settings in the app.
• Health access: change what HealthForge can read or write in the Health app on iPhone or in Health Connect on Android.
• Notifications: turn categories off in the app, or all notifications off in your device settings.
• Social: choose whether each post is public, turn activity sharing off, stop people finding you by your email, choose who can mention you, turn read receipts off, mute conversations, clear your recent searches, decline follow and message requests, and block or report people.

Depending on where you live, you may have the right to access, correct, delete or move your information, or to object to how it’s used. Email support@healthforge.app to make a request. You can also complain to the privacy regulator where you live.

HealthForge isn’t intended for children under 13, and we don’t knowingly collect their information. If we learn that we have, we’ll delete it. Messaging is only for people 18 or over.

• Information moves between the app, our servers and the services above over encrypted connections.
• Photos and videos are served through short-lived links, and only to people signed in to HealthForge, apart from the public posts and profile photos our website shows (section 6). What’s sent in a message is served only to the people in that conversation.
• Only a small number of HealthForge administrators can see account details, to support users and enforce our rules. Changes to an account’s access, and every moderation decision, are recorded.

No way of storing or sending information is completely secure, but we work to protect yours.

When this policy changes, we’ll post the new version here and update the date at the top. If a change significantly affects how your information is used, we’ll also tell you in the app.

For questions, requests or concerns about your privacy, email support@healthforge.app.