This Privacy Policy applies to the FitHalo mobile application (the "Application") created by Jacob Johnston (the "Service Provider") and made available free of charge. The Application is provided "as is."

Information Collection and Use

The Application does not collect personal information when you download or use it. Registration is not required. If you choose to connect a third-party service such as Strava or Hevy, certain workout data may be transmitted to that service as described below.

Location and Health Data

The Application may request access to your device's location services to record workout routes and to Health permissions to read and write workout information. This data is stored locally on your device and is not collected or transmitted by the Service Provider, except when you explicitly choose to share a workout through a third-party integration such as Strava or Hevy.

Third-Party Integrations

The Application offers optional integrations with Strava and Hevy. Each integration is entirely voluntary and must be explicitly enabled by you through the Application's settings.

Strava

If you choose to connect your Strava account, the following applies:

  • Data transmitted to Strava: When you upload a workout, data such as activity type, start time, duration, distance, GPS route, heart rate, and calorie estimates may be sent to Strava on your behalf.
  • Authentication: The Application uses Strava's OAuth 2.0 authorization flow. Your Strava credentials are never seen or stored by the Application or the Service Provider. An access token issued by Strava is stored locally on your device solely to perform uploads you initiate.
  • Service Provider access: The Service Provider does not receive, store, or have access to any data transmitted to Strava.
  • Strava's privacy practices: Once data is uploaded to Strava, it is governed by Strava's Privacy Policy. The Service Provider is not responsible for Strava's data handling practices.
  • Disconnecting Strava: You may revoke the Application's access to your Strava account at any time from within the Application's settings or directly through your Strava account settings. Revoking access stops all future data transmission to Strava.

Hevy

If you choose to connect your Hevy account, the following applies:

  • Authentication: Connecting Hevy requires an API key, which Hevy provides to its Hevy Pro subscribers. The API key and your Hevy account name are stored locally on your device using the platform's secure storage mechanisms. The API key is sent only to Hevy, with each request the Application makes to Hevy on your behalf, and is never seen or stored by the Service Provider.
  • Data transmitted to Hevy: If you turn on sending workouts to Hevy, each strength training session you log in the Application is sent to Hevy on your behalf, including its title, start and end times, exercises, and sets (such as weight, reps, duration, distance, and effort), along with notes describing details Hevy cannot otherwise record. You may choose to have these workouts marked as private in Hevy.
  • Data received from Hevy: If you turn on bringing routines or workouts in from Hevy, the Application reads your Hevy routines and workouts from Hevy and stores them locally on your device. This data is not transmitted to the Service Provider.
  • Service Provider access: The Service Provider does not receive, store, or have access to any data transmitted to or received from Hevy.
  • Hevy's privacy practices: Once data is sent to Hevy, it is governed by Hevy's Privacy Policy. The Service Provider is not responsible for Hevy's data handling practices.
  • Disconnecting Hevy: You may disconnect Hevy at any time from within the Application's settings. Disconnecting removes the API key and your Hevy account name from your device and stops all future data transmission to and from Hevy. You may also turn off each direction of syncing separately.

Data Sharing

The Service Provider does not sell, trade, or otherwise share your data with third parties. The only exceptions are when you voluntarily send workouts to Strava or Hevy through the optional integrations described above. No data is shared with any other third party under any circumstances.

Opt-Out Rights

You may disconnect the Strava integration at any time from within the Application's settings or through your Strava account, and the Hevy integration at any time from within the Application's settings. You may stop all use of the Application at any time by uninstalling it through your device's standard uninstall process.

Children's Privacy

The Service Provider does not knowingly collect personal information from children. Parents and legal guardians are encouraged to monitor their children's use of the Application and to instruct children never to provide personal information through the Application without permission. If you believe a child has provided personal information, please contact the Service Provider at [email protected] so that appropriate action can be taken. In jurisdictions requiring parental consent, you must be at least 16 years old to consent to the processing of personal information unless a parent or guardian provides consent on your behalf.

Security

The Application does not collect or store personal information on the Service Provider's servers, so there is no risk of unauthorized access to your data by the Service Provider. Strava OAuth access tokens and the Hevy API key are stored locally on your device using the platform's secure storage mechanisms and are used solely for the integrations you enable.

Changes to This Policy

The Service Provider may update this Privacy Policy from time to time. Any changes will be posted on this page. Your continued use of the Application after changes take effect constitutes your acceptance of the revised policy.

By using the Application, you consent to the terms of this Privacy Policy now and as amended by the Service Provider.

Contact

If you have any questions regarding this Privacy Policy or the Application's practices, please contact the Service Provider at [email protected].