Privacy policy

The short version: your training data is yours, sharing is opt-in, and we never sell data or run trackers. The full policy follows.

Huzo (“we”, “us”) builds a workout tracking app. This policy explains what personal data we collect, why, and the choices you have. It applies to the Huzo web app, any installed app version, and our websites. Effective September 26, 2026.

What we collect

  • Account data: email address, display name, optional profile photo, optional username. If you sign in with Google, we receive your name and email from Google.
  • Workout data: the plans you build, your weekly schedule, and the workouts you validate (exercises, sets, optional weights per set).
  • Body measurements (optional): weight, body fat, and body-part circumferences you choose to log.
  • Feed content: posts you write, photos you upload, and the public/private choice you make per post. Follows and whether you opt in to sharing workout progress with followers.
  • Safety records: the date you accepted these terms and this policy, reports you file about posts, and the list of athletes you block.
  • Gym check-ins (optional): if you pin a gym and grant location permission, your device uses your location once per validation to check whether you are near that gym. We store only the result, the gym's name on the validated workout, never your coordinates or location history. Without permission, workouts are simply self-reported.
  • Age declaration: the app is 18+. On first sign-in you declare your birth month and year so we can enforce that requirement; we store only the month and year, never the full date.
  • Analytics (optional, consent-gated): if and only if you accept analytics in the in-app consent prompt, we collect privacy-respecting product analytics via PostHog (US-hosted) — feature usage and crash reports. The default is off, nothing is collected before you accept, and you can withdraw consent anytime in settings (sharing off, delete the data).
  • On-device only: theme, units, rest-timer settings, per-exercise weight preferences, and any guest-mode data. These never leave your browser or device.

Consumer health data (US states)

Laws such as Washington’s My Health My Data Act treat body measurements and fitness information as consumer health data. For that data we collect only what you enter, use it only to show your own progress, never sell it, never share it for advertising, and never use it for targeted advertising. You can delete every entry yourself, and deleting your account removes all of it.

Why we process data (legal bases)

  • To provide the service you signed up for (contract): accounts, plans, workouts, measurements, feed.
  • Your consent: posting publicly, sharing progress with followers, uploading photos, using Google Sign-In. You can withdraw consent at any time (make a post private, turn progress sharing off, delete the data).
  • Legitimate interests: keeping the service secure and preventing abuse.

What we never do

  • We do not sell or rent personal data.
  • We do not show ads or share data with advertisers.
  • We do not run analytics without your consent (see “Analytics” above — optional, off by default, and off entirely until you accept).
  • We do not use your data to train AI models.

Service providers and storage

Data is stored on Supabase, hosted on AWS in Singapore (ap-southeast-1). Feed photos are stored on Cloudflare R2 via a Huzo-operated worker. Google processes data for Google Sign-In, and - only when you use the gym pin feature - a one-shot, not-stored device-coordinate lookup via the Google Places API to find nearby gyms. These providers process data on our instructions under data-processing agreements. Data is encrypted in transit. The service is operated by a small independent team.

Health Connect (Android)

The Android app can sync with Health Connect, the on-device health data hub on Android phones. With your permission it writes validated workouts, hydration and nutrition entries into Health Connect, and reads steps and weight to show in your trackers. That data stays on your device inside Health Connect (or in your Huzo account if you have one and the tracker is enabled) - we never sell it, never share it for advertising, and never use it for targeted advertising. You control the connection from Android's Health Connect settings and can revoke access at any time. Health Connect support is free in Huzo and will always be free.

Retention and deletion

We keep your data while your account exists. Deleting your account (Profile → Account → Delete account) permanently and immediately removes your account and every record tied to it: plans, workouts, measurements, posts, follows. Guest-mode data lives only on your device and resets automatically after 24 hours away. You can export everything as JSON at any time (Profile → Settings).

Your rights

Wherever you live, you can access, correct, export, or delete your data yourself in the app. Additionally:

  • EU/EEA and UK (GDPR): you may restrict or object to processing and lodge a complaint with your national data protection authority.
  • US states (California CCPA/CPRA, Washington MHMD, Virginia, Colorado, and similar): you have the right to know, access, correct, delete, and not be discriminated against for exercising rights. We do not sell or share personal information as those laws define it, so no opt-out link is required today.
  • India (DPDP Act 2023): you can access, correct, erase, and nominate. Grievances go to the contact below and are acknowledged within 72 hours.
  • Brazil (LGPD), Canada, Japan, Singapore, Australia: equivalent access, correction, and deletion rights.

Children

Huzo is not directed at children under 13 (under 16 in the EEA), and we do not knowingly collect their data. If you believe a child created an account, contact us and we will delete it.

Security

Traffic is encrypted (HTTPS), passwords and sessions are managed by Supabase Auth, and database access is protected by row-level security so users can read only their own records (and public posts).

Changes to this policy

We will update this page and the effective date when the policy changes. Material changes that affect your rights will be surfaced inside the app before they take effect.

Contact

Questions, requests, or grievances: support@huzo.app. You may also reach your local regulator; for EU/EEA users that is your national data protection authority.