Privacy policy

Last updated: October 29, 2026

heavypal ("we", "us") is a workout tracking app. This policy explains what data the app handles and what your choices are.

Contact: support@heavypal.com

Data we collect

When you sign in with Google or with Apple we receive and store:

• your email address and display name, and your Google profile picture when you sign in with Google
• a user ID we create for your account

Apple lets you hide your email address when you sign in. If you do, we only ever see the relay address Apple gives us.

While you use the app we store data you create:

• workouts, exercises, sets, reps, and weights you log, including past workouts you add later and workouts you import from another app
• training programs and workouts, your training goal and workouts per week
• body weight, body measurements and water you log (optional)
• your height and gender, if you add them (optional); your gender picks the body figure your workouts are drawn on
• your country (you pick it, or the app fills it in from your phone's own region setting, see "Country" below) and your phone's time zone, so that "today" and "this week" match your calendar
• friends you add and interactions in social features, such as likes and comments
• messages you send to the AI coach (optional)
• messages you send to support in the app, and the file you attach when you report an import problem (optional)
• a push notification token for your device, if you enable notifications, and which notifications you want. Promotional pushes ("News and tips") are off until you say yes; we keep your answer and when you gave it.

How you use the app

To improve heavypal, the app records how it is used:

• the screens you open and for how long, what you tap, and which cards were on screen
• where on the screen you tap, as a position only. Nothing you type is recorded: the number pad's keys record nothing, and your phone's keyboard never reaches the app.
• what you search for and the first results shown
• what you do, such as starting, finishing or saving a workout
• errors, crashes, and how long the app takes to start
• which notification opened the app
• your app version and device details such as phone system, language and text size

These records are linked to your account and kept for 90 days.

Once per app version the app also reports where each card sits on a screen. These boxes are not linked to anyone.

On Android, after you sign in, the app reads once which link or campaign led to the install (Google Play's install referrer, with the times of the click and the install). It is linked to your account and kept until you delete the account. iPhones send nothing like it.

Our server logs every request the app sends: the time, the address called (with any search words in it, such as a name you search for in Add friend), the answer, your IP address and your app version. This log is kept for 400 days.

None of this is sold or shared. It is deleted with your account, apart from the anonymous daily counts described under "Data retention and deletion". The app has no ads and no third party tracking.

Country

Your country is used for the regional leaderboard. The app fills it in from what your phone already knows: the country of your SIM card, or the region of your device's language settings. This needs no permission, nothing is read from your location, and only the two letter country code is saved. You can change it, or clear it, in Settings at any time.

Calendar

If you add training days to your calendar, events are created directly in your device calendar. Calendar data is not uploaded to our servers.

How we use data

• to run the app: sync your training data, power progress charts, social features, and leaderboards
• to generate AI coaching responses to your requests
• to answer your support messages
• to send push notifications you have enabled, like workout reminders or friend activity, and News and tips only if you said yes
• to see which features are used, to find and fix errors, and to see which links and campaigns bring new users

We do not sell your data or use it for advertising.

Service providers

• Hosting: our servers run on Hetzner infrastructure in Germany (EU).
• AI coach: the content of your AI coach requests and relevant training context is processed by Anthropic to generate responses.
• Push notifications: delivered via Google Firebase Cloud Messaging.

These providers process data on our behalf and are not permitted to use it for their own purposes.

Leaderboards and social

Your display name, country flag, and training stats such as workout counts and points appear on the global and regional leaderboards. Set Profile Visibility to Private in Settings and only your friends see you there. Friends you add see your finished workouts in their feed and, if you turn on "Show my activity to friends", your workout while you train. A workout you share by link can be seen by anyone who has the link.

Data retention and deletion

Your data is kept while your account exists, with these exceptions:

• records of how you use the app (screens, taps and tap positions, searches, actions, errors): 90 days
• the server's request log, with your IP address: 400 days
• a daily summary per account: whether you opened the app, how many sessions, screens and workouts, sets and total weight lifted, and your phone system and app version. It is kept to see how use changes over time. When you delete your account it is no longer linked to you and stays only as an anonymous count.
• where each card sits on each screen, per app version: kept, not linked to anyone

You can delete your account at any time in the app under You, Settings, Account, Delete Account. This permanently deletes your account and associated data from our servers, including your usage records, request log and install source. After that we keep only the anonymous daily counts above, requests sent while signed out (such as the sign-in itself), which are linked to no account and are deleted after 400 days, a record of any change support made to your account, kept for 2 years, and your places on past monthly leaderboards: they stay as "Deleted user" with that month's points, workout totals and country, without your name or account, so nobody else's place changes. You can also request deletion at heavypal.com/delete-account or by emailing support@heavypal.com.

Security

All traffic between the app and our servers is encrypted in transit (TLS).

Children

heavypal is not directed at children and is intended for users 18 and over.

Your rights

Depending on where you live, for example in the EU or EEA under GDPR, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict processing. Contact us at support@heavypal.com to exercise these rights.

Changes

If we change this policy we will update this page and the date above.