Privacy Policy

Last updated: 18 October 2026

This policy explains what personal data the Heatsy app and its server process, why, who else receives it, and what you can do about it. Heatsy is a strength-training app for iPhone. It is made by DDDEV LTD (“we”, “us”).

Who is responsible

DDDEV LTD is the controller of your personal data.

• Registered office: c/o Schoolgate Accounting Services, 46-50 Coombe Road, New Malden, London, KT3 4QF, England
• Company number: 16374016 (registered in England and Wales)
• Email: support@heatsy.app

The short version

• You sign in with your email address and a one-time code. We store your account, profile, plans and workout log on our server in the EU (Hetzner, Germany) so they sync and survive a new phone.
• The camera counts reps on your phone. Video is never saved and never leaves the device.
• Apple Health is optional: the iPhone app saves finished workouts there, and the Apple Watch app reads your heart rate and active energy on the watch during a workout to show them. This Health data stays on your devices and is not sent to us.
• The AI features run only after you allow them. They send training details, including the limits and injuries you enter (not your name, email or account ID), to OpenRouter, which routes them to a model provider in an EU region, as set in our routing: Microsoft Azure, Amazon Bedrock, Google Vertex AI or Anthropic. Each request asks for zero data retention and no training, and providers that collect data for training are switched off in our OpenRouter account.
• Usage statistics (PostHog, EU) are sent only if you turn them on. They are off by default.
• No ads and no sharing with data brokers.
• You can delete your account and all synced data in the app at any time.

What we collect and why

Account

• Email address, to create your account and send sign-in codes. Codes expire after 10 minutes.
• Display name, if you set one.
• Account ID, created by our server.
• Technical sign-in data: a sign-in token, and the IP address and device type (user agent) recorded when you sign in, to keep you signed in and to protect the account against misuse. They are stored with the session, which is valid for up to 30 days, and deleted when you sign out or delete your account.

You sign in only with your email address and a one-time code. We do not offer Sign in with Apple or passwords for user accounts.

Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)); session security data also our legitimate interest in protecting accounts (Art. 6(1)(f)).

Profile and training conditions

What you tell us in onboarding and in Profile: body type shown (male or female model), where you train (home or gym), your equipment, training days and session length, experience level, goals, and your limits and injuries: body areas you want to spare (for example knee or lower back) and an optional short note (up to 60 characters, for example “overhead press hurts”).

Your limits and injuries are health data. They are stored on your phone and on our server with your profile (plan conditions). We use them only to choose and order exercises, and, if you allow AI processing, they are included in the AI requests that build or change your plan (see “AI features”). We process them on the basis of your explicit consent (GDPR Art. 9(2)(a)), which you give when you enter them. You can remove them at any time in Profile → Plan conditions.

Plans, workout log and notes

Your plans and their names, the workouts you log (exercises, sets, reps, weights, times), your own exercises (name and machine), your settings and any notes you write on exercises and workouts. These are stored on your phone and synced to our server so they are backed up and available after you reinstall or switch phones.

Legal basis: performance of our contract with you (Art. 6(1)(b)).

Subscription

Purchases are handled by Apple. We do not receive your payment details. The app checks your subscription status with Apple on your device. Our server also receives App Store notifications and stores your subscription status (for example trial, active, grace period), the product, the dates, the App Store transaction ID and a random purchase token that links the purchase to your account, to unlock features. Legal basis: performance of contract (Art. 6(1)(b)).

Camera

The camera is used only while you choose to count reps. Pose detection runs on your phone. Video and images are not recorded, saved or sent anywhere, by us or by anyone else.

Apple Health

If you turn on Profile → Apple Health, Heatsy saves each finished workout to Apple Health: start and end time, the activity type (strength training), an estimated active energy figure and the number of sets. The iPhone app asks only for permission to write and does not read data from Apple Health. The Apple Watch app records the strength workout and reads your heart rate and active energy on the watch while the workout runs, to show them on the watch and on your iPhone. This data stays on your devices and in your Apple account. It is not sent to us.

Notifications

Notifications are scheduled locally on your phone: the rest-timer alert. We do not use push notification servers.

Product analytics (PostHog)

Only if you turn on Share usage statistics (in onboarding or in Profile → Usage statistics; off by default), the app sends a small, fixed set of usage events to PostHog, hosted in the EU, to help us understand which features are used and where people get stuck. Examples: a screen was opened, a workout was finished (counts and duration ranges, not the weights or reps themselves), the paywall was shown, an error code. Events carry the app version, OS version, language, device class (iPhone or iPad), subscription status and a pseudonymous analytics ID. Without this consent nothing is sent to PostHog.

Once you are signed in, the analytics ID is a pseudonym that our server calculates from your account with a secret key kept only on our server. It links your events to your account, but it is not your account ID or email, and PostHog does not receive your name, email, account ID or IP address. While the consent is on, our server also sends subscription events (started, renewed, refunded, billing problem) to PostHog under the same pseudonym. Events never include free text you type, workout notes, limits or injuries, camera data or Apple Health data. There is no session replay or screen recording. We do not use this data for advertising or to track you across other companies’ apps or websites.

Legal basis: your consent (Art. 6(1)(a)). Turn the switch off at any time: the app deletes events waiting to be sent, and our server deletes your person and events in PostHog and then the secret key, so the pseudonym can no longer be linked to you. If PostHog cannot be reached, the deletion is queued and retried. Deleting your account does the same. Events are kept until you withdraw consent or delete your account.

Server logs

We do not keep logs of what you send. The web server in front of our API writes a standard access log (time, IP address, device type (user agent), request method and path, response status) to run the service, find errors and stop abuse. The log is limited in size and overwritten automatically. Our API logs only technical events such as start-up, error codes and, for AI requests, the outcome and timing, never the content of requests. Legal basis: legitimate interest (Art. 6(1)(f)).

AI features

Heatsy’s plans are built by our own rules engine on our server. With your permission, an AI model helps with four things:

1. Building a plan: it chooses between exercises our engine has already found suitable for your conditions.
2. Changing a plan in one phrase, for example “no barbell on Fridays”.
3. Adjusting after a workout: it explains in plain words the changes our engine proposes.
4. Answering questions about an exercise, such as where you should feel it or common mistakes.

Our server also uses the AI model to recognise the muscles worked by an exercise you add yourself, from its name.

Who processes it. Requests go from our server to OpenRouter (OpenRouter, Inc., USA), a service that routes requests to AI models, and through it to one of these model providers: Microsoft Azure, Amazon Bedrock (Amazon Web Services), Google Vertex AI (Google Cloud) or Anthropic. They run Anthropic’s Claude models (currently Claude Haiku 5.5, with Claude Sonnet 5.5 as a backup if the first model fails). Our routing settings send requests to model providers in EU regions (currently Google Vertex AI, Europe). OpenRouter and the model providers act as processors on our behalf.

What is sent: where you train, your equipment, training days, session length, level, your limits and injuries (the body areas you want to spare and your short note), a short wish for the plan if you type one, the names of the exercises in your plan and the candidate exercises, the changes our engine proposes after a workout, the phrase you type to change your plan, the question you ask about an exercise, and the name of an exercise you add yourself. Each request also carries a random-looking identifier that we calculate from your account ID with a secret key (HMAC). It cannot be turned back into your account ID by anyone who does not hold our key. The model provider requires it to separate users.

What is never sent: your name, email address, account ID, camera images or video, and Apple Health data.

Retention and training. Every request is sent with OpenRouter’s settings for zero data retention and for excluding providers that collect data or train on it. In addition, our OpenRouter account blocks models and providers that collect data for training. Under these settings neither OpenRouter nor the model provider should keep your request or use it to train models. We do not store the content of AI requests or the model’s answers in our logs or database; we keep only daily counters of AI requests per account (for fair-use limits), without any content.

Consent. Nothing is sent to the AI services until you allow it, on the consent screen in onboarding or when you first use an AI feature. Our server refuses AI requests without your recorded consent. Legal basis: your consent (Art. 6(1)(a)) and, for your limits and injuries, your explicit consent (Art. 9(2)(a)). If you decline, you get a fixed plan built by our rules engine, and after-workout adjustments still happen by the same rules without AI. You can withdraw consent at any time in Profile → Privacy & data. Withdrawing stops all further AI requests. It does not affect requests made before.

Health questions. The AI features do not give medical advice. Questions that mention pain, injury, diagnosis, treatment or medication are not sent to the model and are not answered; please ask a doctor or physiotherapist.

Limits of AI. AI output can be wrong. Our engine checks every change the model proposes against the exercise catalogue and your conditions, and drops anything outside them, but you remain responsible for how you train.

Our website heatsy.app

The website uses no advertising or social-media scripts. When you first open it, a banner asks whether we may count visits with PostHog (EU region, eu.i.posthog.com) and Google Analytics 4. Until you choose Allow, nothing is sent to PostHog or Google, and the Google Analytics script is not even loaded. If you choose Decline, nothing is sent or loaded either.

If you allow it, each page you open sends a page-view event, and a tap on an App Store button sends a button-click event. Each event contains the page address and a random identifier that the website stores in your browser’s local storage (not a cookie). The identifier is not linked to your Heatsy account, and we do not create person profiles from it. Like any server, PostHog receives your IP address when your browser connects.

Google Analytics 4. If you allow it, the website also loads Google’s gtag.js script from googletagmanager.com and uses Google Analytics 4 (Google Ireland Limited, and Google LLC in the USA). Google Analytics sets the cookies _ga and _ga_* in your browser, which hold a random identifier that tells returning browsers apart. Each page you open sends a page-view event, and a tap on an App Store button sends a button-click event. These events include the page address, technical data about your browser and device (such as browser, operating system, language and screen size), an approximate region derived from your IP address, and the random identifier from the cookie. The identifier is not linked to your Heatsy account. Google receives your IP address when your browser connects, and Google may process this data in the USA; for such transfers we rely on the EU Standard Contractual Clauses under Google’s terms. Google acts as our processor. We do not use Google Analytics for advertising.

Legal basis: your consent (GDPR Art. 6(1)(a)). We ask again after 6 months if you declined and after 12 months if you allowed. To withdraw consent earlier, clear this site’s data and cookies in your browser; the banner then appears again.

Who receives your data

We do not sell personal data and we do not share it for advertising. We use these service providers (processors). They act on our instructions under each provider’s data processing terms:

Apple processes your purchases, App Store account and, if you use them, Apple Health (including heart rate and active energy read on Apple Watch) and Siri, under Apple’s own privacy policy. We may also disclose data if the law requires it.

International transfers

Our server is in the EU. AI requests (only if you allow AI processing) pass through OpenRouter, Inc. (USA), whose servers are in the United States. For this transfer we rely on the EU Standard Contractual Clauses, which OpenRouter uses for transfers outside the EEA and the UK. The AI model itself runs at model providers in EU regions, as set in our routing. PostHog analytics is hosted in the EU. If you allow Google Analytics on our website, Google may process the data in the USA under the EU Standard Contractual Clauses. If Resend processes your email address outside the EU, the same safeguard applies under Resend’s data processing agreement. You can ask us for a copy of these safeguards.

How long we keep data

• Account, profile, plans, workout log and notes: until you delete your account. Deleting a single workout or plan removes it from the app and keeps a deletion marker for syncing until the account is deleted.
• Sign-in codes: 10 minutes. Sessions (with the IP address and user agent recorded at sign-in): valid for up to 30 days; deleted when you sign out or delete your account.
• Limits and injuries: with your profile, until you remove them or delete your account.
• AI requests: not stored by us. OpenRouter and the model provider are instructed not to retain them. Daily AI usage counters (for rate limits: account ID, day, type of request, number; no content) are kept in our own database, not in analytics, and are deleted automatically after 7 days and when you delete your account.
• Usage statistics (PostHog): only while the consent is on; kept until you withdraw consent or delete your account, and then deleted in PostHog.
• Subscription records: until you delete your account.
• Server backups: backups are kept on Hetzner storage in Germany and rotated within about 5 weeks. Deleted data disappears from backups when they rotate.
• Server logs: no logs of request content. The web server’s access log is limited in size and overwritten automatically.

Deleting your account

In the app: Profile → Delete account (also reachable from Profile → Privacy & data → Delete my data). This deletes from our server your account, profile (including limits and injuries, body model and AI consent), plans, workout log, your own exercises, notes, sessions, pending sign-in codes and subscription records. If you had usage statistics on, our server first deletes your person and events in PostHog (or queues the deletion and retries it if PostHog cannot be reached) and then the secret key behind your pseudonym. It cannot be undone. The app tells you deletion completes within 24 hours. In practice our server deletes the data immediately, and backups rotate out as described above.

Deleting your account does not cancel an App Store subscription. Cancel it in your Apple ID subscription settings.

Your rights

If GDPR or UK GDPR applies to you, you have the right to:

• access your data and get a copy;
• correct it;
• delete it (you can do this yourself in the app);
• restrict or object to processing based on our legitimate interests;
• data portability;
• withdraw consent at any time without affecting earlier processing: AI processing in Profile → Privacy & data, usage statistics in Profile → Usage statistics, limits and injuries by removing them in Profile → Plan conditions;
• complain to a data protection authority, in particular in the EU country where you live or work.

To exercise a right, write to support@heatsy.app from the email address of your account.

Security

Connections between the app and our server are encrypted (HTTPS). Each user’s rows in our database are separated by row-level security. Access to the server is restricted to our team.

Children

Heatsy is not intended for children. You must be at least 16 years old to use it.

What we do not do

• No advertising and no ad networks.
• No sharing with data brokers.
• No crash-reporting SDKs in the App Store version. Diagnostic logging exists only in our internal test builds.

Changes

If we change this policy we will update the date above. If a change affects what is sent to AI services, the app will ask for your consent again.

Contact

DDDEV LTD, c/o Schoolgate Accounting Services, 46-50 Coombe Road, New Malden, London, KT3 4QF, England. Company number 16374016. Email: support@heatsy.app