Privacy Policy

1. Who is responsible for your data

Hello World Technologies LLC is the data controller for information collected through ApexGym and this website. Contact us at support-fitness@helloworldtech.com about anything in this policy.

One important distinction: when a coach uploads notes or programs about their own clients, the coach decides what to collect and why; we process it on their behalf as part of running the Service.

2. What we collect

2.1 Account information

• Name and email address, from signup.
• Your role (coach or trainee) and account creation date.
• For coaches: referral code, bio, specialties, certifications, years of experience, location, coaching mode and profile photo — most of which is shown on your coach profile to the trainees linked to you.
• For trainees: the coach's referral code used to link, and which coach you are linked to.

2.2 Health and fitness information

This is the most sensitive category we handle, and it is collected because coaching cannot work without it. Depending on what you choose to fill in, a trainee profile may include:

• age, date of birth, gender, height and weight, and body measurements over time;
• fitness goals, experience level, activity level and training availability;
• medical conditions, injuries, surgery history, medications, and food or medication allergies;
• lifestyle answers: occupation, sitting hours, sleep duration and quality;
• nutrition information: diet preference, meals per day, logged food, macros and water intake;
• smoking and alcohol frequency;
• emergency contact and phone number, if you provide them;
• progress photos you upload;
• workout logs — completed sessions, sets, reps and weights;
• if you explicitly connect Health Connect: steps, active calories, distance, heart rate and sleep, read from your phone only after you grant permission, per metric, and stopped the moment you disconnect.

Every field beyond the basics is optional. You can skip it, and you can clear it later from your profile.

2.3 Content you create

Programs, custom exercises, templates, plan assignments, session schedules, progress notes, and messages exchanged between a coach and a trainee.

2.4 Payment information

Subscriptions are processed by Google Play We never receive or store your full card number, CVC or expiry. We retain only what we need to run billing: an anonymous store subscriber id, the plan, the status and the current period end date. Google's handling of card data is governed by its own privacy policy.

2.5 Technical and usage information

• A device push token, if you allow notifications, so your coach or client can reach you.
• Crash and error diagnostics, used to fix faults.
• On this website: privacy-friendly, cookie-free analytics via Umami — aggregate page views, referrers and which buttons get clicked. It does not set advertising cookies, does not fingerprint you and does not track you across other sites.
• If you send us a support message, the name, email, subject and message you typed.

2.6 What we do not collect

• Card numbers.
• Government identifiers such as Social Security numbers.
• Precise GPS location. A coach's “location” is a city they type in.
• Contacts, call logs or SMS.
• Advertising identifiers. There is no ad SDK in the app.

3. Why we use it, and our legal basis

We do not use your health data for advertising, profiling or resale, and we do not use your content to train third-party AI models.

4. Who can see your data

4.1 Your coach

When a trainee links to a coach with a referral code, that coach can see the trainee's profile, intake questionnaire (including medical history), progress, workout logs, nutrition logs, progress photos and their shared message history. That is the point of linking — but it is worth being explicit about. No other coach on the platform can see any of it. This is enforced by database security rules, so it holds even if a client app is tampered with.

4.2 Your trainees

A coach's profile — name, photo, bio, specialties, certifications, experience, location and coaching mode — is visible to the trainees linked to that coach. There is no public coach directory: a trainee only ever sees the coach whose referral code they joined with.

4.3 Service providers

We share data with a small number of processors, only as needed to run the Service:

• Google Firebase — authentication, database, file storage and hosting.
• Google LLC (Google Play) — payment processing, billing and subscription management.
• Spoonacular — nutrition and recipe lookup. We send the search terms and dietary filters needed for a query, not your identity.
• Expo — app delivery and push notification routing.
• Umami — cookie-free website analytics.
• Health Connect — an Android service on your own phone. Only if you connect it, and only to read the metrics you approve; your health data is not sent anywhere by connecting it.

4.4 Legal and business transfers

We may disclose data where legally required, or to protect the rights and safety of our users. If the business is acquired or merged, data may transfer to the acquirer, who would remain bound by this policy; we will notify you before that happens.

4.5 What we never do

We do not sell personal information, and we do not share it for cross-context behavioural advertising — as those terms are defined under the California Consumer Privacy Act and comparable US state laws.

5. How we protect it

• Encryption in transit (TLS) and at rest, via Google Cloud infrastructure.
• Strict Firestore security rules scoping every read and write to the account that owns the data and, where applicable, their linked coach.
• Authentication handled by Firebase Authentication; we never store your password.
• Card data never reaches us; Google Play handles it end to end.
• Internal access limited to what is needed to operate and support the Service.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant regulators as required by law.

6. How long we keep it

• Account and health data — while your account is active. Cancelling a subscription does not delete it; your data is preserved so everything is intact if you come back.
• After you delete your account — removed from live systems promptly and purged from backups within 90 days.
• Billing records — retained up to 7 years where tax and accounting law requires it, even after deletion.
• Support messages — up to 24 months.

7. Your rights and choices

Wherever you live, you can ask us to:

• Access — get a copy of the data we hold about you.
• Correct — fix anything inaccurate (most of it is editable in-app).
• Delete — erase your account and data.
• Port — receive your data in a machine-readable format.
• Object or restrict — limit certain processing.
• Withdraw consent — for anything based on consent, at any time.
• Opt out of marketing — unsubscribe from any non-essential email.

The fastest routes are in the app: edit your profile to correct data, disconnect Google Fit to stop health syncing, turn off notifications in your device settings, and use Profile → Delete account to erase everything. For anything else, email support-fitness@helloworldtech.com — we respond within 30 days and never charge for a request.

We will not discriminate against you for exercising these rights. Your service and price stay the same.

7.1 If you are in the EU, EEA or UK

Our legal bases are listed in section 3. You have the right to lodge a complaint with your local supervisory authority. Data may be processed in the United States; such transfers rely on Standard Contractual Clauses or an equivalent safeguard.

7.2 If you are in California

Section 2 lists the categories of personal information we collect, section 3 why, section 4 who receives it, and section 6 how long we keep it. We do not sell or share personal information. You may exercise your CCPA/CPRA rights — including as an authorised agent — at support-fitness@helloworldtech.com.

8. Children

ApexGym is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal information, contact support-fitness@helloworldtech.com and we will delete it.

9. Where your data is processed

We operate from the United States and our providers (Google, Expo) run infrastructure in the US and other countries. By using the Service you understand your data will be processed in the United States, under the safeguards described above.

10. Cookies

The mobile app uses no advertising or tracking cookies. This website uses no cookies for analytics — Umami is cookie-free — and only strictly necessary storage required for the site to function.

The full list of what is stored, who sets it and how long it lasts is in the Cookie Policy, which also carries the switch that turns analytics off.

11. Changes to this policy

We may update this policy. Material changes will be announced by email or in the app at least 30 days in advance, and the effective date above will change. Where the law requires it, we will ask for your consent again.

12. Contact us