Privacy Policy

1. Who we are

EMBRS ("the app", "we", "us", "our") is a strength training and nutrition app that lets you build workouts, track sets, reps and macros, run Strength Cycles and follow your body progress. This Privacy Policy explains what data we collect, why we collect it, how it is stored and what rights you have. It applies to the EMBRS website, web app, mobile installation (PWA) and the native iOS and Android apps.

Data controller: EMBRS. Contact: support@embrs.dev.

2. Data we collect

• Account data: email address, username, hashed password, and (if you sign in with Google or Apple) the identifier and email returned by that provider.
• Training data: exercises, sets, reps, weight, notes, personal records, Strength Cycles, gyms and machines you enter.
• Body Progress data (Premium): weigh-ins, body measurements and any progress photos you choose to save.
• Nutrition data: food logs, meals, diet plans and photos of recipes or diet plans that you choose to upload.
• Preferences: language, units, theme, font, layout and reminder settings — stored on your device and in your account.
• Subscription data: the plan you are on and the subscription status reported by Apple, Google or our payment processor (we never receive your full card number).
• Technical data: basic device info, crash and error reports, and anonymous usage signals used to keep the app stable.

We do not sell your data and we do not use it for advertising or profiling.

3. How we use your data

• To sign you in, save your workouts and sync them across your devices.
• To provide Premium features such as smart progression, Strength Cycles, diet plans, Body Progress and analytics.
• To power AI features (recipe parsing, food estimation, workout generation, machine scanning) when you use them.
• To send account-related notifications (password reset, reminders you have opted in to).
• To detect abuse and keep the service secure.

Legal bases (GDPR): performance of contract, your consent (for optional features), and our legitimate interest in operating a secure service.

4. AI features

When you use AI features (photo-to-macros, AI food search, AI workout generation, scan machine, screenshot import), the relevant input — a photo, barcode result or text prompt — is sent to our AI providers (currently OpenAI and Google) solely to produce a response. We do not use this content to train third-party models. Verified food entries you create may be added to our shared community food database in anonymised form so other users can find them.

5. Storage and processors

Your data is stored on a secure cloud backend and processed by these sub-processors:

• Supabase (Lovable Cloud) — authentication, database and file storage, hosted in the EU.
• OpenAI and Google (Gemini) — AI processing for the features listed above.
• Open Food Facts, USDA FoodData Central, FatSecret, Livsmedelsverket — third-party nutrition databases queried when you search or scan foods.
• Apple and Google — sign-in and, in the mobile apps, in-app purchases and subscription management.
• Cloudflare — content delivery and edge hosting.

All processors are bound by written data processing terms. Data may be processed outside the EU under standard contractual clauses.

6. Retention

We keep your data for as long as your account is active. When you delete your account, your personal data is removed from the active system within 30 days. Backups are rotated on a rolling basis and purged within 90 days. Aggregated, non-identifying data (e.g. community-verified food entries) may be retained.

7. Your rights

You have the right to access, correct, export, restrict and delete your data. You can:

• Export your training and nutrition data from Settings.
• Delete your account from Settings → Account.
• Contact us at support@embrs.dev for any data request.
• Lodge a complaint with your local data protection authority.

8. Security

Passwords are stored as salted hashes. Traffic is encrypted with TLS. Access to your data at the database level is protected by row-level security so only you can read it. Progress photos are stored privately and are never public.

9. Location data (GPS runs)

If you start a GPS run, the app reads your device location while the run is active in order to draw your route and calculate distance and pace. Location is only collected during a run you started yourself, is stored with that workout in your account, and is never shared with advertisers or used for tracking across apps. You can deny or revoke location permission at any time in your device settings; the rest of the app keeps working without it.

10. Purchases in the mobile apps

In the iOS and Android apps, Premium is sold through Apple's In-App Purchase and Google Play Billing. Those stores process the payment and manage renewals and refunds; we only receive a confirmation that your subscription is active, which we store against your account so Premium unlocks on every device. We never see your card details. Cancellations are made in the App Store or Google Play.

11. Children

EMBRS is not directed to children under 13, and we do not knowingly collect their data. If you believe a child has provided us with data, contact us and we will delete it.

12. Changes

We may update this policy. Material changes will be communicated in the app. The "Last updated" date above always reflects the current version.

13. Contact

Questions or requests: support@embrs.dev