Privacy Policy

1. Who we are

EMBRS ("the app", "we", "us", "our") is a strength training and nutrition app that lets you build workouts, track sets, reps and macros, run Strength Cycles and follow your body progress. This Privacy Policy explains what data we collect, why we collect it, how it is stored and what rights you have. It applies to the EMBRS website, web app, mobile installation (PWA) and the native iOS and Android apps.

Data controller: EMBRS. Contact: support@embrs.dev.

2. Data we collect

• Account data: email address, username, hashed password.
• Training data: exercises, sets, reps, weight, notes, personal records, Strength Cycles, gyms and machines you enter.
• Health and fitness data: the personal details you choose to enter for calorie estimation — gender, age, height and body weight — plus workout metrics such as duration, distance, pace, elevation, calories and, on iPhone, heart rate read from Apple Health. These are optional; the app works without them and they are used only to show and calculate your own results.
• Body Progress data (Premium): weigh-ins, body measurements and any progress photos you choose to save.
• Nutrition data: food logs, meals, diet plans and photos of recipes or diet plans that you choose to upload.
• Preferences: language, units, theme, font, layout and reminder settings — stored on your device and in your account.
• Subscription data: the plan you are on and the subscription status reported by Apple or our payment processor (Stripe) (we never receive your full card number).
• Epassi activation data: the receipt or order number and account email you send us, the access period we activate, and an internal Epassi marker used by our administrator to identify the activation.
• Technical data: basic device info, crash and error reports, and anonymous usage signals used to keep the app stable.

We do not sell your data and we do not use it for advertising or profiling.

3. How we use your data

• To sign you in, save your workouts and sync them across your devices.
• To provide Premium features such as smart progression, Strength Cycles, diet plans, Body Progress and analytics.
• To power AI features (recipe parsing, food estimation, workout generation, machine scanning) when you use them.
• To send account-related notifications (password reset, reminders you have opted in to).
• To detect abuse and keep the service secure.

Legal bases (GDPR): performance of contract, your consent (for optional features), and our legitimate interest in operating a secure service.

4. AI features

When you use AI features (photo-to-macros, AI food search, AI workout generation, scan machine, screenshot import), the relevant input — a photo, barcode result or text prompt — is sent to our AI providers (currently OpenAI) solely to produce a response. We do not use this content to train third-party models. Verified food entries you create may be added to our shared community food database in anonymised form so other users can find them.

5. Storage and processors

Your data is stored on a secure cloud backend and processed by these sub-processors:

• Supabase (Lovable Cloud) — authentication, database and file storage, hosted in the EU.
• OpenAI — AI processing for the features listed above.
• Open Food Facts, USDA FoodData Central, FatSecret, Livsmedelsverket — third-party nutrition databases queried when you search or scan foods.
• Apple — in-app purchases and subscription management in the iOS app.
• Stripe — payment processing and subscription management for purchases made on the website.
• Cloudflare — content delivery and edge hosting.

All processors are bound by written data processing terms. Data may be processed outside the EU under standard contractual clauses.

Epassi handles wellness-allowance payments under its own privacy terms as a separate payment provider. We use the purchase details you send us to verify and activate access; your workout, nutrition and health logs are not sent to Epassi as part of this activation.

6. Retention

We keep your data for as long as your account is active. When you delete your account, your personal data is removed from the active system within 30 days. Backups are rotated on a rolling basis and purged within 90 days. Aggregated, non-identifying data (e.g. community-verified food entries) may be retained.

7. Your rights

You have the right to access, correct, export, restrict and delete your data. You can:

• Download a copy of your training and nutrition data yourself from Settings → Account & connections → Export my data.
• Delete your account from Settings → Account.
• Contact us at support@embrs.dev for any data request.
• Lodge a complaint with your local data protection authority.

8. Security

Passwords are stored as salted hashes. Traffic is encrypted with TLS. Access to your data at the database level is protected by row-level security so only you can read it. Progress photos are stored privately and are never public.

9. Location data (GPS runs and walks)

When you choose a GPS run or walk, the app reads your device location to prepare the map and, during the workout, draw your route and calculate distance and pace. Location is only collected for a GPS activity you choose yourself, is stored with that workout in your account, and is never shared with advertisers or used for tracking across apps. You can deny or revoke location permission at any time in your device settings; the rest of the app keeps working without it.

Active workout recording on iOS: EMBRS requests "While Using the App" location permission. After you press Start or Resume while EMBRS is open, native iOS location updates can continue while the screen is locked or you use another app. Background recording is enabled only during that active workout and is disabled when you pause or end it. We do not use location for passive background monitoring, advertising or location profiles. Denying permission prevents GPS recording but does not prevent use of the other features.

Force-quitting EMBRS by swiping it away stops GPS recording; reopening does not record the missing interval. GPS reception, device settings and iOS restrictions can affect accuracy and continuity. In the web version, the browser may limit tracking when the screen is locked or you leave EMBRS; use the iOS app for background workout recording.

9b. Apple Health (heart rate)

On iPhone you can allow EMBRS to read heart rate from Apple Health. We only read heart-rate samples recorded during an outdoor run or walk you finished in the app, and we use them solely to show your average and maximum heart rate for that activity. We never write anything to Apple Health, never use health data for advertising or tracking, and you can revoke access at any time in the Health app.

10. Purchases

In the iOS app, Premium is sold through Apple's In-App Purchase. Apple processes the payment and manages renewals and refunds; we only receive a confirmation that your subscription is active, which we store against your account so Premium unlocks on every device. We never see your card details. Cancellations are made in the App Store.

On the website, Premium is sold through Stripe. Stripe processes the payment and stores your card details; we only receive your subscription status and store it against your account, so a website purchase also unlocks Premium in the app. You can manage or cancel a website subscription at any time from Settings in EMBRS.

For Epassi purchases, activation is handled manually using the receipt or order number and account email you send to support@embrs.dev. We record the activated access period and an administrator-only Epassi marker to manage your access and support requests. This processing is necessary to fulfil your purchase; payment records may be retained where required by accounting law.

11. Children

EMBRS is not directed to children under 13, and we do not knowingly collect their data. If you believe a child has provided us with data, contact us and we will delete it.

12. Changes

We may update this policy. Material changes will be communicated in the app. The "Last updated" date above always reflects the current version.

13. Contact

Questions or requests: support@embrs.dev