Privacy Policy

Account information — name, email, username, password, birth year, gender.

Profile information — photo, weight, height, fitness goal, location, bio.

Workout data — exercises, sets, reps, weight, duration, personal records.

Activity data — GPS routes, duration, distance, pace — only when you log an activity. Activity summaries and route maps may be visible to other members on your profile and in the feed, depending on your privacy settings.

Connected tracker data — if you choose to connect a fitness tracker via Health Connect, we sync data you grant permission for (such as steps, calories burned, exercise sessions, and sleep) to power your activity rings, Portfolio score, and analytics. Syncing is optional and off until you connect a tracker; you can disconnect at any time in Settings.

Nutrition data — meals logged, macros — completely private, never shared.

Coach/athlete data — program assignments, compliance metrics — never food logs.

Device information — device type, OS, app version — for bug fixing only.

• To provide the WeHashFit service
• To calculate your leaderboard ranking
• To enable coach-athlete features
• To send notifications you have opted into
• To improve the app (aggregate, anonymous data)
• To understand how our public website is used (aggregate analytics)

We do NOT sell your data to third parties, and we never use your workout, nutrition, or health data for advertising.

WeHashFit collects health-related data including workout metrics, body measurements, and nutrition information. This data is treated with the highest level of sensitivity.

We will not:

• Sell your health data
• Use it for advertising or marketing
• Share it with third parties without your explicit consent
• Allow coaches to access your nutrition logs

Nutrition data is entirely private. Your coach can only see whether you hit daily targets (yes/no) — never what specific foods you ate.

We use trusted third-party service providers to help deliver WeHashFit. These fall into the following categories:

• Authentication and data storage — to securely store your account and fitness data
• Payment processing — to handle subscription billing. We never store your payment card details.
• Exercise and nutrition content — to power our exercise library and nutrition database
• Video delivery — to stream exercise demonstration videos
• Security and performance — to protect the service and ensure reliability
• Advertising and analytics measurement — third-party advertising and analytics tools on our public website, used to measure how our own marketing campaigns perform. These operate on website activity only and never receive your workout, nutrition, or health data. When you create an account or start a subscription we may also share a one-way hashed (SHA-256) version of your email address with these providers, solely so that conversions can be matched to our own campaigns — never your name, workouts, nutrition or health data. On iOS, we also use Apple's own install-attribution framework (AdServices), through our subscription provider, to learn whether an install came from one of our Apple Ads campaigns. This returns only campaign-level information (which campaign, ad group or keyword) — never your identity, workouts, nutrition or health data — and does not use the advertising identifier or show the tracking prompt. In the EEA, UK and Switzerland these tools load only after you consent (see section 5).

We share only the minimum data necessary for each provider to perform their function. We do not permit our service providers to use your data for their own purposes.

A list of our current service providers is available on request by contacting privacy@wehashfit.com

Our public website (wehashfit.com — not the app, and not the pages you see after you sign in) uses two kinds of optional cookies: analytics cookies, set by Google Analytics 4, that tell us which pages are viewed, from which country and on what kind of device; and advertising measurement cookies, set by the measurement tools described in section 4, that tell us which of our own campaigns an account or subscription came from. Neither kind sees your workouts, nutrition, body measurements or any other health data, and we never use them to show you advertising.

If you visit from the European Economic Area, the United Kingdom or Switzerland, both kinds are off until you choose: a banner lets you accept all, reject all, or pick each kind. Your choice is stored in a single first-party cookie (whf_consent) for six months and can be changed at any time from the “Privacy choices” link in the website footer. Elsewhere these cookies are set by default and the same link lets you turn them off.

Google Analytics is configured with Google signals and ad personalisation disabled, data retention of 14 months, and Google's regional processing for EU, UK and Swiss visitors, under which IP addresses are discarded before any data is logged. Website analytics data is aggregated and is never joined to your WeHashFit account.

Cookies that are strictly necessary — your sign-in session, your theme and the consent choice itself — are always on and do not require consent.

We implement technical and organisational measures to protect your personal data against unauthorised access, including:

• Row-level security on all database tables
• Encryption in transit (TLS) and at rest
• Automated blocking of known web scrapers and AI crawlers
• Regular security audits

We do not sell your personal data to third parties and we do not permit automated collection of user data from our platform. Your workout data, health metrics, and personal information are used solely to provide and improve the WeHashFit service.

We retain your data for as long as your account is active. You may request deletion of your account and all associated data at any time via Settings → Account → Delete Account.

Aggregated, anonymised statistics may be retained for product improvement purposes.

Depending on your location, you may have rights to:

• Access your personal data
• Correct inaccurate data
• Delete your account and data
• Export your data (available on request by emailing privacy@wehashfit.com)
• Withdraw consent

Australian users: rights under the Privacy Act 1988 (Cth)

EU/UK users: rights under GDPR

California users: rights under CCPA

To exercise these rights, contact privacy@wehashfit.com

WeHashFit is intended for users aged 18 and over. We do not knowingly collect data from anyone under 18.

We will notify you of material changes via email or in-app notification at least 14 days before they take effect.