Privacy

The short version

• We ask for a name. Never an email or phone number.
• Your training lives on your device. We keep your name on our servers so no one else can take it; add a passkey and your training syncs to London so it can follow you.
• No ads, no ad trackers. We don't sell or share your data for marketing.
• Delete your profile and its training, photos and passkey go from our servers.

Who we are

Heatwayve is run by Abrar Ahmed, who is responsible for your personal data (the "controller"). Questions, requests or complaints: ab@heatwayve.app.

What we collect, and why

• The name you choose — held on our servers from the moment you create a profile, so it stays yours. Names are checked against ours as you type.
• A passkey, if you add one — to sign you in. We keep its public key and a few technical details (an ID, a sign-in counter, when it was made). Face ID, Touch ID and your device PIN never leave your device; your password manager keeps the passkey under your profile name.
• Your training, once you add a passkey: sessions (when they started, how long they took, your time zone), sets, weights, reps, effort ratings, readiness and its reason, breaks and their reason, schedule, focus, streak and the programme's working estimates — to run and adapt your programme.
• Bodyweight, and a dated log of it — to set loads and show your progress. It's also noted on each progress photo.
• Progress photos, only if you add them — stored privately and shown only to you after passkey sign-in. Location and camera data are stripped before upload.
• Bug reports you send — your message, profile name, the page you were on, your browser and device details, and when you sent it — so we can fix things.
• Usage and performance — page views, load times, and an anonymous count of finished sessions, through Vercel Web Analytics and Speed Insights. No name attached, no cookies, nothing that follows you across other sites.
• Your IP address — briefly, to stop abuse, and in our hosting provider's logs.
• Anything you email us, if you do.

Health information

Readiness and its reasons, breaks (including "injured or ill"), bodyweight, training and photos can say something about your health, which UK law treats as special category data. We only use it with your explicit consent, which you give by entering it, and only to run Heatwayve for you. Withdraw consent any time by deleting it or your profile.

Our lawful bases

• Providing the app you asked for (contract) — your name, passkey and training.
• Explicit consent — health information and progress photos.
• Legitimate interests — keeping the service secure and working (rate limiting, logs), measuring performance, and handling bug reports and emails.

Where it lives, and who helps us

• Vercel — delivers the app worldwide; the server functions that handle your data run in London. Also runs the analytics above.
• Neon — our database, in London.
• Vercel Blob — private file storage in London for passkey public keys, progress photos, backups, and older copies of some profiles' training.
• YouTube — demo videos embed in privacy-enhanced mode. Opening one connects your browser to Google, under its own privacy policy. Some links open YouTube itself, where its usual terms and cookies apply.
• Buy Me a Coffee — if you tip, that happens on their site under their policy. They may pass us your supporter name and message.

Our providers are US companies and may access data from outside the UK. Where they do, it's under UK-approved safeguards, such as the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum.

If you use "Copy your training" and paste it into an AI service, that copy is yours to share — the service you paste it into handles it under its own terms. We don't send it anywhere.

Cookies and on-device storage

• One strictly necessary cookie keeps sync signed in; a second keeps photos unlocked. Each renews while you use the app and lapses after 30 days (sync) or 7 days (photos) unused. Neither tracks you.
• Your training is kept in your browser's storage on your device. Photos you view may sit briefly in your browser's cache.
• No advertising or tracking cookies. If you open a demo video, YouTube may set its own.

How long we keep it

• Your name and training — until you delete your profile. Training can't be removed one session at a time on our servers.
• Photos — until you delete them or your profile.
• Backups — refreshed daily and weekly, deleted with your profile. Our database provider keeps a short restore history that expires on its own.
• Sign-in records — each works for 30 days at most. The records (your profile name and dates) stay until you delete your profile.
• Bug reports — not removed when you delete your profile. Ask and we'll delete yours.
• Server logs, which can include your profile name — kept briefly by our hosting provider.
• No passkey? Your name (and anything synced before 27 July 2026) stays until you add one and delete your profile, or email us.
• Data on your device — until you clear it or remove the app.

Your rights

You can ask to access, correct, delete, restrict or move your data, object to how we use it, or withdraw consent. Much of it you can do yourself: delete photos in the Locker Room, delete your profile and its server data from the profile page (your passkey proves it's you), or copy a summary of your recent training from AI coaching. For a full copy, or anything else, email us — we'll reply within a month.

Age

Heatwayve is for adults and isn't intended for anyone under 16.

Complaints

Tell us first at ab@heatwayve.app — we'll acknowledge it within 30 days. If you're still unhappy, you can complain to the ICO, the UK's data protection regulator: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · 0303 123 1113 · ico.org.uk/make-a-complaint.

Changes

If this changes, we'll update this page and the date at the top. This notice isn't legal advice to you; it's our account of what we do.