Privacy policy

Who we are

HerShape ("HerShape", "we", "us") makes the HerShape mobile app for iOS and Android, an AI fitness and nutrition app built for women. This policy explains what we collect, why we collect it, who processes it, and the rights you have over it. It applies to the app and to this website. If anything here is unclear, email support@hershape.app and we will explain it plainly.

What we collect

Everything below comes from you directly, from your use of the app, or from the app stores when you subscribe. We collect it to run the app, not to build an advertising profile.

Account

• Name and email address.
• Whether you signed in with email, Apple, or Google.

Body and fitness profile

• Height, weight, target weight, and age.
• Activity level, fitness goals, and dietary preferences.
• Equipment access, available equipment, and workout location.
• Meal budget, shopping preferences, and cooking time.

Health information you choose to share

HerShape asks about health details because plans are generated around them. This is sensitive data, and we treat it that way. Specifically, the app can store your:

• allergies and diseases (health conditions you list, such as diabetes)
• hormonal conditions (such as PCOS or a thyroid condition)
• birth control type
• life stage (regular or irregular cycles, perimenopause, menopause, pregnancy, postpartum, breastfeeding, or prefer not to say)
• last period date, cycle length, and period flow
• pregnancy trimester and postpartum months, where they apply

You can select "prefer not to say" for your life stage, and fields like birth control and hormonal conditions are optional.

Activity in the app

• Your generated meal plans and workout plans.
• Workout history, tracked meals, weight logs, and body measurements.
• Weekly check-ins, monthly reviews, points, achievements, and any leaderboard rooms you join.
• Messages you send to Coach Sarah, the in-app AI coach.
• First party analytics events, such as which screens and features you use. We do not use third party advertising or tracking SDKs.

Purchases

• Subscription status, plan, and store receipt data, handled through RevenueCat. Payments are processed entirely by Apple or Google. We never see or store your card details.

Device

• Push notification token, platform, and device name, used only to deliver the notifications you turn on.

What we use it for

• Generating and adapting your personal meal and workout plans.
• Estimating your cycle phase and sending the cycle, meal, and workout notifications you enable.
• Running Coach Sarah, progress tracking, points, and leaderboards.
• Managing your subscription and restoring purchases.
• Answering support requests.
• Understanding how the app is used so we can improve it, using our own analytics only.
• Keeping the service secure and preventing abuse.

AI processing

When you generate a plan or message Coach Sarah, the relevant parts of your profile (including health conditions, allergies, and your current cycle phase) and your coach messages are sent to OpenAI to produce the result. This happens under our agreement with OpenAI as a data processor, and this data is not used to train OpenAI's models.

Who processes your data

We use four service providers to run HerShape. They process data on our behalf and are not allowed to use it for their own purposes:

• Supabase hosts our database and handles authentication. All profile, health, cycle, plan, and progress data lives here.
• OpenAI generates meal plans, workout plans, and Coach Sarah's replies from the inputs described above.
• RevenueCat manages subscription state using a pseudonymous user ID and store receipt data.
• Expo delivers push notifications using your device push token.

What we never do

• We never sell your personal data.
• We never share your health or cycle data with advertisers or data brokers.
• We do not show ads and do not embed advertising SDKs in the app.

Legal bases (GDPR)

If you are in the EU, EEA, or UK, we process your data on these bases:

• Contract: account data, plans, progress, and subscriptions, so the app can do what you signed up for.
• Explicit consent: health and cycle data, which you provide voluntarily during onboarding or in your profile. You can withdraw consent at any time by editing or deleting this data, or by deleting your account.
• Legitimate interests: security and first party analytics.
• Consent: push notifications, which you can turn off at any time.

Your rights

Depending on where you live, including under the GDPR and the CCPA/CPRA, you have the right to:

• Know what personal data we hold about you and get a copy of it.
• Correct data that is wrong. Most profile data can be edited directly in the app under Settings, Edit Profile.
• Delete your data (see the next section).
• Receive your data in a portable format.
• Restrict or object to certain processing, and withdraw consent.
• Not be discriminated against for exercising any of these rights.

We do not sell personal data or share it for cross context behavioral advertising as defined by the CCPA, so there is nothing to opt out of. To exercise any right, use the in-app tools or email support@hershape.app from the address on your account. We will verify the request through that account and respond within the timeframe the law requires. If you are in the EU, EEA, or UK, you can also complain to your local data protection authority.

Deleting your account and data

In the app, open Settings and tap Delete Account. This permanently deletes your account and all of your data, including your profile, health and cycle details, meal and workout plans, progress, and history. It cannot be undone.

One important note: subscriptions are billed by Apple or Google, not by us, so deleting your account does not cancel an active subscription. Cancel it in your App Store or Google Play subscription settings to stop future billing.

You can also email support@hershape.app and we will delete your account for you.

Retention

We keep your data while your account exists. When you delete your account, your data is deleted from our production systems right away, and residual copies in encrypted backups are purged on a rolling basis within 30 days.

Security

Data is encrypted in transit, encrypted at rest by our database provider, and protected by row level security so that each account can only ever read its own records. No system is perfectly secure, but we design so that a mistake in one place does not expose everyone's data.

International transfers

Our service providers process data in the United States and other countries. Where data moves out of the EU, EEA, or UK, it is protected by standard contractual clauses or equivalent safeguards through our providers.

Age

HerShape is for people aged 16 and over. We do not knowingly collect data from anyone under 16, and if we learn that we have, we will delete it.

Not medical advice

HerShape provides general fitness and wellness information. It is not medical advice, diagnosis, or treatment. Cycle phases in the app are estimates, and HerShape is not a contraceptive, fertility, or pregnancy planning tool. Do not use it to prevent or achieve pregnancy. Talk to your doctor before changing your exercise or nutrition, especially if you are pregnant, postpartum, or managing a health condition.

Changes to this policy

If we make meaningful changes, we will update this page and the date at the top, and for significant changes we will tell you in the app before they take effect.

Contact

Questions, requests, or concerns: support@hershape.app