Legal
Privacy Policy
This policy describes exactly what data the Alzor app collects, what it is used for, which providers it is shared with, and how you can control or delete it.
Alzor is operated by [LEGAL ENTITY NAME], a company organized under the laws of [STATE], with its address at [ADDRESS] ("Alzor", "we", "us"). By creating an account you accept this policy. If you do not agree, do not use the app. For any question, write to soporte@alzor.app.
Consumer health data. Much of what Alzor handles (body weight, height, injuries, workouts and meals) is consumer health data under laws such as the Washington My Health My Data Act. Our Consumer Health Data Privacy Policy explains how we handle it and the specific rights you have.
1. What we collect
Account data
- Email address. Used as your account identifier and to sign in.
- Display name. The name you choose to appear under in leaderboards, guilds and challenges. If you do not choose one, we show the part of your email before the at sign.
- Password. Never stored in plain text: we keep only a cryptographic hash.
- Apple identifier, if you use Sign in with Apple. If you choose to hide your email, we receive Apple's private relay address instead of your real one.
- Preferences: app language, units (pounds and feet or kilograms and centimeters), time zone, notification settings, your companion's species, and your referral code if you use one.
Body profile data
- Weight and height, entered during onboarding or in the Body tab. We store them in kilograms and centimeters even if you see pounds and feet. Your weight is kept as a history of weigh-ins (one per day) so we can show your trend.
- Declared injuries and restrictions, so routines can avoid them.
- Training goal, experience level, available equipment, training days and daily minutes.
- Sex (male or female), chosen during onboarding to shape your body illustration. It is not stored on our server; see "Usage analytics" below for the one place it is sent.
Activity data
- Completed workouts: exercises, sets, reps and weights lifted, plus the workouts you plan or build yourself.
- Personal records and 1RM estimates derived from them.
- Streaks, experience points, rank, stats and per-muscle-group progress, and your companion's condition, which is computed from your training.
- History of quests, penalties, duels, companion battles, challenges and guilds.
Food data
- Your meal log: which foods you log, at which meal of the day, the grams and the calories, protein, carbohydrates and fat of each one. We use it only to show you your diary, your totals and whether you hit your goal.
- Your macro goals (objective, calories, protein, carbohydrates and fat), calculated from your weight and editable by you.
- The foods you create from a package label or with the AI estimate (name, optional brand, barcode and nutrition values). They are private: nobody else can see them.
When you scan or type a barcode that is not in our database yet, our server looks it up on Open Food Facts sending only that code. When a text search returns few results in our database, our server may also send the search text to Open Food Facts. Neither request includes your account, your weight or your meal log. If you use "estimate with AI" and have accepted the AI consent, the description you type (for example, "a bowl of chili") is sent to OpenAI, and nothing else about you (see section 4).
Purchase data
- Your subscription status and history (plan, renewal date, trial period), received from RevenueCat and the relevant app store.
- We never see or store your card details. Payment is processed entirely by Apple or Google.
Usage analytics
The app sends usage events to PostHog, our product analytics provider, so we can see where people get stuck: which onboarding screens are viewed, completed or skipped, sign-ups and logins, and which version of the onboarding you saw. Before you create an account these events use a random identifier; after you sign in they are linked to your account ID. During onboarding, some events include the answers you gave: goal, experience level, companion species, sign-in method, how many pieces of equipment and limits you selected, and training days. Your height, weight and sex are not sent to PostHog. We do not send your name, email or meal log to PostHog, and we do not use these events for advertising.
Our server also records an internal event each time an AI routine is generated, to measure cost and quality.
Technical data
- Push notification token for your device, only if you allow notifications.
- Server logs needed to operate and debug the service.
What we do NOT collect. We ask your age once, only to confirm you are 13 or older: it is never sent to our server or stored. We do not ask for your date of birth, your location, your contacts, your photos, your browsing history or advertising identifiers. The app contains no advertising or ad attribution SDKs, and we do not track your activity across other companies' apps or websites. That is why the app never shows the iOS tracking (ATT) prompt.
2. What we use it for
- Generating your personalized routines with artificial intelligence (see section 4).
- Recording and showing your progress: ranks, streaks, records, stats and your companion.
- Keeping your meal diary: daily totals, macro goals and the reward for hitting them.
- Running the social features: leaderboards, friends, guilds, duels, challenges and battles.
- Managing your subscription and granting access to paid features.
- Sending you notifications about your quests, challenges and streaks, if you allowed them.
- Understanding and improving the app through the usage analytics described above.
- Keeping the service secure and preventing abuse.
We do not sell your data. We do not share it with advertisers. We do not use it for advertising of any kind.
3. Who we share it with
Only with the providers required to run the app. Except for Open Food Facts (last row), all of them act as service providers (processors) under contract, process data only on our instructions, and are located in the United States.
| Provider | Purpose | What it receives |
|---|---|---|
| Supabase (USA) |
The database where your account lives. | All data described in section 1, except the analytics events and your sex. |
| Railway (USA) |
Hosting for our API server. | Processes the app's traffic; keeps no separate copy of your profile. |
| OpenAI (USA) |
Generating your workout routines and, if you use it, estimating a meal you describe. | For routines: your goal, weight, height, body mass index, declared injuries and restrictions, equipment, training history, records, streak and rank. For meal estimates: only the text you type. Only if you accept the AI consent. See section 4. |
| PostHog (USA) |
Product analytics. | The usage events described under "Usage analytics" (no height, weight or sex). |
| RevenueCat (USA) |
Managing subscriptions and in-app purchases. | A user identifier and your subscription status. |
| Expo (USA) |
Delivering push notifications and app updates. | Your device's push token and the notification text. |
| Apple · Google | Processing subscription payments. | They handle payment data directly; we only receive confirmation of your subscription status. |
| Open Food Facts (France) |
Open database of packaged foods, used to recognize a barcode or complete a search. | Only the barcode or search text, sent from our server. It does not receive your account or any other data about you. The product data it returns is used under the ODbL license. |
Other users see only what is meant to be public: your display name, companion, rank and level in leaderboards, guilds, duels and battles, and the guild names and challenges you create. They never see your weight, your injuries or your meal log.
We may also disclose data when legally required, or to defend legal rights against fraudulent or abusive use of the service. If [LEGAL ENTITY NAME] is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction, and this policy will continue to apply to it.
4. Artificial intelligence
Your workout routines are generated by a large language model from OpenAI. Only if you accept the AI consent inside the app, every time the app creates or regenerates a routine our server sends OpenAI the following information about you. If you decline, or revoke it in Settings, routines are built from our own templates and nothing is sent to OpenAI.
- Your training goal.
- Your weight, your height and the body mass index computed from both (the number, with no clinical category).
- The injuries and restrictions you declared.
- Your equipment, your recent training history (including which muscles you trained in the last 48 hours), your records and 1RM estimates, your streak, your rank and your account age.
The same consent covers the AI meal estimate: when you describe a meal and ask for an estimate, only that text is sent to OpenAI, and the result is saved as a private food in your account.
We do not send your name, your email or your password. Even so, we want to be explicit: the routine information above can identify you and includes health-related data. We do not claim that it is anonymized.
We do not store the text of the requests we send to OpenAI: only a fingerprint (hash) that cannot be used to rebuild them. We do store the routine the model returns, to debug its quality. Those records are deleted when you delete your account.
AI-generated routines can contain mistakes. They are not medical advice: consult a healthcare professional before starting any exercise program, and stop exercising if you feel pain or discomfort.
5. Legal basis (GDPR)
If you are in the European Economic Area or the United Kingdom, we process your data on these bases:
- Performance of a contract (art. 6(1)(b)): creating your account, generating routines, logging workouts and running your subscription.
- Explicit consent (art. 9(2)(a)): your weight, your height, the injuries you declare and your meal log are health-related data, a special category. We process them only because you provide them voluntarily, and you can withdraw that consent by clearing those fields or deleting your account.
- Legitimate interest (art. 6(1)(f)): service security, abuse prevention and product analytics.
Your data is stored and processed in the United States. Those international transfers rely on the European Commission's Standard Contractual Clauses included in our agreements with the providers listed in section 3.
6. How long we keep it
We keep your data for as long as your account exists. When you delete your account, we permanently erase from our database your user record, your profile, your weigh-ins, your workouts, your records, your quests, your battles, your guilds, your meal log, your macro goals, the foods you created, your stored subscription data, your push tokens and your AI generation logs. Deletion is immediate and final: there is no trash bin, no grace period, and it cannot be undone.
Database backups may retain data for a short additional period before rotating. Server logs containing technical information are kept for a limited time for security and diagnostics. Analytics events already sent to PostHog are not erased automatically when you delete your account: write to soporte@alzor.app and we will have them deleted.
7. Your rights
In-app account deletion
You can delete your account at any time, without contacting us and without conditions, from Profile → Settings → Delete account. If you do not have an active subscription yet, a Delete Account link is also available directly on the subscription screen.
If you are in the United States
Depending on your state (for example California, Virginia, Colorado, Connecticut, Texas and others), you may have the right to:
- Know and access the personal information we hold about you, and receive a portable copy.
- Correct inaccurate information and delete your information.
- Opt out of the sale of personal information, targeted advertising and profiling. We do none of these, so there is nothing you need to opt out of.
- Limit the use of sensitive personal information. We use your health data only to provide the features you ask for.
- Appeal our decision if we decline your request, by replying to our answer with the word "Appeal".
- Non-discrimination for exercising any of these rights.
California residents: the categories of personal information we collect are identifiers, customer records, commercial information (subscription status), internet or other electronic activity (usage analytics), and sensitive personal information (health data and account log-in). Sources, purposes and recipients are set out in sections 1 to 3. We do not sell or share personal information as defined by the CCPA.
If you live in Washington or Nevada, or another state with a consumer health data law, also see the Consumer Health Data Privacy Policy.
If you are in the EU or the UK (GDPR)
- Access: obtain a copy of the data we hold about you.
- Rectification: correct inaccurate data.
- Erasure: have your data deleted ("right to be forgotten").
- Restriction of and objection to processing.
- Portability: receive your data in a structured, machine-readable format.
- Withdraw your consent at any time, without affecting the lawfulness of prior processing.
- Lodge a complaint with your national supervisory authority.
To exercise any of these rights, write to soporte@alzor.app from the email on your account. We may ask you to confirm your identity, and we respond within the applicable statutory deadlines.
8. Security
Traffic between the app and our server is always encrypted over HTTPS. Passwords are stored as hashes. Session tokens are kept in the operating system's secure storage (iOS Keychain or Android Keystore). Access to the database is limited to the people who operate the service. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
9. Children
Alzor is not directed to children under 13 and we do not knowingly collect data from them. The app asks your age before you create an account and blocks anyone under 13. If we discover an account belonging to a child under 13, we delete it. If you are a parent or guardian and believe your child created an account, write to soporte@alzor.app and we will remove it.
10. Changes to this policy
If we change this policy we will update the date shown at the top. If the change is material, we will notify you inside the app before it takes effect.
11. Contact
Data controller: [LEGAL ENTITY NAME], [ADDRESS].
Contact point for any privacy matter: soporte@alzor.app
See also the Terms of Use and the Consumer Health Data Privacy Policy.