Privacy policy

Who is responsible

Heza is run by Jo Kassis, a private individual in Spain, who is responsible for your data under the EU's data protection law (GDPR). Write to team@heza.app about anything on this page.

What Heza stores

• Your account: email address, name, and a password (stored only as a secure hash that nobody can read). If you sign in with Google or Microsoft, Heza receives your name and email from them.
• Your profile and goals: sex, birth year, height, weight, time zone, calorie and macro targets, and what you are training for.
• What you log: meals and drinks, water, weigh-ins, workouts and sets, runs and other activities, planned sessions, and any photos you upload.
• Watch data, if you connect Garmin or COROS: activities with routes and heart rate, steps, calories, heart rate variability, resting heart rate, sleep (unless you turn sleep tracking off), training load and fitness estimates.
• Health notes you choose to add, such as injuries, pain levels and summaries of medical reports.
• Coach notes and other entries written by your AI assistant through the Heza connector.
• Your help conversation: what you write to the Heza team in Help, and the team's replies.
• Your email choices: whether you want News from Heza, and when you last changed it.
• How you found Heza: the website or link you came from when you signed up (for example a search engine or a campaign link), and your answer if you tell us how you heard about Heza. It is used only to understand what brings people to Heza.
• Technical data needed to run the service: sign-in sessions, connected apps, and encrypted access tokens for Garmin or COROS.

How it is used

To show you your data, calculate calories, targets and trends, sync your watch, let your AI assistant read and update your data when you ask it to, and send emails. Account emails (sign-up confirmation and password resets) and the team's replies when you ask for help always go out. News from Heza (new features and tips) goes out only if you switch it on in Settings, and you can switch it off there at any time, or with the link in any news email.

Heza has no ads, does not sell or rent your data, and does not share it for anyone else's marketing.

Why Heza may use your data

• Your account and the features you use (logging, calculations, watch sync, the AI connection and account emails): because they are needed to provide the service you signed up for (GDPR article 6(1)(b)).
• Your health data: your explicit consent (article 9(2)(a)), which Heza asks for once in the app.
• News from Heza: your consent (article 6(1)(a)), which you give or withdraw with its switch in Settings.
• Keeping Heza secure and backed up, preventing misuse, and seeing how people find Heza (where you came from when you signed up, and visit counts on this website): Heza's legitimate interest in running a safe service and knowing what works (article 6(1)(f)). You can object to this by email.

Who can see your data

• You.
• Your AI assistant, when you connect one (for example Claude or ChatGPT). It can read and change the data in your own account only. What you share in that conversation is also covered by that provider's privacy policy. You can disconnect it at any time in Settings.
• Nobody else sees what you log: meals, workouts, runs, watch data, weight, health notes and photos. The Heza team doesn't look at it, and Heza's admin screens can't show it. If you need help, you choose what to show us: what you write in Help, which stays in your help conversation with the team's replies, or a screenshot. The team sees only your name and email, when you signed up, last signed in and last used Heza, which watch and AI you've connected, how many entries you've logged (a count, never what they are), and the custom exercises you create, with your name.
• Other Heza users only see foods: food names and nutrition values you log or create can appear in everyone's food search, without your name. You can keep a custom food private with its "Share with everyone" switch. If you report a shared food or suggest a correction, the Heza team sees what you sent, without your name.

Services Heza relies on

• Hostinger, which provides the server Heza runs on.
• Brevo, which sends Heza's emails.
• GitHub and Cloudflare, which each keep a copy of the nightly backups. Backups are encrypted on Heza's server before they leave it, so neither company can read them.
• Garmin or COROS, only if you connect your watch.
• Google or Microsoft, only if you sign in with them.
• Open Food Facts and the USDA food database, which receive food search terms and barcodes, never your personal details.

Security and storage

Heza runs on a server rented by the Heza team. Connections use HTTPS, watch access tokens are encrypted, and the server is locked against outside access. Backups are made every night and kept for 14 days.

The server is in Frankfurt, Germany. GitHub and Cloudflare are based in the USA; they only receive the encrypted backups, and both rely on the EU-US Data Privacy Framework for data from the EU. If you connect a watch or sign in with Google or Microsoft, those companies handle your data under their own privacy policies, which may include countries outside the EU.

How long it is kept

Your data, including your help conversation, is kept while you have an account. When you delete your account it is removed right away, and from backups within 14 days. If you tell Heza why you're leaving, only that answer and the date are kept, without your name. Server logs, used to fix problems, are overwritten within a few weeks. Sign-in records (when an account signed in, used to keep accounts secure) do not have a time limit yet, and stay after an account is deleted.

Health information

Much of what you log is health related. You decide what to store, and you can edit or delete entries at any time. Heza shows estimates, not medical advice.

Heza asks everyone for explicit consent to store health data, and records when you gave it. You can withdraw it at any time by deleting your account in Settings; this does not affect what was done before you withdrew.

Your choices

• Correct or delete entries in the app, and turn off sleep tracking or disconnect your watch or AI assistant in Settings.
• Switch News from Heza on or off in Settings, under Emails.
• Download a copy of your data from Settings, as one JSON file or as spreadsheets (CSV).
• Delete your account and all its data yourself in Settings, under "Delete my account". It happens right away, and it is removed from backups within 14 days. Custom foods you shared stay in the shared food search without your name; everything else is deleted. You can also ask us to do it by emailing team@heza.app.

Your rights

You can ask to see the data Heza holds about you, have it corrected or deleted, get a copy to take elsewhere, limit how it is used, or object to uses based on Heza's legitimate interest. Most of this you can do yourself in the app, as described above. For anything else, email team@heza.app: you'll get an answer within one month.

If you think Heza handles your data wrongly, you can complain to the Spanish data protection authority, the AEPD (aepd.es), or to the data protection authority in the EU country where you live.

This website

This website (heza.app) sets no cookies. If you're signed in to the app, my.heza.app sets one small cookie for heza.app that only says you're signed in, so this website can take you straight to the app. To see how many people visit and where they come from, it counts visits with Umami, which runs on our own server. It doesn't identify you, and the data isn't shared with anyone else. The app itself lives at my.heza.app and is covered by this policy.

Age

Heza is meant for people aged 16 and over.

Changes

If this policy changes, the date at the top changes too. For important changes you will be told in the app or by email.