Privacy policy

• Your account: email address, name, and a password (stored only as a secure hash that nobody can read). If you sign in with Google or Microsoft, Heza receives your name and email from them.
• Your profile and goals: sex, birth year, height, weight, time zone, calorie and macro targets, and what you are training for.
• What you log: meals and drinks, water, weigh-ins, workouts and sets, runs and other activities, planned sessions, and any photos you upload.
• Watch data, if you connect Garmin or COROS: activities with routes and heart rate, steps, calories, heart rate variability, resting heart rate, sleep (unless you turn sleep tracking off), training load and fitness estimates.
• Health notes you choose to add, such as injuries, pain levels and summaries of medical reports.
• Coach notes and other entries written by your AI assistant through the Heza connector.
• Technical data needed to run the service: sign-in sessions, connected apps, and encrypted access tokens for Garmin or COROS.

To show you your data, calculate calories, targets and trends, sync your watch, let your AI assistant read and update your data when you ask it to, and send account emails (sign-up confirmation and password resets).

Heza has no ads, does not sell or rent your data, and does not share it for anyone else's marketing.

• You.
• The Heza team, as explained at the top of this page.
• Your AI assistant, when you connect one (for example Claude or ChatGPT). It can read and change the data in your own account only. What you share in that conversation is also covered by that provider's privacy policy. You can disconnect it at any time in Settings.
• Other Heza users only see foods: food names and nutrition values you log or create can appear in everyone's food search, without your name. You can keep a custom food private with its "Share with everyone" switch.

• Hostinger, which provides the server Heza runs on.
• Brevo, which sends Heza's emails.
• Garmin or COROS, only if you connect your watch.
• Google or Microsoft, only if you sign in with them.
• Open Food Facts and the USDA food database, which receive food search terms and barcodes, never your personal details.

Heza runs on a server rented by the Heza team. Connections use HTTPS, watch access tokens are encrypted, and access to the server is limited to the Heza team. Backups are made every night and kept for 14 days.

Much of what you log is health related. You decide what to store, and you can edit or delete entries at any time. Heza shows estimates, not medical advice.

• Correct or delete entries in the app, and turn off sleep tracking or disconnect your watch or AI assistant in Settings.
• Download a copy of your data from Settings.
• Ask for your account and all its data to be deleted by emailing team@heza.app. It is done within 30 days, and removed from backups within a further 14 days.

Heza is meant for people aged 16 and over.

If this policy changes, the date at the top changes too. For important changes you will be told in the app or by email.