PRIVACY POLICY

What we collect

Account: your e-mail address, and your name if you give it. If you sign in with Apple or Google we receive their ID token (e-mail, name, a stable user id). There are no passwords.

Training: your training style, your weekly training plan (training and rest days, focus, usual time), workouts, exercises, sets, reps and weights.

Daily tasks and routines: what you add (for example vitamins, medication, meals, workout, kickboxing, prayer, water, sleep), their time, weekdays and amount, whether a reminder is on, and which days you completed them. We use this to award XP and to take a little XP for planned tasks left undone.

Check-ins: energy, focus and stress scores and the optional note you write.

Meals and body: meals and food entries, your preferred diet and meals per day, weight entries, fasting times, your shopping list, and, if you fill in the nutrition profile, your age, sex, height, weight, activity, body goal and pace, optional body fat and target weight, and the calorie and protein targets we compute.

Reminders: medication, prayer, appointment and other reminders you set, and a record of notifications we sent you (title, short text, when, whether you read it).

Technical: a push token for your device, app version, and basic request logs for security and abuse prevention. Logs never contain your health, mood, meal or body data.

Feedback you send from inside the app (bug, support, suggestion) and your replies.

What we do not collect

No location, contacts, microphone recordings, or advertising ID. We do not read Apple Health or Google Health Connect. We do not use advertising or analytics trackers, and we never put health data into analytics.

Health and mood data

Medication and vitamin tasks, check-ins, meals, weight, body measurements, fasting and the nutrition profile are health data. We treat them as sensitive: they are used only to show you your own progress, compute your targets and send the reminders you set. We do not sell them, share them with advertisers, or use them to profile you. They are never written to logs or analytics, they are included in your data export, and they are hard-deleted when you delete your account.

You choose what to log. Logging health data is optional; the app works without it. By adding it you give your explicit consent for us to process it for these purposes. You can withdraw that consent at any time by deleting the entries or your account.

Calorie and protein targets, meal ideas and coach messages are general guidance, not medical advice. Talk to a doctor before changing medication or starting a diet.

Data kept on your phone

Reminders for tasks, medication, prayer and fasting are scheduled on your phone so they work offline; the phone holds their title and time. Recent data and changes made offline are cached on the phone until they sync. Deleting the app removes them.

AI features (optional)

Meal photo scan: when you scan a meal, after you agree once, the photo is sent to Google Gemini only to name the foods and estimate grams. We do not store the photo. Nutrition values come from our own food table, USDA FoodData Central and Open Food Facts; for those lookups we send only food names or a barcode, never your identity.

Coach messages and meal plans: when enabled, your check-in scores and note, or your calorie and protein targets, are sent to Anthropic's Claude to write a short reply or a day's meal plan. We send no name or e-mail with it. At most 3 AI requests per person per day.

Anthropic does not use API data to train its models. We use Google Gemini's free tier, under which Google may use what is sent to improve its services and people at Google may review it; that is why the scan asks first and is never required. Do not scan photos that show your face or other people.

How we use it

To provide the app (sync, XP and ranks, reminders, training plans, meal targets), to sign you in, to handle your subscription, to answer support requests, and to keep the service secure.

Legal basis: providing the service you asked for (contract) for your account and app data; your explicit consent for health data; our legitimate interest in security and abuse prevention for request logs.

Notifications are opt-in per category and you can change them any time in Settings. Survey notifications are off by default and sent at most once a month.

Who processes it for us

Hosting and database: Vercel (website and API) and Supabase (PostgreSQL database). Their servers may be outside your country; they protect data under standard contractual clauses.

Sign-in: Apple and Google, only if you choose them.

Payments: RevenueCat with the App Store and Google Play for in-app purchases, and Stripe for web checkout. We never see your card number.

Push notifications: Firebase Cloud Messaging and Apple Push Notification service. They receive the device token and the notification text.

E-mail: sign-in codes and support replies are sent through our Google (Gmail) mailbox over SMTP. Google sees the recipient address and the message.

AI and food data: Google Gemini, Anthropic, USDA FoodData Central and Open Food Facts, as described above.

We do not sell or rent personal data to anyone.

How long we keep it

While your account exists. When you delete your account we hard-delete your data from our database; sign-in codes and rate-limit records expire within hours, and backups roll off within the host's retention window.

Your rights

You can export all your data and delete your account from Settings in the app or on the website. You may also ask us to correct your data, restrict processing, or object to it, and you may complain to your data-protection authority.

For anything else, write to support@khepra.app.

Security

Data is encrypted in transit. Secrets are server-side only. The database denies direct access to every table; only our server reaches it. Admin access is limited to named people with two-factor sign-in and is audit-logged. No system is perfectly secure; if something affecting you happens we will tell you.

Children

Khepra is for adults. We do not knowingly collect data from anyone under 18.

Changes

We will post changes here and update the date above. Last updated 22 October 2026.