Privacy policy

Last updated October 17, 2026

This policy explains what data HEIMAR, the strength training app, handles, what it is used for and how you can delete it. The data controller is Juan Santabar, the developer of HEIMAR; you can reach us at appheimar@gmail.com.

Without an account, everything stays on your phone

HEIMAR works without an account. In that case your workouts, routines, measurements, settings and photos are stored only on your phone and never reach us. If you uninstall the app, they are deleted with it, except for any backups you exported yourself.

What we store if you create an account

An account keeps your data safe and lets you see it on another phone. With it we store:

• Your email and an encrypted password, to sign in.
• Your profile: name, sex, age or date of birth, weight, height, experience and what you tell us about how you train (goal, time, place and schedule). They are used to calculate ranks, muscle recovery and suggested loads, and to build routines.
• Your activity: workouts, sets, routines, custom exercises and machines, notes, app settings, and your daily body weight and measurements.
• The photos you add: your profile photo and your reminder photos.
• Your plan: whether you have HEIMAR Pro, since and until when, and with which invitation code; and whether you tapped “Join HEIMAR Pro”.

This data is stored with Supabase, which provides our database. Each account can only read and change its own data.

AI features (HEIMAR Pro)

When you use an AI feature —the suggested load, building a routine, reading the weights on a machine or a bar, or explaining which machine it is— the app sends our server what that feature needs: your recent sets and training profile, or the photo you took. The server runs on Cloudflare and passes the request to an AI model on Cloudflare Workers AI. We do not keep those photos or requests: they are used to answer and then discarded. To limit usage, the app also sends a randomly generated device identifier.

Cloudflare keeps technical logs of each request (time, result, errors) for a few days, which we use only to find bugs.

Phone permissions

• Camera and photos: only when you choose to take or attach a photo.
• Notifications and alarms: for the end of a rest period and the reminders you schedule. They are created on the phone; we do not send notifications from a server.
• Vibration: for alerts during a workout.

What we don't do

• We don't sell or rent your data.
• We don't show ads or use advertising or tracking tools.
• We don't share your data with anyone other than the providers named above, and only so the app can work, unless the law requires it.

Security and where data is stored

Everything travels encrypted (HTTPS). Supabase and Cloudflare may store or process data outside Colombia, under their own security measures.

How long we keep it and how to delete it

We keep your data while you have an account. You can delete it at any time from the app, in Profile › Account › Delete account: your account, your records and your cloud photos are deleted right away. If you no longer have the app, see how to request deletion.

Your rights

You can access, update, correct and delete your data, and withdraw your consent, under Colombian Law 1581 of 2012 and the laws of your country. You can do most of it yourself in the app; for anything else, email us at appheimar@gmail.com and we will reply within 15 business days at most.

Children

HEIMAR is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.

Changes

If this policy changes, we will update the date above and, for significant changes, let you know in the app.