Privacy Policy

Mynvoqe Labs LLC ("we", "us", "our") is the controller of the personal information processed in PumpCal.

• Address: Mynvoqe Labs LLC — all correspondence by email at contact@mynvoqe.com (pumpcal.com)
• Privacy contact: contact@mynvoqe.com
• EU/UK representative or DPO: privacy requests from the EU and UK are handled at contact@mynvoqe.com

• Account: email address, password (stored only as a salted hash by our authentication provider), or a Google sign-in identifier; display name.
• Profile and onboarding: age or date of birth, sex or gender selection, height, weight, training experience, goals, available equipment, days and minutes per session, injuries, pain and limitations.
• Body data: weight, body-fat percentage, lean mass, circumference measurements, and progress photos you choose to upload.
• Training: planned and completed workouts, exercises, sets, repetitions, loads, RPE, session notes, saved workouts and history.
• Nutrition: meals, foods, portions, calories and macronutrients, food photos, scanned nutrition labels, recipes, shopping lists, and food preferences including allergies and dietary restrictions you enter.
• Coach: the messages you send the Coach, and voice input you choose to dictate.
• Support: the content of messages you send us.

• Derived training metrics: tonnage, average RPE, strain, readiness and recovery estimates, progression state and plan revisions.
• AI outputs: Coach replies, plan recommendations, meal analyses, and the reasons recorded for a recommendation.
• Subscription records: entitlement status, plan, store, product identifier, purchase and expiry timestamps, trial and grace-period state, and sandbox flags.
• Diagnostics: error reports and performance measurements, redacted so that they exclude email, credentials, tokens and free-text Coach or health content.
• Technical data handled by our hosting and network providers to deliver the app, including IP address and device/browser characteristics. IP address is used for delivery, security and abuse prevention; PumpCal does not use it to derive or store a precise location.

If — and only if — you connect them and grant permission on your device:

• Apple Health (HealthKit) on iOS and Health Connect on Android: steps, distance, active and resting energy, heart rate, resting heart rate, heart-rate variability, active minutes, VO₂ max where the platform provides it, hydration, weight, body-fat and lean mass, sleep duration and stages, and workouts.
• Data from wearables (for example a watch) reaches PumpCal only through Apple Health or Health Connect, together with the source and device name so duplicate readings can be reconciled.

You can revoke this access at any time in your device's health settings and disconnect the integration in PumpCal. Disconnecting stops new imports; it does not delete data already imported, which you can delete separately or by deleting your account.

Health information you write into PumpCal, or that PumpCal reads from Apple Health or Health Connect, is never used for advertising, is never sold, and is never used to train AI models.

Much of what PumpCal holds is sensitive: health and fitness data, body measurements, progress photos, injuries and limitations, dietary restrictions and allergies, and — where you provide it — information that may reveal a health condition. Some laws treat this as a special category requiring your explicit consent.

We process this information to provide features you have asked for, and we ask for your consent where the law requires it. You can withdraw consent by disabling the feature, deleting the data, or deleting your account.

• To create and secure your account and authenticate you.
• To generate and adapt training plans, exercise guidance, recovery estimates and progress analysis.
• To analyse food photos and nutrition labels you submit, and to look up nutrition data.
• To answer your questions in the Coach, including reading aloud in your language.
• To operate subscriptions and verify entitlement.
• To keep the Service secure, prevent abuse, and diagnose faults.
• To provide support and to send required service messages.
• To comply with legal obligations.

• Performance of a contract: providing the account, training, nutrition and subscription features you signed up for.
• Explicit consent: health and fitness data, progress photos, microphone and camera access, health-platform integrations, and marketing email.
• Legitimate interests: security, fraud and abuse prevention, and diagnosing faults — balanced against your rights.
• Legal obligation: tax, accounting and responding to lawful requests.

PumpCal uses AI to answer Coach questions, to analyse photos of meals and nutrition labels, and to read replies aloud. To do that, the relevant content — your message, the exercise or meal context, the image, or the text to be spoken — is sent to AI model providers through the Lovable AI Gateway, which routes requests to model providers including OpenAI and Google.

• We do not use your content to train our own models.
• We do not authorise our AI providers to use your content to train their models under the enterprise/API terms we use; API-tier processing is on our instructions. Providers may retain content briefly for abuse monitoring under their own policies.
• Voice dictation uses your device's or browser's built-in speech recognition. Depending on your device and browser, that recognition may be performed by Apple or Google as part of your operating system, under their privacy policies, before any text reaches PumpCal.
• Coach replies are read aloud by a text-to-speech model; the audio is streamed to your device and is not stored by us as a recording.

Training-plan generation and progression are rules-based and deterministic. AI recommendations are suggestions; nothing in PumpCal makes a decision with legal or similarly significant effects on you.

We share information with processors only as needed to run the Service:

• Lovable Cloud (Supabase) — database, authentication, file storage and server hosting for all account, training, nutrition, health and media data.
• Lovable AI Gateway, and through it OpenAI and Google model APIs — Coach replies, meal-photo and nutrition-label analysis, and text-to-speech.
• USDA FoodData Central (U.S. Department of Agriculture) — public nutrition reference lookups. Food names are queried; your identity is not sent.
• RevenueCat — subscription state and receipt validation, when you purchase in the app.
• Apple and Google — app distribution, in-app purchases and billing, and, if you enable them, the health platforms on your device.
• Email delivery for authentication messages (sign-up confirmation, password reset) through our authentication provider.

We do not use third-party advertising SDKs, third-party analytics SDKs, or crash-reporting SDKs from ad networks. Diagnostics are first-party and redacted.

We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising as those terms are defined by California and other US state privacy laws. We do not serve targeted advertising in PumpCal, and we do not use health, nutrition, photo or Coach data for advertising.

Our hosting, AI and subscription providers operate in the United States and may process your information there and in other countries. If you are in the EEA, the UK, Brazil or another country with transfer restrictions, your information may be transferred abroad under appropriate safeguards such as the European Commission's Standard Contractual Clauses and equivalent mechanisms.

We keep your information for as long as your account exists, so that your history, progress and plans remain usable.

• Account and app data: retained until you delete the record or your account, then deleted within 30 days, with backup copies expiring within 90 days.
• Progress photos and food photos: retained until you delete them or delete your account.
• Diagnostics: retained for a short operational period and not linked to your identity in a durable way.
• Subscription and billing records: retained as required for accounting, tax and dispute handling.
• Security logs: retained for a limited period for abuse and intrusion investigation.

We use row-level security so that database rows are readable only by the account that owns them, server-side authorisation for privileged operations, private storage buckets with time-limited signed links for photos and media, encryption in transit (HTTPS/TLS) and encryption at rest provided by our hosting platform, secret management that keeps API keys server-side, and least-privilege access for administrative operations.

No product or transmission method is completely secure, and we do not claim that PumpCal is 100% secure.

In the app you can view and correct profile information, export a copy of your data, revoke permissions, disconnect health integrations, delete individual records, and delete your account.

Depending on where you live, you may also have rights to access, correct, delete, restrict or object to processing, to portability, to withdraw consent, and to appeal a refusal. Contact contact@mynvoqe.com and we will respond within the period required by applicable law.

If you are a California resident, you may request to know the categories and specific pieces of personal information we collect, to delete it, to correct it, and to limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioural advertising, and we do not offer financial incentives for data. We will not discriminate against you for exercising your rights.

Residents of other US states with comprehensive privacy laws (for example Colorado, Connecticut, Virginia, Utah, Texas, Oregon and Montana) have comparable rights, including a right to appeal our decision.

You may access, rectify, erase, restrict, object to, or port your personal data, and withdraw consent at any time without affecting prior processing. You may lodge a complaint with your supervisory authority.

Você pode confirmar a existência de tratamento, acessar, corrigir, anonimizar, bloquear, eliminar, portar seus dados, obter informação sobre compartilhamento, e revogar consentimento, nos termos da Lei nº 13.709/2018. Contato: contact@mynvoqe.com.

PumpCal is not directed to children under 16. We do not knowingly collect personal information from anyone under that age. If we learn that we have, we delete the account and its data. A parent or guardian can contact contact@mynvoqe.com to request deletion.

PumpCal uses local device storage and cookies that are strictly necessary to run the app: keeping you signed in, remembering your language, region, units and theme, caching content for performance, and storing your diagnostics opt-out. We do not use advertising cookies or third-party tracking pixels.

Diagnostics and usage events are first-party, redacted before they leave the device, and can be turned off in Settings. Error reports may still be captured for safety and reliability, with a minimised payload when you have opted out.

We maintain an incident-response process. If a breach affects your personal information and the law requires notification, we will notify you and the relevant authorities within the period required by the applicable law, and describe what happened, what data was involved, and what to do.

We will post updates here and, for material changes, notify you in the app or by email before they take effect. The version you accepted is recorded against your account.

Mynvoqe Labs LLC — Mynvoqe Labs LLC — all correspondence by email at contact@mynvoqe.com (pumpcal.com). Privacy: contact@mynvoqe.com. Support: contact@mynvoqe.com.