Privacy

Last updated 22 October 2026

https://gethector.app/privacy

Hector is the AI training plan that reads your Apple Health — a daily lift log and a weekly planner. Apple Health is the record.

We don’t put your name or email in the product database. Identity is the Firebase Auth UID.

You sign in with Apple or Google through Firebase Authentication, the sign-in service in our own Google Cloud project. Hector asks neither Apple nor Google for your email. Firebase Authentication keeps your Firebase Auth UID, which service you signed in with and that service’s ID for your account, and when you signed up and last signed in. If you sign in with Google, it also keeps the name and profile photo link Google shares as your basic profile. If you sign in with Apple, Apple gives your name only to the app on your iPhone, and Firebase Authentication keeps no name.

You can also sign in with an email address and a password. Then Firebase Authentication collects your email address and a password, which it stores only as a salted one-way hash, to provide sign-in: to check your password, to send you a message that confirms your address, and to reset your password when you ask. Hector does not use your email address for tracking, and does not put it in the product database or send it to Google Analytics.

The first and last name on your profile are filled in from your sign-in when it shares them, or you type them, and you can change them. That name stays on your iPhone; Hector never sends it to our servers or to your paired Apple Watch.

The product database holds only Auth UID, workout sessions, workout sets, subscription entitlements, your Eat Now nutrition profile, your training profile (including your health check choice), and the weekly plans we generate for you. With iCloud sync on, part of it is also copied to your private iCloud (see iCloud sync).

While a workout is open, Hector’s Live Activity shows your next set on the Lock Screen, and you can log it there.

Weight and height stay in Apple Health; your paired Apple Watch shows your latest weight. Hector reads your date of birth from Apple Health and keeps a copy on your iPhone only, so your age, heart rate zones and birthday message keep working; if Apple Health does not share one, you can enter it in Settings → Training, and it is kept the same way. The copy is never sent to our servers, is left out of iCloud and device backups, and is removed when you sign out or delete your account. Your age is worked out from that date, or, if there is none, from the age you type on the screening page. On your birthday Today shows one greeting line you can close. If you turn on the birthday message in Settings → Notifications, Hector sets one local notification on your iPhone for 9 in the morning on your birthday; it says only “Happy birthday. Have a good one.” and carries no name, age, or date.

Training plans and screening

To build a weekly plan we store a training profile: the kinds of training you want to do, how many days a week you want to train and how long a session should be, your experience level, the equipment you have, the classes you attend and how often, any movements you have asked us to avoid, your health check choice if you made one (see below), and the date and version of the terms you accepted, plus a yes/no that you are 18 or older. When Hector knows your age (your date of birth, or else the age you typed) it fills in that yes/no without asking; only when it does not know your age do you confirm it yourself.

Setup is a single screening page. It starts with one safety question, the doctor-restriction checkbox: you check it to confirm that no doctor has told you to limit exercise. Until you check it, Hector only logs and tracks your training; it does not recommend workouts or build a plan. Once you check it, the page shows the Health check, then asks for your date of birth, or the age you type if you prefer (only when Apple Health does not share a date of birth; you can skip it), your biological sex (only when Apple Health does not share it; you can skip it), whether you are 18 or older (only when Hector does not know your age), and your agreement to the consent statement.

The Health check lists five concerns under “Talk to a physician first if any of these apply.” and offers two choices, each a single tap: “None of these apply to me” and “One of these applies — keep it gentle”. You do not have to choose, and Hector does not ask you to choose before it builds a plan. Until you choose, Hector records no choice and your plan stays gentle, at moderate intensity. Only “None of these apply to me” lets a plan go above moderate intensity. The same card is in Settings → Training, under Health check, where you can change your choice at any time.

A gentler choice takes effect at once. If this week’s plan was built above moderate intensity and your health check now keeps it gentle (for example, you chose “One of these applies — keep it gentle”), Hector asks our planning service to rebuild the week at moderate intensity straight away, and holds your sessions gentle until the new week arrives.

A choice counts for a year. When it is more than a year old, or you change the movements you asked us to avoid, Hector shows the Health check again and builds no new plan until you choose again or tap “Retake the health check”, which clears the old choice and keeps your plan gentle.

Earlier versions of Hector asked seven yes/no screening questions. If you answered them, those answers stay stored with your training profile until you make a Health check choice, which replaces them. Hector now reads them as no choice: they do not change your plan, which stays gentle until you choose.

Your doctor-restriction answer is kept on your iPhone and sent to our servers, where it is stored apart from the product database, in Google Cloud Firestore under your Firebase Auth UID: your current answer, plus an entry for each change with the new answer, whether you made it in setup or in Settings, the app version, and the time. With iCloud sync on, your answer and an entry for each change you make while sync is on, timed by your iPhone’s clock, are also kept in your iCloud copy (see iCloud sync). It decides whether Hector recommends workouts, and it is never sent to any AI service or to Google Analytics. When your account is erased (see Deleting your account), this record is erased from Firestore, and a copy is kept in the legal-claims record described there.

Your health check choice is health information. It is stored on your iPhone and, with the date you made it and the movements you asked us to avoid at that time, with the rest of your training profile in our product database under your Firebase Auth UID. With iCloud sync on, it is also in the iCloud copy of your training profile. Our planning service reads it from there for one thing: deciding whether a plan may go above moderate intensity. The plan request your iPhone sends does not carry it; a rebuild after a gentler choice says only that it is a safety rebuild. Your choice is never used for advertising or analytics, and it is never sold. It is never sent to any AI service; the exercise-selection request carries only a yes/no flag saying whether the plan is capped, which your choice sets. When your account is erased (see Deleting your account), it is erased from our product database, along with any older screening answers, and a copy is kept in the legal-claims record described there. Your biological sex stays on your iPhone. Your typed age is never sent to our servers; with iCloud sync on, it is also kept in the iCloud copy of your training profile.

Apple Health

On your device the app reads steps, active energy, workouts, weight, height, VO2 max, and date of birth from Apple Health to show your day, your profile, your progress calendar (up to a year of workout days), and the Analytics screen. The Steps row on Today also shows your walking and running distance for the day, which Hector reads from Apple Health for that row; it stays on your iPhone and is sent to no server. On device, the Analytics screen charts your steps and the sleep, resting heart rate, and heart rate variability described below, and shows your VO2 max; its strength section uses the sessions you log in Hector, not Apple Health. Hector also reads body fat, for the weekly check-in on the Analytics screen and so your paired Apple Watch can show it. It reads flights climbed to show them with a stairs workout, and biological sex, which the Supplements page shows and which stays on your iPhone. When you open an outdoor workout from your progress calendar, Hector also reads that workout’s saved route from Apple Health to draw the map on its detail screen; the route is kept in memory on your iPhone, never stored, and sent to no server, though the map itself comes from Apple, which can see which area is shown. On an iPhone with iOS 18 or later, it also reads the workout effort score Apple Health holds for a workout, either the rating you gave it or Apple’s estimate. The score is shown on your progress calendar, in a workout’s detail, and after a lift, on your iPhone only, and it is never stored or sent. The weekly check-in adds it into one weekly figure, described next.

The weekly check-in on the Analytics screen reads, on your iPhone, from Apple Health: weight, body fat, height, VO2 max, resting heart rate, heart rate variability, sleep, steps, active energy, your workouts and their walking and running distance (for your best mile and longest run), and the calories eaten, protein, carbohydrates, and fat that other apps write to Health. On iOS 18 or later it also reads the effort score that you or your Apple Watch give a workout, and adds up each workout’s minutes times its effort score into one weekly figure, Weekly Effort, kept with your check-ins; a workout without a score is left out. Hector also reads your Apple Exercise minutes, for the Exercise row on Today and the check-in, and your walking heart rate average, shown only as your own trend on the check-in; it is never compared with a reference group. These stay on your iPhone and are sent to no server. It puts them beside the sessions you log in Hector and shows how each number changed from your baseline, taken when you started, and from the weeks before. Hector keeps your check-ins on your iPhone only and sends them to no server; signing out or deleting your account clears them from your iPhone. If you turn on the weekly reminder, it is a local notification on your iPhone that says your check-in is ready; it contains none of your numbers.

If you subscribe, the Leaderboard (the crown on Today) and How You Compare on the Check-in tab show where your latest VO2 max and resting heart rate sit within published US reference ranges for your age and biological sex: the lower, middle, or upper third of the range. It compares your number with a published table, never with other people who use Hector. Hector works this out on your iPhone from numbers it already has; the ranges are built into the app, and your age, sex and readings are not sent anywhere for it. It is not shown to anyone under 18. The Leaderboard’s Invite a Friend opens your iPhone’s share sheet with a link to Hector and none of your numbers; Hector sees nothing you share there.

If you subscribe, Settings → Nutrition also uses your weight, height, age (from your date of birth, or else the age you typed), and biological sex (your answer in setup, or else Apple Health), together with your goals, training days, health check choice, and doctor’s restriction answer, to suggest calorie and macro targets. Hector works them out on your iPhone: the suggestions are never stored or sent, and no Apple Health value leaves your iPhone for them.

The Hector app on your paired Apple Watch also reads Apple Health on the Watch: steps, active energy, heart rate, heart rate variability, VO2 max, weight, body fat, walking and running distance, cycling distance, flights climbed, dietary energy (which no Watch screen shows yet), and date of birth (for heart rate zones). Its permission request also asks to read workouts, but the Watch app never reads them; it only saves the workouts you run on the Watch to Apple Health. Hector sends nothing it reads there to your iPhone or anywhere else.

Your paired Apple Watch shows your latest weight, body fat, VO2 max, resting heart rate, and heart rate variability, and your latest blood pressure reading when Blood pressure is on. These values pass only between your iPhone and your paired Apple Watch; they are never uploaded. Apart from the workout summaries described next, Hector sends nothing it reads from Apple Health to a server, except the yes/no that you are 18 or older: when you have not typed an age, Hector fills it in from your Apple Health date of birth without asking (see Training plans and screening).

When we build a plan we read the workouts Apple Health recorded in the seven days before that week, and send their date, kind, and length to our planning service so the week accounts for what you already did.

On the Sleep screen Hector also reads, on device only, sleep analysis and overnight signals Apple Health already stores: heart rate, resting heart rate, heart rate variability, respiratory rate, blood oxygen, sleeping wrist temperature, and sleeping breathing disturbances. Those values stay on your iPhone, apart from the latest resting heart rate and heart rate variability your paired Apple Watch shows; they are never uploaded. Hector also reads heart rate recovery, how far your heart rate falls in the first minute after a workout, and shows it on that workout's detail, in Analytics and in the weekly check-in. It stays on your iPhone and is sent to no server.

Hector’s Apple Health permission request also lists blood pressure, blood glucose, and lab results, and you can allow or decline each one there. Blood pressure is read only while the Blood pressure section is on. The section is on unless you turn it off in Settings → General. When you open it, Hector reads the last 90 days of blood pressure samples in Health (for example from a connected cuff) and keeps them on your iPhone, can write readings you enter back to Health, and shows your latest reading on your paired Apple Watch. Glucose is read when you open Analytics: Hector reads the last 14 days of blood glucose from Health (for example from a CGM that shares to Health), read-only, and keeps the readings in memory only.

Hector reads lab results only after you have tapped Show My Lab Results on Analytics. Before that tap, Hector reads no lab results. After that, “Share new lab results automatically” (Settings → General) is on by default; while it is on, Hector reads the lab result records Health shares with it when you open Analytics and each time it refreshes your Health data, for example when you come back to the app or open your profile. With it off, Hector reads them only when you open Analytics. Lab results are kept in memory only, never saved on your iPhone. Blood pressure, glucose, and lab results are never uploaded to our servers.

We write workouts back to Apple Health for the sessions you log or finish in the app: strength, HIIT, cycling, running, rowing, and walking. We do not write weight, height, or date of birth back, and those three never leave your iPhone and your paired Apple Watch.

iCloud sync

If your iPhone is signed in to iCloud, Hector also keeps a copy of your workout sessions and sets, your Eat Now nutrition profile (your allergies, diet, and calorie and macro targets), your training profile with your health check choice, and your doctor-restriction answer with its changes, encrypted in your private iCloud, where Hector and Google cannot read them. The copy keeps that data the same on each device where you use Hector with the same Hector account and the same iCloud account. Our servers still receive and store the same data as described on this page; the iCloud copy is kept as well, not instead.

For a workout session the copy holds when it started and ended, the Apple Health workout it was saved as, and when it last changed. For each set you confirmed it holds the exercise, the weight and reps, whether it was to failure or part of a drop set, the weight and reps Hector suggested and what that suggestion was based on, its place in the session, and when it last changed. A set of an exercise you created carries that exercise’s id, which is made from the name you typed, as it does on our servers. Sets you did not confirm are not copied, and neither are the effort ratings, notes, tempo, distance and other details you add to a set on your iPhone. Your training profile is copied whole: everything in it that Training plans and screening describes, including your health check choice with its date and the movements you asked us to avoid at that time (or your older screening answers), your preferred equipment for exercise swaps, and the age you typed, if you typed one. For each change to your doctor-restriction answer that you make while sync is on, the copy holds the new answer, whether you made it in setup or in Settings, the app version, and the time on your iPhone’s clock; earlier changes stay only on our servers.

Nothing else goes into the iCloud copy: not your profile name, date of birth, biological sex, check-ins, weigh-ins and measurements, progress photos, blood pressure readings, weekly plans, the plan you make yourself, favorite or pinned lifts, workout favorites, custom exercises, or supplements, and nothing Hector reads from Apple Health apart from the yes/no that you are 18 or older in your training profile.

The first time sync runs for your account on an iPhone, Hector copies what is already on that iPhone, together with what our servers hold for you: your recent workouts (up to the last 180 days), your Eat Now and training profiles, and your doctor-restriction answer. Each Hector account has its own space in your iCloud, so another Hector account that uses the same iCloud account never sees yours. The copy counts toward your iCloud storage. Hector compares the copy with what is on your iPhone at most once a day; if a record is missing from iCloud it copies it again, and the check never deletes or overwrites anything.

Settings → General → iCloud Sync shows whether sync is on. While your iPhone is not signed in to iCloud, iCloud is not available to Hector or cannot be reached, or your iCloud storage is full, nothing goes to iCloud until that changes. If your iPhone is signed in to a different iCloud account from the one Hector synced with, Hector pauses sync for your account until you tap Use This iCloud Account. If you remove Hector’s data from iCloud in the Settings app, Hector stops copying until you tap Turn Sync Back On. Signing out of Hector leaves the copy in your iCloud. Delete account deletes it (see Deleting your account).

Location

Eat Now’s nearby-restaurant search uses your location on the device, through Apple Maps, only while you use that screen. Eat Now does not store or send your location.

Separately, each plan request includes your device’s time zone so the week starts on the right day; it is not stored with the plan.

Analytics

The Hector iPhone app sends usage events to Google Analytics through Google’s Measurement Protocol, so we can see where people get stuck between signing in and subscribing and which features they use. An event is a short name for something you did or saw in the app, sometimes with a few short values. The app does not record every screen or tap; it sends only the events in these groups:

The exercise event names the exercise by its id in our catalog (for example back-squat). For an exercise you created yourself it says only “custom”, never the name you typed, and an event an earlier version of the app left waiting on your iPhone is changed the same way before it is sent. The referral tags come from the link you opened.

Every event also carries a random ID the app makes up once per install (not the advertising identifier, and not taken from anything on your device), a session number taken from the time the app was opened, and the time of the event. While you are signed in, it also carries your Firebase Auth UID, the same ID that keys your account in our product database, so the events are linked to your Hector account. Events recorded while you are signed out carry no UID. The app sends each event straight from your iPhone to Google, so Google also receives your network (IP) address, as with any request over the internet.

Events never carry your name, your email, your typed age, your biological sex, your health check choice, your screening or doctor-restriction answers, the movements you asked us to avoid, your nutrition settings, your location, your photos, your sets, weights, or reps, or anything read from Apple Health, such as steps, workouts, sleep, heart rate, weight, height, or date of birth. They say whether you allowed Apple Health, not what it holds. We do not use the advertising identifier, and every event asks Google not to use it to personalize ads.

If your iPhone is offline, events wait on it (up to 200, oldest dropped first) and are sent later, with the time they happened. Signing out or deleting your account does not clear events still waiting, does not reset the install ID, and does not delete events already sent to Google Analytics. Deleting the app removes the install ID and any events still waiting.

Hector has no setting to turn these events off. The Hector app on Apple Watch sends no analytics of its own; a set you confirm on the Watch is recorded by your iPhone and counted there like any other set.

Website and waitlist

The gethector.app site counts visits with a first-party, cookieless counter. It stores daily totals by page, referring site and campaign tag, with no IP address, no cookie and no identifier, and it does nothing if your browser sends Do Not Track or Global Privacy Control.

If you join the waitlist we store your email, the campaign tag and referring site you arrived from, an optional referral code, and your optional answers about Apple Watch and training style. We email you about the launch only after you confirm in the message we send you, and you can decline in the same message.

AI-assisted exercise selection

A rules engine we wrote decides how much you do — the sessions in your week, how long each one is, and its sets, reps, and effort — from published physical activity guidelines. Anthropic’s Claude API then picks which exercises from our own catalog fill the slots the rules engine already created. It cannot add, remove, or change a session, and it can only choose exercises we offered it.

What we send with that request: the training goals you chose (for example, add muscle or increase cardio), your experience level, the shape of each session the rules engine has already fixed, the candidate exercises from our catalog for each block (their ids, names, muscle groups, and tags) and the ids of exercises already placed that day, which kinds of classes you attend and how often, the exercise ids you were given recently, the Monday date of the week being planned, and a single yes/no flag saying whether the plan is capped.

The reply contains the chosen exercise ids and one short sentence per session explaining the session, which the app shows you as written.

What we never send: your health check choice or older screening answers, the movements you asked us to avoid, your equipment, your name, your email, or your Auth UID.

We keep the request and the reply in our own logs for 90 days so we can review what was chosen, then they are deleted. The request and reply are stored under a random request id rather than your account id. A separate operational log line records which request id belonged to your account, so we can join the two if we need to investigate a plan you report.

Deleting your account

Settings → Delete account schedules your account to be erased 30 days later, and the app shows you the date. Until then your account stays on our servers. As soon as the request goes through, Hector clears data from the app on that iPhone, as described below, and signs you out. If the request fails, nothing is cleared from your iPhone and you stay signed in. If the app cannot tell whether the request went through (for example, the connection dropped), the deletion may still stand, and Hector shows you the erase date and the two choices the next time you sign in or open the app. Any other device signed in to your account returns to the sign-in screen within about an hour, but it keeps the data already on it until you sign in there and choose Delete as planned, or, after the erase, until you delete the app.

To change your mind, sign in before that date. Hector then shows your erase date with two choices. Keep my account cancels the deletion and brings back what our servers hold. It does not bring back an iCloud copy that was already deleted; when sync runs again, Hector copies into your iCloud what is then on your iPhone. What was only on your iPhone, such as the name on your profile, your date of birth and the age you typed, was cleared and may need to be entered again. A subscription stays attached, because the App Store holds it. Delete as planned signs you out again and clears the device the same way. If you do nothing, the deletion goes ahead. Once the erase has started it can no longer be cancelled.

When you choose Delete account, Hector clears this data from the iPhone: your workout sessions and sets, your profile with your first and last name, your training profile with your health check choice, your weekly plans, your Eat Now profile, your doctor-restriction answer, your workout favorites, changes still waiting to sync, any feedback drafts, and an unfinished setup page. Progress photos you saved on this iPhone belong to your account: Delete account removes them when the deletion date passes, and no other account on the iPhone can see them. Weigh-ins, measurements and pinned lifts you saved on this iPhone are removed when the deletion date passes. Not everything on the iPhone is cleared. Some data Hector keeps for your account there, such as your blood pressure readings, biological sex, supplements, and whether you have turned on lab results, is not cleared from your iPhone by Delete account. Custom exercises are not tied to an account, so they show for whoever next signs in to Hector on that iPhone. Deleting the app from your iPhone removes all of it.

With iCloud sync on, Delete account also deletes your iCloud copy (see iCloud sync) as soon as the request goes through, without waiting for the erase date. It is not part of the daily erase, because our servers cannot reach it. If your iPhone is offline or iCloud cannot be reached, the sign-in screen says the deletion is still going, and Hector tries again each time the app opens and when the connection returns. If your iPhone is signed in to a different iCloud account from the one Hector synced with, Hector cannot reach the copy and does not say it was deleted: the sign-in screen tells you, and you can remove Hector’s data under iCloud in the Settings app on a device signed in to that account. If you delete the app before the deletion goes through, the copy stays in your iCloud until you remove it there. Another device signed in to your account and the same iCloud account stops syncing once it sees the copy is gone.

The erase runs once a day. It happens at the first daily run after the same time of day you asked, 30 days later, so it can come later on the date the app showed you, or on the day after. It erases your sign-in record in Firebase Authentication, your workout sessions and sets, your training profile with your health check choice and any older screening answers, your Eat Now nutrition profile, your weekly plans, the record of your subscription on our servers, your doctor-restriction answer with its history, and your workout favorites. If a step fails, it is tried again on the next daily run. Signing in afterwards with the same Apple, Google, or email account starts a new, empty account. Deleting your account does not cancel an active App Store subscription; Apple bills that separately. To stop it, cancel it in your Apple account’s subscription settings, or with Manage Subscription in Hector’s Settings before you delete.

Two things are kept after the erase. Both stay on our servers, and neither can be read from the app or this website.

The first is a legal-claims record, kept in case of a legal claim. It holds your doctor-restriction answers with each change and when it was made (the answer, whether you made it in setup or in Settings, the app version, and the time); your current restriction setting; your health check choice with the date you made it and the movements you asked us to avoid at that time, or your older screening answers, exactly as stored in your training profile; your terms consent (when you accepted and which version) and your yes/no that you are 18 or older; which sign-in service you used; and when your account was created and erased. It holds no name, email, or account id in readable form. It is filed under a one-way code made, with a key only our servers hold, from your sign-in service and its ID for your account, so the same Apple, Google, or email account signing in again gives the same code. We keep it for 6 years after the erase, and delete it within a month after that.

The second is an anonymous summary that helps us understand why people leave. It holds the months you signed up, asked to delete, and were erased; whether you subscribed (none, a first period, or renewed), monthly or annual, and whether it was active, canceled, or expired when you asked; about how many sessions you logged and in how many weeks (as ranges), and the month of your last one; the kinds of training, days a week, session length (as a range), experience, and equipment from your training profile; which kind of link or code brought you to Hector, from a short fixed list; and the app versions. It holds no name, email, account id, exact time, date of birth or age, Apple Health value, weight, set, exercise name, movement you asked us to avoid, class you attend, health check or screening answer, or anything you typed. Its record id is random. We set no date to delete it.

Workouts already written to Apple Health stay in Apple Health. Delete them in the Health app if you want them gone. Usage events already sent to Google Analytics are not deleted (see Analytics), our server logs are not part of the erase, and neither are the notices Apple sends our servers when a subscription starts, renews or changes; they carry Apple’s transaction details, not your Hector account ID.

Hector is not a medical device.

Support: support@gethector.app. That is also the in-app Feedback button.