Privacy Policy

Effective 2026-10-04.

Bi Train is a training app. To coach you it needs some data about your body and your training, and some of that is health data. This policy says what we collect, why, who else sees it, how long we keep it, and how you take it with you or delete it. The short version: we use your data to run Bi Train for you, we never sell it, health values never go to analytics, and you can export or delete everything from Profile at any time.

Who we are

Bi Train is operated by Bi Dev Lab, the controller of your personal data. For anything about your data, contact bidevlab@gmail.com.

What we collect

• Account: your email address and an optional display name. For each signed-in device, its IP address and browser user agent, kept only until that session ends (at most 30 days). Our security log records sign-ins with a keyed hash of the IP address, never the address itself.
• Training: your goal, experience, equipment and plan; every workout, exercise, set, load, rep count and effort rating you log; custom exercises; and workout notes, which we encrypt individually.
• Health and recovery (health data): sleep duration and quality, energy, soreness and where it is, stress, a “something hurts” flag, and bodyweight if you enter it.
• Connected devices, only if you connect one (Oura, WHOOP, Apple Health, Health Connect): each night’s sleep times and duration, heart rate variability, resting heart rate and each day’s step count. Nothing else is requested. Access tokens for the service are stored encrypted, and disconnecting deletes them. You choose whether the nights already imported are kept or deleted.
• History you import from another app’s export (Strong, Hevy): the workouts, exercises and sets in the file.
• What Bi Train works out from that: estimated strength, trends, plateaus, readiness scores, insights, recommendations, personal records and milestones.
• Coach: the questions you ask and the answers, if you use Coach.
• Food, if you track it: the details your targets are worked out from (sex if you give it, birth year, height, weight, activity and goal), the foods and amounts you log, meals you save, foods you create or read from a label, water, steps you type in, and weigh-ins. When you log by photo, description or label, we keep the reading it produced; the photo itself is never stored.
• Meal plans, if you use them: your diet, allergies and foods to avoid, cooking and budget preferences, the plans and recipes made for you, and your shopping lists.
• Billing: your subscription status (plan, renewal date, which store), from the App Store or Google Play through RevenueCat. Payment details stay with Apple or Google; we never see them.
• Notifications: your notification settings and, if you turn on push, the push address your browser gives us for this device.
• Usage analytics, only if you allow it: which screens you open and which features you use, as event names and coarse buckets (for example “a workout of 45–60 minutes was completed”). Never health values, loads, notes, names, emails or full URLs. Before you have an account we count visits without cookies or any stored identifier. If you turn usage analytics off, nothing is sent at all.
• Error reports: technical details when something breaks, with cookies, request bodies, query strings and local variables removed before they leave your device.

Why we use it, and on what basis

• To provide Bi Train (your plan, the workout runner, progress, readiness and insights): performance of our contract with you.
• To process your health data: your explicit consent, given when you sign up (GDPR Art. 9(2)(a)). Without it Bi Train can’t work, so withdrawing it means deleting your account.
• Coach, AI-written insight wording, meal and label estimates from a photo or description, and meal plans: your consent (“AI coach” in Profile). Turn it off and Coach and those estimates stop (search and manual logging still work); insights fall back to our own wording.
• Usage analytics and product email: your consent, each with its own switch in Profile.
• Security, abuse prevention and error monitoring: our legitimate interest in keeping Bi Train safe and working.
• Billing records: our legal obligations (tax and accounting).

Bi Train gives fitness guidance, not medical advice. We don’t use your data for advertising, we don’t sell it or share it for cross-context behavioural advertising, and we don’t make decisions about you that have legal or similarly significant effects.

Who else processes it

We use these service providers, under contracts that limit them to processing on our instructions:

• Vercel (hosting) and Neon (database), in the United States (Ohio).
• Anthropic (the Claude models behind Coach, insight wording, meal estimates and meal plans), only when AI coach is on. It receives a training summary, the meal or label photo or description you send for an estimate, or for a plan your targets, preferences and the foods you log most, never with your name or email; Anthropic does not use API data to train its models.
• RevenueCat (confirms App Store and Google Play subscriptions; it receives your Bi Train account id, not your name or email). Apple and Googleprocess the payments as the stores.
• PostHog (usage analytics, EU hosting), only as described above.
• Sentry (error monitoring), scrubbed as described above.
• Resend (sign-in codes and account email).
• Open Food Facts (the public food database behind barcode scanning): our server sends only the barcode number, never anything about you. Barcode scanning itself runs on your device.

This is the complete list of the providers that process your data for us. Most are in the United States, so your data leaves your country. Where data leaves the EEA or UK we rely on an adequacy decision (Israel has one, and so do providers certified under the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.

How long we keep it

• Your account and training data: for as long as you have an account.
• When you delete your account: everything above is erased immediately. Encrypted database backups age out within 7 days. A security log entry that your account was deleted is kept for 24 months under a keyed one-way hash, not your identity.
• Billing records: as long as tax law requires, held by Apple or Google as the seller of record.
• Exports are generated for you to download and aren’t kept.

Your rights and choices

• Export: Profile → Your data → Export my data downloads everything we hold about you as a file you can take elsewhere.
• Delete: Profile → Delete account (in the app) or Profile → Your data → Delete account (on the web) erases your account and its data. A store subscription is cancelled in your App Store or Google Play account.
• Correct: edit your details, settings and workouts in the app, or ask us.
• Withdraw consent: each optional consent has a switch in Profile → Privacy, and takes effect straight away.
• Depending on where you live (including the EEA, UK, California and Washington State) you also have rights to access, restrict or object to processing, and to complain to your data protection authority (in Israel, the Privacy Protection Authority). Contact bidevlab@gmail.com; we answer within one month. We won’t treat you differently for using any of these rights.

Security

Data is encrypted in transit and at rest; workout notes are additionally encrypted per field. Access is scoped to your account in every query, sign-in uses one-time codes (no passwords to leak), and we log security-relevant events. If a breach affects your data, we will tell you and the relevant authorities within the time the law requires.

Children

Bi Train is not for anyone under 16. We don’t knowingly collect data from children; if you think we have, contact us and we will delete it.

Changes

If we change this policy in a way that matters, we’ll tell you in the app and ask for your consent again where the law requires it. The version date is at the top. See also the Terms of Service.