Privacy Policy

1. Information We Collect

a. Account Information

When you create an account, we collect:

• Your name and email address
• Password (stored in hashed form; we never store or see your plain-text password)
• Your selected trainer persona preference
• Authentication session records, password reset records, account status, and friend code
• Subscription, restore-purchase, and access-code redemption status

b. Health and Fitness Data

To personalize your training experience, we collect information you provide, including:

• Age, height, weight, goal weight, biological sex, and body composition information you choose to enter
• Fitness goals, fitness level, workout frequency, available equipment, gym access, exercise preferences, and exercise dislikes
• Dietary restrictions, food preferences, food dislikes, calorie targets, hydration targets, and nutrition goals
• Health conditions or physical limitations you choose to share
• Workout plans, workout schedule, exercise logs, personal records, challenge activity, meal plans, meal logs, calorie and macro estimates, and hydration logs
• Menstrual cycle information (optional, only if you enable this feature)

c. Conversation, Media, and User Content

When you interact with your AI trainer or use media-based features, we collect:

• Chat messages and conversation history
• Voice recordings or voice input, when used, for speech-to-text processing; we do not intentionally keep raw voice recordings after processing
• Text sent to trainer voice features and generated audio returned by text-to-speech providers when you use voice playback
• Meal photos, menu photos, profile photos, generated/share images, and related captions or descriptions you choose to provide
• AI-generated insights derived from your conversations to improve personalization
• Conversation summaries used to maintain continuity across sessions
• Feedback, ratings, liked or disliked meals/exercises, support messages, and contact form submissions

d. Usage and Device Data

We automatically collect certain information when you use our Service:

• Browser type, operating system, responsive device class, app version, and release information
• App usage patterns, screen views, and feature interactions
• Session identifiers, event identifiers, timestamps, notification opens, notification scheduling outcomes, and communication preferences
• Error, crash, performance, and diagnostic data, with sensitive request bodies and prompts scrubbed where feasible
• IP address, user agent, content type, and request metadata used for analytics, security, rate limiting, abuse prevention, and troubleshooting
• Referral source, campaign attribution data, UTM parameters, and, where permitted by your platform settings and consent, Meta click identifiers such as fbclid

e. Social and Community Data

If you use our social features, we collect:

• Friend connections and friend requests
• Leaderboard rankings and points
• Zip code and state (for regional leaderboards)
• Public accomplishment share pages and share-card metadata if you choose to create or share them

2. How We Use Your Information

We use the information we collect to:

• Provide and personalize the Service: Generate custom workout plans, meal plans, and AI-driven coaching tailored to your goals, fitness level, and preferences
• Power AI interactions: Enable intelligent conversations with your AI trainer that remember your history, adapt to your progress, and provide relevant advice
• Track your progress: Calculate BMR, track calories and macros, monitor streaks, and generate daily summaries of your activity
• Enable social features: Support friend connections, leaderboards, and community challenges
• Manage subscriptions and access: Verify purchases, restore subscriptions, redeem access codes, and apply premium entitlements
• Send communications: Deliver push notifications, in-app messages, activity reports, re-engagement emails, password reset codes, and other service-related messages according to your settings
• Improve our Service: Analyze usage patterns, feature adoption, and user behavior to enhance the app experience
• Measure advertising effectiveness: Track web ad conversions to understand which campaigns bring users to our Service, subject to consent settings where applicable
• Ensure security: Protect accounts, detect fraud, and enforce our terms of service
• Provide support: Respond to contact requests, troubleshoot bugs, investigate abuse, and improve reliability

3. How We Share Your Information

We do not sell your personal information. We share your data only with the following categories of service providers and partners to operate, secure, support, market, and improve the Service:

a. AI and Language Processing

DeepSeek and OpenAI: We send the minimum relevant profile context, conversation data, meal/workout context, and task prompts needed to generate personalized coaching. DeepSeek is the primary text provider and OpenAI is the fallback. We do not send your date of birth; only your server-derived age may be included. Images are sent only when you request photo analysis.

OpenAI or ElevenLabs: If trainer voice playback is enabled, we send the text to be spoken, selected trainer voice settings, and limited request context to the configured text-to-speech provider so it can generate audio. We may cache generated audio with trainer, provider, model, voice version, and text-hash metadata to improve performance.

b. Subscription Management

Stripe: We use Stripe-hosted Checkout and Stripe Customer Portal to process payments, manage payment methods, show invoices, and handle subscription changes or cancellations. NX does not collect or store card numbers.

c. Email Services

Resend: We use Resend to deliver transactional emails including password reset codes, activity reports, and re-engagement messages. Resend receives your email address and the content of these messages.

d. Text Messaging

Twilio: If you separately opt in and verify your mobile number, Twilio processes your number, verification requests, coaching message content, delivery status, and carrier opt-out signals to provide the NX Trainer text program. Mobile information and text-message consent are not sold or shared with third parties or affiliates for their own marketing or promotional purposes.

e. Advertising, Analytics, and Diagnostics

Meta (Facebook/Instagram): Where enabled and permitted by your consent and platform settings, we use Meta's Conversions API to measure the effectiveness of our advertising campaigns. We may send hashed user data such as email and first name, Meta click identifiers, and conversion events such as registration, activation, or subscription purchase to Meta for ad attribution and optimization. Hashed data is transformed using SHA-256 before it is sent, but Meta may still use it for advertising measurement and matching according to its policies.

Sentry: We use Sentry for crash reporting, error diagnostics, performance troubleshooting, and reliability monitoring. Sentry may receive device, platform, release, error, stack trace, route, and hashed user identifier information. We scrub request bodies, headers, cookies, chat prompts, meal/photo/profile fields, passwords, tokens, and similar sensitive details where feasible before sending events.

First-party analytics: We store app event data such as screen views, feature interactions, conversion events, and notification events in our own systems to understand product usage and improve the Service.

f. Hosting, Database, and Infrastructure

We use cloud hosting, database, storage, logging, and deployment providers to run the Service, store account and app data, deliver web pages and app assets, and maintain backups and operational logs. These providers process data on our behalf under their own security and privacy commitments.

g. Public Sharing and Social Features

If you create a public accomplishment share page, send an invite, copy a share link, or use platform sharing tools, the information you choose to share may be visible to recipients, social platforms, or the public page URL.

h. Legal Requirements

We may disclose your information if required to do so by law, in response to a court order or subpoena, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Passwords are hashed using industry-standard bcrypt encryption before storage
• All data is transmitted over encrypted HTTPS connections
• Browser sessions use secure, host-only, HTTP-only cookies in production
• Database access is restricted and monitored
• Password reset codes expire after 15 minutes and can only be used once
• Rate limiting is applied to authentication endpoints to prevent abuse
• Server and app error reports are scrubbed to reduce sensitive health, meal, photo, profile, password, token, and prompt data before diagnostics are sent to Sentry

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to using commercially reasonable measures to protect your data.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Service. Specifically:

• Account data: Retained until you request account deletion
• AI provider prompts and responses: Content is removed after 30 days; de-identified usage and cost metadata is retained for up to 24 months
• Trainer conversation history and NX rule deliveries: Retained for up to 24 months
• Workout and nutrition logs: Retained to track your long-term progress
• Analytics data: Retained for up to 24 months for trend analysis
• AI-generated insights: Retained while your account is active; superseded insights are soft-deleted
• Voice input: Raw voice recordings are processed for speech-to-text and are not intentionally retained after processing
• Trainer voice audio: Generated text-to-speech audio may be cached with provider, model, voice version, trainer, and text-hash metadata for performance
• Support, security, and operational logs: Retained as needed for troubleshooting, fraud prevention, legal compliance, and abuse prevention
• Subscription and access-code records: Retained or de-identified as needed for purchase verification, fraud prevention, accounting, and entitlement administration
• Text messaging: Twilio processes mobile numbers, verification requests, message content, and delivery data on our behalf. Routable phone numbers and SMS messages are deleted with the account. We retain only a keyed, non-reversible phone hash and minimal consent/opt-out evidence for four years after account deletion to document compliance.

If you delete your account, we delete your account, profile, authentication sessions, password reset records, points and rank records, reports, friendships and friend requests, trainer chat history, conversation summaries, AI insights, notification/contact ledgers, analytics events linked to your user ID, local billing entitlement records, and feedback records linked by our user hash. We detach redeemed access-code records from your user account rather than deleting the code inventory itself. Some data may remain in backups, security logs, Stripe billing records, or provider systems for a limited period where required for legal, security, accounting, fraud-prevention, or operational reasons.

6. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you
• Correction: Update or correct inaccurate information through the app's profile and settings screens
• Deletion: Delete your account and associated app data from Settings, or contact us for help
• Opt-out of communications: Disable re-engagement emails and notifications through the app's settings
• Text messaging choices: Disable trainer texts in Settings at any time, reply STOP to opt out through the carrier, or reply HELP for support. A carrier STOP must be followed by START before app delivery can resume.
• Data portability: Request your data in a portable format
• Withdraw consent: Withdraw consent for optional features like menstrual cycle tracking at any time
• Advertising choices: You can use browser and Meta privacy controls and decline optional tracking consent.

Before deleting your NX account, cancel an active subscription through the Stripe Customer Portal in Settings. To download your retained data, use “Download My Data” in Settings. To exercise other rights or get help, contact hello@nxtrainers.com.

7. Children's Privacy

NX is available only to U.S. residents age 18 or older. We require users to confirm that they are at least 18 during registration. If you believe a minor has provided us with personal information, contact hello@nxtrainers.com.

8. International Data Transfers

Our service providers, including DeepSeek, OpenAI, ElevenLabs, Stripe, Resend, Meta, Sentry, and our cloud infrastructure providers, may process data in the United States or other jurisdictions.

9. Third-Party Links and Services

Our Service may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through our Service.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by updating the "Last Updated" date at the top of this page and, where appropriate, through in-app notifications or email. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: hello@nxtrainers.com
• Contact form: nxtrainers.com/contact