Holmquist FitnessPrivacy Policy
This Privacy Policy explains how Holmquist Tech Solutions LLC, a Minnesota limited liability company ("Holmquist", "we", "us"), collects, uses, shares and protects information when you use the Holmquist Fitness web app at holmquist-fitness.com, including when it is installed to your home screen (the "App").
Holmquist Fitness is a general fitness and wellness app. It is not a healthcare provider, and we are not a "covered entity" or "business associate" under HIPAA. Because the App handles information about your body, food, and exercise, we also publish a separate Consumer Health Data Privacy Policy, which forms part of this policy.
The short version
- We collect what you put into the App (account details, body stats, food log, workouts, recovery, AI requests) so the App can work and sync to your account.
- We do not sell your personal information, and we do not use it for targeted advertising.
- Service providers (Supabase, Netlify, OpenAI, Stripe, and Microsoft Clarity for masked usage analytics, which you can turn off) process data for us to run the App.
- You can download your data, correct it, and delete your account from Settings at any time.
Contents
- Information we collect
- How we use it
- AI features
- Who receives it
- Analytics and cookies
- How long we keep it
- Your choices and rights
- Security
- Adults only
- State privacy laws
- Changes
- Contact us
1. Information we collect
| Category | What it includes | Source | Where it's stored |
|---|---|---|---|
| Account | Email, password (stored only as a secure hash by our authentication provider), first and last name, account creation date, last time you used the App | You | Supabase (our database and authentication provider) |
| Body and profile data | Sex, age, height, weight and weight history, goal (lose / maintain / gain), target rate, activity level, calorie and macro targets | You | Your device and Supabase |
| Food and nutrition log | Foods, amounts, meals, water, favorites, custom foods, barcodes you scan | You; food details from Open Food Facts or our built-in list | Your device and Supabase |
| Training and recovery | Workouts, sets, reps, weights, durations, training plans, stretching and recovery routines and sessions | You | Your device and Supabase |
| AI requests | Text you type to the AI Coach or AI builders (which may describe pain, soreness or limitations), meal descriptions, meal photos, and a summary of your profile, goals and recent logs sent as context | You | Processed by OpenAI through our server. AI Coach chat history is saved on your device and in Supabase. Meal photos are not stored by us. |
| Agreements and consents | Which policies and consents you accepted, policy version, time, and your browser's user-agent string | You / your browser | Supabase |
| Subscription | Plan, subscription status and dates, Stripe customer and subscription IDs. Card details are entered on Stripe's page and are never received or stored by us. | You and Stripe | Stripe and Supabase |
| Usage limits | The date and number of AI requests you made today | Automatically | Supabase |
| Sign-up notification | First and last name, device type and browser, whether the App is installed, sign-up time | You / your browser | Netlify Forms (visible to us in our hosting dashboard) |
| Feedback and privacy requests | Your message, optional rating, request type, and (if you choose) your name and email; device type and app version | You | Netlify Forms |
| Technical data | IP address, browser and device type, pages and API endpoints requested, error logs | Automatically | Netlify (hosting) logs; content delivery networks that serve app libraries |
| Usage analytics (on by default; you can turn it off) | Clicks, taps, scrolling, page views, device and browser details, approximate location derived from IP, and session recordings in which on-screen text and app content are masked | Automatically, unless you turn it off | Microsoft Clarity |
We do not collect precise location, contacts, photos from your library (other than a meal photo you choose to analyze), or data from other apps or wearables.
2. How we use information
- To provide the App: calculate targets, log food and workouts, show progress, run timers and routines, and sync your data across devices.
- To run AI features you request: see section 3.
- To manage accounts and subscriptions: sign-in, free trial, billing status, cancellations and receipts (via Stripe).
- To keep the App safe and working: prevent abuse, enforce usage limits, fix errors, and secure our systems.
- To respond to you: feedback, support and privacy requests.
- To improve the App: with masked usage analytics (which screens and buttons are used), never the content of your logs.
- To comply with law and enforce our Terms.
We do not use your health or fitness information for advertising, and we do not sell it.
3. AI features
When you use the AI Coach, Describe a Meal, Meal Photo, AI Plan Builder or AI Recovery Routine, our server sends your request (and, for the Coach and builders, relevant parts of your profile and logs as context) to OpenAI, L.L.C., which generates the response. We send it through OpenAI's API, under terms which, as of this policy's date, say that API data is not used to train OpenAI's models by default and may be kept by OpenAI for a limited period (generally up to 30 days) for abuse monitoring.
Please don't include more health detail in AI requests than you need. AI output can be wrong; see the Medical & Fitness Disclaimer.
4. Who receives your information
We share information only with service providers that process it on our behalf to run the App, when you direct us to, or when required by law:
| Provider | Purpose | Data |
|---|---|---|
| Supabase, Inc. | Accounts, authentication and database (cloud sync) | Account, profile, logs, consents, subscription status. |
| Netlify, Inc. | Website hosting, server functions, forms | Technical data; sign-up and feedback form submissions; requests passing through our server functions |
| OpenAI, L.L.C. | AI features | AI requests and context as described in section 3 |
| Stripe, Inc. | Subscription payments, billing portal, receipts | Email, payment details (entered directly with Stripe), subscription records |
| Microsoft Corporation (Clarity) | Usage analytics | Masked usage data (taps, scrolling, screens); your logs and on-screen text are masked. You can turn it off. |
| Open Food Facts | Food search and barcode lookup | Search terms and barcodes are sent directly from your device (with your IP address). Not linked to your account. |
| jsDelivr and unpkg (CDNs) | Deliver app code libraries (sign-in library, barcode scanner) | Technical data such as IP address |
We may also disclose information if required by law or legal process, to protect the rights, safety or property of users or others, or as part of a merger, acquisition or sale of assets (subject to this policy). Exercise videos open on YouTube, which has its own privacy policy.
5. Analytics, cookies and local storage
Usage analytics (Microsoft Clarity) are on by default with all app content and on-screen text masked, so they show how the App is used (taps, scrolling, which screens) but not your food, weight or other entries. Turn them off anytime in Settings → Privacy & legal. They never load if your browser sends a Global Privacy Control signal. The App stores your data and sign-in session in your browser's local storage so it works offline. See the Cookie & Storage Policy.
6. How long we keep information
- Account and app data: while your account is open. When you delete your account in Settings, your account, profile, logs, AI Coach history and consent records are deleted from our live database right away. Copies in our providers' backups may persist for a limited time until overwritten.
- Data on your device: until you clear it (Settings → Clear data on this device) or uninstall.
- Billing records: Stripe and we keep transaction records as required for tax, accounting and legal purposes (generally 7 years).
- Form submissions (sign-up, feedback, privacy requests): 24 months, then deleted.
- Hosting and function logs: per Netlify's log retention.
- Analytics: per Microsoft Clarity's retention (recordings are generally kept for a limited period).
7. Your choices and rights
- Access and portability: Settings → Your data → Download my data gives you a copy of your app data.
- Correction: edit your profile, goals and logs in the App at any time, including correcting nutrition values.
- Deletion: Settings → Account → Delete account permanently deletes your account and synced data and cancels any subscription.
- Opt out of analytics: turn analytics off in Settings. Because the App can't work without processing fitness data, withdrawing consent to it means deleting your account.
- Other requests or questions: Settings → Your data → Privacy request, or email support@holmquisttechsolutions.com.
We will verify requests by confirming they come from the signed-in account or its email address, and respond within 45 days (extendable where the law allows). Depending on where you live, you may authorize an agent to make a request for you, and you may appeal a decision by replying to our response with "Appeal" in the subject line. We won't discriminate against you for exercising your rights.
8. Security
We use encryption in transit (HTTPS), database row-level security so each account can access only its own data, secret keys kept only on our servers, and password hashing by our authentication provider. No system is perfectly secure. If a security incident affects your information, we will notify you and authorities as required by applicable law.
9. Adults only
The App is for adults 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
10. State privacy laws
Some U.S. states give residents specific rights over personal and consumer health data, including rights to access, correct, delete and obtain a copy of data, to opt out of sale, targeted advertising and profiling, and to know which third parties receive data. We honor these requests for all users regardless of state. We do not sell personal data or use it for targeted advertising or profiling that produces legal or similarly significant effects. Residents of Washington, Nevada and Connecticut should also read our Consumer Health Data Privacy Policy.
11. Changes to this policy
If we make material changes, we will update the version and date above and ask you to review and accept the updated policy in the App before continuing.
12. Contact us
Holmquist Tech Solutions LLC
Email: support@holmquisttechsolutions.com