Privacy Policy
Last updated 13 August 2026 · Effective 13 August 2026
The short version
- HYREN is a HYROX training app. To coach you, it stores your profile, your training logs, and the injuries, pain and wellness check-ins you choose to record. It does not connect to Apple Health, Health Connect, or any wearable.
- Your data lives in your own account. We never sell it, we don't run ads, and we don't use third-party analytics or trackers.
- The health details you record are used only to adapt your training to your recovery, and never for ads or marketing.
- You can export or delete your account at any time from Settings. If an Apple subscription is active, the limited billing-contact and compliance records described in section 10 are retained.
- If you buy HYREN Pro, Apple bills it — we get a purchase ID and an expiry date, never your card.
- You must be 16 or older to use HYREN.
1. Who we are
HYREN is operated by Mohamed Sheha as an individual (sole trader). In this policy, "HYREN", "we", "us" and "our" refer to Mohamed Sheha operating HYREN. For the purposes of data-protection law (including the EU/UK GDPR where applicable), Mohamed Sheha is the data controller responsible for your personal data. Contact: sheha@hyrenapp.com.
2. What this policy covers
This policy explains what personal data the HYREN website and mobile app collect, why, who we share it with, how long we keep it, and the rights you have. It applies to the HYREN website, app, and the backend services that run them. It does not cover third-party services you use separately — those have their own privacy policies.
3. The data we collect
3.1 Account data
- For a website beta registration: your name, email address, optional race date, registration status, and consent timestamp, used to hold your place and contact you about beta access.
- For a job application: your name, email address, the role you applied for, and anything you choose to add — where you are based, your experience and availability, links to your work, and your message. Used only to assess the application and reply to you.
- For a partnership enquiry: your name, email address, and the details you give about your organisation — its name, your role there, its website, country, and size — plus your message. Used only to assess the enquiry and reply to you.
- For an app account: your email address and a securely hashed password, used to create and secure your account and to send verification, recovery, purchase, renewal, and price-change messages. An Apple account that supplies no usable address must verify a billing-contact email before purchase.
3.2 Profile data (you give us this)
- Name, sex, age, height, weight.
- Your race goal: target race, race date, division, and goal finish time.
- Injuries, pain notes, and any medical conditions you choose to record so the app can train around them.
- Your equipment, schedule, coaching preferences, and recovery toolkit.
3.3 Health and fitness data — sensitive / special-category data
HYREN does not connect to Apple Health, Health Connect, or any wearable. It reads no sleep, heart-rate, HRV, blood-oxygen or VO₂max data from your phone or watch. Everything below is data you enter or generate inside the app:
- Your training logs — sessions, exercises, sets, reps, loads, paces, reps-in-reserve, and form notes.
- Subjective wellness inputs — session RPE (how hard a session felt), soreness/energy check-ins, and pain flags.
- Values derived from the above — your readiness score, training load, estimated 1-rep maxes, and projected race finish.
Health and fitness data of this kind is treated as sensitive (special-category) data and is given extra protection (see section 6).
3.4 Device and technical data
- A push-notification token, if you turn notifications on, so we can send the alerts you opt into.
- Authentication tokens stored securely on your device (in the device keychain) to keep you signed in.
- When the app opens it asks our update service whether a newer version of the app's code is available. That request sends the platform (iOS or Android) and the app's runtime version, and — as with any request over the internet — your device's IP address. It carries no account identifier, no device identifier, and none of your training or health data, and it happens whether or not you have turned notifications on. See section 8.
3.5 Subscription data (if you buy HYREN Pro)
- Identifiers Apple gives us for your purchase — a transaction ID and an original transaction ID — plus the plan, price, currency, storefront, trial state, renewal state and date, and any refund or revocation.
- An immutable record of the price, period, renewal and cancellation disclosures you accepted immediately before StoreKit opened, and evidence of the required transactional notices we sent.
- Your account or verified billing-contact email is used to deliver those notices. We never receive or store your card, bank details, or Apple Account billing address.
3.6 What we do not collect
- We do not collect your precise location, your contacts, your photos, or advertising identifiers.
- We do not use third-party analytics, advertising SDKs, or trackers.
- We do not sell your personal data to anyone, ever.
- We do not receive or store your payment card, bank details, or billing address.
4. Where your data comes from
- From you — what you type into your profile and log during training.
- Derived by us — readiness, load, and projections we calculate from the above.
5. How we use your data, and our legal basis
| What we use it for | Legal basis (GDPR) |
|---|---|
| Create and secure your account; sign you in | Performance of a contract with you |
| Save your website beta registration and contact you about beta access | Your consent |
| Assess a job application or partnership enquiry you send us, and reply to it | Your consent, and our legitimate interest in recruiting and in evaluating business partnerships |
| Generate and adapt your training plan from your profile and logs | Performance of a contract / our legitimate interest in providing the service |
| Use the injuries, pain and wellness inputs you record to compute readiness and train around them | Your explicit consent (Art. 9(2)(a)) |
| Unlock and maintain your HYREN Pro access, and keep it working across your devices | Performance of a contract with you |
| Send notifications you opt into (reminders, readiness, taper) | Your consent |
| Keep the app secure, debug problems, and prevent abuse | Our legitimate interest in a safe, working service |
| Comply with legal obligations | Legal obligation |
You can withdraw consent at any time (see section 9); it doesn't affect processing we already carried out lawfully.
6. Health data — explicit consent and your control
Because health data is sensitive:
- You give it to us only by choosing to record it — an injury, a pain flag, a soreness or energy check-in. Nothing is read from your phone, your watch, or any health store, and none of it is required to use HYREN.
- We use it only to adapt your training to your recovery and to train around what hurts. We never use it for advertising or marketing, and we never share it with third parties for their own purposes.
- You can edit or clear these entries at any time and export or delete your account from Settings. Health and training data is removed immediately; only the narrow subscription-compliance exception in section 10 can remain.
7. The AI Coach
- When you send a coach message, the text of that message is sent to Anthropic, our AI provider, together with a summary of your current training numbers (readiness, recent sessions, goal), solely to generate a reply. It is not used to train their models.
- We do not store your coach conversations. Each message is sent, answered, and discarded — the coach has no memory of previous messages, and there is no transcript in your account to export or delete.
- If the AI is unavailable, HYREN answers from its own built-in logic instead, and nothing leaves our backend.
- Please do not type medical details into the coach. It gives training guidance, not medical advice — see our Terms of Service. If you describe an acute symptom, HYREN will stop giving training advice and tell you to see a professional.
8. Who we share data with (our sub-processors)
We don't sell your data and we don't share it for anyone else's marketing. We do rely on a small number of service providers ("sub-processors") to run HYREN. They process data only on our instructions.
| Provider | What it does | What it handles |
|---|---|---|
| Convex (cloud database & hosting, USA) | Stores your account and training data and runs the app's backend | All account, profile, training, and health data |
| Turso (serverless database, USA) | Stores website beta registrations, job applications, and partnership enquiries | The website form data described in § 3.1 — your name, email address, and whatever else that form asked for |
| Resend (transactional email, USA) | Queues and delivers account verification, password recovery, purchase, renewal, and price-change emails, plus the confirmation sent when you submit a job application or partnership enquiry | Your email address and the contents and delivery status of the transactional message. Resend normally retains email data for 30 days |
| Apple (App Store) | Sells and bills the HYREN Pro subscription as merchant of record, and handles cancellations and refunds | Your payment details, which go to Apple and never to us. Apple handles these under its own privacy policy, as an independent controller — not on our instructions |
| Apple Push / Expo notifications | Delivers notifications you opt into | A push token; no health data |
| Expo (app updates, USA) | Serves corrected versions of the app's code between App Store releases, so a fix can reach you without waiting for review | The platform and runtime version the app asks with, and the IP address the request comes from. No account or device identifier, and none of your training or health data |
| Anthropic (AI provider, USA) | Generates AI Coach replies | The text of your coach messages plus a summary of your current training numbers (see section 7). Not stored by us; not used to train their models |
Some providers (e.g. Convex) are based in the United States. Where your data is transferred outside the UK/EEA, we rely on appropriate safeguards such as the provider's Standard Contractual Clauses or an equivalent transfer mechanism.
9. Your rights
Depending on where you live, you have the right to:
- Access a copy of your data — built into the app: Settings → Export my data.
- Erase your data — built into the app: Settings → Delete my account. Account, sign-in, health, and training data is removed immediately, subject only to the narrow subscription-compliance retention described below.
- Rectify inaccurate data — edit it in your profile, or contact us.
- Port your data — the export is a structured, machine-readable file (JSON).
- Restrict or object to certain processing, and withdraw consent at any time.
- Complain to a data-protection authority (in the UK, the Information Commissioner's Office, ico.org.uk; in the EU, your local authority). If you are in the US, you may have rights under your state's privacy law (for example, California's CCPA/CPRA).
To exercise any right that isn't already a button in the app, email support@hyrenapp.com. We'll respond within the time the law requires (usually one month).
10. How long we keep your data
- We keep a website beta registration until access is issued, you ask us to remove it, or the beta programme ends. You can request deletion at any time by emailing support@hyrenapp.com.
- We keep an unsuccessful job application for 12 months from your last contact with us, so we can consider you for a role that opens later, and then delete it. Tell us to delete it sooner and we will.
- We keep a partnership enquiry for 24 months from your last contact with us, or for as long as a partnership is running.
- We keep account, profile, health, and training data for as long as your account exists.
- If you delete while an Apple subscription is active, we retain only the billing-contact email and minimum subscription facts needed to send required notices until the subscription ends. Deletion does not cancel Apple billing.
- When the subscription ends, that retained contact address and account link are erased. Pseudonymous consent and notice evidence is retained until the later of three years after consent or one year after subscription termination, and then automatically deleted.
- Our queued-email content is removed from Convex after final delivery processing; Resend normally retains provider-side email data for 30 days.
- Other data deleted in the app is removed from our live systems immediately and purged from encrypted backups within 30 days.
- If your account is inactive for 24 months, we may delete it after first trying to contact you.
11. How we keep your data secure
- Data is encrypted in transit (TLS) and stored with our cloud provider's encryption at rest.
- Sign-in tokens are held in your device's secure keychain.
- Access to your data is keyed to your authenticated account; one user cannot read another's data.
- No system is perfectly secure, but we take reasonable, proportionate measures to protect your data and will notify you and the relevant authority of a qualifying data breach as required by law.
12. Children
HYREN is not intended for anyone under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact us and we will delete it.
13. Changes to this policy
If we make a material change (for example, enabling the AI Coach's external processing, or adding a sub-processor), we will update this page, change the "Last updated" date, and — where the change is significant — notify you in the app and, where required, ask you to re-confirm your consent.
14. Contact
Questions, requests, or complaints: support@hyrenapp.com.