Privacy Policy

This policy applies to all users of the Service worldwide, including clients, personal trainers, and visitors to our website. We are headquartered in Ontario, Canada, and our primary legal framework is Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). We also comply with the EU/UK General Data Protection Regulation (GDPR) for users in those regions and the California Consumer Privacy Act (CCPA) for California residents.

2.1 Account Information

• Name, email address, and password (or sign-in token from Apple or Google if you use social login)
• Role (client or trainer) and profile details you provide (bio, location, profile photo)
• Trainer credentials or certifications you voluntarily upload

2.2 Health & Fitness Data

You voluntarily provide sensitive health information when using the Service. This includes:

• Body measurements: weight, body fat percentage, muscle mass, and unit preferences (lbs/kg/%)
• Progress photos you upload for body composition tracking
• Meal photos and food diary entries
• Workout history, training plans, and exercise performance data
• Goals (calorie, macro, and fitness targets) set by you or your trainer
• Session notes and trainer-client communications via in-app chat

Health data is sensitive. We process it solely to deliver the features you request and never sell it to third parties.

2.3 Device & Usage Information

• Device type, operating system version, and unique device identifiers
• Push notification token (used to send you alerts; cleared on logout)
• App usage patterns and feature interactions for product improvement
• IP address and approximate location (country/region)

2.4 Payment Information

We do not store your full payment card details. Payments are handled by:

• Apple App Store or Google Play (for in-app subscriptions via RevenueCat)
• Stripe (for service payments and trainer payouts via Stripe Connect)

We receive only a transaction record and subscription status — not your raw card number or bank details.

2.5 Advertising Identifiers

If you are on a free tier, we use Google AdMob to show advertisements. On iOS, we request your permission via Apple’s App Tracking Transparency (ATT) prompt before accessing your IDFA (Identifier for Advertisers). You may decline; you will still see ads but they will be non-personalised.

• Operate, maintain, and improve the Service
• Analyse meal photos using Google Gemini AI to estimate nutrition macros
• Generate AI workout suggestions and body composition progress analysis
• Provide trainer CRM features, including AI-generated client insights
• Connect clients and trainers, sync subscription tiers, and enforce feature limits
• Process payments and manage subscription entitlements via RevenueCat and Stripe
• Send push notifications (chat messages, session reminders, workout assignments)
• Display relevant advertisements to free-tier users via AdMob
• Investigate and resolve disputes, enforce our Terms of Service, and comply with legal obligations
• Communicate service updates, security notices, and support responses

Haus of Axion uses Google Gemini 3 Flash to analyse meal photos, suggest workouts, review progress, and generate trainer insights. When you trigger an AI feature:

• Your photo or text input is transmitted to Google’s Gemini API servers, which may be located outside Canada
• Google processes the data under its own privacy policy and data processing terms
• AI output (macro estimates, exercise suggestions, body composition notes) is approximate and for informational purposes only — it is not medical advice
• We do not use your data to train Google’s models; inputs are processed transiently

You can avoid AI processing by not using AI-powered features (meal photo analysis, AI workout suggestions, progress analysis).

Each third-party service has its own privacy policy. We encourage you to review them. We contractually require service providers to protect your data and use it only as instructed.

Our primary database and file storage are located in Canada (AWS ca-central-1 / Supabase). Certain third-party processors (Google Gemini, Google AdMob, RevenueCat, Stripe) operate servers in the United States and other countries. By using the Service you consent to these cross-border transfers. Where required by law (e.g., GDPR), we rely on Standard Contractual Clauses or equivalent safeguards.

• Account data: retained while your account is active plus 90 days after deletion
• Health & fitness data (meals, workouts, photos, progress): deleted within 30 days of account deletion
• Payment records: retained for 7 years as required by Canadian tax law
• Push tokens: cleared immediately on logout
• AI usage logs: aggregated and anonymised after 90 days

Depending on your location, you may have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate data
• Deletion — request erasure of your account and associated data (also available directly in-app via Settings → Delete Account)
• Portability — receive your data in a machine-readable format
• Objection / Restriction — object to or restrict certain processing (e.g., personalised ads)
• Withdraw consent — for any processing based solely on consent (e.g., IDFA for personalised ads)

To exercise any of these rights, email info@hausofaxion.ca from the address associated with your account. We will respond within 30 days.

California residents (CCPA): You have the right to know what personal information we collect, to delete it, and to opt out of its sale. We do not sell personal information.

The Service is not directed to children under 13. Users between 13 and the age of majority in their jurisdiction may only use the Service with parental or guardian involvement. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, contact info@hausofaxion.ca and we will delete the account promptly.

We use industry-standard safeguards including TLS encryption in transit, encrypted storage at rest, JWT authentication with short token lifetimes, and role-based access controls. No transmission over the internet is 100% secure; you use the Service at your own risk. Report suspected security vulnerabilities to info@hausofaxion.ca.

We may update this policy as the Service evolves. When we make material changes we will update the “Last updated” date at the top and, where feasible, notify you via email or an in-app notice. Continued use after the effective date constitutes acceptance of the revised policy.

For privacy questions, access requests, or complaints:

If you are an EU resident and believe we have not handled your data appropriately, you have the right to lodge a complaint with your local data protection authority.