Heart — Privacy Policy

1. What data Heart collects

1.1 Health & fitness data

• ·Heart rate (BPM) — read in real time from a paired Bluetooth heart-rate monitor (e.g. Coospo HW9) over standard BLE service 0x180D (Heart Rate Measurement, characteristic 0x2A37).
• ·R–R intervals — used to compute heart rate variability (HRV / RMSSD).
• ·Derived metrics — recovery score, strain score, calorie estimates, sleep stages (awake / light / deep / REM), sleep score, and rolling 30-day baselines for resting HR and HRV. All derivations run on-device.
• ·Session history — start time, duration, average / max HR, calories, zone distribution, and (if you enable it) GPS route for runs / rides.

1.2 Profile data you enter

• · Age, sex, weight, and height (used by the calorie and HRV-baseline formulas).
• · Sleep target and accessibility preferences.

1.3 Device data

Identifier, name, firmware version, signal strength, and battery level of paired Bluetooth heart-rate monitors.

1.4 Location data (only if you use the route feature)

GPS coordinates while a session is active, used to draw the route map. Location is never read outside an active session.

1.5 Diagnostic data

A rolling log of the last 20 sync / BLE failures (technical strings, no health data) and an in-app crash log. Crash reports are recorded only if you enable "Crash reports opt-in" in Privacy & export. They are written to a file on your device and are not transmitted unless you choose to share a diagnostic export.

2. Where data is stored

All data is stored in your device's private application storage:

• ·iOS — the app sandbox (Documents and NSUserDefaults), automatically protected by iOS data protection.
• ·Android — internal app storage (SharedPreferences and the documents directory). On Android 10+ this storage is hardware-encrypted by the OS using your screen-lock credential.

Other apps cannot read this storage. Uninstalling Heart removes all of it.

3. Data Heart does not collect

• — No name, email, phone number, or contact list.
• — No device contacts, photos, microphone, or camera access.
• — No advertising identifiers.
• — No analytics, tracking pixels, or third-party SDKs that profile users.
• — No background telemetry to any server controlled by us. The "Outbound telemetry" switch in Privacy & export is off by default and does not currently transmit data.

4. Permissions Heart requests, and why

Heart never reads location outside an active route-tracking session, and never accesses Bluetooth peripherals other than the one you pair with.

5. Third-party services

Heart's only network requests are to OpenStreetMap tile servers when you download an offline map area in Settings → Offline Maps. Tile requests include your approximate map region but no Heart-specific identifiers. Map tiles are © OpenStreetMap contributors, ODbL license. Once downloaded, tiles are cached locally and used without further network access.

Heart contains no advertising SDKs, no analytics SDKs, and no crash-reporter SDKs that send data off-device.

6. Data sharing

You can share your data with third parties only by your explicit action:

• · Export to another device — produces a JSON bundle you can transfer.
• · Export local bundle / training data / CSV — produces files you can save or share through your OS share sheet.
• · Diagnostic export — bundles recent technical logs for support purposes.

We do not sell data. We do not share data with advertisers. We do not share data with insurers or employers.

7. Your controls

In Settings → Privacy & export you can at any time:

• → Toggle Anonymize exports, Crash reports opt-in, and Outbound telemetry.
• → Export to another device — JSON bundle of sessions and sleep data.
• → Export local bundle, training data, or CSV files.
• → Create a diagnostic export.
• → Clear heart-rate history — deletes recorded HR samples and sleep corrections; sessions and settings are kept.
• → Delete all data — permanently removes every heart-rate sample, every session, sleep corrections, app settings, profile, paired devices, and crash logs from this device. This action cannot be undone.

You can also remove all Heart data by uninstalling the app.

8. Children

Heart is not directed to children under 13 (or the equivalent minimum age in your country). The calorie and HRV reference norms used by the app are not validated for children and may produce inaccurate results.

10. Security

• · Storage on Android 10+ is hardware-encrypted by the OS using your screen-lock credential. iOS storage is protected by the iOS data-protection class.
• · Heart does not transmit your data to any server, so transit-level breaches are not applicable.
• · If you discover a security issue, please contact us at the address below before public disclosure.

11. Changes to this policy

If we update this policy, we will revise the "Last updated" date at the top and, for material changes that expand the data Heart collects, present the new policy in the app on next launch.

12. Contact

Questions, data-export requests, deletion requests, or security reports:

mail.roshankumargupta@gmail.com

For security disclosures, please write before publicly disclosing the issue so it can be reproduced and fixed.

13. Jurisdictional notes

• ·EEA / UK (GDPR / UK GDPR) — Heart processes personal data only on your own device. No transfer occurs by default. You retain full rights of access, rectification, erasure, restriction, portability, and objection through the in-app Privacy & export screen.
• ·California (CCPA / CPRA) — We do not "sell" or "share" personal information as those terms are defined under the CCPA / CPRA.
• ·Health-data laws (HIPAA, etc.) — Heart is a consumer wellness app and is not a HIPAA-covered entity. Data you collect through Heart is not protected health information unless you choose to share it with a covered entity.