Heart Privacy Policy

1. What data Heart collects

1.1 Health & fitness data

• ·Heart rate (BPM), read in real time from a paired Bluetooth heart-rate monitor (e.g. Coospo HW9) over standard BLE service 0x180D (Heart Rate Measurement, characteristic 0x2A37).
• ·R–R intervals, used to compute heart rate variability (HRV / RMSSD).
• ·Derived metrics: recovery score, strain score, calorie estimates, sleep stages (awake / light / deep / REM), sleep score, and rolling 30-day baselines for resting HR and HRV. All derivations run on-device.
• ·Session history: start time, duration, average / max HR, calories, zone distribution, the GPS route of walks, runs and rides you start, and gym sessions detected from the gym location you save.

1.2 Profile data you enter

• · Age, sex, weight, and height (used by the calorie and HRV-baseline formulas).
• · Sleep target and accessibility preferences.

1.3 Device data

Identifier, name, firmware version, signal strength, and battery level of paired Bluetooth heart-rate monitors.

1.4 Location data

Heart reads your location for three things:

• ·Routes: GPS coordinates while a walk, run or ride you started is active, used to draw the route map.
• ·Gym detection: if you save a gym location, Heart checks your location in the background to notice when you have been inside the radius (250 m by default, 100 to 500 m in Settings) for two minutes with the band on, and then starts a Gym session.
• ·Location timeline: on by default, off in Settings. While the band is connected, Heart logs a point at most every 2 minutes or 50 m. Nothing is recorded within 150 m of the Home location you save.

Location data stays on the phone. It leaves only inside a backup you turn on, or as a route you choose to put on a shared image, where the route is cut off around your Home location.

1.5 Diagnostic data

A rolling log of the last 20 sync / BLE failures (technical strings, no health data) and an in-app crash log. Crash reports are recorded only if you enable "Crash reports opt-in" in Privacy & export. They are written to a file on your device and are not transmitted unless you choose to share a diagnostic export.

2. Where data is stored

All data is stored in your device's private application storage:

• ·iOS: the app sandbox (Documents and NSUserDefaults), automatically protected by iOS data protection.
• ·Android: internal app storage (SharedPreferences and the documents directory). On Android 10+ this storage is hardware-encrypted by the OS using your screen-lock credential.

Other apps cannot read this storage, and uninstalling Heart removes it.

Backups are different. Heart writes its backups to Download/Heart in the phone's shared storage, so that they survive an uninstall. That folder is kept when you uninstall Heart, and other apps you have given access to your files can read it. Delete it yourself if you want every copy gone.

3. Data Heart does not collect

• - Heart never asks for a name, an email or a phone number.
• - The advertising identifier is never read.
• - The build has no analytics SDK and no tracking pixel; it never opens contacts, photos, the microphone or the camera; and no code in it profiles users.
• - No background telemetry. The only background request to a server controlled by us is the update check in section 5, and it sends nothing about you. The "Outbound telemetry" switch in Privacy & export is off by default and does not currently transmit data.

4. Permissions

Heart reads location only for the three purposes in 1.4. It talks to the one Bluetooth device you paired and ignores everything else a scan turns up.

5. Network requests and third-party services

Every request Heart makes is listed here. Like any web request, each one shows your IP address to the server it goes to.

• ·OpenStreetMap tile servers: map tiles for route maps and for offline map areas you download in Settings → Offline Maps. Tile requests include the map region but no Heart-specific identifiers. Once downloaded, tiles are cached locally. Map tiles are © OpenStreetMap contributors, ODbL license.
• ·Update check (from version 1.0.23): at most every 12 hours Heart fetches a small version file from pointbreaklab.com, which is hosted on GitHub Pages. Nothing about you is sent with it, and you can switch it off in Settings. If you accept an update, Heart downloads the new version and checks its checksum before Android asks you to install it.
• ·Only if you turn them on: Google Drive backup (stored in your own Google account, where Google's terms apply) and phone-to-phone sync over your own Wi-Fi, which goes directly between your phones.

Heart contains no advertising SDKs, no analytics SDKs, and no crash-reporter SDKs that send data off-device. The crash log is written to a file by Heart's own code, so there is no reporter SDK in the path.

6. Data sharing

You can share your data with third parties only by your explicit action:

• · Export to another device. Produces a JSON bundle you can transfer.
• · Export local bundle / training data / CSV. Produces files you can save or share through your OS share sheet.
• · Diagnostic export. Bundles recent technical logs for support purposes.
• · Share as a Story image. Shares a finished session or the day's Brief as an image, with switches for what goes on it (heart rate, calories, times, route). A route is cut off around your Home location.
• · Google Drive backup. Only if you turn it on. Copies your backup to your own Google account.
• · Phone-to-phone sync. Only if you start it. Copies your data to your other phone over your own Wi-Fi.

Nothing is sold, and no data goes to an advertiser, an insurer or an employer. Your data leaves the phone only through the actions above, each of which you start or switch on yourself.

7. Your controls

In Settings → Privacy & export you can at any time:

• → Toggle Anonymize exports, Crash reports opt-in, and Outbound telemetry.
• → Export to another device: JSON bundle of sessions and sleep data.
• → Export local bundle, training data, or CSV files.
• → Create a diagnostic export.
• → Clear heart-rate history. Deletes recorded HR samples and sleep corrections; sessions and settings are kept.
• → Delete all data. Permanently removes every heart-rate sample, every session, sleep corrections, app settings, profile, paired devices, and crash logs from this device. This action cannot be undone.

Uninstalling Heart removes its app storage. Backups in Download/Heart, and in Google Drive if you turned that on, stay until you delete them yourself.

8. Children

Heart is not directed to children under 13 (or the equivalent minimum age in your country). The calorie and HRV reference norms used by the app are not validated for children and may produce inaccurate results. Those norms come from adult populations.

10. Security

• · Storage on Android 10+ is hardware-encrypted by the OS using your screen-lock credential. iOS storage is protected by the iOS data-protection class.
• · Heart has no server of its own that receives your data. The only copies outside the phone are the ones you create: exports, shared images, a Google Drive backup or a Wi-Fi sync.
• · A security report reaches one person at the address in section 12. Please write before disclosing publicly, and expect a slow reply and no bug-bounty payout.

11. Changes to this policy

If we update this policy, we will revise the "Last updated" date at the top and, for material changes that expand the data Heart collects, present the new policy in the app on next launch.

12. Contact

Questions, data-export requests, deletion requests, or security reports:

mail.roshankumargupta@gmail.com

For security disclosures, please write before publicly disclosing the issue so it can be reproduced and fixed.

13. Jurisdictional notes

• ·EEA / UK (GDPR / UK GDPR). Heart processes your health and location data on your own device. It is transferred only if you turn on Google Drive backup or Wi-Fi sync, or share an export or image yourself. You retain full rights of access, rectification, erasure, restriction, portability, and objection, and you can exercise most of them directly in the in-app Privacy & export screen.
• ·California (CCPA / CPRA). We do not "sell" or "share" personal information as those terms are defined under the CCPA / CPRA.
• ·Health-data laws (HIPAA, etc.). Heart is a consumer wellness app and is not a HIPAA-covered entity. Data you collect through Heart is not protected health information unless you choose to share it with a covered entity.