Privacy Policy

ReInvent is a fitness, nutrition, and habit app operated by Sean McKeen (“we”, “us”). It is built local-first: your training, food, and habit data lives on your device. This policy explains the small set of data that leaves it, who we share it with, how it is protected, and the controls you have. Questions or privacy requests: support@reinvent-app.com.

What we collect

• Account details: your email address, your name, and a password (stored only as a salted hash by our authentication provider). These create and secure your account.
• Your content, when cross-device sync is enabled: food log entries, custom foods and saved meals, workouts, routines, personal records, habits, body-weight entries, points, goal settings, and profile details you enter (height, age, sex, body-fat estimate).
• Health & fitness data: the workout, nutrition, and body-metric information above is fitness data; any Apple Health data you choose to connect is covered under Apple Health below.
• Cycle data, if you use it: period days, flow, and any symptoms you log stay on the device you logged them on. They are never uploaded to our servers, never synced between your devices, never included in analytics, never visible to anyone you share progress with, and never used to change any recommendation the app makes. You can delete all of it at any time from Settings → Cycle, which removes it immediately and permanently from that device.
• Photos: progress photos you attach to a workout are stored on your device and, when sync is enabled, backed up to a private storage bucket only your authenticated account can reach (via short-lived signed links). Photos of nutrition labels or meals are processed on your device only and are never uploaded.
• Analytics, only if you opt in: anonymous product-usage events (for example, “a widget was added”). Analytics are OFF by default, contain no names, food text, notes, or free-form input, carry no device or user identifier, and are never linked to your account. You choose this in Settings → Privacy & Data.

We do not collect your location, contacts, advertising identifiers, or biometric identifiers, and we do not track you across other apps or websites.

Apple Health

Every Health connection is opt-in, per data type, and off by default. Depending on what you enable, ReInvent reads weight, steps, sleep (including sleep stages, where your device records them), water logged in other apps, heart-rate variability, resting heart rate, respiratory rate, one-time profile details (height, age, sex), and — only if you enable it separately — the period days you log in Health. Cycle data read from Health is read-only, joins the device-local cycle log described above, is never uploaded or synced, and never changes any recommendation. It writes nutrition, water, workouts (time only), and weigh-ins you log. Each toggle requests only its own permission, and turning one on never enables another.

Heart-rate variability, resting heart rate and respiratory rate are read purely as context you can look at beside your training. They are shown only against your own recent range, are never combined into a score or a readiness figure, and never affect anything the app calculates — including muscle freshness, which is worked out from your logged sets alone.

We never sell or share Health data, never use it for advertising, marketing, or data mining, and never disclose it to third parties. Health-derived data is used only to show your own trends inside the app. Steps, sleep, heart-rate variability, resting heart rate and respiratory rate stay on your device and are never sent to our servers. Weigh-ins imported from Health join your in-app body-weight log, so if cross-device sync is enabled they are backed up to your account like any other body-weight entry; leave sync off (or the weight connection off) to keep them on-device only.

Where your data lives

Everything is stored on your device first, in a local database. If sync is enabled, your content is also stored with our backend provider (Supabase) under row-level security, so only your authenticated account can read or write it.

Food-database lookups (search, barcode) send only the search text or barcode number to our food-data service — never your log, identity, photos, or Health data. Label and meal scanning runs entirely on your device.

Who we share data with

We do not sell your personal information and we share it only with the service providers needed to run the app, each acting on our behalf:

• Supabase (authentication, database, file storage) — stores your account and synced content, including workout progress photos, in the United States.
• Aptabase (analytics) — receives only the anonymous, opt-in usage events described above, in the United States. It never receives your name, email, logs, or any identifier.
• USDA FoodData Central and Open Food Facts (food databases) — receive only the food search text or barcode number you look up, forwarded server-to-server with no user identity attached.
• Apple (and Google, on Android) — process app distribution and, in the future, any paid subscription billing. Apple Health data is exchanged only on your device under your control.

We may also disclose information if required by law, to protect our rights or users, or as part of a business transfer — in which case this policy continues to apply.

How your data is protected

• In transit: all traffic between the app and our servers is encrypted over HTTPS, with App Transport Security enforced (no cleartext connections).
• At rest on your mobile device: data written to the local database is sealed with AES-256-GCM encryption using a device-only key held in the iOS Keychain / Android Keystore. On iOS this sits on top of an app-declared file-protection class; on Android it sits on top of the device-wide encryption Android applies to app storage. The key never leaves your device and is not stored on our servers.
• On the web version of ReInvent, local data relies on your browser’s built-in storage isolation and is not additionally encrypted at rest.

No security measure is perfect; we cannot guarantee absolute security, but we work to protect your data in line with its sensitivity.

Your rights and choices

• You can access and correct your account and profile data directly in the app, and export your workouts, food log, and weight history as CSV files at any time (Settings → Privacy & Data).
• You can delete your account and its synced data at any time (Settings → Delete account), as described below.
• Depending on where you live (for example, under the EU/UK GDPR or the California CCPA/CPRA), you may have additional rights to access, correct, delete, or receive a portable copy of your personal data, and to object to or restrict certain processing. We honor these rights and do not discriminate against you for exercising them.
• We do not sell or “share” your personal information for cross-context behavioral advertising, so there is no “Do Not Sell or Share” step to take; we also honor recognized opt-out preference signals such as Global Privacy Control.

To make any request, email support@reinvent-app.com; we may need to verify your identity via your account.

International data transfers

Our providers store and process data in the United States. If you use ReInvent from outside the U.S., your information will be transferred to and processed there, which may have different data-protection laws than your country. By using the app you understand this transfer.

What we never do

No ads, no advertising SDKs, no cross-app tracking, and no selling of data — to anyone, ever. We do not use your data to train AI models. ReInvent does not use any third-party artificial-intelligence service; coaching hints and insights are computed on your device from your own data.

Retention and deletion

Your data is kept for as long as your account exists. When you delete your account (Settings → Delete account), we permanently remove your account and all synced data — workouts, food log, body metrics, habits, points, settings, and progress photos — from our servers, and clear local data from the device.

One exception: if you submitted an exercise to the shared community catalog and it was approved and published, that catalog entry is de-identified and remains available to other users after your account is deleted. You can export your workouts, food log, and weight history as CSV before deleting (note: CSV export covers those three data sets, not every item in your account).

Children

ReInvent is not directed to children under 13 (or the minimum age in your region), and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.

Changes and contact

If this policy changes materially, we will update the date above and note the change in the app. For any question or privacy request, contact Sean McKeen at support@reinvent-app.com.