Privacy Policy

Fysik is run by [your full name or company name], in [country] ("we"). We decide how your data is used and we're responsible for it. Questions or requests: hello@fysik.io.

• Your account: your email address, the name you choose, and what you tell us in setup or Settings (units, time zone, what you use Fysik for, and optionally your birth date, height and goals).
• What you record: gyms and machines, plans and workouts, food and meal plans, weight and measurements, progress photos, daily check-ins and sleep, supplements, medications and injections, symptoms, bloodwork reports and results, messages with your coach or clients, and your questions to the AI assistant.
• From a wearable, if you connect one: Whoop's recovery and sleep readings, and the access it grants us (kept encrypted).
• To keep your account safe and the service working: your signed-in devices with their type and network address (kept while you stay signed in, at most 30 days after you last used them); sign-in attempts by address, to limit guessing (cleared after a day); and a record of actions like signing in, sharing or deleting, which never includes what you recorded.
• For notifications you turn on: your devices' push addresses, and what was sent when.

On your device, Fysik keeps your recent workouts, plans and gyms so it works with no signal. They're wiped when you sign out. Cookies are only the ones the service needs: one keeps you signed in, and short-lived ones finish signing in with a passkey, connecting Whoop, or joining through a link (which link, for an hour). No analytics, advertising or tracking cookies.

Only to run Fysik for you: to show and work out what you've recorded, to share what you choose with the people you choose, to send the emails and notifications you've asked for, to keep your account secure, and to fix what's broken. We don't sell it, rent it, or use it for advertising, and we don't build profiles of you for anyone else.

The legal basis is providing the service you signed up for. Sending anything to AI needs your separate, explicit consent, area by area, which you can withdraw in Settings at any time. Health records are only kept because you choose to record them, and you can delete them whenever you like. [Check whether the law in [country] needs a separate, explicit consent before someone records health information: Fysikdoesn't ask for one yet.]

Supplements, medications, injections, symptoms and bloodwork are sensitive. Recording them is optional:Fysik works fully without them. They're encrypted with a key of their own, never shared as part of any group of settings, and only shared when you turn on that area for one person and confirm it by name. Someone you share your health log with sees the last 90 days, without your notes.

A bloodwork PDF is kept only while its values are being checked, then deleted, unless you choose to keep it. Fysik reads the values out of it; it doesn't interpret them for you.

• The people you share with. Only the areas you choose, read-only, until you stop. Every time they look is logged for you to see, and kept for 365 days.
• Your coach, if you connect with one. They see your name, email address and what you share with them, and nothing else. They can send you plans to accept; they can't change your records.
• Anyone with a link you make. A plan, a gym or a coaching join link shows that and nothing else of yours (with your name only if you choose). Stopping a link is immediate.
• Companies that run parts of the service for us, each only for that job, under contract:
  • Railway, which hosts the servers, the database and stored files, in Singapore.
  • Resend, which sends our emails (sign-in codes, invitations, notifications you turn on).
  • Anthropic, which provides the AI, only if you turn it on, and only the areas you allow. Meal photos you ask about are sent to it and not kept by us.
  • The push service of your browser or phone (Apple, Google or Mozilla), which delivers notifications. They say as little as possible, since they show on lock screens.
  • Whoop, only if you connect it, to fetch your readings.
  • Open Food Facts, which receives a barcode you scan, and nothing about you.
• Authorities, only if the law requires it, and we'll tell you if we're allowed to.

On servers in Singapore. If you live elsewhere, your data travels there, and some of the companies above handle it in other countries (Resend and Anthropic in the United States, for example). We only use providers bound by contract to protect it.

• Everything you record: until you delete it, or delete your account.
• When you delete your account: at once from the service, and from backups within 30 days.
• Sign-in codes: 10 minutes. An address typed on a link's page to join: 60 minutes.
• Records of who looked at what you share: 365 days.
• Records of actions on your account: kept, but never with what you recorded, and not tied to you once your account is deleted.

Everything travels encrypted. Your health log, bloodwork, progress photos, messages, coach notes and AI conversations are also encrypted in the database with keys kept separately, so a copy of the database alone can't read them. Sign-in is by emailed code or passkey, with no passwords to leak.

This isn't end-to-end encryption: the service holds the keys, so it can read your records to show them to you. Access is limited to running the service.

• See and correct what you've recorded, in the app.
• Download all of it as files, any time: Settings → Your data.
• Delete any record, or your whole account, from the app.
• Stop sharing with anyone, or stop a link, at once.
• Turn AI off, or change what it may read, at any time.
• Stop any kind of email or notification, from Settings or the link in each email.

You may also have rights under the law where you live, such as to object to or restrict how we use your data. Ask at hello@fysik.io; we answer within 30 days. If you're unhappy with our answer, you can complain to [your country's data-protection authority, with its website].

Fysik is for people aged 18 and over. If you think someone younger has an account, tell us and we'll delete it.

If we change this policy in a way that matters, we'll tell you in the app and ask you to agree again before you carry on. The date at the top says which version this is.