Privacy Policy

1. Data controller

The controller of your personal data is Mamba IT Michał Kuś, ul. Świętokrzyska 16, 32-650 Kęty, Poland, NIP (tax ID) 5492486607. Data protection contact: huge@hugeai.pl.

2. What data we process

• Account data: email address, name, username, password (stored only in hashed form) or your Google/Apple account identifier, profile picture.
• Year of birth: used only to check that you are 16 or over. Kept until you delete your account and never shown to other users.
• Training data: exercises, sets, reps and load that you log yourself, and training plans.
• AI coach (Hugie): the messages you write to Hugie and its replies (conversation threads), your latest training insight on the Training tab, and daily counts of messages and insights used for usage limits. See section 3a.
• Social content and connections: posts, comments, likes, friends, squads, reports and blocks.
• Purchases and subscriptions: which subscription you have (for example AI Premium), its status, renewal and expiry dates, and the purchase history needed to provide it. Payments are handled by Google Play or the Apple App Store; we never receive your card or bank details.
• Crash reports, error reports and performance measurements: in release builds of the App only. Crash and error reports contain the stack trace, error type and message, App version and build number, operating system and version, device model, and anonymised technical breadcrumbs of what led up to the error (screen route template; HTTP method, status and path without query parameters). Performance measurements are taken in a sample of App sessions: App start time, how long screens take to load and render (screens identified only by their route template), and the duration and status of requests to our server (method and path template, with identifiers removed). None of these include your name, email address, user ID, workout, post or comment content, photos or precise location; identifiers in screen and request paths are removed on your device before anything is sent. We do not collect session replays.
• Terms acceptance: which version you accepted and when.
• Ads (free version only): the App sends none of your account data to the ad provider. When ads are shown, Google’s ad software in the App (Google Mobile Ads SDK) collects device identifiers other than your device’s advertising ID, your IP address (from which Google estimates your approximate location), which ads were shown to you and how you interacted with them, and technical diagnostic data. See section 3b.
• Correspondence: messages you send to huge@hugeai.pl.

3. Purposes of processing

• account and sign-in;
• workout log;
• social features (posts, comments, friends, squads);
• support;
• subscriptions and purchases;
• showing ads in the free version (see section 3b);
• AI coach: training insights and Hugie chat (see section 3a);
• diagnosing and fixing App crashes and errors, and measuring App performance (stability and security);
• security and moderation;
• age check, terms acceptance record, legal obligations.

Apart from the ads in the free version described in section 3b, the App contains no ads and no advertising trackers.

Your content (posts, comments, profile picture, name and username, training plans, squad names; see Terms section 7):

• is never sold;
• is never used to train artificial intelligence models, by us or by our service providers;
• is never used in advertising or promotion outside the App without your separate, explicit consent, which you can withdraw at any time;
• exercise names you enter in training plans may be added to the App’s shared exercise catalogue, available to all users, without anything that identifies you.

Photos added to posts are checked automatically before publication; a photo that very likely shows nudity or violence is rejected. Post text and photos may also be flagged automatically for human review. Decisions to remove content or suspend an account are made by a person.

3a. AI coach (Hugie)

The AI coach is the training insight on the Training tab and the Hugie chat. Full access to the AI coach comes with an AI Premium subscription (Terms, section 3). Responses are generated by Anthropic’s Claude model. To generate them, we send Anthropic:

• For the training insight: a summary of your workouts in the current calendar month compared with the previous one (number of workouts, consecutive training days, total volume, change in load, exercises with a new best weight), plus the progress of your active training plan and the exercise names in its next session. The summary does not include your name, username, email address, plan name or account ID. If you have logged few workouts this month, the insight is produced on our server without AI.
• In the Hugie chat: your message, up to 20 earlier messages from the same conversation, and the training data Hugie looks up to answer: exercises, sets, reps and load from a chosen period (up to 180 days back), the history of a chosen exercise, your active training plan (progress, names and focus of the plan’s days, the exercises in the next session) and a summary of the current week or month. Hugie only sees your own data, never other users’ data.

Each request also carries a pseudonymous identifier (a one-way hash of your account ID) that does not let Anthropic tell who you are; it is used to detect abuse. What you write in the chat reaches Anthropic exactly as you write it, so don’t include details about your health or about other people. Hugie is instructed not to assess pain, injuries or medical conditions and to refer you to a doctor or physiotherapist instead.

Insights and Hugie’s replies are generated automatically and are general training tips, not medical advice. They have no effect on your account or your access to the services.

Data sent to the AI coach is never used to train artificial intelligence models, by us or by Anthropic. Anthropic’s commercial terms for the API (Commercial Terms) prohibit training models on customer data. Anthropic deletes inputs and outputs from its systems within 30 days, unless they are needed to enforce its Usage Policy or the law requires otherwise.

3b. Ads in the free version

• Where and to whom: ads appear only in the Home feed, between posts, and only to signed-in users without a paid subscription. They are never shown during a workout, and each ad is marked “Sponsored”. Ads are limited to content suitable for teenagers.
• Non-personalised ads only: every ad request asks Google for non-personalised ads, which are not based on your past behaviour or a profile of you. On iOS we never ask for permission to track you, and on Android the App does not have access to your device’s advertising ID.
• Consent: in the European Economic Area, the App shows Google’s consent form before the first ad and requests ads only once Google’s consent tool allows it. You can change your choice at any time in the App: Settings → Ad privacy (shown where the consent rules apply).
• What we share: nothing from your account: no user ID, email address, name, training data, posts or messages. Google collects the data listed in section 2 directly through its software in the App.
• Google’s role: Google (Google Ireland Limited for users in the European Economic Area) decides on its own how it uses this data for advertising, as an independent controller, under its privacy policy. How Google uses data from apps that use its services: policies.google.com/technologies/partner-sites.

4. Recipients

We use the following processors:

Processor	Scope
Google Cloud (Cloud Run, Firestore, Cloud Storage)	app server, database, photos and avatars
Google Cloud Vision API	automated screening of photos added to posts, before publication (a downscaled copy of the photo is sent)
Google Cloud Natural Language API	automated screening of post text and tags
TypeSafe AI	matching exercise names you enter to the exercise catalogue and ordering exercise search results (receives only exercise names and search terms, never your account ID)
RevenueCat	subscription management (purchase status and history, linked to your account ID)
Anthropic (Claude model)	Hugie AI coach: training insights and chat replies (receives the data described in section 3a, with a pseudonymous identifier instead of your account ID)
Sentry (Functional Software, Inc.)	App crash and error reports, App performance measurements
Resend	emails: password reset, contract confirmation, notices of changes to the terms, report notifications to the moderation team
Netlify	hosting of hugeai.pl

Payments for subscriptions are processed by Google Play (Google) or the Apple App Store (Apple) under their own privacy policies.

Ads in the free version are provided by Google (Google Ireland Limited for users in the European Economic Area), which acts as an independent controller of the data it collects through its ad software (section 3b).

5. Where data is stored

The app server and database run in Google Cloud region europe-central2 (Warsaw). Automated content screening (Cloud Vision, Cloud Natural Language) uses Google’s European Union endpoints. TypeSafe processes exercise names and search terms in the United States. Anthropic processes data sent to the AI coach outside the European Economic Area, including in the United States; by default a response may be generated in any region of Anthropic’s infrastructure. Google may process ad-related data outside the European Economic Area. Some other providers may process data outside the European Economic Area.

6. How long we keep data

• Account, year of birth, training data and content: until you delete your account. When you delete your account (in the App or by email request), it stops working immediately and we delete the related data from our production systems without undue delay.
• Content you delete: disappears from the App immediately and is deleted from our production systems without undue delay.
• Backups: the database can be restored to any point in the last 7 days, and deleted files (such as photos) are kept for another 7 days. We make no other backups or exports. Deleted data is gone from backups within 7 days at the latest.
• Training plans other users follow: if the author deletes their account, the plan stays available to those users without anything that identifies the author.
• Exercise names in the shared catalogue: stay in the catalogue without anything that identifies you.
• Reports and moderation evidence: for as long as needed to handle the case and any appeal, and no longer than 6 months and 90 days after the last decision in the case (or after the report, if there was no decision). Longer only where the law requires it or where it is necessary to establish, exercise or defend legal claims, for as long as necessary.
• AI coach: Hugie conversation threads, your latest training insight and daily usage counts: until you delete your account; we delete them together with the account. Copies sent to Anthropic are deleted by Anthropic within 30 days (section 3a).
• Subscriptions: subscription status (type, store, expiry date, renewal): until you delete your account; the log of subscription event notifications from RevenueCat (only the event ID and type, used to skip duplicates): 30 days. Apple or Google keep the purchase and payment history under their own rules.
• Ads: we keep nothing about the ads you see. Your consent choice is stored only on your device, by Google’s consent tool. Google keeps the data its ad software collects under its own retention rules.
• Technical logs: 30 days.

7. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object. You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

To exercise these rights, email huge@hugeai.pl. We reply within one month. You can also delete your account yourself in the App: Delete your account.

Where the consent rules apply, you can change or withdraw your ad consent at any time in the App: Settings → Ad privacy. Withdrawing consent does not affect ads shown before.

8. The hugeai.pl website

This website uses no cookies and no analytics. If you pick the light or dark theme, that choice is kept only in your browser’s storage (localStorage) and is never sent anywhere. Our hosting provider (Netlify) processes technical connection data (such as IP addresses) to deliver the site.

9. Changes

We will tell you about material changes in the App. The last-updated date is shown at the top of this page.