Privacy Policy for XPulse

App name: XPulse
Package name: com.fitforma.app
Developer: Kostandin Gjini
Contact: gjinikostandin@gmail.com
Last updated: September 9, 2026

This Privacy Policy applies to the XPulse mobile application ("XPulse", "the app"), published on Google Play by Kostandin Gjini ("we", "us", "our"). It explains what data XPulse collects, how that data is used, who it is shared with, and how you can control or delete it.

1. Who we are

XPulse is developed and published by Kostandin Gjini, an individual developer. The developer name above matches the developer name on the XPulse Google Play store listing, and the package name above matches the app that this policy covers.

For any privacy question, data access request, or deletion request, contact gjinikostandin@gmail.com. We aim to respond within 30 days.

2. Health and fitness data (Health Connect)

This section describes how XPulse accesses, collects, and uses Health Data. It applies to health and fitness information read through Android Health Connect.

2.1 What we read

Connecting Health Connect is optional. XPulse works without it. If you choose to connect, and only after you grant permission in the Health Connect system dialog, XPulse reads the following data types:

Health Connect data type	Android permission	What XPulse does with it
Steps	`android.permission.health.READ_STEPS`	Shows your daily step count on the Health card, and plots a 7 day and 30 day step trend chart so you can see whether your activity is rising or falling.
Active calories burned	`android.permission.health.READ_ACTIVE_CALORIES_BURNED`	Shows active calories on the Health card and in the trend chart, and is used to suggest recovery actions after unusually high output days.
Heart rate	`android.permission.health.READ_HEART_RATE`	Shows your most recent heart rate reading on the Health card.
Resting heart rate	`android.permission.health.READ_RESTING_HEART_RATE`	Feeds the daily Readiness score, where an elevated resting heart rate lowers your score and prompts a lighter training day. Also plotted as a trend chart.
Sleep session	`android.permission.health.READ_SLEEP`	Shows last night's sleep duration and feeds the daily Readiness score, where sleep debt lowers your score and adjusts the difficulty of the day's plan.

XPulse requests read access only. XPulse never writes, edits, or deletes data in Health Connect, and does not request any write permission.

XPulse does not request background access to health data. Data is read only while you are using the app.

2.2 How Health Data is used

Health Data is used solely to provide features to you inside the app:

To display your own metrics back to you on the Health screen.
To draw your 7 day and 30 day trend charts.
To calculate your daily Readiness score, which adapts how demanding your daily plan is.

2.3 How Health Data is not used

We do not sell Health Data, and we never will.
We do not use Health Data for advertising, marketing, or remarketing.
We do not transfer Health Data to data brokers, information resellers, or any third party for their own purposes.
We do not use Health Data to determine creditworthiness or for any lending purpose.
We do not send Health Data to third party artificial intelligence or analytics providers.

2.4 Where Health Data is stored

Health Data read from Health Connect is processed on your device and held in app memory for the current session. XPulse does not upload your Health Connect data to our servers or to any third party.

2.5 How to revoke access and delete Health Data

Open the Health Connect app on your phone, choose App permissions, select XPulse, and remove any or all permissions at any time.
Or open XPulse > Settings > Health and tap Disconnect, which revokes the permissions and clears the health values held by the app.

Revoking access takes effect immediately. Because Health Data is not stored on our servers, there is nothing further for us to delete once access is revoked.

3. Other information we collect

Account information. When you create an account we collect your email address and a password. Passwords are stored and hashed by our authentication provider, Supabase, and are never visible to us. You may optionally provide a display name.

Onboarding answers and profile. Your responses to the onboarding questionnaire, your chosen objective and goals, archetype, difficulty setting, and your progress (XP, levels, streaks, stats, completed challenges). This is used to personalize your plan.

Camera and photos. When you use the food scanner or body scan, the photo you capture or select is sent for AI analysis so we can return a nutrition or body composition estimate. These photos are processed to generate that analysis and are never used for advertising. The food accountability photo feature keeps photos on your device and does not upload them.

Journal entries and reflections. Text you write in the journal is stored so the app can generate insights and personalize your plan.

Usage data. Basic in-app interactions needed to operate features, for example which challenges you completed.

Purchases. Subscription status is handled by RevenueCat and Google Play Billing. We receive your subscription state, not your payment card details.

4. How we use your information

To provide and personalize the app, including your daily plan, challenges, and insights.
To generate AI analysis of food photos, body photos, and journal entries.
To sync your progress across your devices.
To send the notifications you have enabled, such as reminders, streak alerts, and the weekly review.
To operate subscriptions and restore purchases.

We do not sell your personal data, and we do not use it for advertising.

5. Who we share data with

Supabase: authentication, database, and storage. Hosts your account, profile, progress, and journal data.
OpenAI: processes food photos, body photos, and journal text to generate analysis. Requests are sent through our server. Health Connect data is not included in these requests.
Open Food Facts: when you scan a barcode, the barcode is sent to look up public product nutrition information. No personal data is sent.
RevenueCat and Google Play Billing: subscription management.
Expo and Google (push notifications): to deliver notifications you enable.

We do not share Health Connect data with any of the above.

6. Data retention

We keep your account and its associated data for as long as your account is active. Health Connect data is not retained on our servers at all, as described in section 2.4. If you request deletion, we remove your account data from our systems within 30 days.

7. Your rights and choices

Access or deletion. Email gjinikostandin@gmail.com to request a copy of your data or the deletion of your account and its data. You can also delete your account from inside the app where that option is available.
Health data. Manage or revoke Health Connect access at any time, as described in section 2.5.
Camera and photos. Grant or revoke camera and photo permissions in Android Settings.
Notifications. Turn notifications off in the app or in Android Settings.

8. Children's privacy

XPulse is not directed to children under 13, or under the minimum age of consent in your jurisdiction. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

9. Security

We use encrypted transport (HTTPS/TLS), server side API keys, and row level security on our database to protect your data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Changes to this policy

We may update this policy. Material changes will be reflected in the "Last updated" date at the top and, where appropriate, by an in-app notice.

11. Contact

Kostandin Gjini
Email: gjinikostandin@gmail.com
App: XPulse (com.fitforma.app)