App & Website Privacy Policy

Information we process

• Account: your email address, display name, account identifier, and authentication events. Ordinary sign-in uses email codes; dedicated App Review accounts use a reviewer-entered password rather than an embedded password.
• Training setup: onboarding answers including goals, equipment, weekly schedule, weight unit, sex selection, age, height, and weight. These answers are saved with your account. These fields are asked during onboarding and are required to complete it. Age, height, weight, and sex selection are used to estimate workout calories; goals and equipment are used to plan workouts.
• Workout activity: generated plans, completed workouts, exercises, sets, weight, repetitions, intensity, and progress history.
• Membership: purchase provider identifiers, entitlement state, renewal/end dates, and whether access is active. We do not store full payment card details.
• Website requests: the email entered for Checkout and basic request data such as IP address and browser information processed for hosting, security, and rate limiting.

Device data we do not request

The current iOS app does not request location, contacts, camera, microphone, HealthKit, or App Tracking Transparency permission. SARAS does not use cross-app tracking or behavioral advertising.

How we use information

• authenticate your account and deliver one-time sign-in codes;
• generate and save workouts, logs, and progress;
• verify purchases and decide whether paid features are available;
• prevent duplicate billing, account resurrection, fraud, and abuse;
• respond to support, privacy, billing, and deletion requests; and
• operate, secure, diagnose, and improve the current service.

Service providers

We share only what is needed to operate SARAS with these providers:

• Supabase for authentication, database storage, and server functions.
• Resend for authentication email delivery.
• Stripe for website Checkout, recurring billing, and web payment records.
• Apple for App Store distribution, in-app purchase, Apple subscription management, and Apple purchase/refund administration.
• RevenueCat for App Store purchase verification and delivery of Apple entitlement state to SARAS. RevenueCat may process an app user identifier, device and app information including operating-system information, purchase and receipt history, subscription metadata, and last-seen activity for that purpose.
• Vercel for website hosting and request processing.

Where these providers process personal information for SARAS, they must protect it under contractual and legal safeguards consistent with this policy and applicable law.

SARAS does not sell personal information and does not share it for cross-context behavioral advertising.

Billing and membership identity

Stripe processes web memberships. Apple processes in-app purchases, and RevenueCat communicates verified Apple subscription state to SARAS. SARAS combines provider status into one account entitlement so one provider cannot erase valid access from the other. Payment cards remain with Stripe or Apple; SARAS receives identifiers and status needed to deliver membership access.

Retention and account deletion

We retain account, training, and entitlement data while your account exists and as needed to operate the service. You can request permanent account deletion inside the iOS app. SARAS then removes account and training data and deletes known Stripe customer records after stopping web billing.

A minimal billing tombstone—an opaque provider identifier, not workout content—is retained so delayed provider events cannot recreate access for a deleted account. Payment providers may retain transaction records under their own legal and accounting duties. Deleting a SARAS account does not cancel an Apple subscription; cancel it in Apple Subscriptions first if you do not want it to renew.

Your choices

You may update onboarding and account settings in the app, request account deletion in the app, or contact us to ask about access, correction, export, billing, or privacy. Rights vary by location; we will verify identity before acting on an account request.

Security and international processing

We use access controls, encrypted transport, provider signature verification, and least-privilege server credentials. No system eliminates all risk. Providers may process information in the United States or other locations where they operate.

Age limit

SARAS accounts are intended for people 18 or older. If you believe a minor provided personal information, contact us so we can investigate and delete it where required.