Privacy Policy

This Privacy Policy explains what the Karada mobile application and the braveheart-labs.com website (together, the “Services”) collect, why, and what choices you have. The Services are operated by Braveheart Labs, 2108 N ST STE N, Sacramento, CA 95816, USA.

Summary

We collect the information needed to run a workout tracker for you: an email address and profile for your account, the training and nutrition data you log, media you choose to attach, and — only if you turn the connections on — health data, wearable data, and GPS location during outdoor workouts. Anything you choose to publish is visible to other users. Some features send what you give them to a third party in order to work: the assistant and photo-recognition features send your input to Anthropic, and map screens load tiles from Mapbox. All of this is described below. We do not sell your personal information, we do not show advertising, and the app contains no third-party analytics, advertising, or tracking software.

Information we collect

Account information. When you create an account we collect your email address. Sign-in is by email; we use Amazon Cognito to manage accounts and credentials. Your password is handled by Cognito and is never visible to us. We verify your email address and use it for account recovery and for service notices.

Profile information. You may add a display name, a short bio, a country, and a profile photo. Your display name and profile photo are shown to other users wherever your activity appears — including alongside comments you leave, which store your display name with them.

Workout data. The training information you enter — exercises, sets, repetitions, weights, programs, routines, notes, timestamps, and body measurements such as weight. This is the core content of the app and is stored so it is available across your devices.

Nutrition data. If you use the nutrition features: the meals and foods you log, photographs of meals you submit, your macro and hydration targets, and body-composition estimates including any photo you submit for a body-fat estimate. See the AI section below for where meal and body photos are sent.

Media you add. Photos and videos you attach to workouts, using your camera or photo library. The app requests camera and photo library access only when you use a feature that needs it; you can decline and continue to use the rest of the app.

Apple Health data — only with your permission. If you grant HealthKit access, the app reads the following categories: workouts, body weight, resting heart rate, heart rate variability (SDNN), sleep (asleep, awake, deep, light, and REM stages), and walking/running, cycling, and swimming distance. It writes one thing back to Health: body weight entries you record in the app. It does not write workouts or any other category. This data is used to display your training and recovery in the app. You can revoke Health access at any time in the iOS Settings app under Privacy & Security → Health. We do not use Apple Health data for advertising or marketing, and we do not share or sell it — this is required by Apple’s rules and it is also our practice.

Oura data — only if you connect it. If you connect an Oura account, we receive readiness, sleep, and activity information from Oura through their authorized API in order to show it in the app. You can disconnect at any time, which stops further collection.

AI assistant and photo recognition — what leaves the app. Karada includes features powered by Anthropic’s Claude API. When you use them, the content you supply is sent to Anthropic (api.anthropic.com) to produce a response:

• In-app assistant. The messages you type, and the training context needed to answer them.
• Coaching and readiness suggestions. Recent workout, sleep, and recovery figures, so the suggestion reflects your actual training.
• Body-composition estimates from a photo. If you use this feature, the photo you choose — which is a photo of your body — is sent to Anthropic to produce the estimate.
• Meal recognition from a photo. The food photo you submit is sent to Anthropic to identify the item and estimate its nutrition.

Photos are sent only for the feature you invoke, at the moment you invoke it. If you do not use these features, nothing is sent. Anthropic processes the request under its own commercial terms and privacy policy. We do not send your email address or account identifiers with these requests.

Location and route data — only with your permission. If you start an outdoor workout and grant location access, the app records your precise GPS position for the duration of that workout, including while the app is in the background and your screen is locked — this is what allows a run or ride to keep recording in your pocket. The resulting route, along with distance, elevation, and speed, is uploaded and stored with the workout on our servers so it is available across your devices. Location is not collected outside an active outdoor workout, and you can decline or revoke location access in the iOS Settings app at any time; the rest of the app continues to work.

Maps. Screens that display a route or map load their imagery from Mapbox. Mapbox necessarily receives your device’s IP address and the map area being displayed in order to serve the tiles, and its SDK may collect its own usage telemetry under its privacy policy. Maps appear only on route and GPS screens.

Fonts. The app may load typefaces from Google Fonts at runtime, which discloses your IP address to Google for the duration of that request.

Device permissions. Depending on the features you use, the app may request access to the camera, photo library, microphone, motion and fitness activity, speech recognition, or location. Each request happens at the point of use and explains why. Declining a permission disables only the feature that needs it.

Website. The braveheart-labs.com website is a set of static pages. It sets no cookies, runs no analytics, and does not track visitors. Our hosting provider may keep standard server logs, such as IP address and requested URL, for security and reliability. If you send us a message through the contact form, the name, email address, and message you type are delivered to us by Web3Forms, a form-delivery service, and are used only to reply to you.

How we use information

We use the information above to operate your account, store and sync your training data, provide the app’s features, respond to support requests, keep the Services secure, detect abuse, and comply with law. We do not use it to build advertising profiles.

Where information is stored

Data is stored on Amazon Web Services infrastructure in the United States. Account records are held in Amazon Cognito, workout data in Amazon DynamoDB, and media files in Amazon S3. Data is encrypted in transit, and at rest by AWS.

Sharing

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose information only:

• to service providers who process it on our behalf — currently Amazon Web Services for hosting, storage, and authentication; Anthropic, for the assistant, coaching, and photo-recognition features described above; Mapbox, for map imagery; and Google, for font delivery;
• to other users, for anything you choose to publish. If you publish a workout, it and any photos attached to it become visible to your followers and in the app’s shared feed, together with your display name and profile photo. Comments and likes you leave are visible to others. Unpublishing removes it from the feed;
• to services you connect, at your direction, such as Apple Health or Oura;
• when required by law, such as a valid subpoena or court order; and
• in a business transfer, if Braveheart Labs is involved in a merger or acquisition, in which case we will give notice before your information becomes subject to a different policy.

Retention

We keep your account and workout data for as long as your account is active. If you ask us to delete your account, we delete your account record, workout data, and media within 30 days, except where we must retain something to comply with law. Backups are purged on their normal cycle.

Your choices and rights

• Access and export. Ask us for a copy of your data at sean@braveheart-labs.com.
• Correction. Edit your training data in the app at any time.
• Deletion. Ask us to delete your account and its data at sean@braveheart-labs.com.
• Revoke connections. Turn off Apple Health access in iOS Settings, or disconnect Oura in the app.

If you are a California resident, the CCPA gives you the right to know what personal information we collect, to request deletion or correction, and to not be discriminated against for exercising those rights. We do not sell personal information and have not done so in the preceding twelve months. If you are in the EEA or the UK, you have rights of access, rectification, erasure, restriction, portability, and objection under the GDPR; our lawful bases are performance of a contract (running your account), consent (Health connections, wearable connections, and location), and legitimate interests (security and abuse prevention).

To exercise any right, write to sean@braveheart-labs.com. We will respond within the time the applicable law requires.

Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us information, write to sean@braveheart-labs.com and we will delete it.

Security

We use industry-standard measures including encryption in transit, encryption at rest, and managed authentication. No system is perfectly secure, and we cannot guarantee absolute security.

Changes

If we change this policy we will update the effective date above and, for material changes, give notice in the app or by email.

Contact

Braveheart Labs 2108 N ST STE N, Sacramento, CA 95816, USA sean@braveheart-labs.com · 669-365-3120