Mayhop — Privacy Policy

Mayhop ("the app", "we", "us") is a strength-training, nutrition and fitness app with an optional social layer. This policy explains what we collect, why, who else sees it, and your choices. Mayhop is local-first: the app is fully usable without an account, and we never sell your data, show ads, or use third-party advertising or tracking SDKs.

Data controller

The party responsible for your data is:

• Name: Akın Türkan
• Country: Turkey
• Postal address: Kartal, Istanbul 34880, Turkey
• Contact: support@mayhopfit.com

Summary

• Signed out, nothing you enter is uploaded or stored by us. The app still makes a few technical requests to our server — to fetch app settings on launch, to load exercise video clips, and (while a workout is running) to send a presence heartbeat. Those requests carry your IP address and are recorded in our server access logs; the data you enter is not part of them.
• Signed in, your training, nutrition and profile data are backed up to our own self-hosted server in Germany so you can restore them and use social features.
• Three optional features send content to OpenAI, our AI provider in the United States: the AI Coach, natural-language meal entry, and voice meal entry. See §3.
• Some information is visible to other users by design — including a leaderboard that lists every account. See §4.
• No advertising. No third-party tracking or analytics SDKs. No data selling.
• You can delete your account and its data at any time from within the app.

1. Information we collect

a) On your device only — never uploaded

Some data never leaves your phone, even when you are signed in:

• Body-composition history — height, neck, waist and hip measurements and the calculated body-fat percentage.
• Water intake and your water goal.
• AI Coach conversation history — your questions and the coach's replies.
• Recipe favourites, saved routines, custom exercises, home-screen layout, language and theme preferences.

b) When signed out

Nothing you enter is uploaded. Everything you log is stored locally on your device. Our server still receives ordinary technical request data (IP address, timestamp, user agent, and the URL requested) for the launch/settings, exercise clip and presence requests described in the Summary.

c) When you create an account and sign in

• Account data — your email address. If you use Google Sign-In, Google returns the basic profile needed to complete authentication.
• Profile data — display name, handle, optional bio, avatar or uploaded profile photo, discipline, meet date, and — where you provide them — bodyweight, sex and height. If you use the AI Coach, also your training goal, experience level, days per week, session length, available equipment, and any injuries or physical limitations you type in.
• Training data — workouts and sets (weight, reps, RPE), cardio sessions, mobility/practice sessions, daily readiness check-ins (sleep, soreness, energy), bodyweight history and streaks.
• Nutrition data — meals you log with their foods and estimated calories and macros, your daily calorie and protein goals, saved favourite meals, and — when you use text or voice entry — the sentence you wrote or spoke, stored with the meal so you can see what it was based on.
• Voice recordings — if you use voice meal entry, the recording is uploaded for transcription (see §3) and is not stored on our servers. The temporary recording file created on your device is held in the app's cache and cleared by the operating system.
• Social content you create — posts, comments, reactions, photos you upload, follows, group memberships, duels, and reports or blocks you submit.
• Group passwords — if you create or join a password-protected group, the password is sent to our server and stored only as a salted hash. We also record failed join attempts to rate-limit guessing.
• Referral data — every account is assigned an invite code, and if a code is redeemed we record which account invited which.
• AI usage records — when you use an AI feature we store a row containing your user id, the time, which feature, the model used and how many tokens it consumed. This is how the free/premium usage limits are enforced. It does not contain your question, your meal text or your transcript.
• Presence — while a workout is running, a short-lived "training now" record so people you mutually follow can see you are active.

We do not collect location or GPS data (the app has no location permission), contacts, browsing or search history, advertising identifiers, or third-party analytics. Our server keeps standard access logs (IP address, timestamp, and the request path) for security and abuse prevention; they are not used to profile you.

2. How we use your information

We use your information to provide the app's functionality: saving and syncing your log, calculating statistics (1RM, totals, DOTS, ranks, streaks, readiness, daily calories and macros), interpreting meals you describe in your own words, powering the social features you opt into, enforcing AI usage limits, keeping the community safe, and answering support requests.

Where GDPR applies, our legal bases are performance of our contract with you (providing the service) and our legitimate interest in a safe, functioning, abuse-resistant community. Where we process health-related data (see §5) in a jurisdiction that treats it as a special category — including under Turkey's KVKK — we rely on your explicit consent, given by choosing to enter that data. You can withdraw it by deleting the data or your account.

We do not use your data for advertising, profiling for third parties, or cross-app tracking.

3. AI features and our AI provider

Three optional features send content to OpenAI, L.L.C. (United States), which processes it on our behalf as a service provider. Your API requests are sent from our server, never directly from your device, and we do not permit the provider to use your content to train its models.

The AI Coach runs in two steps. Every question is first sent to the provider to be classified — is this about training, nutrition, hydration, recovery or the app? Only a question that passes is sent a second time, with the training summary above, to be answered.

That means a question the coach declines to answer was still sent to the provider for the check. It was not answered, it did not use one of your AI messages, and no training data went with it — but we will not tell you it never left the app, because it did.

What is not sent. Your name, handle, email and account id. Your water log and water goal — those never leave your device at all, so the coach has no access to them and will say so if you ask. Your meal log and nutrition targets: these are not part of the coach's context. Your body-composition measurements.

Viewing a recipe sends nothing. The recipes are stored in the app; browsing, searching, favouriting or reading one involves no network request to OpenAI. Adding a meal by typing or speaking it is a separate, optional AI feature.

Your conversation with the coach is stored on your device only. We do not keep it on our servers. The last few messages travel with each question so a follow-up makes sense, and clearing the chat in the app removes it.

We do not log the content of these requests — not your question, not the classification, not the answer, not your meal text, not your transcript. What we record for each AI call is the model used, the number of tokens, the time, the feature, whether it succeeded, and a short non-content code such as in_scope or out_of_scope. Audio is forwarded for transcription and is not retained by us.

These features are optional: the app is fully usable without them, and you can log meals by hand, from recipes or from a previous meal with no AI involved.

4. What other users can see

Some information is public to other signed-in users by design. Please treat it as public:

• Your profile — display name, handle, bio and avatar, including in user search.
• Anything you post — posts, comments, reactions, and any workout you choose to attach to a post (routine name, exercises, sets, reps and RPE).
• Your follows — who you follow and who follows you.
• Public group memberships.
• The leaderboard — every account appears, with display name, handle and a DOTS strength score derived from your total and bodyweight. Your bodyweight itself is never shown; only the score. There is currently no way to opt out of the leaderboard.
• Presence — a "training now" indicator visible to people you mutually follow while a session is running.

Photos you upload (avatars and post images) are stored in public buckets: anyone with the direct file URL can open them, whether or not they are signed in. Please do not upload anything you would not want to be public. We ask the photo picker to omit EXIF metadata, and the app re-encodes images it uploads, but we cannot guarantee that every platform strips every embedded field.

Your training log, nutrition log, check-ins, goals and body measurements are private to your account and are not visible to other users.

5. Health-related data

Some of what Mayhop stores is health-related, and we treat it that way: bodyweight, sex, height, body-composition measurements, sleep and soreness check-ins, any injuries or limitations you type in, and your nutrition log and targets.

• All of it is optional — the app works without it.
• Body-composition measurements and water intake never leave your device, and are not sent to our AI provider.
• Under some laws — including the Turkish KVKK and the GDPR — data about your health may be a special category of personal data with stricter conditions. We treat it that way: we ask for the minimum, keep it to the feature you are using, and do not sell or share it for advertising.
• Sending health-related data to our AI provider is asked separately, and it is not part of accepting these terms. The first time you use the AI Coach, it shows you what would be sent — your training summary, and with it your bodyweight, height, sex and any injuries or limitations you have written down — who receives it (OpenAI) and where they are (the United States). Nothing is sent unless you allow it there.
• That permission is recorded against your account with the date and the version of the wording you saw. If we change the wording materially, we ask again rather than carrying the old answer forward.
• You can refuse, and the app keeps working. The AI Coach is one optional feature; logging, recipes, charts and manual meal entry are unaffected.
• You can withdraw it at any time in Settings, under "AI Coach data permission". Withdrawing clears the record, and our server then refuses AI Coach requests for your account — so it stops the sending, not just the button.
• Mayhop is not a medical device and does not provide medical advice. Calorie and macro figures, especially those estimated by AI, are approximations and are labelled as such in the app. Targets you set are your own. Talk to a qualified professional before making decisions about your health, diet, or training, particularly if you are pregnant, have a medical condition, or have a history of disordered eating.

6. Sharing and disclosure

• We do not sell your personal data.
• Service providers we rely on to run the app:
• OpenAI (United States) — AI features, as described in §3.
• Google — only if you choose Google Sign-In, to authenticate you.
• Hosting and infrastructure providers — to run our self-hosted server and deliver content.
• Moderation — if content is reported, our moderators can read that content and the surrounding context in order to act on it.
• We may disclose information if required by law, or to protect the rights, safety and security of our users and the app.

7. Data storage, location and security

Your synced data is stored on our self-hosted server located in Germany and transmitted over encrypted (HTTPS) connections. Access is protected by per-user security rules (row-level security), so accounts can only read and write their own private data. Group passwords are stored only as salted hashes. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.

8. International transfers

Your synced data is processed in Germany. Content sent to our AI provider under §3 is processed in the United States. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers.

9. Data retention

• Active account data is kept while your account exists.
• Nutrition history: your device keeps roughly the last 120 days to save space, but the copy on our server is kept for the life of your account — so your history is longer on the server than in the app. Deleting a meal in the app also deletes it from the server; the older archive is removed when you delete your account.
• AI usage records (§1c) are kept while your account exists so limits can be enforced fairly.
• Access logs are retained for a short period for abuse prevention.
• Support emails are kept as long as needed to handle your request and for a reasonable period afterwards.
• Content you shared publicly may persist in other people's devices or caches outside our control after deletion.

10. Deleting your account

Go to Profile → Settings → Delete account. This deletes your account and its records from our servers — profile, training, nutrition, social content, AI usage records and group memberships — and deletes photos you uploaded.

Deleting your account also clears the app's data on this device, including the records that are never uploaded — your body-composition history, water log and AI Coach conversation. Your language and theme preferences are kept, since they are display settings rather than personal data. Data you synced to another device stays on that device until you delete it there or remove the app.

One honest caveat: if a photo cannot be removed at that moment, your account is still deleted; the file is left with no owner and is unreachable from the app. We remove such files during routine maintenance of the storage buckets.

11. Your rights and choices

• Use without an account — the app is fully functional signed-out.
• Skip the AI features — meals can be logged by hand, from recipes or by repeating a previous meal.
• Access — your data is visible in the app. Email us for a portable copy.
• Delete — see §10.
• Where GDPR/KVKK applies you also have the right to rectification, restriction, objection, data portability, to withdraw consent, and to lodge a complaint with your local data-protection authority.
• To exercise any right, email support@mayhopfit.com.

12. User-generated content

The app lets users post text, photos and comments. We provide reporting, blocking, and automatic hiding of content that receives multiple reports, and we act on objectionable content. By posting you agree to our Terms of Use and Community Guidelines, shown in the app.

13. Children's privacy

Mayhop is not directed to children. You must be at least 13 years old — or the higher minimum age for digital consent in your country, such as 16 in some EU member states — to use the app. We do not knowingly collect data from children below that age; if you believe a child has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy. Material changes will be reflected in the "Last updated" date above and, where appropriate, announced in the app.

15. Contact

Questions about this policy or your data: support@mayhopfit.com