Privacy Policy

1. Overview

HivRa is a personal wellness app for iPhone that helps you plan meals, track nutrition, workouts, body weight and steps, keep recipes, and manage grocery lists. HivRa Studio is a companion website where fitness and nutrition professionals can view data that HivRa users have chosen to share with them. Both use the same HivRa account system. HivRa is developed and operated by Hiba Begum ("HivRa", "we", "us").

This Privacy Policy explains what information we collect, why we collect it, where it is stored, who can see it, how long we keep it, and the choices you have. It applies to the HivRa app, HivRa Studio, and this website (hivra-landing.vercel.app). Please read it together with our Terms of Use.

2. Information We Collect

Account information

Sign-in details - Your email address and password, managed by Firebase Authentication. We never see or store your password in plain text.
Display name - The name you choose to show other HivRa users, for example on shared recipes and grocery lists.
Age confirmation - Your confirmation, when you sign up, that you are at least 16 years old, and when you gave it.

Profile and fitness information

Body and profile details - Your age, sex, height, weight, activity level and fitness goal. We ask for your age as a number, not your date of birth.
Calculated values - Your estimated daily calorie needs (TDEE), calorie and nutrition targets, and daily workout goal, calculated from the details above.
Weight history - Body-weight entries you log and any target weight you set.
Workouts - Workouts you log in HivRa, such as exercises, sets, repetitions, weights, duration, distance and notes, and the routines you create.
Daily steps - One step total per day, either imported from Apple Health or entered by you. See Section 3.

Nutrition, recipes and groceries

Meals and nutrition - Your meal plan, meals you mark as eaten or skipped, and custom foods, including foods you add by scanning a barcode.
Recipes and photos - Recipes you create, save or copy, and photographs you add to them from your camera or photo library. See Section 8.
Grocery lists - Lists and items you create or edit, list membership, and invitations, including the email address of each person invited to a shared list.

Other information

Professional sharing records - If you use HivRa Studio or connect with a professional, the invitation and sharing details described in Section 9.
Legal acceptance history - Records of the Privacy Policy and Terms of Use versions you accepted. See Section 11.
AI usage counts - A daily count of the AI meal recommendations you have requested, used to apply a daily limit. See Section 5.
Push notification token - A token that identifies your device for push notifications, stored with your account and removed when you sign out.
Usage statistics and crash reports - Limited app-usage events and crash diagnostics, described in Section 6.
Information stored only on your device - A local copy of your data for offline use, workout streak history, and planning patterns used to schedule reminders. Planning pattern data is not uploaded to our servers.

Most of this information is stored in Google Cloud Firestore under your account and synced across your devices. Recipe photos are stored separately in private Cloudflare R2 storage, as described in Section 8.

3. Apple Health (HealthKit)

With your permission, HivRa reads the following from Apple Health: heart rate, active energy burned, step count, workouts, and activity summaries (including your Exercise ring goal). HivRa only reads from Apple Health. It does not write any data to Apple Health.

We use this information as follows:

Processed on your device - Heart rate, active energy and workouts imported from Apple Health are processed on your iPhone for workout summaries, goals and recommendations. Workouts imported from Apple Health are not uploaded to our servers.
Stored with your account - Your daily step totals are synced to your HivRa account so your step history is available across devices. Your Exercise ring goal may be used to set your daily workout goal, which is saved in your profile. To avoid counting the same workout twice, we also store an identifier for each Apple Health workout HivRa has already processed, with its activity type and date, but not the workout details.
Shared only if you choose - Your daily step totals are shared with a professional only if you grant that professional the "Daily Steps" permission (Section 9).

Information from Apple Health is never used for advertising or marketing, never sold, and never shared with third parties except as you direct (for example, with a professional you approve) or with the service providers that store HivRa data for us (Section 7).

You can turn off HivRa's access at any time in the iOS Settings app (Privacy & Security → Health → HivRa). HivRa continues to work without Apple Health, with less automatic tracking.

4. How We Use Your Information

We use your information only to provide, secure and improve HivRa:

To create and secure your account and keep your data in sync across devices
To calculate calorie targets and personalise meal and workout recommendations
To show your progress, including weight and step history and the Weekly Recap
To provide recipes, recipe sharing, grocery list sharing, barcode lookup and Siri shortcuts
To share data with professionals you have connected with, as you direct
To schedule reminders and notifications you have allowed
To record your acceptance of our Privacy Policy and Terms of Use
To enforce daily usage limits, prevent abuse and keep HivRa secure
To understand overall app usage (if you allow it) and to diagnose crashes and fix problems

We do not use your data for advertising, we do not sell or rent your personal information, and we do not share it for cross-context behavioural advertising. We do not build advertising profiles.

Where laws such as the EU or UK General Data Protection Regulation apply, we rely on these legal bases: performing our agreement with you (to provide the app's features); your consent (Apple Health access, camera and photo access, and sharing with professionals, each of which you can withdraw at any time); our legitimate interests in keeping HivRa secure, preventing abuse, diagnosing crashes and understanding overall usage (you can turn off usage statistics at any time, as described in Section 6); and compliance with legal obligations.

5. AI Features

HivRa uses an AI model provided by Groq for three features. Requests go from the app to our server, which is hosted by Render. Our server forwards the request to Groq and returns the response to the app.

Meal recommendations - We send the meal type and food preferences you choose, the intensity and muscle groups of your recent workout, and these profile details: age, sex, height, weight, activity level, fitness goal and estimated daily calorie needs (TDEE). These help the model suggest suitable meals and portion sizes.
Recipe reading - When you ask HivRa to read a recipe, we send the text you entered.
Ingredient reading - When you ask HivRa to read an ingredient list, we send the text you entered.

We do not send your name, email address or account ID to Groq. This does not make AI requests anonymous: your body measurements and fitness details are personal, health-related information, and any text you type is sent as you entered it. Please do not type other personal information into recipe or ingredient text.

For meal recommendations, our server also checks that you are signed in and applies a daily limit. To do this, it passes your sign-in token to our Firebase backend, which keeps a count of the recommendations you have used each day under your account ID. That count is not shared with Groq.

Our server is configured not to store AI prompts, responses or request bodies in its application logs. Render and Groq process requests under their own terms and may keep technical information, such as IP addresses, timestamps and request metadata, according to their own policies and retention practices, which we do not control. If the AI service is unavailable, HivRa shows suggestions from a built-in list of meals instead.

AI-generated suggestions may be inaccurate and are not medical or nutritional advice.

6. Analytics and Crash Reporting

Usage statistics (Firebase Analytics)

When it starts - Usage statistics are turned off each time the app starts and are switched on only after you have accepted the Privacy Policy and Terms of Use, and only if you have not turned them off.
What is collected - When you sign up or sign in (and the sign-in method), which main areas of the app you open (workouts, recipes, meal planner or grocery lists), and whether you are signed in. Firebase also collects some standard events automatically, such as app opens and session information, together with device and app information such as device model, iOS version, app version, an app-instance identifier and an approximate location derived from your IP address.
What is not collected - We do not send your name, email address, account ID, health data, workouts, meals or recipes to Firebase Analytics, and we do not link usage statistics to your HivRa account.
Turning it off - You can turn off "Share anonymous usage statistics" at any time in the app (Profile → Settings → Privacy). This stops collection and resets the analytics identifier on that device. The choice is saved on your device, not in your account, so it applies to that device only and resets if you delete and reinstall the app.

Crash reports (Firebase Crashlytics)

If the app crashes, Firebase Crashlytics sends a crash report with technical details such as the device model, iOS version, app version, an installation identifier, and information about the app's state at the time of the crash.
Crash reporting runs separately from usage statistics. It is not affected by the "Share anonymous usage statistics" setting, and there is currently no in-app setting to turn it off. We do not attach your account ID, name or email address to crash reports.

No advertising tracking

HivRa uses a version of Firebase Analytics that does not access Apple's advertising identifier (IDFA). Advertising personalisation is turned off, HivRa does not show ads, and HivRa does not track you across other companies' apps or websites. Usage statistics and crash reports are kept by Google under the retention settings and policies of Firebase.

7. Service Providers

We use the following service providers to run HivRa. They process information on our behalf to provide their services, and we share with each only what it needs for that purpose.

Google Firebase (Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging, Analytics and Crashlytics) - Stores your account and app data, runs our server functions (recipe photos, professional sharing, usage limits and account deletion), delivers push notifications, and provides usage statistics and crash reports (Section 6). firebase.google.com/support/privacy
Cloudflare (R2 storage) - Stores the photos you add to recipes in private storage, and hosts the exercise illustrations shown in the app. cloudflare.com/privacypolicy
Render - Hosts our server, which handles AI requests and recipe photo suggestions (Section 5). render.com/privacy
Groq - Provides the AI model that processes the requests described in Section 5. groq.com/privacy-policy
Unsplash - Provides stock photos for recipes. Our server sends the recipe or meal name to Unsplash to find a photo, and your device loads the photo directly from Unsplash. unsplash.com/privacy
Open Food Facts - When you scan a barcode for a product that is not already in your foods, your iPhone sends the barcode number directly to Open Food Facts to look up nutrition information. No account information is sent. world.openfoodfacts.org/privacy
Apple - Provides Apple Health, Siri and Shortcuts, push notification delivery and the App Store, under Apple's own terms and privacy policy. apple.com/legal/privacy
Vercel - Hosts the HivRa Studio website and this website. vercel.com/legal/privacy-policy

Like any internet service, these providers can see your device's IP address and basic technical information when your device or our server connects to them, and may keep it in technical logs under their own policies. Ingredient nutrition data comes from a copy of USDA FoodData Central built into the app, so no information is sent for those lookups.

We may also disclose information if required by law or valid legal process, or where necessary to protect the rights, safety or security of our users, HivRa or others.

Apart from the service providers in Section 7, your information is visible to other people only in the following cases.

Recipes and recipe photos

Shared by default. New recipes are shared with all signed-in HivRa users unless you turn off "Share with community" before saving. You can stop sharing any recipe at any time.
A shared recipe, including its photo, can be seen by anyone signed in to HivRa. Other users see the recipe name, ingredients, instructions, servings, nutrition, photo, and your display name as its creator. If you have not set a display name, the part of your email address before the "@" is shown instead. The recipe also carries an internal account identifier.
Other users can save a shared recipe, add it to their meal plan, or make their own copy, which they can edit and share. A copy keeps your display name as the original creator.
If you stop sharing or delete a recipe, or delete your account, other users can no longer open it from you. Copies they have already made, or recipes they saved to their meal plan, become their own and stay with them, including your display name as the original creator.
Recipe photos are stored privately in Cloudflare R2 and are never given a permanent public link. Each time someone with access views a photo, the app gets a temporary link that expires after a few minutes. Before uploading, HivRa removes location and camera details from the photo, and our server rejects photos that still contain them. Please do not include people or personal information in recipe photos you share.

Grocery lists

You can invite people to a shared list by email address. The invitation stores the invited email address, your display name, the list name and the invitation's status. The person invited sees your display name and the list name, and can accept or decline.
Everyone on a shared list can see and edit its name and items, and see each member's display name. Only the list owner can invite people or delete the list. You can leave a list you do not own at any time.

Professionals

If you connect with a professional on HivRa Studio, they can see only the categories of data you approve, as described in Section 9.

9. Sharing With Professionals (HivRa Studio)

HivRa Studio lets you share selected HivRa data with a fitness or nutrition professional, such as a dietitian, personal trainer or coach. Sharing is always your choice, and nothing is shared until you approve it.

How it works

A professional can invite you by your email address, or you can send a request to a professional from the app. If you have a HivRa account, the invitation appears in the app with the professional's name, profession, organisation and an optional note.
Accepting an invitation does not share anything. Sharing starts only when you approve at least one category and a history window: the last 7, 30 or 90 days, or all available history. Every category is off until you turn it on.
Professional credentials are self-declared and are not verified by HivRa. Professionals choose their own profession when they register. They are independent and are not employed by or acting for HivRa. Choose professionals you trust.

What a professional can see

Nutrition Summary - Daily calorie and macronutrient totals, the number of meals eaten or skipped, and your estimated daily calorie needs.
Meal History - Individual meals, including planned meals, with food names, quantities and nutrition.
Weight History - Your weight entries, your current profile weight and your target weight.
Daily Steps - Your daily step totals, which may come from Apple Health.
Workout History - Workouts you logged in HivRa, including any notes. Workouts imported from Apple Health are not included.
Fitness Goals - Your goal, activity level, daily workout minutes and estimated daily calorie needs.
Strength Progression - This category can be selected but does not currently share any data.

When you approve sharing, the professional also sees your display name. Professionals cannot see your grocery lists, your recipes' contents, your age, sex or height, other Apple Health data, or any category you have not approved. Professionals can view shared data but cannot change it. Every request a professional makes is checked on our server against your current permissions.

Changing or revoking sharing

You can change the categories or history window, or stop sharing completely, at any time in the app. The professional can also end the connection. Changes take effect on the professional's next request; once sharing stops, the professional can no longer load your data.
HivRa Studio has no feature to download or export your data, but we cannot prevent a professional from writing down, copying or taking screenshots of what they have already seen. Information a professional keeps outside HivRa is not under our control.

Information about professionals

If you register on HivRa Studio, we collect your name, email address, display name, self-declared profession, optional organisation name, and when you accepted this policy and the Terms of Use. We also keep records of the invitations you send or receive (including the recipient's email address and any note) and of each sharing connection (the categories and history window approved, and whether and when the connection was ended).

10. Siri, Notifications and Weekly Recap

Siri and Shortcuts - You can use Siri or the Shortcuts app to add or remove grocery items, read a grocery list or recipe, and add a recipe to your meal plan. Apple processes your voice request; HivRa receives only the result (for example, the item name), never a recording. A request to add a recipe to your meal plan is held briefly with your account until the app processes it. Siri may speak or display your recipe or list content on your device, where people nearby may hear or see it.
Weekly Recap - A weekly summary of your workouts and planned meals, calculated on your iPhone. It does not use AI and is not sent to us or anyone else. It is delivered as a notification on Sunday evenings.
Notifications - Reminders and the Weekly Recap are scheduled on your device. You can turn them off at any time in the iOS Settings app (Notifications → HivRa). There is currently no separate in-app switch for the Weekly Recap.

To show which terms applied to you and when, HivRa keeps a versioned history of your acceptance of this Privacy Policy and the Terms of Use. Each time you accept, a new record is added containing:

the versions of the Privacy Policy and Terms of Use you accepted (each version is the document's effective date, for example 2026-11-02) and the addresses where they are published
the date and time of acceptance, recorded by our servers
where you accepted (when you signed up, or when the app asked you to review updated documents)
the version of the app you were using

Acceptance records are added, never edited or replaced. Earlier records are kept alongside new ones for as long as your account is active, and are deleted when you delete your account (Section 12). If we make material changes to this policy or the Terms of Use, we may ask you to review and accept the updated documents in the app before you continue using HivRa.

12. Data Retention and Account Deletion

How long we keep information

We keep your information for as long as your account exists, unless you delete it sooner. You can delete individual items, such as recipes, photos, workouts and weight entries, in the app. Some records are kept until a related account is deleted: ended professional connections, resolved or expired invitations, and daily AI usage counts. Usage statistics and crash reports are kept by Google under Firebase's retention settings.

Deleting your account

You can delete your account in the app (Profile → Settings → Delete Account). Deletion is permanent and cannot be undone. For your security, you must have signed in recently; if not, the app will ask you to sign out and sign in again first.

When deletion completes, it removes the following from HivRa's active systems:

Your account login, your profile and body details, and your display name
Your workouts, routines, weight history, daily step history, meal plans, nutrition settings, custom foods, saved recipe interactions, pending Siri requests, records of processed Apple Health workouts, and push notification tokens
Your recipes, including shared ones, and all your recipe photos. A photo that cannot be removed immediately is queued and deletion is retried automatically.
Grocery lists you own, with their items and invitations; your membership of other people's lists; invitations you sent or received; and your email address in other lists' pending invitations
Your HivRa Studio connections, invitations and, if you have one, your professional profile
Your daily AI usage counts
Your legal acceptance history, which is removed last
The HivRa data for your account that the app keeps on that device, such as local copies of your recipes, meal plans, workouts, routines, weight and step entries, and cached settings

Your account is reported as deleted only after every step has completed. If a step cannot be completed, for example because your device is offline, the app shows an error and keeps your sign-in so you can try again. Some of your data may already have been removed at that point, and trying again completes the rest.

What account deletion does not remove

Copies held by other users - Copies of your shared recipes that other users made or saved before you deleted your account belong to them and are not deleted. They keep your display name as the original creator. Items you added to someone else's shared grocery list remain part of that list.
Information others keep outside HivRa - For example, notes or screenshots a professional made of data you shared.
Usage statistics and crash reports already sent to Google, which are not linked to your account and are kept under Firebase's retention settings.
Service provider records - Technical logs and request metadata kept by our providers (such as Google, Cloudflare, Render, Groq and Vercel) under their own retention policies.
Backups - Deleted information may remain for a limited period in backup or disaster-recovery copies maintained by us or our providers, until those copies expire or are overwritten.
Records we must keep - Information we are required to keep by law, or need to establish or defend legal claims, such as correspondence about a privacy request.
Other remaining device storage - Data that is not tied to your account, or other app storage such as offline caches, is removed when you delete the HivRa app from your device. Data in Apple Health belongs to Apple Health and is not affected.

If you cannot use the in-app deletion, or you are a HivRa Studio professional without a HivRa app account, email hivrasupport@gmail.com from the email address on your account and we will delete your account for you.

13. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. You can:

Access - View most of your information in the app, or ask us for a copy of the information stored under your account
Correct - Edit your profile and most of your data directly in the app, or ask us to correct it
Delete - Delete individual items, or your whole account as described in Section 12
Control recipe sharing - Choose whether each new recipe is shared, and stop sharing at any time
Control professional sharing - Change the categories or history window, or stop sharing, at any time (Section 9)
Leave shared grocery lists - Leave a list you do not own, or delete a list you own
Turn off usage statistics - In Profile → Settings → Privacy (Section 6)
Manage device permissions - Turn off Apple Health access (Settings → Privacy & Security → Health → HivRa), notifications (Settings → Notifications → HivRa), or camera and photo library access (Settings → HivRa)

To make a privacy request, email hivrasupport@gmail.com, preferably from the email address on your account. We may need to verify your identity before acting on a request, and we will respond within the time required by applicable law. HivRa does not currently offer an in-app data export, so copies of your data are provided on request. You will not be treated differently for exercising your privacy rights. You may also have the right to complain to your local data protection authority.

14. Children's Privacy

HivRa and HivRa Studio are intended only for people aged 16 and older. When you create an account, you confirm that you are at least 16. We do not knowingly collect personal information from anyone under 16. If you believe someone under 16 has created an account, contact us at hivrasupport@gmail.com and we will delete the account.

15. Data Security

We protect your information with measures including: database access rules that limit your profile and personal records to your own account; server-side permission checks on every request a professional makes; private storage, metadata removal and short-lived links for recipe photos; sign-in verification and a daily limit on our server before AI meal recommendations are processed; and HTTPS encryption for data in transit. Passwords are handled by Firebase Authentication and are never stored by us in plain text.

No method of storing or transmitting data over the internet is completely secure, and we cannot guarantee absolute security. If we learn of a security incident that affects your personal information, we will notify you and the relevant authorities where required by law. Please use a strong, unique password and keep your device secure.

16. Where Your Information Is Processed

Our server functions are hosted by Google in the United States, and our other service providers may process information in the United States and other countries. If you live outside the United States, your information will be transferred to and processed in countries whose data protection laws may differ from those where you live. Where required, we rely on the safeguards our service providers offer for these transfers, such as standard contractual clauses.

17. HivRa Studio and This Website

The HivRa Studio website does not use advertising or analytics tools or tracking cookies. To keep you signed in, Firebase Authentication stores your sign-in session in your browser's storage. Client data is shown on screen and held in memory only; it is not saved in your browser and is cleared when you sign out or close the tab. Studio's demo mode stores sample workspace data in your browser's local storage.

This website (hivra-landing.vercel.app) is hosted by Vercel and does not use cookies, analytics or advertising tools. It loads fonts from Google Fonts, so Google receives your IP address and basic browser information when you visit. Vercel and Google may keep technical logs under their own policies.

18. Changes to This Policy

We may update this Privacy Policy from time to time. Each version is identified by its effective date, shown at the top of this page, and the app records which version you accepted (Section 11). When we make material changes, we will notify you in the app and may ask you to review and accept the updated policy before you continue using HivRa. If you do not agree to an updated policy, you can stop using HivRa and delete your account.

19. Contact

For privacy questions, data requests or concerns, contact Hiba Begum, HivRa's developer, at hivrasupport@gmail.com.

This policy is published at hivra-landing.vercel.app/privacy.html.