This policy explains what data Aaroha collects, why, where it goes, and what control you have over it. Aaroha is a free fitness app; the privacy story is intentionally simple and local-first.
1. Data we collect
From you, on your device
- Profile: name, age, gender, height, weight, activity level, goals, training days, injuries (free text), trainer-tone preference, coach language.
- Workouts: form scores per rep, alerts triggered, session duration, sets/reps, exercise type, timestamps. Generated by the on-device pose engine.
- Body measurements: weight, waist, chest, arms, thighs, BMI/body-fat estimates. Self-reported.
- Nutrition logs: meals (text or photo), macros, water intake. Self-reported.
- Progress photos: stored only on your device — never uploaded.
- Cycle tracking (optional): period start dates. Stored only on your device.
- Voice journal entries: free-text notes after the daily check-in. Stored only on your device.
- Time capsule messages: text/voice messages you record for future-you. Stored only on your device.
- Step counter: daily step counts via the OS pedometer.
- Camera frames during workouts: processed in real-time on-device. Frames are never sent off-device. Only screenshots you explicitly tap "save" on are written to storage.
From third parties (transient, only when used)
- Workout-plan generation: your profile is sent to our AI partner to generate a personalised plan. Sent on demand, not stored on their side beyond their standard log retention.
- Meal-photo analysis: photos are sent to our AI partner for nutritional estimation. Same as above.
- Real-time motivational cues: short text prompts (no personal data) sent to our AI partner during workouts.
- Trainer chat: your message + minimal workout context sent to our AI partner.
- Privacy Mode (opt-in): when enabled, ALL of the above are routed to an on-device model instead. Nothing leaves your device.
Cloud sync (optional, only if you sign in)
- If you sign in with email/password: we sync your profile, workout sessions, and personal bests to our database so you can recover them on a new device.
- If you choose guest mode: nothing syncs. All data lives only on your device.
What we DON'T collect
- Location
- Contacts
- SMS / call logs
- Browsing history
- Advertising IDs
- Biometric raw images
2. Why we collect it
- Profile, workouts, measurements, nutrition — to give you a personalised training plan, form feedback, and progress tracking. This is the app's core function.
- Step counter — to encourage daily activity beyond workouts.
- Camera frames during workouts — to count reps, score form, and detect posture issues. Processed on-device only.
- Cloud sync — so signing in on a new phone restores your history.
- Crash reports — to fix bugs faster. We capture stack traces and device model only; never your inputs.
We do not sell your data. We do not show ads. We do not share data with third parties for marketing.
3. Your rights & controls
- View your data: it's all visible inside the app — Profile, Dashboard, Measurements, Progress Photos.
- Delete a single item: each section has its own delete (e.g. tap-and-hold a progress photo).
- Reset all data on this device: Profile → Settings → "Reset All Data". Wipes everything locally.
- Delete your account permanently: Profile → Settings → "Delete my account". Wipes both your device data AND your row in our database. Cannot be undone.
- Privacy Mode: Profile → Privacy → toggle Privacy Mode. After setup, every AI call runs on-device. No request ever leaves your phone.
- Export your data: tap "Send to Strava / Hevy" on any workout summary to export it as a TCX file.
- Opt out of leaderboards: Profile → Leaderboard → "Leave". Removes your entry server-side.
4. Children
Aaroha targets age 13+. Onboarding validates age 13–80 and rejects values outside that range. We do not knowingly collect data from children under 13.
If you believe a child under 13 has used the app, email support@soniqinfotech.com and we'll delete the data.
5. Data security
- In transit: HTTPS / TLS 1.2+ for every network request.
- At rest: our database encrypts data at rest.
- API keys: managed via secure environment variables; never embedded in the APK.
- Auth tokens: stored in encrypted device storage.
We don't claim military-grade security. We claim sensible defaults and minimal data collection.
6. Changes to this policy
We'll update this file when we change anything. Material changes (new third parties, new data categories) will be announced in the app via a one-time alert.
7. Contact
Email support@soniqinfotech.com for any privacy questions, account deletion requests, or data access requests. We'll respond within 7 days.