Skip to content
Hench
Download

Legal

Privacy Policy

Last updated 31 October 2026

This policy explains how Hench ('we', 'us' or 'our') handles information when you use the Hench app, visit hench.app, join our Android waitlist or contact us. For privacy questions and requests, email hello@hench.app.

Privacy at a glance

  • You do not need to create a Hench account or give us your name or email address to use the app.
  • Your workout log is stored on your device and can sync to your private iCloud storage when iCloud Sync Backup is enabled.
  • Optional AI features send training information to our server, which passes it to OpenAI to write your routine, or to Alibaba Cloud for requests from mainland China, Hong Kong and Macau. Our server clears the request and the result after 30 days.
  • We use Google Analytics in the app and Sentry for diagnostics. They receive an app-generated user ID. Website Google Analytics, which also measures our Google ads, loads only after you accept analytics.
  • An app-generated ID is not your name or email, but it allows records to be linked to the same app user.

1. Who is responsible and how to contact us

Hench is run by Kanwaljit Nagra in the United Kingdom, who is the controller responsible for the information described in this policy. Apple and other providers also process information for their own services under their own privacy policies.

Contact hello@hench.app with the subject 'Privacy' for questions, complaints or requests about your information.

2. Your workout data and iCloud

The app stores workout data on your device. It uses this information to record workouts, show your history and suggest progression.

iCloud Sync Backup syncs your workout data and generated plans to your private iCloud storage. Turning it off in Settings stops syncing but does not erase existing copies.

The app asks once for your gender: male, female or non-binary. The question is optional, and you can skip it. Your answer is stored with your training preferences, on your device and, when iCloud Sync Backup is on, in iCloud. It is included in app analytics, as described in section 5; if you skip the question, analytics records only that you skipped it. Your answer is not sent with AI requests and is not shown in Settings.

The AI service does not receive a copy of your entire workout history. It receives the information listed in section 4 when you request a generation. Some workout information also appears in app analytics events, as described in section 5.

A random app user ID stored on your device links your AI, analytics and diagnostic records. It can persist after reinstalling the app. It is not your name, email address or Apple ID.

3. Apple Health and device permissions

Apple Health integration is optional. With permission, Hench can save and check workouts in Apple Health. It requests read access to workouts, heart rate, active energy, walking/running and cycling distance, and activity summaries, plus permission to save workouts.

You can manage Hench's Health access in Apple's Health or Settings app and switch the integration off in Hench. Removing permission does not automatically delete workouts already saved to Apple Health. You can manage those records in Apple Health.

Apple Health records are separate from Hench's workout log. Measurements read from Apple Health are not included in AI requests. Text you enter in prompts or workout titles can be included, so please avoid putting private health information there.

Notifications, including rest-timer reminders, require your permission. You can change this in your device's Settings.

4. Optional AI features

Suggested Routines and HenchAI Coach generate routines and plans when you request them, and Suggested Routines generates your first routines when you finish setting up the app with it on. Generating sends information to our server, which passes part of it to our AI provider. Our server keeps the request and the generated result for 30 days.

What the app sends

When you request an AI routine or plan, the app sends your training preferences, text you provide, summaries of your routines, recent workouts and coaching progress, your app user ID, the app's version and platform, and information needed to verify access.

Suggested Routines is on when you set up the app. If you finish setting up with it on, the app asks for your first routines straight away. That request sends your training preferences, a default session length and focus, your app user ID, the app's version and platform, and information needed to verify access. It sends no text and no summaries of your training.

Your recorded lifting weights are not part of the training summary, and AI requests do not include your answer to the gender question. The app does not add your name, email address or Apple ID to the request. However, notes and titles are sent as text: if you put personal information or weights in them, that text is sent.

What our AI provider receives

To write your routine or plan, our AI provider receives your training preferences, text you provide, and the summaries described above: routine and workout titles, routine goals, workout dates and durations, exercise names and set counts, and how your last coaching block went. It does not receive your app user ID, the app's version or platform, or any purchase or verification information.

OpenAI does not use information sent through its API to train its models unless the customer opts in, and Hench has not opted in. We ask OpenAI not to store the routines it writes for us. OpenAI keeps records for detecting misuse, which can include requests and responses, for up to 30 days, unless the law requires longer or keeping them is needed to protect its services or others from harm. See OpenAI's data controls.

Requests from mainland China, Hong Kong and Macau

Requests from mainland China, Hong Kong and Macau are never sent to OpenAI. Where the service is available, they are sent to Alibaba Cloud Model Studio in its China (Beijing) region, in mainland China, which writes the routine or plan with Alibaba's Qwen models. Requests from Hong Kong and Macau are therefore sent to mainland China. Model Studio receives the same information OpenAI would. Where the service is not available, the request is declined and no AI provider receives it. We tell where a request comes from by the location of the internet connection it arrives on, so a request made through a VPN or another network counts as coming from where that connection is.

Alibaba Cloud says it does not use data sent through Model Studio to train models. It says it stores the data generated by these requests to comply with relevant laws and regulations. It does not say for how long, and its documentation describes no setting for asking it not to. See Model Studio's privacy notice.

What our server stores

Our server stores each request and its result for 30 days, then clears them. It keeps a record of each generation (when it was made, which feature, whether it succeeded, how long it took and how much it cost to produce) and of your free allowance, with a coded form of your app user ID and, if you subscribe, of your subscription's identifier. We use these to return results, track your free allowance, apply usage limits, avoid duplicate generations and investigate faults.

We do not store full purchase proofs or app-verification information with your AI requests.

See section 10 for retention and section 11 for deletion requests. Deleting a generated routine on your device does not delete the server's generation record.

Your choices

You can use the workout tracker without generating AI routines. No AI generation request is sent until you start a generation, or finish setting up the app with Suggested Routines on. You can turn Suggested Routines off during setup, and you can switch Suggested Routines and HenchAI Coach off in Settings to prevent further use of those features. This does not recall a request already sent or erase records already stored. App analytics and diagnostics operate separately.

Generated routines are suggestions you can choose whether to use. They are not medical assessments, and Hench does not use them to make decisions with legal effects about you.

5. App analytics and diagnostics

We use Google Analytics to understand how the app is used, and Sentry to investigate errors and crashes. Both start collecting information when the app opens and receive the app-generated user ID described in section 2.

  • Google Analytics: app usage, purchase activity, and app and device information. This can include workout information, your training preferences, your answer to the gender question, the names of exercises and routines, and what you type into the exercise search. Google may derive approximate location from network information.
  • Sentry: crash reports and diagnostic information, with app and device details, to help us find and fix faults.
  • App settings and security: Google and Apple process information about your app installation and device to deliver app settings and verify that requests come from a genuine copy of Hench.

The website analytics choice below applies to this website only. It does not switch off Google Analytics or Sentry in the app. The current app does not have a separate switch for those services. You can contact us about your information or object as explained in section 11.

6. Website analytics, cookies and local storage

Our website asks before loading Google Analytics. If you accept, Google receives information about your visits, interactions and how you reached the site, along with browser and device information. Google may derive approximate location from network information. We use this to understand website use and the effectiveness of our campaigns.

Accepting also lets us measure our Google ads: if you arrived from one of them, Google Ads learns whether you then followed a link to the App Store. We do not allow this information to be used for personalised advertising or remarketing.

If you continue without analytics, our website does not use Google Analytics for your visit. You can change your choice here. Declining after previously accepting disables further analytics collection on the page and attempts to remove its Google cookies; it does not delete information already sent to Google.

  • Analytics cookies: Google Analytics uses cookies to recognise browsers and visits. Their default lifetime is two years, subject to browser and service settings. See Google's cookie information.
  • Ad measurement cookie: when you arrive from one of our Google ads, a Google cookie keeps the ad's click identifier for 90 days, so a later visit can be credited to that ad.
  • Saved preferences: your browser remembers your analytics choice and light or dark appearance for later visits.

These saved preferences have no scheduled expiry; you can remove them by clearing this website's data in your browser. Clearing the analytics choice makes the website ask again. Essential network processing by our hosting provider, such as receiving your IP address to serve a page or protect the service, still takes place when you decline analytics.

7. Support, the Android waitlist and purchases

We use your email address and anything you send us to respond to support requests and investigate issues. Feedback sent from the app includes its version.

If you voluntarily join the Android waitlist, your email address is collected and stored through Google Forms so we can tell you when Hench is available on Android. You can ask to leave the list or have your submission deleted by emailing hello@hench.app from the address you supplied. Google's handling of its own services is described in its Privacy Policy.

Apple handles payments. Hench checks purchase and subscription information to provide Pro features, including server checks for AI access, and reports purchase activity to Google Analytics. Hench does not receive your payment-card number.

Following a link to the App Store, a social network or another website takes you to a separately operated service with its own privacy practices.

8. Service providers and international processing

The providers involved in the processing described here are:

These providers may process information outside the country where you live, including in the United States. Diagnostic information is sent to Sentry in the United States, and AI requests are sent to OpenAI. Our server is outside mainland China: a request from mainland China, Hong Kong or Macau reaches it first, and is then sent to Alibaba Cloud in mainland China.

Where information leaves the UK or the European Economic Area for a country without an adequacy decision, it is protected by each provider's data processing terms: the EU–US Data Privacy Framework and its UK Extension where the provider is certified, or standard contractual clauses with the UK Addendum. Email hello@hench.app for a copy of the safeguards that apply.

We may also disclose information when required by law, or where necessary and lawful to protect the service, investigate abuse or establish, exercise or defend legal claims.

Where the UK GDPR or EU GDPR applies, the basis depends on the purpose:

  • Providing the service: processing needed to deliver the workout tracker, sync you request, subscription access, the AI routines and plans you ask for, and related support is necessary to perform our agreement with you.
  • Consent: the basis for website analytics, ad measurement and Android waitlist notifications. You can withdraw it through the controls or contact route described in this policy.
  • Security and reliability: our legitimate interests in protecting the service, verifying genuine requests, preventing allowance abuse and diagnosing failures.
  • Understanding app use: our legitimate interest in learning how the app is used so we can improve it.
  • Legal obligations: complying with a legal requirement where it applies to the information we hold.

You are not legally required to provide a training prompt, answer the gender question, allow Health access or join the waitlist. We do not ask for medical information in AI prompts. An AI request needs its training inputs and verification information to work; without them, we cannot provide that generation.

10. How long information is kept

  • Device and iCloud records: remain on your device and, when synced, in iCloud. Removing a workout or routine from view may not immediately erase all copies. Turning sync off does not delete them.
  • AI requests and results: cleared from our server 30 days after the generation.
  • AI generation and allowance records: kept while they are needed to apply the free allowance and usage limits. Disabling AI, removing a routine or uninstalling the app does not remove them. You can request deletion as described in section 11.
  • OpenAI: keeps its records for detecting misuse for up to 30 days, as described in section 4. Deleting our copy does not delete OpenAI's.
  • Alibaba Cloud: stores the data generated by requests from mainland China, Hong Kong and Macau for a period it does not state, as described in section 4. Deleting our copy does not delete Alibaba Cloud's.
  • Analytics and diagnostics: Google Analytics keeps user-level and event-level data for up to 14 months, and Sentry keeps crash and error reports for up to 90 days. Aggregated reports that no longer relate to an app user or browser can be kept longer. Cookie lifetimes are separate from how long a provider keeps what it has received.
  • Hosting: our server does not store IP addresses. Cloudflare processes them to serve and protect the service, under its own policy.
  • Support correspondence: kept for as long as needed to resolve your request and any follow-up, and to meet legal obligations or handle claims.
  • Waitlist submissions: deleted after we have sent the Android launch email. You can ask to leave the list earlier.

Contact us about the retention or deletion of records relating to you.

11. Your choices, deletion and privacy rights

Depending on the law that applies, you may have rights to access and receive a copy of your information, correct it, request deletion, restrict processing or receive portable data. Where we rely on consent, you can withdraw it without affecting processing that was lawful before withdrawal.

Objecting to processing

You can object to processing based on legitimate interests for reasons relating to your situation. Email hello@hench.app to exercise these rights.

Making a request

For the app, send your request from Hench: Settings, then Send us Feedback. That email includes your app user ID, which is how we find your app and AI records; without it we may not be able to find them. Otherwise email hello@hench.app, and for waitlist requests use the address you submitted. We may ask for further information to verify a request. Do not send passwords, payment-card details or purchase proofs.

We will respond within the applicable legal deadline, normally one month for UK or EEA requests, and explain any lawful extension or reason we cannot fulfil a request. Rights can have exceptions; a request does not necessarily require erasing information needed to comply with a legal obligation or handle a legal claim.

Managing copies on your devices

You can manage Health access and records through Apple Health, iCloud storage through Apple's settings, and browser cookies through your browser. Uninstalling Hench does not necessarily remove iCloud data, the app's saved user ID, Apple Health records or information already sent to our providers. Contact us if you need help understanding which copies a deletion action affects.

Complaints

You can complain to the UK Information Commissioner's Office or the data protection authority where you live or work. For the EEA, see the list of supervisory authorities. You do not need to contact us first.

If you live elsewhere, including a US state with applicable privacy rights, contact us to exercise those rights or appeal our response where the law provides an appeal. The scope of those rights depends on the law and whether it applies to Hench.

12. Children's privacy

Hench is a general-audience fitness app and is not directed at children under 13. We do not ask for a date of birth. If you are a parent or guardian and think your child under 13 has given us information, contact hello@hench.app and we will help remove what we hold.

13. Security and changes to this policy

We use encrypted connections and checks intended to prevent unauthorised access and misuse of our AI features. No security measure can guarantee that information will never be accessed without authorisation.

We will update this policy when our practices change and show the revised date above. Where required, we will provide notice of a material change and obtain any new permission needed before using information for a new purpose.