Privacy Policy

Who we are

Anabolic Advisor is run by Michael Hernandez, an individual based in Florida, United States. “We” and “us” mean the operator of the anabolicadvisor.com website and the Anabolic Advisor iPhone app. This policy covers both, and the Discord bot and companion watch that connect to them. The contact address is at the end of this page.

What we collect and why

We collect what you enter, what your connected devices send, what you allow from Apple Health, and some technical data automatically.

Account

Your name, email address and password, which is stored only as a salted hash. We also record which version of the AI consent you agreed to, and when.

Profile

Sex, date of birth or age, height, weight, goals, units, time zone, and your answers during setup.

Workouts and activity

Sessions, sets, weights, cardio, templates, schedules, records, notes, steps and distance.

Food and water

What you log, saved foods, targets, and any meal or label photo you choose to estimate from. Those photos are sent for the estimate and not kept unless you save them.

Body

Weigh-ins, measurements, body composition, body scans and daily check-ins.

Progress photos

Photos you upload or take in the app. We remove their embedded metadata, including location, when you upload them.

Labs

Lab results you enter or import, and report files you upload. A report file can show your name, date of birth and address.

Heart and blood pressure

Blood-pressure readings, ECG recordings and pulse oximeter readings from devices you connect.

Glucose

Readings from a glucose sensor you connect or upload.

Fitness tracker

Daily recovery, strain, sleep, heart-rate variability, per-minute heart rate and workouts, plus your tracker's model and serial number.

Smart scale

Weight and body composition from your scale maker's account, if you connect it, and the sign-in tokens that connection uses.

Apple Health

The data listed in the Apple Health section below, only if you give permission.

Supplements, medications and anything else you log

Names, doses, schedules, stock and dates.

Atlas

Your chats, notes Atlas saved about you, reminders, and the thumbs up or down you give its replies. If you use your own AI key on the website, we store it encrypted.

Voice

Short voice clips on the website, a watch or Discord are turned into text. We keep the text, not the audio. The iPhone app doesn't upload voice.

Social

Groups, challenges, leaderboards, coach connections, share links and event replies.

Discord

If you link it: your Discord id and username, your direct messages with Atlas, and your setup answers if you joined through Discord.

Support and bug reports

What you write, any screenshots you attach, the page you were on, the app version, your device's screen size and browser details, and recent error messages.

Technical data

Your IP address and browser or device details with each sign-in, a name for each device signed in (usually the device's own name), the app version, and server logs that record your account id, activity and errors. A watch adds its hardware id, Wi-Fi network name and last IP address.

We use this data to run the service for you: to store your history, draw your charts, work out your targets, send the reminders you set up, let Atlas coach you, keep accounts secure, limit abuse and fix bugs. We also count how many people use each feature, to decide what to improve; those totals name nobody and stay with us. We don't use your data for anything else.

We don't collect your location. Outdoor routes in the iPhone app's tracker screen stay on your phone. We don't collect your contacts or any advertising identifier, and there are no payments, so we hold no payment details.

Apple Health

If you allow it, the iPhone app reads these from Apple Health: steps, active and resting energy, walking and running distance, exercise time, stand time, flights climbed, heart rate, resting and walking heart rate, heart-rate variability, respiratory rate, blood oxygen, VO2 max, weight, body fat, lean mass, sleep and workouts. iOS asks you first, and you can turn any of them off in the Health app at any time. If you connect Apple Health on the tracker screen, it also reads body temperature, BMI, water, caffeine and workout routes, and those stay on your phone.

The app syncs a daily summary of these to your account so your charts and coaching can use them.

Nothing is written to Apple Health unless you turn on a write option. Those options write your glucose readings, or your tracker's heart rate, heart-rate variability, blood oxygen, respiratory rate, sleep and workouts.

AI companies

Atlas, food photo estimates, nutrition-label reading and lab report reading are powered by AI from other companies. Workout names and chat titles are too. Here's who receives what.

xAI (Grok)

What you ask Atlas and your past chats. Your age, sex, height, weight and goals. Your workouts, food, supplements, measurements, lab results, blood pressure, glucose, sleep, recovery and activity, including data from Apple Health and your connected devices. Notes Atlas saved about you. Food and label photos you take. Lab reports you upload, which can show your name and date of birth.

Groq

Voice clips, if you use voice input on the website, a watch or Discord. They're turned into text.

OpenAI, Anthropic or Google

Only if you add your own key in the tracker screen. Your questions there and summaries of your recovery, sleep and workouts go from your phone to the company you picked, under your account with them.

• It's used only to answer you and run these features. It's never used for ads and never sold.
• Your body progress photos are never sent.
• xAI and Groq can keep what they receive for up to 30 days to check for abuse. xAI says it doesn't train its models on it without permission.
• These requests don't carry your name, email address or account id as identifiers. Your name can still reach these companies if it appears in something you send, such as a lab report or a message.
• xAI's own legal documents now use the name SpaceXSI. We can't guarantee which country xAI processes a request in.
• If you use your own AI key on the website, this data goes to the company you chose (xAI, OpenAI or OpenRouter) under your agreement with them.
• A question to Atlas in a public Discord channel goes to xAI along with your display name, and its answer is public. There, Atlas can see only your workouts.

Your consent

In the App Store app, nothing goes to an AI company until you agree on the consent screen, which names these companies. Until you do, the account's data isn't sent to them from any of our apps or services, and the rest of the app works normally.

On the website and Discord, AI features are on for accounts that never signed in to the App Store app, as we tell you when you sign up. They also stay on there for accounts created before this consent existed. Anyone can turn them off.

To withdraw consent, turn off AI sharing in Settings, in the app or on the website. It stops at once, for your whole account, on every surface. What a company has already received stays with it for the period above.

Other companies

Cloudflare

All traffic to the website, the app and a watch passes through Cloudflare, which protects the site and delivers it. It can see that traffic, including your data in transit, your IP address and your device details. On the website it also measures visits and page speed, without cookies, and we see only the totals.

Anthropic

We use Anthropic's Claude Code, an AI coding tool, to investigate and fix problems. Bug reports you send, including screenshots, go through it, and so can account data when we're diagnosing a problem. It's used only for that.

Discord

Only if you link it. Your messages with Atlas, voice notes and photos sent there, password-reset links, and group posts all pass through Discord under Discord's own terms.

Your smart scale's maker

Only if you connect it. We fetch your readings from them using the sign-in you approve on their site.

A lab-testing service

Only if you connect it on the website. We store your login for that service, encrypted, and use it to sign in and fetch your results.

Your browser's push service

If you turn on web notifications, they pass through your browser maker's push service, encrypted.

Apple's push service

If you allow notifications in the iPhone app, they reach your phone through Apple, encrypted in transit. We keep a token for your phone to address them, and delete it when you sign out or turn Atlas notifications off.

Open Food Facts

When you look up a barcode, we send the barcode number and nothing about you.

YouTube and unpkg

On the website only. Opening an exercise video loads it from YouTube, and the watch setup page loads a tool from unpkg. Each sees your IP address.

The service providers we use to run Anabolic Advisor (Cloudflare, xAI, Groq and Anthropic) are bound by their terms with us to protect your data with the same or equal protection as this policy. Data you choose to send elsewhere is covered by that company's own policy. We may also disclose data if the law requires it, or to protect someone's safety.

People you share with

• Share links are public to anyone who has the link. They expire after 30 days by default, and you can revoke them in Settings.
• Groups and challenges show members your name and results. A group with a Discord channel can post your workouts, runs and records there. You control this per group.
• Coaches you accept can see an overview of your data until you end the connection.
• API keys you create give whatever you connect to them full access to your account. They expire after 90 days, and you can revoke them at any time.

Where it's stored

Your database and files, and their backups, are on servers we run ourselves in the United States, not in a public cloud. If you use Anabolic Advisor from another country, your data comes to the United States.

Connections to the website and app use HTTPS. Passwords are stored as salted hashes, and API keys as hashes. Your own AI keys and lab-service login are encrypted. Access to the servers is limited to the operator and the tools described on this page, and the operator can see your data in order to run the service and help you. No system is perfectly secure, and we can't promise a breach will never happen.

How long we keep it

Your data stays until you delete it or your account. Nothing in your account expires on its own. When you delete your account, your data is removed from our live database and file storage at once. Copies then remain in these places:

• Database backups are kept for 14 days, and second copies for about 31 days. Deleted data stays in them until they age out. We use backups only to recover from a failure.
• File backups of photos, lab files and bug-report screenshots don't age out by themselves yet. To have yours removed from them, email us and we'll do it by hand.
• Server logs are kept for 30 days. They're written to diagnose problems and hold your account id, what was requested and any errors. Logs at our own web proxy hold your IP address and are kept for a limited time.
• AI companies can keep what they received for up to 30 days, as above.
• Discord keeps your messages there until you delete them on Discord. Deleting your account here doesn't delete them.

Sign-in sessions end after 7 days without use and are then erased. Bug reports are deleted with your account. Raw tracker recordings, from a research feature that isn't in the App Store app, are kept for 30 days, and reference oximeter sessions until you delete your account.

Your choices and deleting

• Delete your account: in the iPhone app, Settings, Delete account. On the website, Settings, Security, Delete my account. It removes your account and everything in it, and it can't be undone. Can't sign in? Use the support page.
• Delete single items: workouts, photos, logs, chats and most other records can be deleted one at a time where you see them.
• Get a copy: on the website, Settings has an export as JSON or spreadsheets. It doesn't include photos. Email us if you want those too.
• Correct: edit your data in the app or on the website.
• Stop AI sharing: turn it off in Settings. See AI companies.
• Stop Apple Health: turn off access in the Health app. What already synced stays until you delete it.
• Disconnect a device or service: in Settings.

Depending on where you live, you may have the legal right to access, correct, delete or get a copy of your data, to withdraw consent, and to appeal a decision we make about such a request. Email us to use any of these rights. We won't treat you differently for using them.

Consumer health data

Some US state laws, including those of Washington and Nevada, give you rights over “consumer health data.” Here, that means the health, body, fitness, food, lab, glucose, sleep and Apple Health data described on this page, and anything we could infer about your health from it.

We collect it from you, your devices and Apple Health, for the purposes listed under What we collect and why. We share it only with the companies on this page and the people you choose. We never sell it. You can see it, delete it and withdraw consent as described under Your choices and deleting.

Adults only

Anabolic Advisor is for people 18 or older. You must confirm your age to create an account. We don't knowingly collect data from anyone younger. If you think someone under 18 has an account, tell us and we'll delete it.

Cookies and browser storage

The website uses cookies to keep you signed in and to remember your theme and sidebar. It also keeps drafts and offline data in your browser. There are no advertising or analytics cookies, and we don't track you across other sites or apps.

Changes

If this policy changes, we'll update this page and its date. If we start sending your data to a new AI company, or send different data, the App Store app will ask for your consent again first.

Contact

Michael Hernandez, operator of Anabolic Advisor: support@anabolicadvisor.com