Privacy policy

01

Who we are

YourHPU is run by Bucket Partners Limited, a New Zealand company, at 18 North Terrace, Darfield, Canterbury 7510, New Zealand. For anything about your privacy, write to rory@yourhpu.com. That address is also our privacy officer.

02

What we collect

Only what you give us, or what the app works out from it:

• Account: your email address, name and password (stored hashed by our database provider; we never see it).
• Profile: age (we ask for your date of birth at sign-up to check you are 18 or over, then keep only your age), sex, height, weight, sport, goals and target event, benchmarks, training history, equipment, injuries and niggles, and your weekly schedule.
• Daily check-ins: sleep, soreness, stress and the readiness worked out from them.
• Training: your season plan, week plans, sessions, and the sessions you log (done, missed, effort, notes).
• Nutrition: your settings and targets, foods you save and what you log eating.
• Chats with your coaches, and coach memory: short notes the coaches keep about you (an injury, a preference, a busy week), and the changes they propose and you approve or decline.
• Membership: your plan, whether it is active, when it renews or ends, and Stripe's reference numbers for you and your payments. Your card details go straight to Stripe; we never see them.
• Consent records: what you agreed to, which version and when.
• Usage counts: how many messages you send and what each AI call cost, with no content.

We don't use advertising trackers or analytics, and we don't collect data from devices or wearables.

03

Why we use it

To coach you: to plan your season and sessions, adjust them to how you are, track your food against your targets, and answer you in chat. We also use it to keep the service running and safe (fixing problems, stopping misuse, keeping costs in check) and to contact you about your account. We never sell your data, never use it for advertising and never share it with your club, employer or anyone else except the providers below.

04

AI processing

Your coaches' replies, plans and sessions are written by Claude, an AI model made by Anthropic. To do that, the relevant parts of your data are sent to Anthropic with each request. What we send to AI lists what each coach sees.

Before anything is sent, we remove:

• your email address, surname and date of birth (coaches see your first name and age);
• email addresses, phone numbers, street addresses and card numbers you type into chat or notes.

Other people's names you type into chat (a partner, a coach, a teammate) are not removed. When you log food or ask about a branded product, the coach reads your words as typed, so amounts and codes stay exact, and may search the web for the product's label (the search uses the product name and your timezone, never your name or contact details).

We use Anthropic's commercial service. Under its commercial terms, Anthropic may not train its models on what we send it, and it deletes what it receives within 30 days. If its automated safety systems flag a message, it may keep that message for up to 2 years. We checked these terms on 20 October 2026 (commercial terms, retention).

AI coaches can be wrong. You decide what you do: see the terms.

05

Where it is stored and who handles it

• Supabase: our database and sign-in. Your data is stored in Sydney, Australia.
• Vercel: runs the app and our server code. Our functions run in Sydney; Vercel is a US company and may handle request data in the United States.
• Anthropic: the AI model, in the United States (as above).
• GitHub: runs our daily database backup and stores it, encrypted, for 7 days, in the United States.
• Resend: sends our emails (sign-up, password, account and membership emails), in the United States. It sees your email address and the email.
• Stripe: takes payments for paid plans, in the United States and other countries. It sees your email address, your card details, the name on your card and your billing country, and keeps the payment records it must keep by law.

Sending your information to these providers outside New Zealand is a disclosure overseas (Privacy Act 2020, principle 12; for Australian members, Australian Privacy Principle 8). We use them because the service can't run without them. They handle your data only to provide their service to us, under their own privacy and security terms, which give protection comparable to ours. We don't control their laws: a provider in the United States can be required by US law to hand over data.

06

How long we keep it

• Your account and everything in it: until you delete your account.
• Records of AI calls (what was sent and returned, cleaned as above), for fixing problems: 30 days.
• Usage counts: kept after you delete your account, with your name and account removed.
• Database backups: one a day, encrypted, each deleted after 7 days, so a deleted account is gone from them within a week.
• Payments: deleting your account deletes your Stripe customer record, but Stripe and we keep the payment and invoice records the law requires (New Zealand tax law generally requires 7 years).

07

Your rights

You can:

• see your data: in the app, or all of it at once with Export my data on your account page;
• correct it: most of it in the app; for your profile, write to us;
• delete it: Delete account on your account page removes your account and data straight away and emails you to confirm. You can also ask by email;
• ask what we hold that the export doesn't show (such as the 30-day AI call records), and who it went to;
• withdraw your consent: this means deleting your account, since we can't coach you without your data.

Write to rory@yourhpu.com from your account's email address. We reply within 20 working days. If you are not happy with our answer, you can complain to the New Zealand Privacy Commissioner or, in Australia, the Office of the Australian Information Commissioner (OAIC).

08

Security and breaches

Your data is encrypted in transit and at rest, each account can only read its own data, and access to the database is limited to the owner. If a privacy breach is likely to cause you serious harm, we will tell you and the Privacy Commissioner (and, for Australian members, the OAIC) as soon as we practicably can, and say what happened and what you can do.

09

18 and over only

YourHPU is for people aged 18 and over. We check your age at sign-up. If we learn an account belongs to someone younger, we delete it.

10

Changes to this policy

The version date is at the top. If we change what we collect, why, or who handles it, we will ask you to agree again the next time you open the app. Smaller wording changes just update the date.

11

Need support?

If you are struggling, talk to someone today: your GP, someone you trust, or one of these free lines.