Privacy Policy
This is a courtesy translation. The Spanish version is the legally binding one; if the two differ, the Spanish text prevails.
Nutrition and consent for sensitive health data
Nutrition is optional. Food, body weight, measurements, sex, age, dietary restrictions, targets and water logs can reveal sensitive health information. They are used to calculate general targets, show your diary and summaries, prepare your recipes and, when requested, adjust targets and schedule local reminders. Before Nutrition data is saved, you must tap Start beside the consent notice and link to this Policy. HADOX records the legal version, UTC date and local or signed-in account space. This acceptance is separate from general sign-in authorisation.
Nutrition: storage, providers and measurement
Your diary, profile, custom foods, recipes, favourites and water are saved on the device first. With a verified account they are privately backed up to Google Firebase; they are not published in Community. Food photos stay on the device and neither their files nor paths are synced. ML Kit reads barcodes on the device. "Read label" reads the nutrition facts photo on the phone with ML Kit and deletes the photo right away; the image never leaves the phone. Intermittent fasting is saved only on the phone and is not backed up to the cloud. If you are over 18 and turn on "Connect with Health Connect" in Nutrition settings (off by default), HADOX reads from Health Connect only two data points: daily steps (to show your progress against your step goal in Nutrition › Today), daily active calories burned (to show them on the "Burned" line with "≈" instead of the workout estimate, without adding them to your calorie target). Everything read from Health Connect is only displayed on the phone: it is never saved to the cloud or Firestore, never sent to Meta or Google Analytics and HADOX never writes data to Health Connect; you can disconnect it anytime by turning off the switch in Nutrition settings or revoking permissions in Health Connect. When a new product is requested, only its barcode is sent to Open Food Facts as query content, together with technical identification of HADOX; the provider also receives normal connection information such as the IP address. It does not receive photos, your profile or diary. A separate product copy is kept on the device. Nutrients come from USDA FoodData Central, Open Food Facts or values you enter. No Nutrition data or events are sent to Meta. Google Analytics receives only onboarding completion and the logging method, without food names, quantities, photos or health information.
Nutrition: withdrawal, export and deletion
You can correct and export your data, or withdraw this consent with Delete my nutrition data in Nutrition Settings. This removes the profile, diary, custom foods, recipes, favourites, water, managed photos and cached products from that device account space, and requests deletion of synced data when connected. Other devices apply deletion when they sync; copies exported outside HADOX cannot be withdrawn. A technical revocation marker without health data is retained to prevent an offline device restoring the diary under an older acceptance. Deleting the account or its local data also removes Nutrition. Access, rectification, cancellation, objection and withdrawal requests can be made using the contact and procedure under Your choices and rights.
Scope and who is responsible
This Policy explains how HADOX handles information when you log training, use local mode or sign in with an account. Adrián Jesús Quijano Castillo is the individual responsible for the use and protection of the data and trades publicly under the Hadox Studio brand, which is not an incorporated company. The address for notices is Andador 12 Este, número 2, colonia Concordia, C.P. 24085, municipio de Campeche, Campeche, México. HADOX operates from municipio de Campeche, Campeche, México and is aimed at people over 18 in its first release in Mexico.
Data you choose to log
You can log a name or alias, age, height, weight, goals, level, training days, routines, plans, exercises, sets, reps, loads, duration, rests, RIR, dropsets, records, goals and body measurements. PRO Coach can also use answers about fatigue, recovery, discomfort, areas to look after, equipment and availability to generate general recommendations. This data can reveal information about your physical condition and is handled only for the features you ask for. If you use Community, you also decide which groups and guild you join, which workouts you share, which photos and comments you post and whom you report or block.
Local mode and files on the device
In local mode, training data and preferences stay in the app's private storage. HADOX keeps a local emergency backup so the file can be recovered if a write is interrupted. Android or the manufacturer could include app data in the device backups according to their own settings. You can export a JSON backup and a CSV of workouts.
Account and backup
HADOX offers two ways to use it and you choose which. Without an account, your workouts, measurements, routines and photos stay on the device and are not backed up to a HADOX account. This does not turn off usage measurement: Google Analytics and Meta's measurement kit may receive the milestones and technical data described in this policy, including when you use the app without an account. With a Google account or an email and password, through Firebase Authentication, HADOX automatically saves the data listed below to your account, to back it up and let you carry on from another device: signing in is the authorisation and no extra acceptance is requested. That statement is shown beside the sign-in buttons before you sign in, tied to a version of this information, and HADOX records its version and date in your account space. Firebase may process a user id, email, name and technical authentication data; HADOX cannot read your password. If you register with an email, HADOX waits until you verify it before backing up your workouts and other synchronised data: in the meantime the changes stay on the device and are sent on their own as soon as the verification is confirmed. You can go back to no-account mode by signing out.
Data kept in your account
With a verified account the following is saved and synced, for backup and continuity between devices: profile without photo, routines and plans, finished sessions with their sets, body measurements, custom exercises without an image, goals, PRO Coach answers and transferable preferences. The workout in progress, timers, the installation id and file paths stay local. Derived statistics are rebuilt from your logs.
Community: what other people see
Community is optional and only works with an account with a verified email. Until you join a group, a guild or a challenge, nobody sees anything of yours. Opening Community does not publish anything: your name only becomes available to other accounts when you join a group, a guild or a challenge, and the app reminds you before you join. Then the members of that group or guild see your display name, your guild emblem, the days you logged a workout since you joined, whether you use the group plan and your progress in its challenges. If you turn on "Show my photo in Community", they also see your profile photo. In a guild, in addition, every workout you save shows up automatically in its activity with its title, its duration and its number of sets (not your weights), without you having to post it. If you also share a workout, they see its volume and best sets, the photo and text you add, and the comments you write. In official challenges, any Community account can see, inside each challenge, the display name of the people taking part and how far they are in that challenge (nothing else from their history); their photo is only seen by someone who shares a group or a guild with them. The app says so next to "Join". To deliver the prizes of its official challenges, HADOX sees who reached the goal and when. Nobody can list or search the people in Community. Your body weight, your measurements, your progress photos, your email and your history from before you joined are never shared. Before posting you must accept the Community rules and state that you are over 18. You can delete what you posted, leave a group or guild, and block or report another person whenever you want. If you report something, HADOX receives the report; whoever manages that group or guild only sees what was reported, how many people did and for what reason, never who.
Community: photos and moderation
The photo you choose to post in Community does leave your phone: it is uploaded to Firebase Cloud Storage into a quarantine area nobody can read, the server strips its metadata (location, phone model), resizes it and sends it to Google Cloud Vision for an automatic check for sexual or violent content before anyone sees it. If the check rejects it, it is not published; if it is unclear, a person on the HADOX team reviews it. Text goes through a list of disallowed words. When someone reports a post, a comment or an account, the HADOX moderation team can see that content in order to decide, and can remove it or suspend posting for whoever breaks the rules. Google handles those images as a provider, only to return the result of the check. The cover of a group, a guild or a challenge is a photo uploaded by whoever manages it: it goes through the same check and can be seen by any verified account that is shown the invitation or the challenge. Your profile photo only leaves your phone with "Show my photo in Community" turned on (since version 68 it comes on when you join Community for the first time, and the rules screen says so; turn it off anytime in Settings, Profile or Community): it goes through the same automatic check (if it is unclear, it is simply not set), only the people you share a group or a guild with can see it, it can be changed up to three times a day, you can remove it whenever you want and it is deleted when you delete your account. If you request the ally checkmark, the city, link and message you write are read only by HADOX to check the guild is real, and are deleted once HADOX decides.
Community notifications
If you have an account and allow notifications, HADOX uses Google Firebase Cloud Messaging to notify you about comments and strength on your posts and guild requests or acceptances. It stores an installation identifier, the device delivery token, platform, language, time zone and enabled notification types linked to your account. The token routes notifications; it is not an advertising identifier. The lock screen shows a generic notice without names, photos, weights, measurements or comment text. Records needed to prevent duplicate notifications or defer delivery are used only for delivery. You can switch off each type in Settings · Notifications or disable all notifications in your phone settings. Signing out stops local registration and requests removal of the device from the server. If there is no connection, remote removal may not complete at that time; the registration expires unless renewed. Deleting your account deletes its notification records. Notifications already delivered by the system may remain visible until you dismiss them.
Usage statistics
HADOX uses Google Analytics to understand how the app is used and decide what to improve. It records milestones along the way: finishing the initial setup, which method you sign in with, when you finish a workout and how many you have, when you generate or share an image, and when you see or complete the purchase screen. It does not record the content of your training: no weight, no body measurements, no discomfort, no exercise or routine names, nothing you type. HADOX does not show ads inside the app. It does use the Android advertising identifier, and shares these same milestones with Google and with Meta, to measure how effective the ads HADOX buys on Google Ads, Facebook and Instagram are: it is there to know which ad brought you here, how much it cost to get you and to stop showing you advertising you are no longer interested in. When you buy a subscription its amount and currency are shared too, without any of your card details. You can reset or switch off that identifier whenever you want from your phone settings, under Google · Ads. Google and Meta handle this data as service providers.
Photos and shared content
Profile, progress, custom exercise and HADOX Share photos stay on the device and are not uploaded to Firebase. The only exceptions are the photo you choose to post in Community and your profile photo with "Show my photo in Community" turned on, both described above. HADOX only reaches a photo or the camera when you choose that action. When you share, the system hands the file to the app you pick; from that moment the receiving app applies its own policies. HADOX does not control copies saved to the gallery, sent or published.
Purposes
The data is used to save and restore your activity, show history, records and charts, adapt units and preferences, generate PRO Coach recommendations, create the content you ask for, back up and sync between your devices when you use an account, run Community (groups, guilds, challenges and moderation) when you choose to use it, handle support, protect accounts and validate access to paid features. HADOX does not show ads, does not sell personal data and does not use your workouts for personalised advertising.
Providers and location
HADOX integrates Google services: Firebase Authentication for accounts, Cloud Firestore for your account data, Google Analytics for usage statistics and Google Play Billing for the subscription. It also uses Google Sign-In as a sign-in provider. Firestore is configured in nam7 (Estados Unidos: centro y este); Firebase Authentication processes data in the United States. It also integrates Meta's measurement kit, which receives the same usage milestones described below to measure how effective the ads HADOX buys on Facebook and Instagram are; it does not include Facebook sign-in and nothing from Facebook appears inside the app. Google and Meta act as providers under their terms of service and data protection terms. HADOX also uses Firebase Cloud Functions to check your purchases against Google Play: when you buy the subscription, Google's receipt travels to that server, which confirms with Google Play that the purchase is real and records whether you have PRO. To verify purchases that server does not receive your workouts, your measurements or your photos. Community also uses Cloud Functions for everything that changes in groups, guilds and challenges (reading from your backup the workouts that count), Firebase Cloud Storage for the photos you post there and Google Cloud Vision to check them. This version does not integrate Crashlytics or in-app ads; optional Health Connect reading happens on the phone and what is read is not sent to servers.
Retention and deletion
Local data stays until you delete a record, use "Delete data from this device" or uninstall HADOX, subject to possible operating system backups. If a synced account exists, its data stays as long as the account exists. "Delete my account and all my data" requests the deletion of the associated data in Firestore and Firebase Authentication and then cleans the device once Firebase confirms those operations. That includes what is yours in Community: memberships and requests, posts, announcements, photos, comments, the strength you gave, the guild's automatic activity, your challenge progress and the reports you made; a group or guild you owned passes to another person who was already in it or, if nobody is left, it is closed along with its photos. The plans and challenges you had published for a group or guild that still exists stay with it, without your name. The log of administration actions and the record of a purchase are kept without your name, for security and legal obligations. A legal or security obligation may require keeping minimal information for the indispensable time; history will not be kept for advertising. Files you already sent to other apps or saved outside HADOX cannot be deleted from HADOX.
Purchases
Google Play processes the payment data for HADOX PRO, and HADOX only receives the information needed to validate the purchase and the access it gives. HADOX will not receive your full card number. Deleting data or deleting a HADOX account does not by itself cancel a Google Play subscription; the subscription is managed separately in Google Play.
Your choices and rights
You can use HADOX without an account, correct your data inside the app, export it, delete specific records, sign out to stop backing up new information to your account, delete only the device or request the full deletion of the account and its remote data. You can also request access, rectification, cancellation or objection and withdraw consent where applicable under the law. Send your request to hadoxstudio.contacto@gmail.com or to the address Andador 12 Este, número 2, colonia Concordia, C.P. 24085, municipio de Campeche, Campeche, México. Include your name, the account email if there is one, the right you want to exercise, a clear description of the request and, for a rectification, the correct data and the supporting evidence. We may ask for reasonable identity verification and will answer within the applicable legal deadlines.
Security and changes
HADOX applies local separation per account, recoverable local writes, Firestore rules that limit each path to its owner, and structure validation. In Community the phone hardly writes anything: joining, posting, commenting and counting workouts are decided by the server, and each wall is only readable by its members. No system is infallible. If the handling materially changes, a new version of this Policy and of the sign-in statement will be published, and that version will be recorded the next time you sign in to your account.