Privacy Policy

1. Who is responsible

Hizz is run by Muratcan Durduoğlu, a private person based in Türkiye, who is responsible for your personal data (the “data controller” under the EU General Data Protection Regulation, GDPR, and Türkiye's Personal Data Protection Law No. 6698, KVKK). Before paid plans start, a company will take this role and we'll update this page. For any privacy question or request, email hello@hizz.app.

2. What we store

• Account: your email address (to send login links) and the name you choose to show in the app.
• Gyms and teams: which gyms or coaches' teams you belong to (we say “gym” for both below), your role (owner, coach or athlete) and when you joined.
• Training plans written by coaches: workouts, stations, targets and notes.
• Your results: total and station times, weights and reps of your strength sets, your division (Open/Pro, Women/Men/Mixed, Single/Doubles), your doubles partner's name if you type one, how hard it felt (1–10) and an optional note.
• Agreement record: that you confirmed you're 16+ and agreed to these terms, and when.
• Waitlist (only if you join it before launch): your email address, whether you're a gym owner, coach or athlete, and when you joined.
• Technical data: login records kept by our login provider for security (such as sign-in time and IP address) and short-lived server logs.

We collect this data electronically, only from what you (or your coach) type into Hizz and from your device when you use it. We don't buy data or get it from other sources.

We do not collect health or medical data, payment card details, your location, or contacts. Please don't put medical information in notes. Only type a doubles partner's first name if they're happy for it to appear.

3. Why we use it

• To run the service you asked for: log you in, show your gym's workouts, save your results, show leaderboards, personal bests and progress (performance of a contract: GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)).
• To email you when Hizz opens, if you joined the waitlist (your consent: GDPR Art. 6(1)(a), KVKK Art. 5(1) explicit consent, which you can take back at any time by emailing us; this doesn't affect emails already sent).
• To keep Hizz secure and working (our legitimate interest: GDPR Art. 6(1)(f), KVKK Art. 5(2)(f)).
• To meet legal duties, such as answering requests from authorities (legal obligation: GDPR Art. 6(1)(c), KVKK Art. 5(2)(ç)).

You need an email address to use Hizz, because that's how you log in. Everything else (notes, how hard it felt, a partner's name) is optional. Joining the waitlist is optional too.

Hizz makes no automated decisions about you with legal or similarly important effects. Summaries such as personal bests or “where to focus” are simple calculations from your own times, shown to you and your coaches.

We don't sell your data or show ads. The only emails we send that aren't login links are the launch emails to people who joined the waitlist.

4. Who can see what

• You see everything you've logged, including your personal bests and progress.
• Your gym's owner and coaches see your name, your results in their gym, your result history in that gym, and summaries made from it (personal bests set in that gym, benchmark attempts, which stations stopped improving, and when you last logged a result there).
• Other members of your gym see your name and your results on leaderboards of published workouts (times only: your total time and your time on each station). Your strength sets, personal bests and progress pages are only for you (and your coaches).
• Other gyms can't see anything about you.
• Your email address is never shown to coaches or other members.
• The waitlist is seen only by the people running Hizz.

5. Services that help us run Hizz

These companies process data only on our instructions, under data-processing agreements:

• Supabase: database and login. Your data is stored in the EU (Frankfurt, Germany).
• Vercel: hosts the website and handles page requests.
• Resend: sends login emails (from its EU servers in Ireland).
• Google (Google Workspace): our email. It holds the emails you send us and the launch emails we send to the waitlist.

We don't share your data with anyone else, unless the law requires it.

Some of these companies are based in the United States, so data may be accessed from outside the EU and Turkey. Where that happens, it's protected by the EU's Standard Contractual Clauses (and, for data from Turkey, the safeguards KVKK requires). When paid plans start, a payment provider will handle payments; we'll update this page first.

6. Cookies

We only use cookies the app needs to work: one that keeps you logged in, one that remembers which gym you last opened, one that unlocks the app on testers' devices before launch, one that remembers your device's time zone (so “today” matches your own clock), and (for coaches) one that remembers the last station you added. If you switch between light and dark mode, that choice is saved only in your browser on that device (it is never sent to us). No analytics, advertising or tracking cookies, so there's no cookie banner.

7. How long we keep it

• Your account and results are kept until you delete them or ask us to delete your account. Your times are part of your training history, so they stay even if a coach deletes the workout.
• If you leave a gym, your past results stay in that gym's history; members no longer see your name.
• Deleting your account deletes your profile, results and agreement records.
• Waitlist entries are kept until we've sent your launch invite, and deleted at the latest 12 months after you joined, or sooner if you ask.
• Login records and server logs are deleted automatically after a short period by our providers.

8. Your rights

You can ask to see a copy of your data, correct it, delete it, receive it in a portable format, restrict or object to how we use it, and take back any consent you gave. Under KVKK (Art. 11) you can also ask whether we process your data and why, who we've shared it with in Türkiye or abroad, that people we shared it with are told about corrections or deletions, and for compensation if unlawful processing harmed you. You can download all your results yourself at any time (My progress → Download my results). For anything else, email hello@hizz.app from the address you use with Hizz (so we know it's you); we'll reply free of charge within 30 days. You can also complain to a data protection authority: in Türkiye the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, kvkk.gov.tr), in the EU the authority of your country.

9. Security

Connections are encrypted, data is stored in the EU, and database rules make sure each person and gym only reaches the data they're allowed to. These rules are checked by automatic tests on every change.

10. Age

Hizz and its waitlist are for people aged 16 and over. If you believe someone younger has an account or joined the waitlist, email us and we'll delete it.

11. Changes

If we change this policy in an important way, we'll ask you to agree again in the app. See also our Terms of Use.