Privacy policy.

This policy explains how 123 operates Napa Fitness: Daily Workouts and handles information when you use our mobile app and this website.

For questions or privacy requests, contact phamvuonghoangnhat@gmail.com.

• Account information: your sign-in provider identifier, email address, and name when provided by Google, Apple, or another supported sign-in provider. A provider profile photo may be displayed in the app.
• Body metrics and goals: gender selection, height, weight, chest, waist and hip measurements, measurement targets, and selected training areas.
• Workout information: generated plans, completed exercises, session dates and duration, energy ratings, streaks, and training preferences.
• Discomfort feedback: a body region, symptom category, severity, and related exercise information you choose to submit.
• Purchase information: product identifiers, store transaction identifiers or purchase tokens, subscription status and expiration. Apple and Google process payment details; the app does not receive your full payment card number.
• Technical information: requests to our services may include IP address, request time, browser or device details, and error information used to operate and protect the service.

Some preferences and cached data stay on your device. The mobile app stores its backend access token using platform secure storage.

We use information to authenticate your account, synchronize your profile, build workout suggestions, record progress, respond to feedback, verify subscriptions, provide support, and protect the service against abuse.

Body metrics and discomfort feedback are used for general fitness personalization. They are not used to diagnose a condition or make medical decisions.

Information is processed by providers needed to deliver the service:

• Google Firebase: account authentication. See Firebase privacy information.
• Google Gemini API: when AI generation is enabled, workout prompts can include body metrics, goals, selected training areas, energy level, available time, and reported soreness. Our workout prompt does not intentionally include your name or email. See Gemini API terms.
• Apple App Store and Google Play: purchase processing and subscription verification.
• Hosting providers: our API/database hosting and Vercel for this website. Cloudflare provides domain and, when enabled, network services.

Provider processing and storage locations depend on their services and our configuration. Information may be processed outside your country. Contact us for details about the providers and transfer arrangements applicable to your account.

Account-linked profile, workout, and feedback records are retained while your account is active so the app can maintain your history. You can request deletion using the instructions on our Delete Account page.

Deleted information may remain in restricted backup copies for up to 7 days before those copies expire under our backup schedule.

Apple and Google may retain transaction records under their own policies. Where a specific legal obligation requires retention, we will explain the applicable information and reason when handling your request.

You can update training preferences in the app, choose whether to submit discomfort feedback, disable nutrition guidance, and request account deletion. Store subscriptions are managed separately through Apple or Google.

Depending on your location, you may have rights to access, correct, delete, obtain a copy of, or restrict processing of your personal information, object to certain processing, or withdraw consent where processing relies on consent. Contact us to exercise these rights; identity verification may be required. You may also contact your local data protection authority.

Where EU/EEA or UK data protection law applies, account and subscription operations generally support delivery of the service you request; security and operational processing may rely on legitimate interests. Processing sensitive health-related information requires an appropriate additional legal condition, including explicit consent where applicable. This policy does not itself collect that consent.

This website does not include advertising trackers, analytics scripts, account sign-in, or a tracking-cookie banner. Our hosting and network providers may process technical requests to serve and secure its pages.

Opening an email link uses your email application. An email is sent only when you send it. Our account-deletion page does not silently submit information to the backend.

The current mobile app does not require access to your contacts, SMS, microphone, camera, or precise location for its workout features.

We may update this policy as the service changes. The date at the top identifies the current version. Material changes will be communicated where required.

Privacy contact: phamvuonghoangnhat@gmail.com.