Privacy Policy

Hold the Standard · a fitness & habit tracking iOS app

This is the privacy policy for Hold the Standard (formerly internally called “The Standard”), an iOS fitness and habit tracking app made by Nathan Kramer. Plain English version of what we collect, where it lives, and what we promise.

1. What data we collect

When you use the app, the following data is collected:

From you, during onboarding

• Name (optional — you can skip this)
• Birth year, biological sex, height, weight
• Activity level (sedentary, light, moderate, active, very active)
• Goal (lose weight, maintain, build muscle, recomposition)

This is used to compute your daily calorie and macro targets via the Mifflin–St Jeor equation. None of this is shared with anyone.

From your daily logging

• Food entries — calories, protein, fat, carbs, optional note, and the source (manual entry, photo AI, or text AI)
• Water entries — amount, time
• Workout entries / habits — title, completion time
• Streak history — which days you hit your targets

Photos & meal descriptions

When you take a photo of food to log it, the photo is sent to OpenAI’s API for analysis (calories and macros). The photo is processed in-memory and is NOT permanently stored on our servers, nor on OpenAI’s. OpenAI’s standard API policy applies: the image is not used to train their models. The same applies to typed meal descriptions when you use the “Tell me what you ate” flow.

From Apple Health (only if you grant permission)

• Steps
• Active calories burned
• Workouts (count, type, duration)
• Water consumed (so we don’t double-count manual logs)
• Body mass (your weight, for staying in sync with Health)

From your Apple Sign In

• A unique Apple-issued user ID (so we know it’s you across launches)
• An email address (either your real one or an Apple-relayed private one — your choice during sign-in)

What we DON’T collect

• Your location
• Your contacts
• Your photos library (we only use the camera, and only when you choose to)
• Any social media accounts
• Analytics / tracking events tied to advertising
• Anything from other apps on your phone

2. Where your data lives

On your iPhone first (local-first design)

Everything you log goes into a local database on your device (SwiftData / SQLite). The app works fully offline.

On our cloud (Supabase) — only when you’re signed in

Your daily logs sync to a Supabase project so you can access them from another device. The cloud database has Row-Level Security policies that prevent anyone other than your own authenticated account from reading or writing your rows. Even our database administrators can only see your data with explicit access permissions.

Apple Health data — stays on your device

We read from Apple Health when you grant permission, but Apple Health data is never transmitted to our cloud. Per Apple’s HealthKit rules (which we strictly follow):

• Health data is not used for advertising or any data-mining purposes
• Health data is not shared with any third parties
• Health data is not stored in our cloud servers
• Health data is not used outside of providing this app’s functionality to you

OpenAI (food photo & description analysis only)

When you log a meal via photo or description, the data is sent over HTTPS to OpenAI’s API for one-time analysis. We don’t store the photo or text. OpenAI’s API does not use API images or prompts to train their models (per their published policy).

Authentication (Supabase + Apple)

Your Apple Sign In session lives in your iPhone’s secure storage. The session token is sent to Supabase only to authenticate API calls.

3. What we never do

• We do NOT sell your data. To anyone. Ever.
• We do NOT share your data with advertisers. This app has no ads and no advertising integrations.
• We do NOT use your data for any purpose other than running this app for you.
• We do NOT track you across other apps or websites.
• We do NOT use Apple Health data for marketing, advertising, or any non-app-functionality purpose. (This is Apple’s rule. We don’t even want to.)

4. Who can see your data

• You. Always.
• Nobody else by default. Our Supabase database has Row-Level Security policies that match your authenticated session ID against your data rows. If the session ID doesn’t match, the database returns nothing.
• In rare cases, our development team may need to access database tables for debugging or to fulfill your support request — and only with your knowledge.

5. Deleting your account

You have two options:

1. Sign out — From the dashboard, tap the gear icon → “Sign out.” Your local data stays on the device. Your cloud data stays on our servers until you delete the account (option 2).
2. Full account deletion — Email us at sargesaysapp@gmail.com with the subject “Delete my account” from the email address associated with your Apple Sign In. We will:
   • Delete your authentication record from Supabase
   • Delete all your profile, food, water, workout, and habit data from our cloud database
   • Confirm completion within 7 days

Deletion is permanent — we cannot restore data after it’s deleted.

6. Changes to this policy

If we materially change this policy, we’ll update the “Last updated” date at the top and notify active users in-app on next launch. If you don’t agree with a change, you can delete your account (Section 5).

7. Children

This app is not intended for users under 14. The onboarding flow requires users to be at least 14 years old. We do not knowingly collect data from anyone under 14.

8. Contact

Questions, concerns, account deletion requests, or just feedback?

Email: sargesaysapp@gmail.com

We respond to every email. Usually within 48 hours.