Plain English.
No selling.

Constant is operated by Gil Erez, doing business as Constant (forming as Constant Ltd in 2026). Contact: gil@trainconstant.com.

• Account: email address, sign-in provider (email, Apple, Google), and timestamps for sign-in and sign-out.
• Profile: what you tell us at onboarding — sex, year of birth, height, training experience, sports, primary goal, careful areas (injuries you want us to program around), equipment access, weekly capacity.
• Logged activity: workouts, sets, food entries, padel and other sport sessions, symptoms or niggles you choose to report, bodyweight entries, and any free-text notes.
• Plans the engine writes for you: readiness state, lever applied, and the full plan history.

When you connect Apple Health, Constant only reads these types — we never write data to Apple Health and never store it in iCloud:

• Heart rate variability (HRV SDNN)
• Resting heart rate
• Sleep stages — asleep, deep, REM, light, awake, in-bed
• Step count
• Active energy burned
• Bodyweight
• Logged workouts

The samples flow from your iPhone directly to your row in our database — they are not shared with anyone, not used to train models, and not used for advertising. Per Apple App Review Guideline 5.1.3, we disclose the specific HealthKit data we read above, do not write inaccurate data into HealthKit, and do not store personal health information in iCloud.

If you connect a third-party wearable (Whoop, Oura, Fitbit), Constant reads the same recovery signals — sleep, HRV, resting heart rate, steps. We store an OAuth token for each provider so we can fetch new data automatically; delete the connection any time from Settings and we delete the token within 24 hours. Whoop and Oura require us to honor a disconnect — we do.

One thing. Constant adapts today's training to how you're recovering and what you've been doing. The engine reads your data, writes one session for today, and logs the outcome for next time.

We do not use your health or fitness data for:

• advertising or marketing of any kind,
• data mining, profiling, or aggregate analytics shared with third parties,
• training third-party AI / ML models,
• insurance underwriting or any benefit conditioned on your data,
• medical diagnosis or treatment — Constant is not a medical device or service.

Your data lives in our Supabase Postgres database (region: ap-northeast-1 Tokyo for production). Each row carries your user_id; Row Level Security (RLS) ensures no other authenticated user can read it. Our server-side functions use a service-role key to read across users for aggregate metrics, never to share individual rows out.

We use Supabase (hosting + auth + database), Vercel (server runtime + edge cache), Anthropic (the LLM that processes food photos + the coach engine), OpenAI (occasional transcription of voice notes), and Resend (transactional email). Each is GDPR-compliant. We send the minimum information needed for the request and nothing more.

• We don't sell your data. Ever.
• We don't write to Apple Health.
• We don't store personal health information in iCloud.
• We don't share data with advertising networks.
• We don't train external models on your data.
• We don't diagnose or prescribe.

• Access + export:request a JSON dump of everything we hold for you — email us, we'll send it within 30 days.
• Delete: delete your account and all its data right in the app — Settings → Delete account, effective immediately — or email us and we hard-delete across our database within 24 hours. Disconnect any wearables first if you also want the provider-side tokens revoked.
• Withdraw consent: revoke Apple Health access at Settings → Apps → Constant → Health. Constant continues to work with manual log entries.
• Object: if you live in the EU, you have all rights under the GDPR. If you live in California, all rights under the CCPA. Contact us; we honor.

The web app uses session cookies (Supabase Auth) and one analytics tool — PostHog (self-hosted-grade privacy, no advertising, no fingerprinting beyond standard pageviews and the events we send: signups, onboarding step views, plan completions). Session recording is disabled. The iOS app does not load any third-party analytics SDK other than first-party Apple-provided crash reporting.

Constant is not directed to children under 16. Don't use it if you're under 16. We won't knowingly process the data of anyone under 16; if you believe we have, email us and we'll delete it.

When we change this policy in a way that affects what we collect or how we use it, we email everyone with an account. Smaller wording changes (typos, clarifications) we just date-stamp the page.

Questions, deletion requests, or data exports: gil@trainconstant.com.