How ZEALO and this site handle information.

This policy covers (1) the ZEALO / RepTrack Pro iOS app and (2) the public marketing and education website at zealofitness.com (including Learn, Science, and related pages).

ZEALO is the product name used publicly on this site. As described on our About page, the app and this site are operated in connection with AutoClosure. This policy does not invent a legal entity type, registered address, or governing jurisdiction beyond what is already stated on those pages.

This page is a factual disclosure of how the product and site work. It is not a claim of HIPAA coverage, GDPR certification, SOC 2, Apple Health “approval,” or any other compliance marketing badge.

Depending on what you enter and which permissions or features you enable, ZEALO may handle:

• Workout logs, exercise history, templates, schedules, and related training records
• Profile and preference data you choose to enter (goals, equipment, settings)
• Body metrics, nutrition-related entries, and transformation photos
• Cycle-related symptoms or phase context you choose to log
• Health and workout data accessed through Apple HealthKit when you grant permission
• Activity, health measurement, sleep, nutrition and hydration data read from a Google Health account (Fitbit devices and Pixel Watch) or another wearable account you choose to connect directly
• Support messages you send by email, which may include device and app version details

The iOS app is designed as a local-first experience. Most of your workouts, profile entries, settings, photos, and related fitness records are stored on your device using SwiftData unless you choose a feature that syncs or sends data elsewhere (for example optional iCloud backup, HealthKit, AI features, or exports you initiate).

HealthKit access is optional. If you grant permission, the app may request a relatively wide set of HealthKit read types to support recovery, readiness, calorie, body composition, cycle-aware, and related features. The app may also write completed workouts to HealthKit (including intent for Apple Watch / workout writes where configured).

You can revoke HealthKit access at any time in iOS Settings. ZEALO does not claim that HealthKit use has been specially “approved” by Apple beyond ordinary App Store and HealthKit entitlement processes, and HealthKit data is not treated here as automatically safe to replicate into other systems.

ZEALO can optionally connect one Google Health account — the Google service that holds Fitbit device and Pixel Watch data — through Google's own sign-in (OAuth). Nothing is read until you connect, and on Google's consent page you choose which of the categories below ZEALO may read. ZEALO works without this connection; it is off until you turn it on in Settings › Health & Wearables.

What ZEALO reads. Only these four read-only categories, and only the ones you allow:

• Activity and fitness — workouts (exercise sessions), and your daily step, active-energy and distance totals.
• Health metrics and measurements — heart-rate samples, daily resting heart rate, heart-rate variability, and daily respiratory rate.
• Sleep — sleep sessions and their stages.
• Nutrition — foods you logged (name, energy, nutrients) and water you logged.

Why. To show that data inside ZEALO: your activity totals and history, your workouts and the heart rate recorded during them, your health-metric readings and trends, your sleep (which is also an input to ZEALO's recovery view), and your hydration total. The connection screen in the app lists exactly what the connection reads and which readings ZEALO stores without using them in a score.

Access is read-only. ZEALO requests only read scopes and never writes anything to your Google Health account. It does not request your Google profile, location, ECG, irregular-rhythm, reproductive-health, mindfulness, symptom or settings data, and it does not import weight, blood oxygen, temperature or Google's or Fitbit's own scores.

Where it is stored. Data read from Google Health is stored on your device, in the app's local database, alongside your other ZEALO records. It is not included in the optional iCloud backup. The sign-in tokens Google issues are stored in the iOS Keychain on that device only. To complete the sign-in, the app uses a small ZEALO token-exchange service (Google Cloud Functions) that holds the OAuth client secret: it forwards the sign-in code or refresh token to Google and returns Google's reply to the app. That service never receives, stores or logs health data, and it does not store the tokens. Health data itself is fetched by the app directly from Google's API.

Sharing. ZEALO does not sell Google Health data, does not share it with third parties, and does not use it for advertising. ZEALO's AI features do not read data imported from Google Health, and connecting Google Health does not turn on AI sharing — that remains a separate choice disclosed in the app. Data you export yourself (for example a PDF report) may include it, as with any other data in the app. ZEALO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your controls. In the app (Settings › Health & Wearables › Google Health) you can Disconnect, which asks Google to revoke ZEALO's access and forgets the tokens on your device while keeping what was already imported, and separately Delete imported data, which removes ZEALO's copy of everything received from Google Health. You can also remove ZEALO from your Google Account at any time under Google's third-party apps and services. Deleting a record in Google Health does not automatically remove ZEALO's copy; use Delete imported data for that.

Nutrition. Foods read from Google Health are shown as Google Health's own record on the connection screen; they are not added to your ZEALO meal or calorie totals. Water read from Google Health is counted once in your ZEALO hydration total — a drink the Fitbit app also wrote to Apple Health is not counted twice.

Other wearable accounts. WHOOP and Oura can also be connected directly, through each provider's own sign-in, with read-only scopes, the same on-device storage, the same AI-sharing boundary, and the same Disconnect and Delete imported data controls. The connection screen for each lists exactly what it reads.

Optional backup uses Apple iCloud via CloudKit into the user's private CloudKit database— not a ZEALO-operated multi-tenant server account. Backup is optional and configured in the app.

Within backup configuration, as implemented:

• Daily Apple Health / physiology readings (HealthDataEntry) are not included in iCloud backups.
• Optional iCloud backup may still include workouts, profile, templates, and photos (photos are included by default; you can change this in settings where the app exposes that control).
• Cycle data is included only if you enable cycle backup — a separate opt-in.

Apple operates iCloud under Apple's terms and privacy practices. HealthKit access remains optional and separate from whether any selected non-physiology records are backed up to your private CloudKit database.

If you use AI-backed features (coach, plans, weekly insights, and similar), the app may send relevant context to OpenAI and/or other configured providers. That context can include profile, workout, nutrition, and physiology summaries, and — where relevant — a categorical cycle phase (not a raw clinical record dump by default). These transfers are also disclosed in-app when you use the features.

AI output is informational only and may be incomplete or incorrect. Third-party AI providers operate under their own terms and privacy policies. We do not control their retention or training practices beyond what their published terms and our configuration allow.

The iOS app may use Firebase Analytics for funnel / product events and Firebase Crashlytics for crash reporting. As implemented in the audited build: these paths are not configured to attach health parameters or a user ID to those events.

Firebase is operated by Google under Google's terms. Crash and analytics data help us understand stability and feature usage; they are not used here as an advertising identity graph.

The marketing site loads Plausible Analytics, a cookieless privacy-oriented web analytics script hosted at plausible.io (script path beginning with pa-LFT3vQZw…). Plausible is used to count page views and basic traffic aggregates.

Because this analytics setup does not use cookies for tracking, there is no cookie consent banner on the site for analytics. The site Content Security Policy allowlists plausible.io for script and connect.

If you contact us through published email addresses, we receive whatever you choose to send (and standard email metadata). Contact addresses remain support@reptrackpro.org and hello@reptrackpro.org (still on the reptrackpro.org mail domain).

Premium access is sold through Apple In-App Purchase (StoreKit), including product identifiers in the com.reptrackpro.premium.* family. Apple bills your Apple ID. ZEALO does not directly process payment card numbers. Restore purchases through Apple's restore flow.

Code fallback display prices are $24.99/mo and $249.99/yr, with a 14-day free trial where offered. The prices and trial terms shown in the App Store and in the in-app paywall govern and may vary by storefront, taxes, and localization.

As of the audited implementation, the app does not use App Tracking Transparency (ATT) for advertising tracking. We did not find ad-network tracking for cross-app advertising purposes in that audit. The product is intended to support fitness functionality, not advertising-based profiling.

• On-device data: remains until you delete it in-app, clear it, or uninstall the app (local clear / uninstall).
• iCloud backup: remains in your Apple iCloud / private CloudKit context until you delete backup data from the app Settings controls or manage it through Apple's iCloud tools.
• Imported wearable data (Google Health, WHOOP, Oura): stays on your device until you use Delete imported data in the app, clear the app's data, or uninstall; disconnecting alone keeps it.
• Subscriptions: cancel through your Apple ID subscription settings; billing and refunds follow Apple's policies.
• AI providers: retention of prompts/responses is subject to each provider's policies.
• There is no documented full server-side account export portal for a ZEALO cloud account, because the product is local-first with optional Apple iCloud backup rather than a traditional ZEALO-hosted account vault.

• Manage HealthKit, notifications, photos, camera, and other permissions in iOS Settings
• Manage optional iCloud backup — including the cycle backup opt-in — in app Settings
• Disconnect Google Health, WHOOP or Oura, or delete the data imported from them, in app Settings › Health & Wearables; revoke ZEALO's Google access under your Google Account's third-party apps and services
• Decline or stop using AI features that send context to providers
• Export or share files you generate; uninstall to remove local app storage
• Cancel or manage subscriptions in Apple subscription settings; restore via Apple

ZEALO is a fitness product. We do not invent a specific minimum age or jurisdiction statement here beyond what Apple's App Store age rating and applicable law already require for download and use. If you are not permitted to use the App Store or to agree to these practices, do not use the app.

We may update this Privacy Policy as the app or site changes. When we make material changes, we revise the effective / last-updated date and publish the updated version on this page.

For privacy questions or support issues, contact support@reptrackpro.org or hello@reptrackpro.org.

Related: Terms & Conditions · About · Contact