Last updated October 14, 2026

Privacy Policy

Sotek LLC runs FurFlex. This policy explains what the app stores, why, who else processes it, and your rights over it. We don't sell your data, show ads, or track you across other sites.

Who is responsible

Sotek LLC, Fargo, North Dakota, United States, is the controller of your personal data in FurFlex. Contact us at hevy@sotek.io.

What we collect

Account: your email address and password. Supabase, our authentication provider, stores the password only as a one-way hash, so nobody can read it, us included.
Training profile: what you enter in Settings. That includes an optional display name, units, time zone, goal, experience, schedule and equipment, any injuries, limitations and notes, and your sex, birth year, height and bodyweight.
Hevy connection: your Hevy API key, encrypted (AES-256-GCM) so it can't be read from your browser or by other users, plus your Hevy user ID and username.
Hevy data: a copy of your workouts and sets, exercises, routines and body measurements (such as weight, body fat and circumferences), imported from Hevy.
Progress photos: photos you upload, with the pose and date. Your browser resizes them and re-encodes them before upload, which removes location and camera metadata.
Coach conversations: your messages, the coach's replies, the programs it proposes, and which of those you saved to Hevy.
Messages to us: what you send from the Contact page, with the topic you pick, your email address and the time, so we can reply.
Consent records: when you gave or withdrew consent to health-data processing, and which version of the wording you saw.
Usage records: how many coach messages you send each day and how much AI processing they use. This is how we apply usage limits.
Activity records: which pages of the app you open and what you do there, such as signing in, syncing, saving settings or messaging the coach, with the time. They don't include what you write to the coach.
Subscription: your Stripe customer and subscription IDs, plan, billing interval, status and renewal date. You enter card details on Stripe's checkout page, so they never reach our servers.
Cookies: sign-in session cookies and a cookie that remembers light or dark mode. We use no analytics or advertising cookies.
Server logs: our host records requests (such as IP address, time and page) and errors. We use them for security and debugging.

You need an email address to create an account. Everything else is optional, but the app's features depend on your Hevy data and can't work without it.

Health information

Workouts, body measurements, injuries, bodyweight and progress photos are health data, which the law protects more strictly. We process them only with your explicit consent, which you give before any of it is imported or stored. You can withdraw that consent at any time in Settings → Your data and privacy. Withdrawing deletes that data and doesn't affect processing that happened before. We never use health data for advertising, and we never sell it.

Why we use it, and our legal basis

Purpose	Data	Legal basis
Create your account and sign you in	Email, sign-in records	Contract (Article 6(1)(b))
Import your Hevy data and show your dashboard, rankings and exercise history	Hevy data, training profile	Your explicit consent (Articles 6(1)(a) and 9(2)(a))
Run the AI coach, including sending data to Anthropic	Training profile, Hevy data, photos you attach, conversations	Your explicit consent (Articles 6(1)(a) and 9(2)(a))
Store progress photos	Photos, pose and date	Your explicit consent (Articles 6(1)(a) and 9(2)(a))
Apply your plan, usage limits and billing	Subscription records, usage records	Contract (Article 6(1)(b))
Keep tax and accounting records of payments	Billing records	Legal obligation (Article 6(1)(c))
Keep a record of your consent	Consent records	Legal obligation (Article 7(1))
Support you, fix problems and see how the app is used	Activity records, messages you send us	Legitimate interests (Article 6(1)(f)): supporting users and improving the service
Keep the service secure, prevent abuse and fix problems	Server logs, usage records	Legitimate interests (Article 6(1)(f)): a working, secure service

We don't use your data to train AI models. We only send you emails about signing in, your subscription, or important changes to the service, and replies to messages you send us.

Who processes it

These providers process data on our behalf, only to run FurFlex:

Supabase: database, sign-in and private photo storage.
Vercel: hosts the app.
Resend: delivers sign-in emails.
Anthropic: runs the AI coach. When you message the coach, Anthropic receives:
- your message and the conversation so far;
- your training profile and a summary of your training data;
- anything the coach looks up in your history, such as workouts, body measurements and routines; and
- any photos you attach. Photos are stored in Anthropic's file storage until you delete them in FurFlex.
Under Anthropic's commercial terms, it doesn't use data sent through its API to train its models.
Stripe: processes payments. It receives your email, your FurFlex account ID and the payment details you enter. We only receive the subscription status. Stripe also acts as an independent controller for some purposes, such as fraud prevention, under its own privacy policy.

Hevy isn't one of our processors. At your direction, we call Hevy's API with your key to read your data, and we write routines to your account only when you press Save to Hevy. Hevy's privacy policy covers the data in your Hevy account.

We may also disclose data when the law requires it, to protect people's safety or our legal rights, or to a buyer if the business is sold. In a sale, this policy keeps applying to your data.

International transfers

Sotek is based in the United States, and we and our providers store and process data there. For people in the European Economic Area, the UK and Switzerland, data sent to our providers is protected by the European Commission's Standard Contractual Clauses (with the UK addendum) in each provider's data processing agreement, or by the provider's certification under the EU-U.S. Data Privacy Framework. Email us for a copy of the safeguards that apply.

How long we keep it

We keep your data while your account is open, or until you delete it. When you delete photos, we remove them from our storage and from Anthropic. When you disconnect Hevy, we delete your stored key and all synced Hevy data. When you withdraw health-data consent, we delete your Hevy data, photos, coach history and body stats. When you delete your account, we delete it and all its data right away, including photos stored at Anthropic. Copies in our database provider's backups expire within 30 days. After that, we keep only what the law requires: Stripe keeps payment records under its own policy, and we may keep billing records for tax and accounting. Activity records are deleted after 180 days, and server logs are kept for no more than 30 days.

Your rights

You have the right to:

access your data, and take it with you in a portable format: use Settings → Download my data;
correct it: edit your profile in Settings, or email us;
delete it: use Settings → Delete data, or Settings → Delete account to remove everything;
withdraw consent to health-data processing at any time, in Settings → Your data and privacy;
restrict our processing, or object to processing based on legitimate interests, by emailing us; and
complain to a data protection authority: in the EU, the authority in your country; in the UK, the Information Commissioner's Office (ico.org.uk).

Email requests to hevy@sotek.io from the address you sign in with, so we know it's you. We reply within one month. If a request is complex, we may extend that by up to two more months, and we'll tell you why within the first month. California residents have the right to know, delete and correct their personal information. We don't sell personal information or share it for targeted advertising.

Automated decisions

FurFlex makes no decisions about you that have legal or similarly significant effects. Rankings, weak spots and the coach's programs are automated suggestions about your training, and you decide whether to use them.

Security

All traffic is encrypted over HTTPS. Database rules keep each account's data readable only by that account. Within Sotek, only the app's administrator can view an account's data and pages, read-only, to support you, fix problems and run the service. Your Hevy key is encrypted at rest, and nobody can read it, the administrator included. Photos are stored privately and shown through links that expire after an hour. No system is perfectly secure. If a breach is likely to put your rights at high risk, we'll tell you without undue delay, and we'll notify the authorities as the law requires.

Children

FurFlex is for people 18 and older. If we learn that an account belongs to someone younger, we'll delete it.

Changes

When this policy changes, we'll update the date at the top. If a change is significant, we'll tell you by email or in the app before it takes effect. If it changes how we use health data, we'll ask for your consent again. See also the Terms of Service.

Contact

Sotek LLC, Fargo, North Dakota · hevy@sotek.io