Privacy Policy
This policy explains what information the Aroha app ("Aroha", "the app") collects, why, and what you can do about it. Aroha is made by SOHREX Labs ("we", "us"), based in India.
The short version: we collect only what you type into Aroha so the app can track your fitness. We don't show ads, we don't sell or share your data for marketing, and you can export or delete everything from inside the app at any time.
1. What we collect
Account
- Your name and email address.
- Your password, stored only as a one-way hash (bcrypt). We can never see it.
- If you sign in with Google: your Google account ID, name and email, which Google confirms to us. We never see your Google password.
- One-time email codes for verifying your email and resetting your password, stored hashed. They stop working after 10 minutes and are deleted once used or replaced.
Profile you enter
- Gender, age, height, current and target weight.
- Tape measurements you choose to add (waist, neck, hips and so on).
- Activity level, fitness goal, experience level and dietary preference.
- The calorie, macro and water goals Aroha calculates from these.
Things you log
- Meals and foods, including custom foods you add from a pack label.
- Workouts: exercises, sets, reps and weights.
- Water, sleep, weight check-ins, habits, tasks and missions.
- Your Evolution Points, stage and streak.
AI features (coming later)
AI features are not in the current version. When they launch, your message and the relevant parts of your profile and logs will be sent to our own AI service to produce a reply. We will update this policy before that happens.
On your phone only
Your sign-in tokens and cached profile are kept in the phone's encrypted secure storage and are not included in device backups. Reminder settings and small preferences stay on the device. Reminders are scheduled on your phone; we don't use push servers to send them.
What we don't collect
- No location.
- No contacts.
- No phone number, address or payment details.
- No advertising ID or device identifiers.
- No third-party analytics, crash-reporting or advertising tools.
2. Why we use it
- To run the app: show your logs, calculate your targets, award Evolution Points and keep your streak.
- To answer AI requests you make.
- To keep the service secure: sign-in, rate limiting and preventing abuse.
- To reply when you contact support.
We process your data with your consent, which you give when you create an account, and only for these purposes. Health and fitness details you enter are sensitive to you, so we treat them that way.
3. Who handles it
We don't sell your data or share it for advertising. It is stored and processed by service providers who run Aroha's infrastructure for us, under their own security and privacy terms:
- Neon: database hosting. Holds your account, profile and logs.
- Cloudflare: network and website. Traffic between the app and our server passes through Cloudflare, encrypted.
- Google Workspace: sends our emails. It receives your email address and the one-time code.
- Google Sign-In, only if you choose it: Google tells us your account ID, name and email. We send nothing about you to Google.
Our server keeps your IP address for up to a minute to limit repeated sign-in attempts, and doesn't store it after that. This website uses no cookies, trackers or third-party fonts.
Data may be stored on servers outside India, such as in Singapore. We may disclose information if the law requires it.
4. How long we keep it
We keep your data while your account exists. When you delete your account, your profile and everything you logged are deleted from our live database straight away. Server backups age out within 30 days.
5. Your choices and rights
- See and export: Profile → Settings → Your data → Export my data.
- Correct: edit your profile or logs at any time.
- Delete: Profile → Settings → Your data → Delete account, or see how to delete your account.
- Withdraw consent: deleting your account withdraws it.
- Complain or ask: email [email protected]. We aim to reply within 7 days.
6. Security
Connections to our servers are encrypted (HTTPS). Passwords are hashed, access to the database is restricted, and sign-in attempts are rate-limited. No system is perfectly secure, but we work to protect your data and will tell you if a breach affects you.
7. Age
Aroha is for people aged 13 and over. If you are under 18, use Aroha only with the consent of a parent or guardian. If you believe a child has given us data without consent, contact us and we will delete it.
8. Health notice
Aroha gives general fitness and nutrition guidance, not medical advice. See our Terms.
9. Changes
If we change this policy, we'll update the date above and, for important changes, tell you in the app.
10. Contact
SOHREX Labs, India · [email protected]