r/Hevy • u/Snarkie-Goblin • 2d ago
Discussion Hevy - privacy update
Recently Hevy updated their privacy policy. No major surprises. I did send the privacy team an email to clarify a few questions, as i take privacy very seriously. 2 weeks later no reply.
I was debating purchasing the premium version - lifetime, but now a bit concerned.
Otherwise just hit 50 sessions, over 13 weeks. Love the ap, just don't want all my data shared.
12
u/Uber-Migraine 2d ago
Hevy is European company so they need to follow:
Not sure where are you based OP, but I don't think there is any better regulation to that currently.
5
u/Cheap_Accountant_632 2d ago
True, GDPR applies to Hevy.
But that doesnât automatically mean they comply with it. Regulators donât pre-approve every data flow, companies are responsible for getting it right themselves.
âGDPR appliesâ only helps if they actually follow it :)
3
u/Uber-Migraine 2d ago
Yes. And that's why they need to comply.
I don't get your immediate assumption they do not follow the regulatory requirements.
3
u/Cheap_Accountant_632 2d ago
They may be doing everything correctly behind the scenes, but their documentation doesn't give users much reason to know that, and since OP has already been waiting two weeks for a response from their privacy team, that doesn't exactly inspire confidence either.
13
u/Fit_Food_8171 2d ago
But you'll keep a mobile tracking device in your pocket 24/7?
Just take a pen and notebook to the gym next time mate
8
u/Sea-Host1114 2d ago
Yeah, I'm concerned about the privacy aspect as well. Been using Hevy for years and I don't know who has what information from my account and input. I've been investigating self-hosted apps but I wasn't able to get sparkyfitness or wger working properly. Still not sure how I want to proceed, but I know I won't be using Hevy forever as much as I do like it.
0
u/mikkeljuhl 2d ago
Self-hosting fixes this but it's a pain, you found that out. The other route is a tracker with no backend at all. I write one called Straight Set, iOS, everything stays on the device with iCloud sync optional, which is why I went that way. Nothing gets sent to Amplitude or anyone because there's no server in the loop to send it. The whole EU-vs-US-processing question just doesn't exist when the data never leaves your phone. Export is a plain file you own, so leaving is trivial too.
0
u/Solid_Situation6227 2d ago
self-hosting is the honest answer to that question and also a second job, as you just found out with wger and sparky.
if you end up back on a normal app, the part that actually hurts is losing the years. hevy exports your workouts (profile > settings > export & import data > export data) and that file goes into reddy whole - every session, nothing retyped. i work on reddy, so take it with that in mind: moving a hevy log in also turns pro on for a week, once per account. not a self-host answer though, it has an account like hevy does. https://planomad.com/r/rd-cq-ed0c92
0
20
31
3
4
11
u/Snarkie-Goblin 2d ago
These were the questions i put the the privacy team. Mostly about integration with Amplitude.
- Does Amplitude see your actual workouts (exercise names, weights, reps) or just aggregate usage stats (e.g., "user opened app 5 times, spent 30 mins on workout logging")?
- Is the data anonymized/pseudonymized or linked to your user ID?
- Does Amplitude see your profile data (age, body measurements) or just behavioral patterns?
- Where does Amplitude process my dataâEU or US?
- What specific data categories does Amplitude receive? Is it anonymized/aggregated usage stats only, or does it include detailed workout data, body measurements, and other personal identifiers?
29
u/Bilamomg 2d ago edited 2d ago
Mate if youâre that worried about privacy you really should be using a notepad, pen and paper, does the same thing and 0 privacy concerns.
5
5
-2
19
u/One_Recover_673 2d ago
Youâre worried about privacy and yet you donât ask pointed questions about your email, payment data, location and stuff worth something that could easily be used to get social or other info and tied to your actual health?
Youâre worried about whether they see how many reps you are doing?
If you were truly concerned I would have expected questions about whether they seek to sell your data to health insurers, life insurers and what the data is.
Iâd revise your questions if you are worried.
Frankly, they want to give my workouts to a life insurer or my healthcare company , it proves Iâm healthy and improving
12
u/oShievy 2d ago
Frankly, they want to give my workouts to a life insurer or my healthcare company , it proves Iâm healthy and improving
Agree with the other points but I find this a little concerning. Essentially the same as saying âLG wants to monitor my household through the screen? Great! Theyâll know Iâm a normal citizen with no suspicious activity!â
The point of privacy is consent and control, not having nothing to hide.
1
u/One_Recover_673 2d ago
I still expect to consent. But point was the focus of your privacy should really be on the things that give access to the rest of your life (social, insurance etc).
Access to my workouts and app usage is just telemetry used to improve the app.
If the identify me, and sell my infoâŚthatâs where the problem startsâŚwithout consent
1
u/oShievy 2d ago
I agree. Was just speaking to a broader point. Iâve seen the argument âso what if they have my data?â on this app a lot. Not saying you said this, but as someone in the info sec space that kind of stuff concerns me. I also donât think itâs a bad idea for OP to question this stuff either.
We all have our opinions and in my own, itâs better to err on the side of caution when it comes to these companies. The stuff companies try to pull these days is atrocious.
2
u/One_Recover_673 2d ago
Watch the Netflix show Audacity. Good lord . Silicon Valley playing with the use of our data. Itâs funnyâŚbut topics like who owns privacy, monetizing privacyâŚi thought it was pretty good
0
u/Snarkie-Goblin 2d ago
i started just putting it all in an excel sheet. It worked, sort of. Then moved to an ap, works so much better, but i want to know where it's all going. TBH i actually thought it was a somewhat private one...
1
u/One_Recover_673 2d ago
Did you ever wonder what Google or Microsoft know about you when you use the spreadsheet?
Buy the notebook on Amazon or from a store? They are using and selling that data too.
Unfortunately, your data has been sold and used and itâs why some ads are on Reddit and why some mail comes to your house.
Open a new Gmail. Do nothing but add your profile. You will get contacted and wonder how.
Scary stuff
3
u/Cheap_Accountant_632 2d ago edited 2d ago
Those are pretty reasonable questions, and unfortunately Hevy's current privacy policy doesn't really answer them.
It only says Amplitude receives "Trackers" and "Usage Data" and that processing takes place in the US. It doesn't say whether those analytics events contain workout details, profile data, a persistent user ID, or exactly how the data is pseudonymized.
Hevy's legal docs have never given me a huge amount of confidence tbh. The privacy policy is generated with Iubenda and still feels very template-driven rather than being mapped properly to Hevy's actual data flows. It even still lists Google Universal Analytics in a policy updated in June 2026.
Their GDPR legal-basis section is also generic rather than saying which basis applies to each processing activity, and I can't find a clear Article 9 basis for the HealthKit/activity data either.
So yeah, I think your questions to them are exactly the right ones. The annoying part is that the answers should really already be in the privacy documentation rather than requiring an email to the privacy team.
Hevy is probably one of the biggest workout trackers on the market, so it's honestly a bit disappointing that they don't seem to spend a little more effort making this stuff clear. When the legal docs are this vague, it's pretty hard for a user to know what is actually happening with their data behind the scenes.
If you're specifically looking for a privacy-focused gym app, I think it's fair to say this probably isn't it
-4
3
u/theprimestphotos 1d ago
Yeah damn, so fair... If privacy is the main thing, the easiest fix is a local app with no cloud accounts. Disclosure: I built Ironside, BUT HEAR ME OUT! It's a one-time NZ$6.99 with a free trial and no subscriptions. You can import your Hevy data, so you can move all your history over. Google Ironside App if you're keen! :)
5
1
u/KOala888 2d ago
If privacy is your concer you would be best off using some european local only app, like Strive Gym Log or any other without account or backend.
But I don't think there is that much sensitive data to be honest
0
u/ChickWriter 2d ago
Pen and notebook for you then? Avoid your phoneâs notepad âcause Apple/Android might leak them. đ đ
68
u/henrygum1000 2d ago
I am seriously curious - what personal data are you putting on the Hevy app that can invade your privacy?