Privacy Policy

1. Who is responsible for your data

The controller of your data is Hala Mahly, who runs Prime You, called here "Prime You" or "we". This policy covers the site and the phone app.

2. What we collect

We collect only what the service needs:

• Account details: your name, your email, and your password (stored encrypted).
• The training data you choose to share: your goals, your notes, your measurements, and your progress photos.
• Membership details: the state of your membership, the payment dates, and the transaction reference from PayPal. Your card numbers never reach us.
• Messages: your conversation with Hala in the app, and the emails about your account.
• Basic technical data: your device type, the notification token if you turn notifications on, and basic server logs for security.

3. Why we use it

We use your data to:

• build your plan and follow it with Hala.
• run your account and send the emails it needs (email confirmation, password reset, plan notifications).
• collect the membership payment and issue the invoices.
• protect the service from use nobody authorised.
• meet what the law requires of us.

4. Who sees your data

Hala alone sees your training data. We do not sell your data, and we do not share it for marketing.

To run the service we use providers who process data on our behalf, under processing agreements:

• Vercel: hosting for the site.
• Supabase: the database and file storage, on servers in Frankfurt, Germany.
• Firebase: phone notifications.
• Resend: delivering the emails about your account (email confirmation, password reset).
• PayPal: collecting the membership payment.

5. Your progress photos

Your progress photos are kept in private storage, and nobody but you and Hala can open them.

A photo or a result is shared without your name only with your explicit agreement, and you can withdraw that agreement any time in Settings.

6. Security

Your data travels encrypted, and access to it is limited to your account and Hala's. Access to the database is governed by row-level policies, and passwords are never stored in a readable form.

7. Cookies and tracking

The site uses no third-party tracking or analytics tools, and its fonts are served from our own domain, so opening a page sends nothing to a font provider. We keep only what is needed to sign you in and to remember your choice in the cookie bar.

You can change that choice at any time from «Cookie settings» at the foot of every page.

8. How long we keep it

We keep your data while your account exists. After you ask us to delete the account, we keep it for 30 days and then delete it for good, apart from the billing records the law requires us to keep for a set period.

9. Your rights

At any time you can ask to:

• see your data and get a copy of it.
• correct anything that is not accurate.
• delete your account and your data.
• withdraw your agreement to sharing photos.
• turn notifications off in the app settings.

10. Children

The service is not meant for anyone under 16, and we do not knowingly collect their data. If we learn that an account belongs to someone younger, we delete it.

11. Where the data is stored

The database and the files are stored in Frankfurt, Germany. Some providers (Vercel, Firebase and PayPal among them) may process limited data outside the European Union, under appropriate contractual safeguards.

12. Changes to this policy

If we update this policy, we publish the new version here with the date of the update, and tell you by email when a change is a significant one.

13. Contact

For any question or request about your data, write to me at halamahly194@gmail.com.