Hejje

Privacy Policy

Last updated: 31 August 2026

1. Who we are

Hejje ("we", "us") is a privacy-first fitness tracking app for Android and iOS. It records runs, rides, walks and hikes, and it also keeps your strength sessions, what you eat and drink, your weight and your steps. It is built and operated by an independent individual developer. This policy explains what data the app handles, what (if anything) leaves your device, and the choices you have. It covers both apps; where the two platforms differ, the difference is called out.

For any privacy question or request, contact support@hejje.app.

2. The account, and how sync works

Hejje requires an account. Registering is the first screen and the app cannot be used without completing it. We want to be plain about that, because "privacy-first" is often taken to mean an app you can use anonymously and entirely offline, and that is not what Hejje is.

What the account asks for is a first name. There is no email address, no password, no phone number, no verification code, and no option to sign in with an account belonging to another company. Technically it is a cryptographic key pair generated on your device plus the name you chose, which is why registration completes with no internet connection: there is no credential for a server to check.

The app itself runs entirely from a database on your phone. Recording activities, browsing your history and using the analytics all work with no connection at all.

Whenever your phone does have a connection, your vault syncs to our servers automatically. There is no sync setting: syncing is part of how the app works, not a feature you switch on, and it starts as soon as you have an account. Everything sent this way is end-to-end encrypted on your device first (see section 4), so we still cannot read it, but it is important that you understand a sealed copy of your data does reach us. Sync is what lets your history survive a lost phone and appear on your other devices.

The social features (following other people) are a further optional step you take from within the app; they are not switched on just by registering.

3. What data Hejje handles

Depending on which features you use, the app processes:

• Activity data: the runs, rides, walks and hikes you record, including GPS route, distance, duration, pace/speed, elevation, heart rate where your device supplies it, and step count.
• Location data: GPS coordinates collected only while you are actively recording an activity. Recording keeps running with the screen off or the app in the background, but it does so through a foreground service you can see, not through a background location permission; see section 8.
• Strength training: the exercises, sets, reps and weights you log, and the personal records worked out from them.
• Food and drink: the meals and items you log, their calories and macros, and the water you record against a daily goal.
• Body measurements: the weights you enter, and any height or date of birth you choose to give, which are used to work out calorie estimates.
• Steps: a daily step count read from your phone's own step sensor.
• Media: photos and videos you choose to attach to an activity.
• Profile: the first name you register with, and optional profile/banner images if you choose to set them.
• Goals & settings: training, calorie, protein, water and step goals, and app preferences you set.
• Account & device information: a cryptographic key pair generated on your device when you register, a device name, and technical details used to keep your account secure (see section 6).

4. End-to-end encryption

What you log is encrypted on your device before it is uploaded, using keys that are generated on and stay on your device. This includes your activity summaries, your GPS routes, your strength sessions, your food and water entries, your weights, your goals, and any photos or videos attached to an activity. We store only the encrypted result and cannot decrypt or read it.

You are given a one-time recovery key when you create your account. It is the only way to restore your encrypted data onto a new device. Because we never receive your keys, if you lose your recovery key we cannot recover your encrypted data for you. Please store it somewhere safe.

5. What our servers can see

To make accounts, sync and following work, a small amount of information is not end-to-end encrypted and is readable by our server. We keep this to the minimum needed:

• Your public profile: your display name, follower/following counts, and your public key. These let other people find and follow you.
• Profile and banner images: if you set them, these images are stored unencrypted so they can be shown to people who view your profile. Do not use an image as a profile picture if you would not want it visible to other Hejje users.
• Device and security information: a device name, the user agent, and a last-seen time. These are used to authenticate your devices and to protect your account from abuse.
• Not your IP address: our server no longer keeps one. It sees an address in the moment a request arrives, the way every web server does, and uses it only to rate limit account recovery so the lookup cannot be guessed at automatically. It is not written down and not stored against your account.
• Social graph: follow requests and follow relationships between accounts, so requests can be delivered and accepted.
• Sync metadata: encryption hides the contents of a record, not the fact that it exists. Each encrypted row we store carries, unencrypted, which part of the app it came from (an activity, a weight, a meal), when it was written, and how large the encrypted payload is. Our server needs these to merge edits from your different devices in the right order and to know where a sync left off. They mean that, without being able to read any of your training, our server could infer that you recorded an activity on a given evening, or that you weigh yourself on Mondays. We do not analyse this, and nothing in the product reports on it, but we would rather state it than let "end-to-end encrypted" imply more than it does.

Your encrypted keys are also held on the server in a form that is itself encrypted with your recovery key, purely so you can restore your account. We cannot unlock it.

6. Media storage

Photos and videos you attach to activities, and your profile/banner images, are stored using Cloudflare R2 object storage on our behalf. Activity media is uploaded encrypted and cannot be read by Cloudflare or by us. Profile and banner images, as noted above, are stored unencrypted so they can be displayed.

7. On-device AI

Hejje's assistant answers entirely on your device. Your activities and any questions you ask are processed locally and are not sent to us, to Cloudflare, or to any cloud AI provider.

Most questions are answered by a small rules-based router built into the app, which reads your own database and does the arithmetic itself. Where your phone provides a system language model of its own (Gemini Nano through Android's AICore, or Apple's Foundation Models on iOS), the assistant can hand the phrasing of a question to it. Those models belong to the operating system, run on the device, and are shared with every other app on the phone; Hejje downloads no model and bundles none.

One disclosure about the Android path. The Google ML Kit component that gives the app access to Gemini Nano reports its own usage telemetry to Google, and offers no documented way to switch that off. Your prompts, your answers and your training data are not part of it and stay on the device, but the component's presence and use are visible to Google. The rules-based router has no such dependency and is what answers when no system model is available.

8. App permissions

The app requests only the permissions its features need:

• Location (while in use): to record your route during an activity. The Android app does not request the background location permission at all; it is explicitly removed from the app's manifest. Recording continues with the screen off because it runs as a foreground service with a visible, ongoing notification, which is a different thing from being allowed to read your location while you are not recording. On iOS the equivalent is the background location mode, used only for the duration of a recording you started.
• Physical activity / step counter (Android) or Motion & Fitness (iOS): to read your step count from the phone's own sensor.
• Notifications & foreground service: to show the ongoing tracking notification and to keep recording, syncing, or importing running reliably.
• Photos / media access: only when you pick a photo or video to attach.
• Health Connect (Android): described in section 9. Requested only if you turn the feature on, and only the parts of it you turn on.

You can review and revoke these at any time in your device's system settings.

9. Health Connect (Android)

Health Connect is Android's own health and fitness store. It lives on your phone, and it is how apps on Android share fitness data with each other without any of it passing through a company's servers. Hejje can read from it and write to it. This is off until you turn it on, in Settings, and nothing described in this section happens before then.

It is offered as two separate switches rather than one, so that you can allow one direction without the other. Each switch asks Health Connect only for the permissions that switch needs:

• Share what you record: Hejje writes your activities, workouts, weight, water, food and steps into Health Connect, so other apps you have chosen can read them. This publishes what you already recorded in Hejje. It reads nothing.
• Workouts from other apps: Hejje reads exercise sessions and their routes, along with the distance, calories and steps recorded over the same period, so that a run recorded on a watch appears in Hejje. Route data is a GPS track and is the most sensitive thing Hejje asks for anywhere. It is shown to you on your own activity screen, stored in your encrypted vault like any activity you recorded yourself, and sent nowhere else.

Health Connect data never leaves your device unencrypted. Anything Hejje reads from Health Connect is stored in the same end-to-end encrypted vault as everything else, described in section 4, and our servers cannot read it. We do not send Health Connect data to any third party, we do not use it for advertising or analytics, and we do not use it to train any model. An activity imported from Health Connect is private to you unless you choose to share it, and is never shared with your followers automatically.

You stay in control of it in three separate places. Hejje's own Settings screen has a switch per direction and a pause control that stops syncing straight away without revoking anything. Health Connect's own screen, which Hejje links to, lets you grant or revoke each individual data type; that screen is the authority, and Hejje only ever reads or writes what it finds granted there at the time. Deleting Hejje removes its access entirely.

Data that Hejje wrote into Health Connect stays in Health Connect until you remove it there, because it belongs to that store rather than to us. Turning the feature off stops Hejje writing anything further, and Health Connect's own controls let you delete what is already there.

10. Who processes data for us

We use a small number of infrastructure providers, acting on our instructions:

• Hetzner: hosts the server that stores your encrypted vault and public profile.
• Cloudflare (R2): stores media as described in section 6.
• Google (Android app only): two platform components, neither of which receives your training data. Firebase Cloud Messaging delivers the push wake-up that tells your phone a shared session is waiting; the message itself carries no content, because the server cannot read the sealed row it is announcing, and the notification text is composed on your device after decrypting. ML Kit provides access to the system language model described in section 7, and reports its own usage telemetry to Google.
• Google Analytics (this website only): counts visits to hejje.app, and only if you agreed to it when asked. It runs on the website, never in the apps. Section 11 sets out what it receives and how to change your answer.

We do not use advertising networks, and neither app contains an analytics, attribution or crash-reporting SDK. Nothing in either app reports your behaviour back to us. We do not sell or rent your data to anyone. The two Google components above are named for completeness: they are part of the platform the Android app is built on, they carry no activity data, and the app has no telemetry of its own. The analytics in the last bullet belongs to this website rather than to either app, it is opt-in, and section 11 explains it in full.

11. This website

Everything above is about the apps. This page is a website, and websites are measured differently, so here is what hejje.app itself does.

The site can use Google Analytics to count visits and see which pages people read. It is off until you say yes. On your first visit a banner asks, and nothing is loaded, requested or set before you answer: choose "No thanks" and your browser never contacts Google at all. Your answer is remembered in your browser's own storage rather than in a cookie, and if you decline it is the only thing kept.

If you do allow it, Google Analytics sets cookies in your browser and receives the page you are looking at, an approximate location worked out from your IP address, and basic details about your browser and device. It does not know who you are, it is not connected to any Hejje account, and it never sees anything from inside the app. The apps themselves still contain no analytics SDK of any kind. This is the website, and nothing more.

Public profile pages on this domain are left out on purpose. A profile URL contains someone's handle, so no analytics runs on those pages under any circumstances, whichever answer you gave.

You can change your mind at any time by clearing this site's stored data in your browser.

12. Data retention & deletion

Data recorded on your device stays there until you delete it or uninstall the app. If you use sync, your encrypted data and public profile remain on our servers until you delete them. You can delete individual activities at any time.

You can delete your entire account from inside the app, under Settings > Delete account. The app asks you to type a confirmation phrase, then ends your follows in both directions, deletes the photos you uploaded, blanks your public profile, erases your account and its server-side data, and wipes the data held on the device you ran it from. This takes effect immediately and cannot be undone: your recovery key stops working, and nobody, including us, can bring the account back. You can create a new account afterwards, but it will not be this one.

If you cannot reach that option, for example because you no longer have a device with the app installed, email support@hejje.app and we will delete the account for you.

13. Your rights

Depending on where you live (for example under the GDPR or CCPA), you may have the right to access, correct, export or delete your personal data, and to object to certain processing. Because your activity data is end-to-end encrypted, much of it is already accessible only to you. For anything on our servers, contact support@hejje.app and we will respond within a reasonable time.

14. Children

Hejje is not directed at children and is not intended for use by anyone under the age of 13 (or the minimum age required in your country). We do not knowingly collect personal data from children.

15. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be highlighted where practical.

16. Contact

Questions, requests, or concerns about your privacy? Email support@hejje.app.