A private fitness tracker that cannot read your training

Most fitness apps mean something narrower by private

Usually it means a visibility setting. Your runs are hidden from other users, your profile is not in search, and the company running the service still holds every route, every meal and every weigh-in in a form it can read, query and sell access to. The setting controls other members. It does not control the operator.

Hejje is built the other way round. The question is not who among the users can see your training. It is what anybody can see, including us, and the answer is fixed in the architecture rather than in a preference you have to find.

Sealed on the phone, before it goes anywhere

Every activity, route, meal, weight and photo is encrypted on your device with a key that only you hold. What reaches our server is ciphertext, and we have nothing to open it with. There is no internal tool, no support override and no admin view, because there is no key.

That also settles the question people ask second, which is what happens in a breach. An attacker who took the whole database would take a pile of sealed records and the small amount of account plumbing described below.

The short list that is deliberately readable

Some things cannot be sealed or the product stops working. These are readable on our side, and they are the whole list:

• Your display name and public key, so an account exists and other people can be followed.
• Your profile and banner images.
• Your follow relationships.
• Device details used to keep the account secure.

The privacy policy lists all of it, and the blog post what our server can actually see walks the database table by table.

No email, no password, no phone number

Setting up asks for a first name and nothing else. There is no address to confirm, no password to reuse, no phone number to link to the rest of your life, and no sign-in button belonging to another company. Your account is a key pair generated on the phone and a name you picked, which is why registering finishes with no signal at all.

An account is not optional, and it is the first screen. What is optional is any way of identifying you. There is no credential of yours sitting in our database waiting to leak, because we were never given one.

The trade is real and worth stating plainly: your recovery key is the only way back into your vault on a new phone. We never receive it, so we cannot reset it, and if it is gone the data is gone.

Nothing in the app is watching you use it

No advertising network. No analytics SDK, no attribution SDK, no crash reporting SDK, in either the iPhone app or the Android one. The privacy policy names every component that talks to anyone at all, including the one piece of Google's on-device AI component on Android that reports about itself, which is disclosed rather than quietly rounded down to zero.

Location follows the same rule. Hejje sees where you are while you are recording an activity, and not otherwise. The Android app ships without the background location permission entirely, so there is no always-on tier to turn off.

Kaya, the assistant that answers questions about your own training, runs on the device. Nothing about your training and none of your questions go to us or to a cloud AI service. It works with the radio off, which is the simplest possible proof of where it runs.

Sharing is something you do, not something that happens

Registering publishes nothing. Following someone is a step you take inside the app, and you choose which individual sessions to share with the people who follow you. There is no public profile by default, no global feed your runs appear in, and no heatmap built out of everybody's routes.