Privacy Policy

Last updated: October 3, 2026

Tuwa ("the app") is developed by Hanwen Ma. This policy explains what data the app collects, how it is used, and your rights.

What Data We Collect

Data you provide

  • Account information: Email address and display name (used for authentication)
  • Workout logs: Exercises, sets, reps, weights, RPE, session duration, and notes you enter
  • Wellness check-ins: Self-reported sleep quality, soreness, energy, and stress ratings
  • Workout descriptions: The sentence you type when you log a session in words (see Workout Text Parsing below)

Data from HealthKit (read-only)

  • Heart rate variability (HRV)
  • Resting heart rate
  • Heart rate during imported workouts
  • Sleep (duration and stages)
  • Body temperature and sleeping wrist temperature
  • Respiratory rate (overnight)
  • VO2 Max
  • Active energy
  • Body weight
  • Workouts and the effort rating you gave them
  • Only if you turn on cycle-aware readings: menstrual cycle data (flow, cycle factors such as contraception, pregnancy or lactation, cycle irregularities) and cycle symptoms

Tuwa never writes data to HealthKit. HealthKit access is optional and requires your explicit permission.

Cycle-aware readings (optional). If you turn on cycle-aware readings in Profile, Tuwa asks Apple Health for your cycle data and your sleeping wrist temperature. Tuwa uses them only on your phone, to read your HRV and resting heart rate against your own baseline for the same part of your cycle. Cycle data never leaves your phone: it is not synced, not sent to any AI service and not shared with anyone. Turning the feature off stops the reading; you can also remove access in iOS Settings › Health.

Data we compute

Recovery scores, ACWR (Acute:Chronic Workload Ratio), training stress, and personal records are calculated on your device from the data above.

How Data Is Stored

  • On your device: All data is stored locally using SwiftData. The app works fully offline.
  • In the cloud: Composite scores (recovery score, workload snapshots, wellness ratings, workout session headers, and personal records) sync to Supabase (hosted on AWS) for multi-device access.
  • Raw HealthKit data is never uploaded. Only computed scores derived from HealthKit data are synced.

Workout Text Parsing

When you log a session by typing a description of it, that text is sent to our parsing service so it can be turned into a draft of sets, reps, and weights for you to review.

The text goes through OpenRouter, an AI gateway that routes it to a language model — by default an OpenAI model. Requests go through our backend, require a signed-in account, and are limited by a daily quota per user. We ask OpenRouter to route requests only to providers that do not store prompts for training.

  • What is sent: Only the workout description you typed, and the units you train in.
  • What is never sent: No HealthKit data of any kind, no recovery or readiness scores, and no email address — only the text you typed.
  • It is optional: Tuwa asks for your permission the first time you use either this feature or Program Import below, before it sends anything. You can withdraw permission at any time in Profile › Legal › AI processing — without it, nothing is sent, and you can still log by hand.

The parsed result is returned to your device as a draft. Nothing is saved to your log until you confirm it.

This is separate from the HealthKit rule above, which is unchanged: raw HealthKit data is never uploaded, to this service or to any other.

Program Import

You can bring a training program into Tuwa by pasting text, or by importing a PDF or photo of it — the text is extracted on your device.

  • What is sent: The program text you paste, or the text extracted from your PDF or photo on your device — text only. No audio, no HealthKit data, and no scores are sent.
  • Who processes it: The text is sent through OpenRouter, an AI gateway, which passes it to a language model — by default an OpenAI model — to turn it into a structured program.
  • What you get back: A draft program is returned to your device for you to review. Nothing is saved until you confirm it.

AI Reasoning (Optional, Pro)

If you have Tuwa Pro and you turn on AI reasoning, Tuwa asks an AI model which change fits today's session. Tuwa's server sends the request directly to OpenAI, which processes it on our behalf.

  • What is sent: Your training plan, the sets you logged, and your readings expressed as words — for example "readiness high", "strain elevated", "match in 2 days".
  • What is never sent: Any number from Apple Health (no heart rate, HRV, sleep time, temperature or menstrual cycle data), your name, your email address or your account ID. OpenAI receives only a one-way hashed identifier so that it can detect abuse.
  • Why: To suggest which change fits today, inside limits that Tuwa's own engine sets. Tuwa checks every answer against those limits, and you decide on every change. If the service does not answer, Tuwa shows its own suggestion.
  • Retention: OpenAI may keep requests for up to 30 days to monitor for abuse, then deletes them. OpenAI does not use them to train its models. We do not use this data for advertising.
  • Your choice: AI reasoning is off until you allow it. This permission is separate from the AI processing permission for typed workouts and program import. You can withdraw at any time in Profile › Legal › AI reasoning. When you withdraw, Tuwa stops sending and deletes its AI-reasoning records on your phone.

Data Sharing

Tuwa does not share your training or recovery data with coaches, other users, advertisers, or data brokers. If future sharing features are added, they will require your explicit consent.

Third-Party Services

We do not use any advertising networks, analytics trackers, or third-party data brokers.

Data Retention and Deletion

Your data is retained as long as your account exists. To delete your account and all its data:

  1. Go to Profile → Delete account in the app

This deletes your account and its data — including workout logs and scores — from our database. For any other privacy request, contact us at the email below.

Your Rights

You have the right to:

  • Access the data we store about you
  • Request correction of inaccurate data
  • Request deletion of your account and all associated data
  • Withdraw HealthKit permissions at any time via iOS Settings → Privacy & Security → Health

Children

Tuwa is not directed at children under 13. We do not knowingly collect data from children.

Changes to This Policy

We may update this policy from time to time. Changes will be posted to this page with an updated date.

Contact

For privacy questions or data deletion requests:

Email: [email protected]