Privacy Policy

Overview

Basis ("Basis," "we," "us," or "our") is a fitness and nutrition tracking application. Basis lets you log workouts, follow training plans, track nutrition and macros, record body metrics and sleep, connect fitness services, and review your progress over time.

This Privacy Policy explains what information we collect, how we use it, who processes it, how long we keep it, and the choices and rights you have. It applies to the Basis web app, the Basis mobile app, and the Basis website.

If you do not agree with this Privacy Policy, please do not use Basis.

Information We Collect

We collect information you provide directly, information generated when you use the app, information you authorize us to receive from connected services, and limited technical information needed to operate and secure the app.

Account information

Name, email address, username, profile photo or initials if you add one, the sign-in method you use (email and password, Google, or Apple), your app settings and preferences, and any support messages you send us.

Fitness and workout information

Exercises, sets, reps, weight, duration, distance, rest times, warmup sets, set notes, workout notes, workout history, training plans and planned exercises, workout templates, fitness goals, personal records, exercise preferences, and custom exercises you create.

Nutrition information

Food and meal entries, calories, protein, carbohydrates, fat, other nutrition values, meal categories, water intake, supplement entries, nutrition goals and macro targets, saved foods, recipes, meal templates, and the search terms or barcodes you use to look up foods.

Body metrics

Height, weight, age, sex, body fat percentage, goal weight, activity level, fitness goal, and progress measurements, if you choose to enter them.

Sleep information

Sleep and wake times, time in bed, time asleep, and the optional quality, energy, and note fields in your sleep reflections, if you choose to log sleep.

Cardio and location information

When you start an outdoor cardio session, Basis records GPS points for the duration of that session so it can show your route, distance, pace, speed, elevation, and splits. Recorded GPS traces and route plans are stored in private storage tied to your account and are not public.

Community content

If you use community features, we store the posts, captions, activity summaries, comments, likes, follows, reports, and notifications you create, plus any photos you choose to attach. Community posts, photos you attach to them, and approved food-database contributions are visible to other users. Do not post anything you want to keep private.

Optional device permissions

• Camera: used to scan product barcodes and to take food photos you submit for nutrition analysis. Only active while those features are open.
• Location: used to record outdoor cardio routes. Only active during a cardio session you start.
• Notifications: used to send reminders and rest-timer alerts you enable. You can turn these off in your device settings.
• Local storage on your device: used to cache app data, support offline workout logging, and remember your preferences.

Technical and usage information

Device and browser type, operating system, app version, error and crash diagnostics, sync and offline queue status, request logs, and IP address, which can be used to derive approximate location. This information is used to operate, troubleshoot, and secure the app.

You are responsible for deciding what information you enter into Basis. Please do not enter information about other people without their permission.

Connected Fitness Services

Basis lets you optionally connect third-party fitness services. We access data from a connected service only after you explicitly authorize the connection on that provider's own authorization screen, and only for the data scopes you approve. You can withdraw that authorization at any time.

Strava

If you connect Strava, Basis imports your Strava activities so they appear in your Basis workout history and statistics. Imported Strava activity details are kept on a temporary basis and are automatically deleted after 7 days. After that, a minimal record is retained (the date and the fact that a workout occurred) so your workout counts, streaks, and monthly totals stay accurate. You can disconnect Strava at any time in Settings, and Basis stops importing immediately.

Other device and sleep sources

Basis currently records sleep from entries you log yourself. Where support for a wearable sleep source exists, we use only the data you authorize for that source, and manual entries fill any night the source does not cover.

Garmin Connect IntegrationGarmin

This section explains how Basis collects, uses, processes, shares, retains, and deletes data received from Garmin. When the integration is enabled, Basis connects to Garmin through Garmin's official Connect Developer Program application programming interfaces (APIs). We receive Garmin data only after you complete Garmin's authorization screen and grant your consent. If you have not connected a Garmin account, we hold no Garmin data about you.

Integration status

The Garmin Connect integration is live in Basis. Connecting is optional: you can link a Garmin account from Settings, then Garmin Connect, and Basis imports supported completed activities from that point forward. Nothing is read from Garmin unless you complete Garmin's authorization screen, and if you have not connected an account we hold no Garmin data about you. Every commitment in this section applies from the moment you connect.

Currently available: import of new supported completed activities. Not yet available: historical activity import, Garmin Health syncing, Training exports, and Courses exports. Activities you recorded before connecting stay in Garmin Connect.

Garmin data we collect

• Activity summary data for the supported completed activities you authorize, stored as Garmin sends it: activity type, activity name, date and start time, duration, distance, pace or speed, elevation gain, calories, and, when Garmin includes them in that summary, average and maximum heart rate and cadence. We store the summary Garmin sends and do not estimate or add fields Garmin did not provide.
• Garmin does not currently send Basis a GPS route or track for an imported activity, and Basis does not request one. An imported Garmin activity therefore appears in Basis without a route map.
• Not collected from Garmin today: sleep summaries, resting heart rate, heart-rate variability, body weight and body composition, training status and load, Training exports, and Courses exports. Basis is not reading those data types from your Garmin account at this time.
• Authorization credentials (access and refresh tokens) needed to keep the connection active. Tokens are stored encrypted on our servers and are never returned to the browser. You can revoke them at any time from your Garmin account, or with the Disconnect control in Basis, which deregisters Basis with Garmin and deletes the stored tokens.

Basis does not collect Garmin account credentials, Garmin passwords, Garmin contacts, Garmin payment information, or Garmin data types you have not authorized.

How we use Garmin data

• To display your imported Garmin activities in your Basis history and activity detail views.
• To include those activities in your statistics, streaks, monthly recaps, training summaries, and personal records.
• To calculate progress and training insights from your own data, and to let you export your data.
• That is the complete current use of Garmin data in Basis. Basis does not send planned workouts, training plans, or routes to Garmin, and no Basis feature writes to your Garmin account.

We do not use Garmin data for advertising, advertising profiles, resale, data brokerage, or to analyze, benchmark, or compete with Garmin or its products. We do not use Garmin data to build profiles of anyone other than you for your own use of Basis.

Artificial intelligence and Garmin data

Garmin data is not sent to, visible to, or processed by any artificial intelligence or machine-learning system in Basis. Garmin-sourced records are kept isolated from AI processing. Our AI features operate only on the specific content you submit in that feature at that moment, as described in the "AI Features and AI Transparency Statement" section below. They never read your stored workout, sleep, or Garmin records.

We do not use Garmin data, or any derivative of Garmin data, to train, fine-tune, evaluate, benchmark, or otherwise improve any AI or machine-learning model, and we do not permit any third party to do so. Because Garmin data is never exposed to AI processing, there is no AI consent to give or withdraw for Garmin data. If that ever changes, we will not enable it without your separate, explicit opt-in consent, which you will be able to withdraw at any time in Settings, and we will update this policy first.

Sharing Garmin data

We do not sell Garmin data. We do not share Garmin data with advertising networks, data brokers, or third-party analytics companies. Garmin data is processed only by the infrastructure providers that host and operate Basis on our behalf, under contract, and only as needed to run the features you use. Those providers are listed under "Providers that process Garmin-sourced data" in the "Service Providers" section, which also names the providers that never receive Garmin data. We disclose Garmin data to Garmin itself only as part of the authorized API exchange, and where we are legally required to do so.

Garmin features that are not available today

Basis does not currently send planned workouts, training plans, or routes to Garmin. Basis does not read Garmin Health or sleep data, does not import historical activities, and does not use Garmin Training or Courses exports. No setting in Basis enables those actions today, and connecting your account does not change anything in your Garmin Connect account.

If we add any of them, we will update this policy before the feature becomes available, state exactly what would be sent to or received from Garmin, and ask for your separate authorization where Garmin requires it. A connection you made for activity import is not consent to a new data type.

Garmin Connect privacy notice: https://www.garmin.com/en-US/privacy/connect/

Garmin privacy statement: https://www.garmin.com/en-US/legal/privacy-statement/

Disconnecting Garmin and withdrawing authorization

• You can revoke Basis's access at any time from your Garmin account: Garmin Connect account settings, then Connected Apps. Revoking access immediately stops any further retrieval of your Garmin data by Basis.
• You can also email daniel@joinbasis.app from the address on your Basis account and ask us to disconnect Garmin for you and delete the Garmin data already imported.
• Withdrawing authorization does not affect the lawfulness of processing that happened before you withdrew it, and it does not delete data that remains in your Garmin account. Manage Garmin-side data through Garmin.

Retention and deletion of Garmin data

• While you are connected, imported Garmin records are retained so your history and statistics stay complete.
• When you disconnect Garmin, we stop retrieving new data, revoke our access at Garmin, and delete the Garmin-sourced records we imported, together with the record of activities Garmin notified us about, at the time of disconnection. No Garmin-sourced record is kept after disconnection, unless a longer period is required by law.
• When you delete your account, Garmin-sourced records are deleted with the rest of your fitness data, as described in "Account Deletion and What Happens."
• Deleting a single imported activity in Basis removes that activity from your Basis account. It does not remove it from your Garmin account.
• Residual copies may persist in routine backups for a limited period until those backups are overwritten. We do not restore individual records from backups except for disaster recovery.

Your rights over Garmin data

You have the same rights over Garmin data as over any other data you store in Basis: access, correction, deletion, export, restriction, and withdrawal of consent. See "Your Rights and Choices" and "Access, Correction, Deletion, and Export" below for the exact steps.

How We Use Information

We use your information to:

• Provide, operate, and maintain Basis and your account.
• Store, display, and analyze your workouts, nutrition, sleep, and body metrics.
• Calculate calorie and macro estimates, rep ranges, rest times, progression guidance, personal records, and trends.
• Import activities from services you connect, including Strava and, if you connect it, Garmin.
• Support offline logging and sync it to your account when you reconnect.
• Send the notifications and reminders you enable.
• Respond to support requests and troubleshoot bugs.
• Secure the app, detect abuse, and protect the rights and safety of our users.
• Comply with legal obligations and enforce our Terms.
• Improve the reliability and usability of features, using aggregated and technical information rather than your health data for advertising, which we do not do at all.

We do not sell your information, and we do not use your health, fitness, sleep, or Garmin data for advertising or advertising profiles.

AI Features and AI Transparency Statement

Basis offers optional AI-assisted features. This section states exactly what they do with your data, so you can decide whether to use them.

AI features in Basis

• Photo food logging: when you take or select a food photo and submit it for analysis, the photo is sent to an AI vision model that estimates the foods, portions, calories, and macros. You review and edit every result before anything is saved.
• Workout text parsing: when you paste workout text and press the parse action, that text is sent to an AI model that converts it into structured workouts you can review before saving.
• Food nutrition lookup: when you search for a food that is not in our databases, the food name or description you typed may be sent to an AI model to estimate nutrition values, which you review before saving.

What is sent, and what is not

• Sent: only the content you submit for that specific action, meaning the photo, the pasted text, or the food query.
• Not sent: your workout history, your nutrition history, your body metrics, your sleep records, Garmin data or any other connected-service data, your email address, your credentials, and your account settings.
• AI features do not read your stored records in the database to build a prompt. Each request is self-contained.

Consent, control, and withdrawal

• AI processing happens only when you actively start an AI action, such as submitting a photo, pressing parse, or running an AI food lookup. That action is your consent for that specific request.
• You can decline to use these features at any time, and the rest of Basis continues to work. To withdraw consent, simply stop using the AI actions.
• AI results you have already saved are ordinary log entries. Delete the entry, or delete your account, to remove them.
• We do not use your content, your saved records, or Garmin data to train, fine-tune, evaluate, or improve AI models, and we do not sell it.

AI estimates may be inaccurate, incomplete, or inappropriate for you. Always review them before relying on them.

How We Share Information

We do not sell personal information. We do not share personal information with advertising networks, data brokers, or third-party analytics or tracking companies.

We share information only in these circumstances:

• With service providers that host, store, or process data on our behalf so we can run Basis, under contract and limited to what their service requires. See "Service Providers."
• With a service you connect, such as Garmin or Strava, when you ask us to send data to it.
• With other Basis users, when you publish community posts, comments, or food contributions.
• When required by law, subpoena, court order, or other legal process, or to protect the rights, safety, and security of Basis, our users, or others.
• To investigate fraud, abuse, or security incidents.
• In connection with a merger, acquisition, financing, reorganization, or sale of assets, where your information may be transferred as part of that transaction, subject to this policy.
• With your consent or at your direction.

Service Providers

These are the providers that process data for Basis, what they receive, and why. Providers act on our instructions and are not permitted to use your data for their own advertising.

Providers that process Garmin-sourced data

• Base44 (application platform): hosts the database, authentication, file storage, and AI gateway for everything you store in Basis, including the Garmin-sourced records we import, and serves them back to you. It processes that data only to run Basis.
• Garmin: returns the activity summaries you authorized through its API. Basis does not send Garmin any of your Basis data today, and no planned workout, plan, or route is transmitted to your Garmin account.
• Google (Maps) and CARTO (map tiles): receive the map viewport and tile coordinates needed to draw a map you open. Imported Garmin activities have no route to draw today, so opening one sends them nothing. They never receive the Garmin activity record, its metrics, or your account identity.

No other provider listed in this policy receives Garmin-sourced data. In particular, AI model providers, USDA FoodData Central, Open Food Facts, Strava, Apple, and the app stores never receive Garmin data.

Providers used elsewhere in Basis

• AI model providers accessed through the Base44 AI gateway: receive only the photo, pasted text, or food query you submit in an AI action. They never receive your stored records, your identity, or Garmin data.
• Google (Places, Routes, and Google Sign-In): receives the map coordinates of the route you plan, record, or view, and, if you sign in with Google, your name, email address, and profile identifier.
• Apple (Sign in with Apple): receives and returns the authentication identifiers needed to sign you in.
• USDA FoodData Central: receives the food search terms and barcodes you look up. No account or health data is sent.
• Open Food Facts: receives the food search terms and barcodes you look up. No account or health data is sent.
• Strava: receives and returns data only if you connect Strava, including the authorization tokens and the activity data you import.
• Apple App Store and Google Play: distribute the mobile app and, where applicable, process purchases under their own policies.

We do not currently use email marketing, advertising, retargeting, or third-party analytics providers inside the app. If we add one, we will update this policy and this list first.

Analytics, Advertising, and Tracking

Basis does not include third-party advertising networks, advertising pixels, cross-site or cross-app tracking technologies, or third-party analytics SDKs. We do not track you across other apps or websites, and we do not use health, fitness, sleep, or Garmin data for advertising or to build advertising audiences.

We keep our own operational logs, such as error reports, crash diagnostics, sync status, and security events, to run and protect the service. Our hosting provider records standard request logs, including IP address and request metadata, to deliver and secure the app.

Local storage on your device is used for app functionality, such as offline workout logging, cached data, and your preferences. It is not used for advertising.

Data Retention

• Account and profile information: retained while your account is active, and removed when you delete your account or request erasure.
• Workouts, nutrition, body metrics, sleep, and plans: retained while your account is active, or until you delete the individual records, and deleted when you delete your account.
• Strava-imported activity details: automatically deleted 7 days after import, with a minimal workout-date record retained so counts and streaks remain accurate.
• Garmin-imported data: retained while you are connected, and deleted when you disconnect Garmin or delete your account.
• Community posts, comments, and notifications: retained until you delete them, delete your account, or request erasure.
• Approved community food contributions: may remain in the shared food database after your account is deleted, with the link to your identity removed on request.
• Support messages: retained as long as needed to resolve your request and for reasonable record-keeping.
• Technical logs and backups: retained for a limited period for security, abuse prevention, and disaster recovery, then overwritten.

We may retain limited information longer where the law requires it, or to resolve a dispute or enforce our agreements. We do not keep health or Garmin data for advertising or model training under any circumstances.

Your Rights and Choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your account and the information in it.
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent where we rely on consent, including for connected services and AI features.
• Limit the use of sensitive personal information.
• Not be discriminated against for exercising these rights.

You can exercise most of these directly in the app. Email daniel@joinbasis.app if you need help or want us to act on your behalf.

Access, Correction, Deletion, and Export

Access and correction

You can view and edit your workouts, nutrition entries, body metrics, sleep records, plans, templates, saved foods, recipes, and profile settings directly in the app at any time. Correction is immediate because you are editing the stored record.

Export

Settings, then Data & Export, lets you download your workout history and your nutrition log as CSV files for any date range or for all time, while signed in. No third party is involved. If you need a broader export, including sleep records, community content, or connected-service data, email daniel@joinbasis.app and we will provide it.

Deletion

Settings, then the Danger Zone, then Delete Account & All Data deletes your stored records and resets your profile fields, then signs you out. See the next section for exactly what that removes.

To have everything else removed, including your login identity, community posts and comments, and your contributor identity in the shared food database, email daniel@joinbasis.app from your account email address. We action these requests within 30 days, and we will confirm when the deletion is complete.

We may need to verify your identity before acting on a request, and we may decline requests that would expose another person's data. You can also authorize an agent to act for you.

Account Deletion and What Happens

When you use Settings, then Delete Account & All Data, the following is permanently deleted from your account immediately:

• Workouts, sets, reps, and exercise history.
• Nutrition logs, food entries, saved foods, recipes, and meal templates.
• Body weight entries and other body metrics.
• Water and supplement tracking data.
• Sleep entries, sleep reflections, and sleep settings.
• Training plans, workout days, planned exercises, and scheduled workouts.
• Custom exercises, exercise notes, and workout and nutrition templates.
• Saved routes and imported workout histories.
• Connected-service records, including stored Strava connection tokens, your Garmin connection and tokens, and the activities imported from Garmin.

Your profile fields, including age, weight, height, sex, and goals, are scrubbed at the same time, and you are signed out.

Some data is not erased by that in-app action and is removed when you request it by email: your login identity (email and name record), community posts, comments, likes, follows, notifications, support tickets, and your contributor identity in the shared food database. We complete those removals within 30 days of your request.

Routine backups may retain copies for a limited period until overwritten, and we may retain information where the law requires it. We do not restore individual records from backups except for disaster recovery.

Disconnecting Services and Withdrawing Consent

• Strava: Settings, then Strava, then disconnect. Basis stops importing immediately.
• Garmin: Settings, then Garmin Connect, then Disconnect Garmin. Basis revokes its access at Garmin and deletes the activities it imported from Garmin. You can also turn off Basis in Garmin Connect under Connected Apps.
• Google or Apple sign-in: manage or revoke access in your Google or Apple account settings.
• Notifications and reminders: turn them off in your device settings or in Basis notification settings.
• AI features: stop using them. No consent is retained beyond each request.
• Location and camera: revoke the permission in your device or browser settings at any time.

Withdrawing consent does not affect processing that already happened, and does not remove data that a third party, such as Garmin, still holds in its own account.

Security

We use administrative, technical, and organizational safeguards designed to protect personal information. Access to stored records is scoped so each user can reach only their own data, connected-service tokens are stored server-side and never exposed to the browser, and data is encrypted in transit and at rest by our infrastructure provider.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential and for using a secure device.

If we become aware of a security incident affecting your personal information, we will investigate and provide notice where required by law.

International Data Transfers

Basis is operated from the United States, and our service providers may process data in the United States and other countries. Where data is transferred internationally, we rely on our providers' contractual safeguards for such transfers. If you use Basis from another region, your information may be transferred to, stored in, or processed in the United States.

Children's Privacy

Basis is not intended for children under 13, and we do not knowingly collect personal information from them. If you are under 18, use Basis only with permission from a parent or legal guardian. If we learn that we have collected information from a child under 13, we will delete it.

California and Other U.S. State Privacy Rights

If you are a California resident, you have rights under California privacy law, including the right to know what personal information we collect, to access it, to correct it, to delete it, to obtain a copy, and to limit the use of sensitive personal information. Residents of other U.S. states with comprehensive privacy laws have similar rights.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use sensitive personal information, including health and Garmin data, for advertising. We will not discriminate against you for exercising your rights.

To exercise these rights, use the in-app controls described above or email daniel@joinbasis.app.

Health Data and Not Medical Advice

Some information you enter or import into Basis may be considered health, wellness, fitness, or body-measurement information under certain laws, and we treat it with the protections described in this policy.

Basis does not provide medical advice, diagnosis, treatment, emergency services, clinical monitoring, or disease management. Basis is not a medical device or a healthcare provider. Consult a qualified healthcare professional before starting or changing an exercise, nutrition, supplement, or weight program.

Changes to This Privacy Policy

We may update this Privacy Policy as Basis evolves. When we make material changes, including any change to how connected-service or Garmin data is handled, we will update the effective date above and notify you in the app or by email before the change takes effect where required.

Continuing to use Basis after an update means you acknowledge the updated policy.

Contact Us

Basis is responsible for the personal information described in this policy. For privacy questions, data requests, or complaints, contact us at:

Email: daniel@joinbasis.app

We aim to respond within 30 days. If you are not satisfied with our response, you may contact your local data protection authority.