Skip to content
HEWED

Legal

Privacy Policy

Hewed is a strength training app. We collect what you log and what you choose to connect, use it only to run Hewed for you, never sell it, and never use it for advertising. You can delete your account and everything synced to it from inside the app. Last updated October 30, 2026.

Who we are

Hewed ("we", "us") wrote this policy. It covers the Hewed website, the Hewed web app (including the lift log, the trainer board and account pages) and the Hewed iPhone app. It takes effect on October 30, 2026.

Questions or requests: owencrabbe@owencrabbe.com, or by mail at 5009 Fletcher St, Anderson, IN 46013.

Hewed is offered to adults 18 and older in the United States.

What we collect

You can use the lift log without an account. Without one, what you log stays in your browser or on your phone and we never receive it. When you create an account or connect a service, we collect:

  • Account details: your email address, a hashed version of your password (we never store the password itself), whether you have confirmed your email, and the date and version of the Terms and this policy you agreed to.
  • Training data you enter: exercises, sets, reps, weights, units, programs, the daily readiness check-in (good, OK or rough) and, if you use the habit plan, your chosen goals, schedule and check-ins.
  • Your outcome log, when you are signed in: for each lift, the weight, sets and reps Hewed suggested and why (the rules version, your last session, your check-in of feel, sleep, energy and soreness, and any trainer call), next to what you actually did, including an optional "reps left in the tank" rating. It is how Hewed learns what works for you.
  • Trainer data: if you are a trainer, the name you show to clients, your invite links and the calls, notes and weights you set for clients. If you are a client, the link to your trainer and the sharing choices you made.
  • WHOOP data, only if you connect WHOOP: your WHOOP member id, access tokens, and one reading per day for the last 8 days (recovery score, heart rate variability, resting heart rate, hours asleep and strain).
  • Waitlist: your email address and the date you joined, if you join the iPhone app waitlist.
  • Security and technical data: hashed session tokens, counts of recent sign-in attempts (keyed by a hash of your email or network address, not the address itself), and standard request logs kept by our hosting provider, such as IP address, browser type and time.
  • Usage events, only if analytics is switched on: coarse events such as a page being viewed, sent without your IP address and without any training, health or habit data.

We do not collect your name, phone number, location, contacts, photos, payment card details or precise location. Hewed does not read Apple Health today. If we add Apple Health, the app will ask your permission first and we will update this policy before it ships.

How we use it

  • To run the app: save and sync your log across devices, work out today's weights, flag stalled lifts and show your trainer what you chose to share.
  • To use your readiness and WHOOP readings to adjust today's plan.
  • To compare Hewed's suggestions with what you did, so its suggestions for you get better. We will not use your outcome log for research without asking for your separate consent first.
  • To send account emails: confirming your address and resetting your password. We do not send marketing email from your account unless you ask for it.
  • To keep Hewed secure: block repeated wrong passwords and abuse, and investigate problems.
  • To fix bugs and improve Hewed, using the minimum data needed.
  • To comply with the law and respond to valid legal requests.

We do not sell or rent your personal information. We do not use your training, health or WHOOP data for advertising or marketing, we do not build advertising profiles, and we do not send your data to AI providers. Hewed does not track you across other companies' apps or websites.

Health and fitness data

We treat your readiness check-ins, WHOOP readings and anything else about your body as health data. We collect it only to provide the features you asked for, connect WHOOP only when you choose to, and share it with a trainer only when you turn that on.

If you live in Washington, Nevada or another state with a consumer health data law, our Consumer Health Data Privacy Policy also applies to you.

Sharing with your trainer

A trainer sees nothing about you until you accept their invite. When you accept, your trainer can see your email address, your synced lift log, your program and today's plan.

Your readiness color (green, yellow or red) is shared by default and you can turn it off. WHOOP detail (the reasons behind the color and your latest WHOOP numbers) is off by default and shared only if you turn it on.

You can change these choices or end the link at any time, and access stops at once. Trainers are independent of Hewed. Our Terms require them to use what you share only to coach you.

Who else receives data

We share personal information only in these cases:

  • Service providers that run Hewed for us, under contracts that limit them to providing that service: Vercel (hosting), Neon (database), Resend (account email) and, if analytics is switched on, Amplitude (usage events). If we add a payment processor for paid plans, we will name it here first.
  • WHOOP, when you connect it: WHOOP sends us your data under your permission, and we tell WHOOP when you disconnect so it revokes our access.
  • Your trainer, as described above, only with your consent.
  • The law: when we must comply with a valid legal request, or to protect someone's safety or the security of Hewed.
  • A business transfer: if Hewed is merged or sold, your information may move to the new owner, who must honor this policy. We will tell you first.

How long we keep it

  • Account and synced training data: while your account exists. When you delete your account it is removed from our live database immediately, and from backups within 30 days.
  • WHOOP readings: the last 8 days only, replaced each day, and deleted when you disconnect WHOOP or delete your account. WHOOP tokens are deleted on disconnect. WHOOP numbers saved with an outcome are encrypted and wiped 8 days after that training day.
  • Outcome log: while your account exists, unless you delete it sooner with "Delete all data" or "Delete lift log". Trainers do not see it.
  • Trainer links and calls: until either side ends the link or deletes their account.
  • Sign-in sessions: up to 180 days, or until you sign out.
  • Password reset and email confirmation links: 60 minutes.
  • Sign-in attempt counters: up to 24 hours.
  • Waitlist emails: until we tell you the iPhone app is available, or sooner if you ask us to remove you.
  • Hosting request logs: for the period our hosting provider keeps them, which is short and set by them.

We may keep a record that you agreed to these terms, and data we are legally required to keep, after deletion.

Your choices and rights

  • Use Hewed without an account, so nothing leaves your device.
  • Export your lift log as a file from the lift screen at any time.
  • Delete your account in the app (web or iPhone). This deletes your account, your synced data, your trainer links and your WHOOP connection.
  • Disconnect WHOOP, or change what your trainer sees, at any time.
  • Ask us for a copy of your data, to correct it, or to delete it, by emailing owencrabbe@owencrabbe.com. We will confirm the request comes from your account email and answer within 45 days.
  • Withdraw consent you gave (for WHOOP or trainer sharing) at any time. This does not affect what happened before you withdrew it.

We will not treat you differently for using these rights. If we decline a request, you can appeal by replying to our answer, and we will respond within 45 days.

Security

Passwords are stored only as salted scrypt hashes. Session tokens are stored only as hashes. Data travels over HTTPS. WHOOP tokens and readings are encrypted with AES-256-GCM before they are stored. Repeated wrong passwords lock sign-in, and password resets sign out every other device.

No system is perfectly secure. If a breach affects your information, we will tell you without unreasonable delay, and we will notify regulators where the law requires it, including the Federal Trade Commission under its Health Breach Notification Rule.

Children

Hewed is for adults 18 and older. Creating an account requires confirming you are 18 or older. We do not knowingly collect information from anyone under 13. If you believe a child has given us information, email owencrabbe@owencrabbe.com and we will delete it.

Where data is stored

Hewed is offered in the United States and your data is stored and processed in the United States.

Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect, and ask you to agree again where the law requires it. The date at the top shows the latest version.

More detail

For a screen-by-screen description of what each part of Hewed stores, see what each screen does with your data.

Contact: Hewed, owencrabbe@owencrabbe.com, 5009 Fletcher St, Anderson, IN 46013.