Privacidade

Pensum is a log of things about your body. We think that means we owe you an unusually direct answer about where it goes, so this page is written in plain words rather than in the language these pages are usually written in.

Pensum is made by Walene. Until Walene is incorporated, Pensum is published by Waleed Hussein, an individual trading as "Walene", of Hecham El Khalil, Tallet El Khayat, Fakieh and Itani Bldg, 1st Floor, Beirut 0000, Lebanon, who is the controller of your data under data protection law — the person who decides what is collected and why. This is the same name the App Store and Google Play show as the developer. You can reach us at contact@pensum.fit, which is our email address for support and for privacy questions, or by opening a support ticket inside the app, under Settings.

Our representative in the European Union (GDPR Article 27) is Data Protection Representative Limited, 77 Camden Street Lower, Dublin D02 XE80, Ireland, reachable through datarep.com. If you are in the EU you can write to them as well as to us.

This page covers the Pensum apps for iPhone and Android and the Pensum web apps for coaches and clients.

Version 1.1 — effective 10 October 2026.

What we hold

• Your account. The email address you sign in with, and a display name. If you sign in with Apple or Google, they pass us your email address (Apple may give us a private relay address instead) and, if you let them, your name; we never receive your Apple or Google password. When you sign up with an email address we send a six-digit code to confirm that it is yours. We also keep a record of which version of these Terms and this Privacy page the sign-up screen showed you, and when.
• What you log. Workouts and sets, food and drink, body weight, body-fat estimates, measurements, progress photos, and any notes you type on any of those. This is the app.
• A few things about you that the calculations need: age, sex, height, what you are training for and how fast.
• Your location, only when you start something that needs it. If you start a run, ride or walk and allow location access, Pensum records the GPS route, distance and pace of that session, including while the screen is off or the app is in the background. If you send your location in a chat, Pensum sends the place you chose. If you choose to share your live location in a chat, for 15 minutes, 1 hour or 8 hours, Pensum keeps that one message up to date, including while the app is in the background, and keeps only your latest position: there is no trail, and it is deleted when the share ends or you stop it. Nothing is recorded outside a session or share you started. A cardio route is saved with the session and is visible to your coach only if you have allowed them to see your training.
• Heart rate, power, steps and workouts from your devices. If you connect a Bluetooth heart-rate strap, power meter, speed or cadence sensor or foot pod, Pensum reads from it during a session and saves the readings with that session. Pensum does not scan for anything else. If you allow it, Pensum also reads steps, heart rate and workouts from Apple Health (iPhone) or Health Connect (Android), one type at a time, and can write your finished cardio sessions back to them. You can withdraw any of these in your phone's settings. Health data from these sources is never sent to advertisers or data brokers and is never used for advertising. Workouts imported from them become sessions in your log. They are never included in what Pensum sends to Anthropic for Ask AI or the weekly report: those summaries leave them out.
• Strava and Garmin. If you connect either account, Pensum asks it for permission to read your activities (from Strava that includes activities you have marked private) and adds them to your log as sessions. Nothing is pulled until you connect. Disconnecting deletes the connection and its access token straight away; sessions already added stay in your log like any other session until you delete them or delete your account. Strava activities are shown only to you: Pensum does not show them to your coach and does not send them to Anthropic or any other AI service.
• Chats with your coach or client. Messages, voice notes, photos, videos, documents, a location, a contact card and links you send are stored with that conversation for as long as the conversation exists, or until you delete a message for everyone. Voice notes are recorded only while you hold the record button. Videos are shrunk on your phone before they are uploaded. If you choose a contact to send, Pensum opens your phone's own contact picker, only when you tap "Choose from contacts", and sends only the card you pick; it never reads or uploads your address book. On Android the phone asks you to allow contacts access the first time, because Android only lets an app read the contact you picked with that permission; Pensum still reads only that one contact. Chats are encrypted between your phone and our servers but are not end-to-end encrypted. If you send a link, our server fetches the page to build the preview, so the person who receives it does not hand their address to the site you linked.
• Calls. Voice and video calls with your coach or client use your microphone and camera and are carried by Stream, a real-time communications provider. Stream receives your account ID, your display name, your username and the link to your profile picture for the call; it never receives your email address. Pensum does not record calls. We keep a log of each call: when it happened, how long it lasted and whether it was answered.
• Shared plan links. If you create a link to share a workout routine or a food plan, anyone who has the link can see the plan as you shared it, and nothing else about you: not your logs, weight, photos or history. You can switch a link off at any time.
• Crash reports. When the app breaks it sends us a technical report so we can fix it. It carries device and error information, not your log, and it is tagged with your account ID (a random identifier, never your email or name) so we can tell which reports come from the same account. Crash reports are on by default; you can switch "Crash reports" off in Settings > Privacy at any time, and from then on none are sent.
• Usage events. If you switch "usage events" on in Settings — it is off until you do — Pensum sends counts of which screens and features get used to PostHog, an analytics company, stored in the EU. PostHog does not receive your account ID: our server turns it into a scrambled identifier using a secret key that only we hold, and that scrambled identifier is all PostHog sees. Events never include what you log: no foods, no exercises, no weights, no measurements, no messages.
• What you send for automatic estimates and Ask AI. If you turn automatic estimates on, what you enter for that feature — a food photo, a nutrition-label photo, the text you typed, your goal, the question you ask, or a short summary of your own recent training and food numbers — is sent to Anthropic, the company that provides our AI, to produce your result. Nothing is sent before you agree, and you can turn it off again at any time in Settings. We keep a count of how many times you have used each AI feature, so the usage limit works. If you are coached, your coach can switch Ask AI off for you.
• Foods other users share. When someone submits a food to the shared catalogue, we send its name and nutrition numbers — not who submitted it — to Anthropic, our AI provider, which checks the numbers look right before the food is made public to everyone. This happens automatically, on our schedule, after the food is submitted; agreeing to your submission going public at the time you submit it covers this verification step.
• Adaptive targets. If you turn on adaptive targets (part of Pensum+), a weekly calculation on our own servers uses your logged weight and food to suggest new calorie and macro targets. It uses no AI and sends nothing to any other company. Targets are applied automatically unless you switch that off in Settings, and you are shown what changed and why. Pensum does not ask you any health questions to use this; the goals screen carries a note telling you to talk to a doctor first if you are pregnant, breastfeeding or have a history of an eating disorder. (A test version asked two yes/no questions about that. If you answered them, the answers are no longer used by anything and are deleted with your account.)
• Notifications. If you allow notifications, your phone or browser is given a delivery address (a "push token", issued through Expo's push service on the phone and through your browser's own push service on the web) that we store so we can reach it, together with which kinds of notification you have asked for. A notification says who sent you something and what kind of thing it was — never what it says, and never anything about your body or your food.
• On the web apps. The coach and client web apps keep your sign-in session and your language choice in your browser's own storage. There are no advertising or tracking cookies.
• Support tickets. If you contact support from inside the app, what you write, any screenshot you attach and the replies we send are stored with your account so the conversation can continue. Walene support can read your tickets in order to answer them. Tickets are deleted when your account is deleted.

We do not sell any of this, and we never will. There is no advertising in Pensum, and no data about you is shared with an advertiser, a data broker, an insurer, or an employer.

Pensum sends no marketing email. No newsletter, no "we miss you". The only email we send is what you need to use your account: the code that confirms your address, the one that lets you sign in or reset your password, and, if a coach uses the "email this invite" button, a single invitation email to the address they typed. A reply to a support ticket arrives in the app, not in your inbox.

What your coach can see

If you accept an invitation from a coach, you answer four separate questions before the relationship starts. None of them is switched on for you.

• Your training — sessions, exercises, sets, and notes on them.
• Your food — food logs, meals, and your current targets.
• Your measurements — weight, body fat, measurements, and notes on them.
• Your progress photos.

Four things are shared whichever way you answer: your age, your sex, your height, and what you are training for. A coach setting your intake without those is guessing. Your coach can also see when you last logged something, even if you have switched everything else off.

You can change any of these at any time, and it takes effect immediately. Pausing or ending the relationship cuts your coach's access at once. Only you can change your own permissions — your coach cannot, and neither can we.

Notes your coach writes about you

Coaches keep private notes on the people they coach. Those notes are not shown to you in the app, and they are kept for 24 months after a coaching relationship ends, together with the frozen record of your check-ins.

They are still information about you. If you formally ask us for everything we hold about you, those notes are included in what you get, even though the app does not display them. We would rather tell you that here than have you discover it.

What a coach can never do

Change anything you logged. Export your log. See anything once the relationship is paused or ended. See another coach's relationship with you, your conversations with the app, your email address, your sign-in history, or anything about anyone who is not their own active client. There is no directory: no coach can find you, browse you, or search for you.

What Walene staff can see

Our staff do not browse accounts. When a person on our team needs to help you, the tool they use shows account facts: your email address, your plan, which devices you are signed in on (type and app version, never a push token), which coach you are linked to, which version of these pages you accepted, the kinds and times of messages we sent you, and your recent crash reports. It does not show what you logged, your photos, your food, your measurements or your chats. Every look-up is recorded in an audit log.

Two exceptions, both because you gave them to us: a support ticket you send (with any screenshot) is read to answer it, and a chat message that someone reports to us is read, with the names of the two people, to decide what to do about it.

Health and body information

Some of what Pensum holds is information about your health or body: your weight and measurements, progress photos, heart rate and Health data, your location during sessions, and anything you choose to tell a coach in a chat. Where the law treats that as a special category of data (the EU's GDPR does), our basis is your explicit consent, given at the moment you choose to log it, connect a device or sensor, allow a phone permission, or share it. You can withdraw it at any time by switching the feature off or deleting the data, and nothing else in the app depends on a feature you leave off.

Pensum is a log and a set of calculations, not a medical service. What it shows you is information about your own numbers, not a diagnosis or treatment.

We never send this information to an advertiser, a data broker, an insurer or an employer. The only companies that handle it are the ones listed below, each for the one job described there.

Who else touches your data

Running an app means other companies hold pieces of it. These are all of them, and what each one is for:

• Supabase — the database, the file storage and the sign-in system. Our project is hosted in Ireland (EU).
• PowerSync — the service that syncs your phone with the database.
• Anthropic (United States) — our AI provider; produces the automatic estimates and Ask AI answers. What you enter for those features is sent to that provider to produce your result, only if you have turned automatic estimates on. It also checks foods other users submit to the shared catalogue before they go public, described above.
• Sentry — crash reports, stored in the EU. Reports carry your account ID and nothing else that names you. Sentry keeps crash reports for 90 days, then deletes them, so that is how long a crash report can outlast your account.
• PostHog — usage counts, stored in the EU, and only if you switch "usage events" on in Settings. It sees a scrambled identifier, not your account ID.
• RevenueCat — manages Pensum+ subscriptions. If you subscribe, it holds an internal identifier for your account and your purchase history, so we can tell which features you have paid for. It never sees your email address, your logs, or anything you have entered in the app.
• Expo — building and updating the app, and its push service, which passes notifications to Apple and Google using your push token.
• Stream — carries voice and video calls between you and your coach or client, and receives the details listed under "Calls" above.
• MapTiler — supplies the map pictures behind your cardio route and behind a location sent in a chat. Your phone asks MapTiler for the map squares for the area on screen, so MapTiler sees which area, and your phone's internet address, but not who you are or what you did there.
• Resend and Zoho Mail — send and receive our email: the confirmation and sign-in codes, an invitation a coach emails to someone, and the messages you send to contact@pensum.fit. They see the address the email is for and its contents.
• Strava and Garmin — only if you connect them; we read your activities from them.
• Apple Health and Health Connect — on your phone, not ours; Pensum reads from and writes to them only with your permission.
• Apple and Google — they handle sign-in if you choose Sign in with Apple or Google, their notification services carry a notification the last step onto your phone, and the Play Store and App Store record a purchase when you subscribe.
• Cloudflare — serves this website, the coach and client web apps and the invite links.

The food catalogue itself comes from Open Food Facts and from the United States Department of Agriculture. Looking a food up does not tell them anything about you.

Most of the companies above are based in the United States; Supabase, Sentry and PostHog store their data in the EU. Where your data leaves the country you are in, the company receiving it is bound by its own published data-processing terms, which is the same protection almost every small app relies on rather than a bespoke transfer agreement per country.

Why we are allowed to process this, and how long we keep it

For readers who want the formal answer rather than the plain-English one above:

• Your account, your logs, your chats, and the coach data above — we process these because you asked us to, by using the app (performance of a contract with you, and our legitimate interest in running the service).
• Usage events (PostHog) — your consent, given by switching the setting on.
• Automatic estimates and Ask AI (Anthropic) — your consent, given when you agree to turn the feature on.
• Location, heart rate, sensor and Health data — your explicit consent, given when you allow the phone permission and start a session, a share or connect the source.
• Crash reports (Sentry) — our legitimate interest in keeping the app working (GDPR Article 6(1)(f)). Reports carry no logged health data, screenshots, screen contents or network addresses, so the impact on you is small; you can object at any time by switching "Crash reports" off in Settings > Privacy. Usage events (PostHog) are never sent without your consent (Article 6(1)(a)), which you can withdraw the same way.
• The record of which version of these pages you accepted — our legitimate interest in being able to show what you were told.

Retention: we keep your account and what you log for as long as your account exists, and delete it when you delete your account, with the exceptions described on this page: a coach's own notes (24 months after the relationship ends), the text of chat messages you sent (see the next section), and a live location, which is deleted when its share ends. We do not keep a separate backup copy of deleted data beyond what our database provider's own short-term backup window holds for disaster recovery, which is not something we can precisely state without checking our processor's own documentation; if that matters to you, ask us and we will find out.

Getting your data out, and getting rid of it

Export is free and complete, and you do not have to ask us for it. So is deletion.

When you delete your account, what you wrote goes: your logs, your measurements, your photos, your cardio routes, your support tickets, and the photos, videos, voice notes and files you sent in chats, including the copies in storage. We also ask the services that hold a piece of you to delete it: your call profile at Stream, your billing record at RevenueCat, your usage records at PostHog (crash reports at Sentry expire on their own after 90 days), and, if you signed in with Apple, we revoke the sign-in link with Apple. Stored files are removed in the background, normally within minutes; if one of these outside services is down at that moment we record what is left and try again.

Two things survive, and we would rather be precise about it than tidy: the text of messages you sent in a chat stays in the other person's conversation, shown as coming from a deleted account, in the same way a message you sent to someone stays in their phone; and anything a coach wrote themselves — their notes, their side of a conversation — remains, attributed to a deleted account. It is their record of their own work, and the coach notes are subject to the 24-month limit above.

Full instructions for deleting your account, from inside the app or without it, are on our delete-account page.

Your rights

Wherever you are, you can ask us at any time to see a copy of what we hold about you, correct it if it is wrong, or delete it — the app's own export and delete tools do the first and third of those for you directly, any time, without waiting on us. If you are in the EU, the UK, or a similar jurisdiction, you also have the right to object to our processing, to ask us to restrict it, to ask for your data in a portable format (export already gives you this), to withdraw a consent you gave us at any time going forward, and to complain to your own country's data protection authority if you think we have got this wrong. Write to contact@pensum.fit for anything the in-app tools do not cover.

Age

You must be at least 16 to use Pensum. One number, everywhere we are available. We chose the highest age any country we ship in requires rather than a different age per country, because Pensum includes private messaging between coaches and clients, and a rule nobody can keep track of is not a rule.

When you create an account the app asks for your date of birth and will not let you continue if you are under 16. It is an honest question, not proof: we do not ask for identity documents and could not check them if we did. The date you type is used on that screen only — it is not sent to us and it is not stored on your account.

If you are under 16, please do not create a Pensum account, and a parent or guardian should not create one for you either. If you believe an account belongs to someone under 16, write to contact@pensum.fit and we will close it.

Governing law

These terms and this policy are governed by the law of Lebanon, where Pensum is operated from, without regard to conflict-of-law rules. If you live somewhere whose law gives you consumer-protection rights that cannot be signed away by agreement — for example, certain rights under EU or UK consumer law, or US state law — nothing here is meant to take those rights from you, and they continue to apply alongside this section wherever the law requires it.

Changes, and how to reach us

If this policy changes in a way that affects what we hold or who sees it, we will say so in the app rather than quietly editing this page.

Questions, or a request for everything we hold about you: contact@pensum.fit.

Version 1.1 — effective 10 October 2026.