Privacy Policy
Last updated: September 2026
This policy covers the Evolve app (web and phone), the Evolve AI membership with Jack, our AI coach, 1-on-1 coaching, and this website. It is written to be read. If anything is unclear, email hello@hqevolve.com.
1. Who we are
HQ Evolve Group (ABN 22 851 950 861) is an online fitness coaching business operated from Victoria, Australia. We are the data controller for the information described here and we comply with the Australian Privacy Principles under the Privacy Act 1988.
2. What we collect
Account and contact. Name, email, phone number, password (stored hashed by our authentication provider), and, if you use them, your Apple or Google sign-in identifiers.
Payment. Handled by Stripe. We receive confirmation of payment, the last four digits and card type, and your subscription status. We never see or store your full card number.
Your profile and goals. Age, sex, height, weight, goal, training experience, days and equipment available, injuries, health conditions and dietary needs you tell us about in onboarding, questionnaires and check-ins.
Everything you log in the app. Workouts and every set, rest and effort ratings, notes on sessions, food and water, body weight, measurements, progress photos, activities, habits, and the answers in your check-ins.
Messages. Text, photos, videos and voice notes you send to your coach or to Jack, and the replies.
Health data you connect. If you connect Apple Health or Health Connect: steps, workouts, sleep, heart rate, active energy and body measurements, read only. We never write to your health record. A daily summary of that data (steps, sleep, resting heart rate, active energy) and the workouts the app imports are sent to and kept on Evolve's servers, tied to your account, so your coach and Jack can see them and adjust your plan; the raw samples stay on your phone. Disconnecting in the app deletes the daily summaries from our servers; imported workouts stay on your calendar until you remove them or delete your account. We never sell health data or use it for advertising.
Device and usage. Device type, app version, crash reports, which screens and features you use, and the time you use them, so we can see what to fix and improve. No advertising identifiers, no cross-app tracking.
Push notifications. A device token if you allow notifications, and your reminder preferences.
3. How we use it
- To run the app for you: your program, your nutrition targets, your plan, your progress and your rank
- To generate personalised content with AI: programs, meal plans, swaps, check-in reviews and Jack's replies are produced from the information above by AI models on our instruction
- To let a human coach coach you, if you are a 1-on-1 client: they see your logs, check-ins and messages
- To keep you safe: disclosed injuries and conditions limit exercise selection and intensity, and Jack is instructed to decline medical advice and point you to a doctor or emergency services where that matters
- To send reminders and service messages you have opted into, and to reply when you write to us
- To bill you and manage your membership
- To improve the app, using usage data and, in aggregate, what gets logged
- To meet legal obligations
We do not sell your information. We do not use it for advertising. We do not build profiles of you for anyone else.
4. AI processing, in plain terms
Jack is software. When you ask him something, the relevant parts of your data (recent sessions, food, check-ins, your goals and the message itself) are sent to our AI provider, Anthropic, to generate the reply, under commercial terms that prohibit training on your data. Voice notes are transcribed by OpenAI's speech-to-text service under the same kind of terms, and the recording is not kept by them. Programs and meal plans are generated the same way. Every AI output is checked by our own rules before it reaches you, but it can still be wrong: it is general fitness guidance, not medical, dietetic or physiotherapy advice.
5. Who else sees your data
Only the providers we need to run the service, each receiving only what its function requires: Stripe (payments), Supabase (database, authentication and file storage, hosted in the United States), Railway and Vercel (hosting), Anthropic and OpenAI (AI processing as above), our email and SMS providers (service messages), and Apple and Google (app distribution, sign-in and push notifications where you use them). Your coach, if you have one, sees what they need to coach you. We may also disclose information where the law requires it or to protect someone's safety.
Some of these providers store or process data outside Australia, mainly in the United States. Where that happens we take reasonable steps, including contractual terms, so your information is handled consistently with the Australian Privacy Principles.
6. Photos and videos
Progress photos, form-check videos and food photos are stored in private storage, are only accessible to you (and your coach, if you have one, for form checks and check-ins) and are never used in marketing without your separate written permission. You can delete any photo in the app.
7. How long we keep it
For as long as your account is open. When you delete your account, your profile, logs, messages, photos and health data are deleted within 30 days; we keep only what the law requires us to keep, such as payment records for seven years. If your membership lapses without deletion, we keep your data so you can pick up where you left off, and delete it after two years of inactivity.
8. Your controls
- Delete your account yourself in the app: Settings, then Your data and privacy. It removes everything above.
- Download your data from the same place, as a file you can keep.
- Correct anything in your profile, or email us and we will change it.
- Turn off notifications in the app or on your phone, and unsubscribe from any email with the link in it.
- Disconnect health data in the app or in your phone's health settings.
To exercise any right, or to complain about how we have handled your information, email hello@hqevolve.com. We reply within 30 days. If you are not satisfied you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
9. Security
Data is encrypted in transit and at rest, access is limited to the people and systems that need it, storage buckets are private and served through short-lived signed links, and uploads are checked before they are stored. No system is perfectly secure; if a breach is likely to cause you serious harm we will notify you and the regulator as the Notifiable Data Breaches scheme requires.
10. Children
Evolve is for people 18 and over. We do not knowingly collect information from anyone younger; if we learn we have, we delete it.
11. This website
hqevolve.com sets no cookies and runs no analytics or advertising pixels. Forms on this site send only what you type in them to us. The app stores a small amount of data on your device so it works offline and keeps you signed in; signing out or clearing your browser data removes it.
12. Changes
If we change this policy we will update the date at the top and, for anything material, tell you in the app or by email before it takes effect.