NCai Privacy Policy
NCai (“we”, “the app”) is a fitness coaching app. This policy explains what data NCai uses, why, who processes it, and how you can delete it. NCai does not sell your personal data and does not show ads.
1. Who this applies to
This policy covers the NCai Android app and the NCai server at ncai-bice.vercel.app, which handles sign-in, the AI proxy, subscription checks, optional cloud backup, and these legal pages.
2. Data we process
- Account: email, display name, a salted password hash (only if you use a password), your membership plan and, if you subscribe, your Google Play subscription status. If you use Google Sign-In or Sign in with Apple, we receive the email and name from that provider.
- Email messages: we use your email address only to send account emails: the verification code when you register and password-reset codes when you ask for one. These emails are sent via Gmail (Google) from the NCai address neekocoach.ai@gmail.com. We do not send marketing email.
- Fitness profile and logs: onboarding answers, training plans, workouts, runs, meals, sleep schedule, hydration, mind & body logs. Stored on your device unless you use cloud backup or send them in an AI request (see below).
- Health Connect (Android): only if you connect Health Connect and grant permission, NCai reads the data types listed in section 3 below. NCai does not write anything to Health Connect.
- Location: precise location only while a live run is in progress, to draw the route and compute distance and pace. It stays on your device and is not used for ads.
- Camera and photos: only when you choose to take or pick a food photo for analysis, or scan a barcode.
- Notifications: local reminders you turn on (for example meal, hydration, bedtime and wake-up reminders) and an ongoing notification while a workout or run is live. The wake-up reminder is a normal notification. It is not an alarm clock and can arrive a few minutes late.
- Purchases: subscriptions are processed by Google Play. Google holds your payment details. Our server checks your purchase with Google Play to confirm which plan is active.
- Optional cloud backup: if you use Backup to cloud, a snapshot of your NCai app data is stored on our server, tied to your account, so you can restore it later.
- Technical data: our server keeps short-lived counters (for example, how many AI messages you sent today and rate-limit counters keyed to a hash of your email or IP address) to prevent abuse. Our hosting provider keeps standard request logs.
3. Health Connect data
NCai asks for read access to these Health Connect data types and nothing else. Each one is shown to you in the app:
- Steps: your daily step count and the Steps ring in Training → Body.
- Distance: walking and running distance in Training → Body and in your activity totals.
- Active calories burned: calories burned through activity, shown in Calories and on Home.
- Heart rate: your current and average heart rate in Training → Body and during workouts.
- Resting heart rate: shown in Training → Body as a recovery signal.
- Heart rate variability (HRV): shown in Training → Body as a recovery signal.
- VO₂ max: shown in Training → Body as your fitness level.
- Oxygen saturation (SpO₂): your latest SpO₂ reading, shown in Training → Body.
- Sleep: time asleep and sleep sessions, shown in Sleep and on Home.
- Exercise sessions: workouts recorded by your watch or other apps, shown in your training activity.
How we use Health Connect data:
- It is used only to show these values in the app and for the coaching features you use (for example, your daily summary and, if you ask the AI coach, a short summary of these values in your request; see section 4).
- It is not sold, not used for advertising, and not used for credit, insurance or any purpose other than providing NCai's features to you.
- It stays on your device. It leaves your device only in an AI request you make or in a cloud backup you create, and it is never shared with data brokers or ad networks.
- NCai's use of data received from Health Connect follows the Health Connect Permissions policy, including its Limited Use requirements.
- You can revoke access at any time in Android Settings → Health Connect → App permissions → NCai.
4. AI features (Google Gemini)
When you use AI chat, AI coaching or food photo analysis, the app sends the request through the NCai server to Google Gemini. Depending on the feature, a request can include your message and recent chat, and a summary of your profile and recent logs: weight, height, age, sex, goals, meals, training and sleep schedule, and a short summary of the Health Connect values listed in section 3. For food analysis it includes the photo you chose. The NCai server does not store the content of AI requests or answers; it keeps only daily usage counters. Google processes the request to generate the answer and may temporarily retain chat interactions so the AI can complete multi-step replies (for example, when it adds something to your plan). Do not send data you do not want processed by Google. AI features require a Pro or Elite plan.
5. Why we process it
To provide training, diet, sleep and recovery features; keep your account secure (verification and password-reset codes); keep a live session running with a status-bar notification; connect Health Connect; answer AI requests you make; and process Play subscriptions. Legal bases: your consent (Health Connect, notifications, location during a run, camera) and performance of the service you asked for (account, emails about your account, logs, AI you trigger, subscriptions).
6. Service providers
We do not sell data. We share data only with providers needed to run NCai:
- Google: Gemini (AI answers and food photo analysis), Google Play Billing (subscriptions), Google Sign-In (if you choose it), and Gmail (sending verification and password-reset emails).
- Apple: Sign in with Apple, if you choose it.
- Vercel: hosting of the NCai server and website.
- Upstash: database for accounts, cloud backups and usage counters.
- Open Food Facts: when you search for a food or scan a barcode, your device sends the search text or barcode to Open Food Facts. No account data is sent.
- CARTO / OpenStreetMap: map tiles for the run map are loaded from CARTO’s servers, which see your IP address and the map area being shown.
- Formspree: if you use the contact/feedback form in Help or the deletion request form on our website, the details you enter are delivered to us via Formspree.
Health data stays on your device except what is included in an AI request you make or in a cloud backup you create.
7. Retention
On-device data stays until you delete your account, clear app storage, or uninstall. Your server account and cloud backup stay until you delete your account. Verification and reset codes expire automatically. Usage and rate-limit counters expire within a few days. AI requests are not used to train NCai’s own models.
8. Your choices
- Deny or revoke OS permissions (location, camera, notifications, Health Connect) in Android settings. Those features then stop working.
- Download a JSON copy: Settings → Privacy & Data → Download my data.
- Delete everything: in the app (Settings → Privacy & Data → Delete account and data) or on the account deletion page. Deleting your account removes your server account and your cloud backup, and wipes NCai data on that device. Cancel any subscription in Google Play separately.
9. Children
NCai is not directed at children under 13 (or the digital-consent age in your country). Do not create an account for a child.
10. Health disclaimer
NCai is a fitness tracking and coaching tool. It is not a medical device and does not provide medical advice, diagnosis, or treatment. Talk to a qualified professional before starting a new training or diet program.
11. Contact
Email neekocoach.ai@gmail.com, or use Help in the app.