Privacy Policy – Kenso

Introduction

This Privacy Policy explains how we collect, use, and safeguard your information when you use the Kenso mobile application ("App"), operated by Zenmonkeys Digital LLC ("Company", "we", "us", or "our"). We collect only the information necessary to provide and improve the App.

Information We Collect

We collect the following types of information:

• Account Information: Email address, username, and encrypted password when you create an account. If you sign in with Apple or Google, we receive your email and a stable identifier from the provider.
• Workout Data: Exercise logs, sets, reps, weights, workout sessions, and performance metrics you enter.
• Program Data: Training programs you create or copy, including exercise configurations.
• Health & Biometric Data (optional): If you enable Apple Health on iOS, we read selected health metrics — heart rate variability (HRV), resting heart rate, sleep stages, body weight, step count, and workout sessions — to power recovery scoring, training-load analysis, and coaching insights. HealthKit data lives primarily on your device; only summarized/aggregated values needed for these features are synced to our servers. You control how much of it syncs — Settings → Apple Health → Sync Apple Health offers Everywhere, Training only, and On device. Choosing a more restricted mode deletes the health data already held on our servers; On device additionally stops any connected Oura or Whoop from syncing to us and deletes what we hold from them, though your data remains in those apps. You can also revoke HealthKit permission at any time from iOS Settings.
• Nutrition Data (optional): Food you log in Kenso — meals, foods, recipes, saved meals, your calorie and macro targets, and body weight entries. It is stored with your account and shown back to you; food lookups use public databases (Open Food Facts and USDA FoodData Central). If you choose to analyse a meal photo or description with AI, that photo or text is sent to our AI providers only after you consent.
• Recovery Snapshots: When you start or complete a workout, we capture a snapshot of relevant signals (HRV, sleep hours, days since last session, recent RPE, etc.) attached to that session for personalized signal analysis.
• OAuth Authorization Data: If you connect Kenso to a third-party AI assistant (e.g., Claude, ChatGPT), we store the authorization grant — which client, which scopes, when issued, last used time, and a hashed access token. We never store the raw access token after issuance.
• Preferences: App settings such as weight units and rest timer preferences.
• Usage Analytics: Basic, aggregated app usage patterns to help us improve the experience. These analytics are not used to personally identify you.

How We Use Your Information

Your information is used to:

• Provide and maintain the workout tracking service
• Generate AI coaching, insights and programs through the AI providers described below, only after you have turned on AI coaching
• Track your progress and display performance analytics
• Send transactional emails (password resets, account notifications)
• Improve the App based on usage patterns
• Respond to your feedback and support requests

Data Storage & Security

Your data is stored securely in a PostgreSQL database with encrypted connections. Passwords are hashed using industry-standard bcrypt encryption. We implement reasonable administrative, technical, and organizational measures to protect your information against unauthorized access, alteration, or destruction.

Third-Party Services

We use the following third-party services as data processors:

• Resend: Transactional email (password resets, account notifications)
• RevenueCat: Subscription and in-app purchase management (Apple)
• Sentry: Error tracking and crash reporting (anonymous device info only)
• OpenAI and Anthropic (AI providers): Power the in-app AI features listed in the "AI Features in the App" section below. Nothing is sent to either provider until you turn on AI coaching in the App. We use their business APIs, under which neither provider trains its models on your data; we do not send your email address or password.
• Capgo: Delivers in-app updates (app version info only)
• Render: Hosts the Kenso API and database (US data center)

We share only the minimum information necessary to operate these services. We do not sell, trade, or share your personal workout or health data with third parties for marketing or advertising.

AI Features in the App

Kenso's coaching features are powered by third-party AI providers, OpenAI and Anthropic. The App asks for your permission in a consent screen before any of your data is sent to them, and you can withdraw that permission at any time from Settings → Health & Connections → AI coaching. While AI coaching is off, none of your personal data reaches an AI provider.

What is sent, by feature:

• Coach chat: the messages you type, your training profile (goals, experience, injuries, training locations), your active program, recent workout sessions and personal records, notes the coach has saved from earlier chats, and any photo you attach. Voice messages are transcribed by OpenAI before being sent as text.
• Daily and post-workout insights, weekly review: recent training volume and sessions, personal records, your active program and training profile. The weekly review also includes your body-weight trend.
• Recovery signals in any of the above: HRV, sleep, resting heart rate and body metrics from Apple Health, Oura or Whoop are included only while Health data for AI is also on (see the Apple Health section above).
• Program import from photo or PDF: the images or PDF pages you upload.
• AI program builder: your goal, experience level, days per week, injuries, training history summary and any notes you enter.
• Morning notification tip: the same data as the daily insight, generated once per day for Pro users who have AI coaching on.

Each provider processes this data to generate the response and, under the API terms we use, does not use it to train its models. Their handling is governed by their own privacy policies (OpenAI, Anthropic).

AI Assistant Integrations

Kenso lets you connect your account to third-party AI assistants — Claude (Anthropic) and ChatGPT (OpenAI) — so you can ask about your training in those products. This is an optional Pro feature and requires explicit OAuth authorization.

What the integration can access: Only the scopes you approve at connection time. These can include workout history, programs, recovery signals, and coaching insights. The full scope list is shown on the consent screen before you authorize.

What the AI provider sees: When you ask the AI about your training, the AI calls Kenso tools that return the relevant data. That data passes through Anthropic's or OpenAI's API to generate the response. Their privacy policies govern handling on their side; we do not control their retention or training practices, though both providers offer opt-out controls in their consumer products.

Revoking access: You can disconnect any AI assistant at any time from Settings → Connected Apps. Revocation is immediate; the integration loses access to your data and must re-authorize to reconnect.

No automatic background access: AI assistants only see data when you explicitly ask them a question that triggers a tool call. They do not poll or monitor your account.

Data Retention

• Account & workout data: Retained while your account is active. Deleted within 30 days of account deletion.
• OAuth access tokens: Hashed; expire after 1 hour. Refresh tokens expire after 30 days. Revoked tokens are kept (marked revoked) for 90 days for audit purposes, then deleted.
• Audit logs: Records of integration tool calls (which tool, when, by which client) are retained 90 days for security and abuse monitoring.
• Backups: Encrypted database backups are retained for up to 30 days.

Your Rights

You have the right to:

• Access: View all your workout data within the App
• Correction: Edit your account information and workout history
• Deletion: Permanently delete your account and all associated data from the Settings page
• Export: Request an export of your data by contacting us

Children's Privacy

Kenso is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of changes by updating the "Last updated" date at the top of this page. Your continued use of the App after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or your data, please contact us at support@kensoforge.com or use the feedback feature within the App.