Privacy Policy

What’s new in this version

This Policy updates the previous version (dated August 27, 2026) to match how SaySet works today: waitlist signup on this website, onboarding training-profile answers, the pre-account voice demo, hashed-IP rate limits, accurate account-closure (anonymization) practices, and jurisdiction-specific rights for Canada, Quebec, the United States, Washington consumer health data, and the EEA/UK/Switzerland. It does not describe features SaySet does not offer (for example advertising cookies, community groups, HealthKit, or in-app subscriptions).

1. Who we are

SaySet is provided and distributed by Apterra Development Inc., a corporation organized under the laws of Ontario, Canada.

For privacy questions, requests, or complaints, contact us at hello.sayset@gmail.com. We do not currently maintain a separate public mailing address for privacy correspondence; email is the designated contact method.

We have not appointed a separate data protection officer or an EU/UK representative. Where those roles are required in the future, we will update this Policy.

2. Personal information we collect

We collect personal information directly from you, automatically through your use of the Services, and from third parties you choose to connect (currently Apple or Google when you sign in). We collect only what we need to operate SaySet, including the website waitlist.

Workout logs, training-profile answers, and related fitness information can be sensitive because they describe your physical activity and goals. We treat that information with additional care and do not use it for advertising.

2.1 Account and identity information

When you create or sign in to a SaySet account, we collect:

• Email address (from you or from Apple/Google, if you allow it)
• Name or display name, if you provide one (including a name Apple or Google shares if you allow it)
• Authentication identifiers and tokens managed by our authentication provider (currently Supabase) and by Apple or Google Sign In

2.2 Training profile and onboarding information

During onboarding you may choose to tell us about how you train. This can include experience level (for example beginner or intermediate), workout frequency, training style or split, primary goal (for example build muscle, lose fat, or get stronger), how you currently track workouts, unit preference, and whether you want workout reminders.

This information is stored on your Device. It may be associated with your account if you sign in, so the App can show a personalized summary. We do not currently ask for height, weight, date of birth, sex, medical conditions, medications, or progress photos.

2.3 Voice and microphone data

SaySet’s voice logging feature uses your Device microphone when you choose to log a workout by speaking, including a short try-it demo during onboarding. When you use voice logging:

• We capture what you say using your Device microphone
• On Apple devices that support it, speech may be converted to text on your Device using Apple’s speech recognition (audio stays on the Device for that step)
• When on-device speech recognition is unavailable, or as a fallback, audio may be sent securely to our servers and then to a third-party speech-to-text provider (currently OpenAI) to create a text transcription
• The transcription is processed to extract structured workout data such as exercise name, weight, reps, sets, distance, or duration (this parsing step may use our servers and/or a third-party language model, currently OpenAI)

We do not keep the raw audio recording in our database after processing is complete. Temporary audio may exist briefly on your Device and in transit while a log is processed, then it is discarded by our systems. Audio is not uploaded to object storage.

We may store the resulting text transcription and structured workout data with your account so you can review and edit what was logged. We may also store limited technical metadata about voice requests (such as timing, file size, success or failure status, and cached structured results) to operate rate limits, prevent abuse, and improve reliability. Those event records are not used as a library of your speech.

If you try voice logging before creating an account, we may process audio the same way for the demo, and we store a one-way hash of your IP address (not the raw IP) to enforce demo rate limits. We do not store demo audio or demo transcripts in our database.

We use voice data only to power workout logging and related App features. We do not use voice recordings to create a biometric voiceprint to identify you across other services, and we do not use them for advertising.

2.4 Workout and fitness data

We collect workout information you log manually or that is derived from voice input, including exercises, weight, reps, sets, distances or durations where applicable, workout titles, timestamps, unit preference, and progress history derived from that data.

If you create custom exercise names or aliases so the App recognizes how you say a movement, we store those with your account.

2.5 Device permissions and local information

Depending on the features you use, the App may request access to:

• Microphone, solely for voice workout logging (including the onboarding demo)
• Speech recognition (iOS), when using on-device transcription for voice workout logging
• Notification permission, if you choose to enable workout reminders. Reminders are scheduled locally on your Device. We do not currently store push tokens on our servers or send remote push notifications

We may also store preferences locally on your Device (for example weight and distance units, onboarding choices, and reminder schedule). Standard technical information needed to communicate with our servers (such as IP address and request metadata) may be processed by our hosting and authentication providers as part of normal network operation. For the pre-account voice demo, we store only a hashed IP as described above.

2.6 Information you provide directly

If you contact us by email or otherwise, we collect the information you include in that communication so we can respond, including your email address and the content of your message.

2.7 Information we receive from third parties

If you sign in with Apple or Google, we receive a provider identifier and, if you allow it, your name and email from that provider. Those providers’ own terms and privacy policies apply to their processing.

Our infrastructure providers (currently Supabase), email provider (currently Resend, for waitlist messages), and voice-processing provider (currently OpenAI) receive the information necessary to authenticate you, store your account or waitlist data, send emails you requested, or transcribe/parse a voice log you submit. They are permitted to process that information only to provide their services to us, subject to their terms and applicable law.

2.8 Information we do not currently collect

To be clear about what SaySet does not do today:

• No Apple Health, HealthKit, Google Fit, or Health Connect integration
• No precise (GPS) location; we do not request location permission
• No advertising networks, no cross-app tracking for advertising, and no App Tracking Transparency prompt for advertising
• No in-app paid subscriptions or collection of payment-card details (any future purchases would be processed by Apple or Google)
• No public community feeds, groups, or social profiles
• No cookies or tracking pixels in the mobile App for targeted advertising
• No connected wearables or third-party health devices

2.9 Waitlist and website information

If you join the SaySet waitlist on our website, we collect:

• The email address you submit
• Optional marketing attribution from the page you visited, such as UTM parameters (utm_source, utm_medium, utm_campaign), a referral path, and a simple source label (for example, which form on the site you used)

We do not collect voice recordings, audio, or workout data through the waitlist form. That kind of data is collected only if you later use the App.

Our website uses Vercel Analytics for basic, privacy-oriented site traffic metrics (such as page views). The site does not set advertising cookies or use analytics to build advertising profiles about you. Attribution is captured from the URL and page path at signup. You can control cookies through your browser settings; disabling them may affect analytics but will not prevent you from joining the waitlist.

We may process your IP address briefly to limit abuse of the waitlist form. We do not store your IP address with your waitlist entry.

3. How we collect information

We gather information in the following ways:

• Directly from you, when you join the waitlist, create an account, complete onboarding, edit your profile, log workouts, export data, or contact us
• From your Device, when you grant permissions such as microphone access and choose to use voice logging
• Automatically through our backend services when you authenticate, sync workouts, or submit a voice log (including security and abuse-prevention metadata)
• Automatically when you visit our website, including basic traffic metrics and, at waitlist signup, URL-based attribution
• From third-party sign-in providers (Apple or Google) when you choose those sign-in methods

4. How we use personal information

We identify the following purposes before or at the time of collection, consistent with Canadian privacy law. We use the information described above to:

• Provide and operate the Services, including the waitlist, account authentication, workout logging, history, progress features, training-profile summary, and data export
• Confirm waitlist signup and send launch-related or early-access messages about SaySet
• Understand how people find the website using optional attribution data
• Process voice input into structured workout data
• Enforce rate limits and prevent abuse of voice features and the waitlist form, including hashed-IP limits on the pre-account demo
• Remember preferences such as units and local reminder settings
• Respond to support requests and communicate with you about the Services (for example account or policy notices)
• Diagnose technical issues and improve reliability of the App
• Protect security, prevent fraud, and enforce our Terms
• Comply with legal obligations and defend our legal rights

We do not sell your personal information. We do not use your voice recordings, transcripts, or workout data to build advertising profiles about you. If you join the waitlist, we email you to confirm your signup and to send launch-related or early-access messages you requested. We do not currently send other promotional or marketing emails. If that changes, we will obtain consent where required (including Canada’s Anti-Spam Legislation) and give you a way to unsubscribe. Waitlist emails may also include an unsubscribe link where appropriate.

We do not use personal information from Apple HealthKit or Google Health Connect, because those integrations are not offered.

5. AI and automated processing

Voice logging uses automated speech recognition and a language model to turn what you say into a structured set. That processing is performed to provide the feature you requested. It can be inaccurate. You can review and edit results before relying on them.

These automated steps do not make legal or similarly significant decisions about you (for example credit, employment, or insurance). They extract exercise details from a phrase you chose to speak or type.

We do not use your voice recordings or workout logs to train a general-purpose SaySet foundation model for unrelated products. Third-party AI providers process audio or text you submit in order to return a transcript or parsed set, under their terms. We send them the content needed for that request, not your full account history.

6. How we disclose personal information

We disclose personal information only as needed to operate the Services, as described below, or as required by law. Service providers are permitted to use your information only to perform services on our behalf, and we require them to protect it with practices appropriate for the services they provide.

• Supabase: authentication, database hosting, and related backend infrastructure for waitlist entries, account, workout, and voice-event data
• Resend: sending waitlist confirmation and launch-related emails
• Vercel Analytics: basic website traffic metrics (such as page views) on our site
• OpenAI: speech-to-text transcription (when on-device recognition is not used) and parsing of voice workout logs
• Apple: on-device speech recognition on supported iOS devices (processed on the Device; not sent to SaySet for transcription in that mode); App Store distribution; Sign In with Apple when you choose it
• Google: Google Play distribution (when applicable) and Google Sign In when you choose it

We may also disclose information to professional advisors (for example lawyers or accountants) under confidentiality, to a successor in a merger or sale of assets (with notice where required), or to law enforcement or regulators when we believe in good faith that disclosure is required by law or necessary to protect the Services, our users, or others from harm.

We do not disclose personal information to advertising networks, data brokers, or other users (SaySet has no public social features).

If we add providers later (for example crash reporting or additional analytics), we will update this Policy before those providers receive personal information in a material new way.

7. Sale, sharing, and targeted advertising

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use targeted advertising cookies or mobile advertising identifiers for ads.

Because we do not sell or share personal information as those terms are defined under the California Consumer Privacy Act (as amended) and similar U.S. state laws, we do not offer a “Do Not Sell or Share” toggle for advertising. If that practice changes, we will update this Policy and provide an opt-out.

8. Aggregated or de-identified information

We may aggregate or de-identify information so it is no longer personal information under applicable law (for example counts of voice-log failures used to improve reliability). We will not attempt to re-identify de-identified information except as required or permitted by law.

9. Data storage, security, and international transfers

Apterra Development Inc. is based in Ontario, Canada. Your waitlist, account, and workout data are stored using our cloud providers. Depending on where those providers operate, your data may be processed in Canada, the United States, or other countries. OpenAI, Resend, Vercel, and some hosting infrastructure process data in the United States.

When information is processed outside your province or country, it is subject to the laws of that place, which may differ from the laws where you live and may allow courts, law enforcement, or national security authorities to access information in certain cases.

We use reasonable technical, organizational, and administrative safeguards designed to protect personal information, including encrypted transmission (HTTPS/TLS) and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. How long we keep information

We retain personal information only as long as needed for the purposes in this Policy, including to provide the Services and to meet legal, security, and accounting requirements.

• Account, workout, transcript, custom-exercise, and training-profile data: while your account is active
• Raw audio: not retained in our database after processing; temporary files on Device and in transit are discarded
• Voice-request metadata (timing, status, cached structured results): while needed for rate limits, abuse prevention, and reliability, and while your account is active
• Hashed IP for the onboarding voice demo: for the short window needed to enforce hourly and daily demo limits
• Waitlist email and attribution: until it is no longer needed for the waitlist and launch communications, or until you ask us to delete it, whichever comes first
• Support emails: as long as needed to resolve your request and for a reasonable period afterward for our records

If you request deletion of your account, we will close your login and delete or anonymize personal data associated with your account within 30 days, except where we must retain limited information for legal, security, fraud-prevention, or accounting purposes. Backup systems may take additional time to fully clear residual copies.

If you ask us to remove you from the waitlist, we will delete your waitlist email and associated attribution within 30 days, except where we must retain limited information for legal, security, fraud-prevention, or accounting purposes.

Account closure in the App clears personal fields on workout rows (setting values to empty/null rather than always removing every historical row), deletes custom exercises, aliases, and onboarding records where those tables exist, and replaces your login email with an internal placeholder so the account cannot be used to sign in. This matches the in-App deletion flow.

11. Your rights, consent, and choices

Depending on where you live, you may have rights to access, correct, delete, or export personal information, to withdraw consent, and to complain to a privacy regulator. You can exercise many of these choices in the App or by emailing us:

• Leave the waitlist or delete waitlist data: email hello.sayset@gmail.com with the subject “Delete my SaySet waitlist entry” and the email address you used to join. Where a waitlist email includes an unsubscribe link, you can also use that
• Export your workout data: Profile → Data → Export data (CSV of your workouts)
• Edit your display name: Profile → Account
• Revoke microphone or speech-recognition access: Device Settings for SaySet. Voice logging will stop; manual logging remains available
• Turn off workout reminders: Profile, in the Workout Reminders section
• Sign out: Profile → Sign out
• Delete your account: Profile → Delete account, or email hello.sayset@gmail.com with the subject “Delete my SaySet account” and the email address on your account
• Other privacy requests (access, correction, withdrawal of consent, appeal): email hello.sayset@gmail.com with the subject “Privacy request,” describe the right you want to exercise, and include the email address on your account

We will verify requests as needed (typically by confirming control of the account email) and respond within the time required by applicable law. You may use an authorized agent where the law permits; we will need to verify the agent’s authority.

You are not required to provide personal information, but we cannot add you to the waitlist, create an account, or provide voice logging without the information those features need.

We will not deny the Services, charge a different price, or otherwise discriminate against you for exercising privacy rights, except as permitted by law (for example, we cannot provide voice logging if you refuse microphone access).

12. Additional information for certain jurisdictions

This Section supplements the rest of this Policy. If it conflicts with another Section for residents of the listed place, this Section controls for those residents.

12.1 Canada (PIPEDA and provincial laws)

Apterra Development Inc. is accountable for personal information under its control. We collect, use, and disclose personal information with your consent, except where the law allows otherwise (for example to investigate a breach of our Terms or to comply with a court order). Consent may be express (for example tapping to allow the microphone, or submitting your email to join the waitlist) or implied where it is reasonable in the circumstances (for example storing a workout you chose to save).

You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent for a required purpose (such as storing workouts on an account, or keeping your email on the waitlist) may mean we cannot continue to provide that part of the Services.

You may request access to, or correction of, personal information we hold about you by emailing hello.sayset@gmail.com. You may complain to the Office of the Privacy Commissioner of Canada, or to your provincial commissioner where applicable.

12.2 Quebec (Law 25)

If you are in Quebec, you have rights of access, correction, and, where applicable, data portability (to receive computerized personal information in a structured, commonly used technological format, and to have it communicated to another person or organization authorized by law to collect it). You may also request, in the circumstances set out in the Act, that we cease disseminating your personal information or de-index a hyperlink. SaySet does not currently publish public profiles or community posts.

Privacy requests for Quebec residents: hello.sayset@gmail.com. You may also contact the Commission d’accès à l’information du Québec.

12.3 United States (including California)

If you are a U.S. resident, applicable state laws (including the California Consumer Privacy Act as amended by the CPRA, and similar laws) may give you the right to know/access, correct, delete, and obtain a portable copy of personal information, to opt out of “sale” or “sharing” for targeted advertising, to limit use of sensitive personal information, and to be free from discrimination for exercising those rights.

Categories we collect, drawn from the list above: identifiers (name, email, waitlist email, account and device identifiers); internet or electronic activity (website visits, waitlist attribution such as UTM parameters and referral path, App usage, IP processed by hosts, hashed IP for the voice demo); audio information (ephemeral voice recordings you submit); inferences limited to structured workout fields parsed from your speech; and sensitive personal information consisting of health-related fitness data you enter (workout logs and training preferences). We do not collect precise geolocation, government ID numbers, or payment-card numbers.

Sources: you, your Device, our website, and sign-in providers you choose. Purposes: the business purposes in Section 4. Recipients: service providers listed in Section 6. Sold or shared for advertising in the last 12 months: no. Sensitive information is used to provide the Services you request, not to infer characteristics for advertising.

California “Shine the Light”: we do not disclose personal information to third parties for their own direct marketing.

To exercise rights, email hello.sayset@gmail.com. To appeal a decision, email the same address with “APPEAL” in the subject line.

12.4 Washington consumer health data

The Washington My Health My Data Act regulates “consumer health data.” For SaySet, that means workout logs, transcripts of spoken sets, and training-profile answers you choose to provide. We collect this data from you (and, for voice, from processors who transcribe or parse it) to provide the Services. We disclose it to the service providers in Section 6. We do not sell consumer health data. We do not use it to display ads. We do not implement a geofence around health-care facilities.

Washington residents may request access, deletion, or withdrawal of consent for consumer health data by emailing hello.sayset@gmail.com. We will not collect this data for a new purpose without notice and, where required, consent.

12.5 EEA, United Kingdom, and Switzerland

If you reside in the EEA, UK, or Switzerland, Apterra Development Inc. is the controller of personal information processed through the Services. Contact: hello.sayset@gmail.com.

Where GDPR or UK GDPR applies, we process personal information on the following bases: performance of our contract with you (providing the waitlist you joined, the account, workout history, and voice logging you request); legitimate interests (securing the Services, preventing abuse, diagnosing faults, measuring basic website traffic, and improving reliability — interests that we balance against your rights); consent (microphone and speech-recognition permissions, processing of health-related fitness data where consent is required, and waitlist emails where consent is the appropriate basis); and legal obligation (when we must retain or disclose information).

You may request access, correction, erasure, restriction, objection, and portability, and you may withdraw consent at any time without affecting processing that occurred before withdrawal. You may lodge a complaint with your local supervisory authority (in the EU, your national data protection authority; in the UK, the ICO; in Switzerland, the FDPIC).

Transfers to the United States and other countries are made using appropriate safeguards required by applicable law, such as contractual protections with our providers. We have not represented that we are certified under the EU-U.S. Data Privacy Framework. You may ask us for more information about these safeguards at hello.sayset@gmail.com.

13. Children’s privacy

SaySet, including the waitlist, is not directed at children under 13 (or the higher minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If we learn that a child has provided personal data, we will delete it and, if an App account exists, close the account. Parents or guardians who believe a child has joined the waitlist or created an account should email hello.sayset@gmail.com.

14. Platform-specific disclosures

• Microphone: requested only for voice workout logging, including the optional onboarding demo. You can decline or revoke access at any time.
• Speech recognition (iOS): used to transcribe spoken sets on-device when available.
• Notifications: local workout reminders only, if you opt in. We do not currently send remote push notifications.
• App Tracking Transparency: SaySet does not track you across other companies’ apps or websites for advertising, and does not request App Tracking Transparency permission for that purpose.
• Website: Vercel Analytics for privacy-oriented page-view metrics. No advertising cookies or pixels for targeted advertising on the site.
• Health data: SaySet does not currently integrate with Apple Health, HealthKit, Google Fit, or Health Connect. Fitness information in SaySet is what you log in the App.

15. Accuracy

We rely on you to provide accurate account, waitlist, and workout information. You can edit logged sets and your display name in the App. If you believe other personal information we hold is inaccurate, including a waitlist email, email hello.sayset@gmail.com.

16. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you in the App or by email where appropriate (including the waitlist email you gave us, if the change affects waitlist processing), and update the “Last updated” date above. Continued use of the App or website after changes take effect means you accept the updated Policy. If you do not agree, stop using the Services, leave the waitlist, and delete your account.

17. Contact us

Questions, requests, or complaints about this Privacy Policy or our privacy practices:

Apterra Development Inc.

Ontario, Canada

SaySet

Email: hello.sayset@gmail.com

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or the privacy regulator in your province or country.