ShulahPrivacy policy
Last updated 1 October 2026
Who we are
Shulah ("we") is a fitness app for training, food and activity. Contact: privacy@shulah.app.
What we collect
- Account: your name, email address or phone number, and your password (stored only as a one-way hash, never readable).
- Profile: birth date, sex, height, time zone, your goals and settings, and a profile photo if you add one.
- Training: the plans you follow, workouts, sets, weights and notes.
- Food: the meals you log, and products you add to the food catalogue. A photo of your plate, if you use photo analysis, is sent to estimate the meal and is not stored.
- Body and activity: weight entries and daily steps.
- Social: friends, what you choose to share with them, and posts or messages in the community.
- Device: phone model, operating system, app version, a notification token, and a scrambled (hashed) form of your IP address used for security.
- Where you sign in from: each time you sign in we note your IP address and the country it belongs to. The address is kept for 90 days, for security only (to notice a stolen account or abuse), and then deleted; only the owner of Shulah can see it, and each look is recorded. The country is kept with your account so we know where Shulah is used. We never record your precise location from it.
Health Connect and watches
If you connect Health Connect (Android), Shulah reads - only with your permission - steps, calories, sleep, resting heart rate, heart rate, workouts your watch recorded, and weight. Shulah never writes to Health Connect.
- Steps and weigh-ins are saved to your account, like steps and weight you log yourself.
- Sleep, heart rate and watch workouts stay on your phone: they are shown in the app and your weekly report, and are not uploaded to our server.
- You can remove the permission at any time in Health Connect; the app then stops reading and clears what it read.
Data from Health Connect is used only to show you your own activity and progress. It is not used for advertising, not sold, and not shared with anyone except as described on this page. Our use of it follows the Health Connect permissions policy, including its Limited Use requirements.
What we use it for
- To run the app: keep your data in sync across your phones, build your plans and reports.
- To show friends what you chose to share (each kind of activity has its own audience; the default is friends or nobody).
- To send the emails you ask for (sign-in and password codes) and notifications you allow.
- To keep accounts safe and stop abuse.
- To understand, in total numbers, how the app is used, so we can improve it. We do not use outside analytics or advertising tools.
Who else handles it
We do not sell or rent your data. A few services work for us and only receive what their job needs:
| Service | Why | What they receive |
|---|---|---|
| Resend | Sending emails | Your email address and the email's content |
| Google Firebase Cloud Messaging | Delivering notifications | A device token and the notification text |
| Google Firebase Crashlytics | Finding and fixing crashes in the app | The error, the screen it happened on, the app version, the phone model and the app's language - never your name, account or anything you logged |
| Cloudflare | Secure connection to our server | Traffic passes through it, encrypted end to end to our server |
| An AI provider (OpenAI or Anthropic) | Estimating a meal from a photo - only when you use that feature | The photo, without your name or account |
We may disclose data if the law requires it.
Where it is kept, and for how long
On your phone, and on our server over encrypted connections. We keep your data while you have an account. When you delete your account, everything in it is deleted immediately; we keep only one record that an account with that internal id was deleted, with no name, contact details or health data. Backups are overwritten within 30 days.
Your rights
- See and change your data in the app at any time.
- Get a copy: email privacy@shulah.app.
- Delete your account in the app (Profile → Settings → Close account) or see how to delete your account.
- Withdraw any permission (Health Connect, notifications, activity recognition) in your phone's settings.
These follow the Saudi Personal Data Protection Law (PDPL). If you are unhappy with how we handle your data you may also complain to the Saudi Data and AI Authority (SDAIA).
Children
Shulah is not meant for children under 13, and we do not knowingly collect their data. If you think a child has an account, email us and we will delete it.
Changes
If this policy changes in a way that matters, we will tell you in the app before it applies. The date at the top always shows the latest version.