Privacy Policy

Almost all of it comes from you: during onboarding, in Preferences, or when you tell Ember something. We don’t buy data about you, and we don’t run advertising trackers. We do count page views, with a cookieless measurement that tells us which pages people read rather than who read them.

Your birth date, sex, weight, allergies, and injuries are sensitive, and we treat them that way. We collect them for one reason: the math and the safety checks don’t work without them. Your age, sex, height, and weight produce your calorie target. Your allergies and injuries become hard rules that every recipe and every workout is checked against in code before you ever see it, including anything Ember adds or changes at your request. What you log as eaten is health information too, and it gets the same treatment: it is only ever yours, it never reaches the feed, a leaderboard, or a challenge, and Ember reads it only to help you.

We are not a medical provider, and Let's Get Hot is not a medical record. We don’t share this information with insurers, employers, advertisers, or data brokers. Not ever.

Your plans are generated by OpenAI. Before anything is sent, we build a deliberately anonymous summary in a single place in our code: your nutritional targets, restrictions, allergies, injuries, preferences, and equipment. Your name, email address, and account ID are excluded by design and never leave our servers as part of a generation request.

Ember, the coach you can talk to, runs on two providers rather than one. ElevenLabs runs the conversation itself, and an OpenAI model writes the replies. When you ask Ember something, your message and the parts of your plans and food log Ember needs to answer are sent to ElevenLabs and on to OpenAI, along with that same anonymous summary. That is true whether you type or speak. We still never send your name, email, or account ID ourselves. What you write or say is sent as you said it, so if you tell Ember your name, both of them see it in your message.

Ember can read your plans and your food log, and it can change your plans when you ask. Every change passes the same allergy, injury, and equipment checks in code as a week we built for you, and nothing changes until you tap Apply. It cannot log steps or workouts, and it cannot join, score, or alter a challenge or a leaderboard, for you or for anyone else.

Talking to Ember out loud sends your microphone audio from your device to ElevenLabs, which turns it into text and turns Ember’s reply into a voice. No recording is kept and no voiceprint is made from it. ElevenLabs holds the written transcript for thirty days so a problem you report can be looked into, then deletes it. The microphone is off until you tap it, and we ask you once before the first time.

A photo you show Ember, or take from the food log for the app to read, goes to OpenAI instead, to work out what is on the plate or which machine you are looking at. A photo you add to an entry yourself, or keep with a saved food as its label, is not read: it goes to OpenAI only to be checked against our rules. When you look a food up by name, that name alone goes to USDA FoodData Central, a public-domain database run by the United States Department of Agriculture, to fetch its calories and nutrients. Nothing else about you goes with it.

Food photos the app read are kept, with the entry they made, so the plate shows beside its numbers in your log. We may also use them, together with what the app read in them and what you confirmed was on the plate, to improve how the app reads plates. A photo you add to an entry yourself is not read and is never used this way: it is kept only to show beside that entry. That work never carries your name, your email or anything else from your account, and the photos are never shown to other members or used in marketing. Delete the entry and the photo goes with it.

Ember can also read recipes from the web, in two ways. If you paste the address of a recipe page, or ask Ember to find recipes online, our server fetches the pages and reads the recipe each one publishes as structured data, so the site sees a request from us rather than from your device. A dish you ask for online goes to OpenAI’s web search to find those pages. Only the ingredients and steps are read; they are shown to you with the site’s name and a link back, they pass the same allergy and kitchen checks as a recipe we write, and nothing from the page is stored. When a page prints no nutrition figures, its ingredient list goes to OpenAI to estimate them, and the card says the figures are an estimate.

A meal the app read from a photo can be matched to the menu of the restaurant you chose for it, when you ask. The restaurant’s name and town and the foods seen on your plate go to OpenAI’s web search to find its menu; our server fetches up to three of those pages, a menu PDF included, so the sites see a request from us; and the text of those pages goes to OpenAI with the foods, how much of each, and any note you wrote, to find the dish. When the menu prints only some of a dish’s figures, or none, its name and its line on the menu, the serving and calories the page names, and the foods with how much of each go to OpenAI again to estimate the rest, and the entry says which figures are the menu’s and which are estimates. A dish is offered only when its line is really on the page, and a figure only when the page prints it with that line. The dish you pick is kept with the photo of that meal for as long as the entry: its name, the line the menu prints for it, any figures printed beside that line, and the address of the page. Nothing else from a page is kept.

Some challenge notifications, such as a daily goal met or a move into the prize range, can have their wording chosen by Ember from a set of messages we wrote. The model sees what changed and a few counts, like how many days you have completed and how many are left. It never sees your name, the challenge name, your step counts, or anyone else in the challenge, and it cannot write a message of its own: it picks one of ours or suggests sending nothing. Whether you are told at all is decided by our own rules first.

OpenAI processes all of these requests through its business API, which does not use submitted data to train its models. Dish photos are generated from a recipe name and description only, and are cached and reused across all users. The images are not personal to you. OpenAI also checks reviews, comments, community notes, and uploaded photos against our rules before anything is published.

These are our service providers. We don’t sell your personal information, and we don’t share it for advertising or cross-context behavioural targeting.

• Kroger

  Prices your grocery list at a real store, and fills your cart if you link your Kroger account

  Your ZIP code (if you type one, or fill it from your approximate location) and ingredient names, to find your nearest store and its shelf prices. Never the location itself. If you connect your Kroger account, we hold an access token that can add items to your cart, encrypted at rest and deleted the moment you disconnect or delete your account. We never see your Kroger password, your payment details, or what you buy: the token can add to a cart and nothing else, and checkout happens on Kroger’s own site.

• OpenAI

  Generates your meal plans, workouts, and dish photos; writes Ember’s replies; identifies the food and gym equipment in photos you show Ember; picks the wording of some challenge notifications; checks reviews, comments, foods you share with the community, and uploaded photos against our rules

  For plans: your calorie target, goal, budget, dietary restrictions, allergies, food likes and dislikes, injuries, fitness level, and equipment. For Ember: your messages, the photos you attach, a transcript of anything you said out loud, the parts of your plans and food log Ember needs to answer, a dish you ask it to find online (to OpenAI’s web search), and the ingredient list of a recipe page it read when that page prints no nutrition figures, plus that same summary. For a restaurant’s menu you look up for a meal: the restaurant’s name and town and the foods seen on your plate (to OpenAI’s web search), then the text of the menu pages found, those foods with their portions and any note you wrote on the photo, to pick the dish on them, and, when the menu does not print all of the dish’s figures, the dish’s name and its line on the menu, the serving and calories the page names, and those foods with their portions, to estimate the rest. For challenge notifications: what changed (for example, a daily goal met), how many days of the challenge you have completed and how many are left, how many challenge notifications you had in the last day, and our own fixed messages to choose between. For moderation: the text or photo being checked. Never your name, email, or any account identifier from us, though anything you type or say to Ember is sent as you said it.

• ElevenLabs

  Runs your conversations with Ember, typed and spoken: carries the conversation to the model that answers, and speaks the replies out loud

  Your messages to Ember and Ember’s replies, and the parts of your plans and food log Ember needs to answer. When you tap the microphone, your audio as well, streamed straight from your device, which means ElevenLabs also sees your device’s IP address for that connection. Nothing from your account goes with it: no name, no email, no weight, and no calorie target. No recording is kept and no voiceprint is made from your voice; ElevenLabs holds the written transcript for thirty days, then deletes it.

• USDA FoodData Central

  Looks up the calories and nutrients for a food you search for by name

  The food name you typed, and nothing else. No account identifier, no cookie, and no other part of your log. It is a public-domain reference database run by the United States Department of Agriculture, and we cache what it returns so the same food is only ever looked up once.

• KLIPY

  Supplies the GIFs you can add to a comment

  The words you type into the GIF search and your app language, sent from our servers rather than your device, with no account identifier. When you post a GIF we store which one it was with your comment. The GIFs themselves load from KLIPY’s servers, so KLIPY sees the IP address of the device showing one, as any website sees a visitor. We keep a copy of what a search returned for up to six hours, so a repeat search is not asked again.

• MongoDB Atlas

  Stores the database

  Everything listed above, encrypted in transit and at rest.

• Vercel

  Hosts and serves the application, counts page views, and measures page speed

  Standard server request logs, including IP address, plus cookieless page-view counts: the page, where the visit came from, rough device and country, and how quickly the page loaded. No cookie is set, and nothing in it names you.

• Cloudflare R2

  Stores the images: dish photos, any photo you attach to a review, the food photos behind your log, label photos you share with the community food catalog, your workout photos, and your progress photos

  The image files themselves, and nothing that says whose they are. Your progress photos arrive already encrypted under your own key, so Cloudflare holds bytes it cannot read. Every image is served through this app rather than from Cloudflare directly, so your browser never contacts them and they never see your IP address.

• Resend

  Delivers our email

  Your email address and the contents of the message. That means password resets, weekly plan notices, giveaway and business emails, and anything you send us through the contact form. For giveaway and business emails, Resend tells us whether each one was delivered, delayed, bounced or marked as spam.

• Stripe

  Sells the website subscription through Link as the merchant of record: takes the payment, collects and remits sales tax, and handles refund requests

  Your email address, payment details and the billing location it needs to work out sales tax, which you enter on Stripe’s own checkout page. As the seller, Stripe keeps its own record of the sale under its own privacy policy.

• Google (YouTube)

  Serves optional exercise tutorial videos

  Nothing until you tap a video. When you do, YouTube receives the request in privacy-enhanced mode.

• Google (Firebase Cloud Messaging)

  Delivers push notifications to the Android app

  A device token that identifies your installation, plus the title and text of the notification. Nothing is sent unless you turn notifications on.

• Google (Maps)

  Draws the map under a route on your own workout page

  The area of the map on your screen, as the map pieces your device asks Google for, and your device’s IP address, as any website sees a visitor. The route line itself is drawn on your device and never sent to Google. Nothing loads from Google Maps anywhere else in the app.

• Google (Address Validation and Places)

  Checks and suggests the delivery address a giveaway winner gives us

  Only for giveaway winners, on the claim page. The Address Validation API receives the street address, apartment or suite, city, state and ZIP code you typed, to check and standardize them. The Places API receives what you have typed in the street address field, a random session identifier, the center point of the ZIP code on the claim form or your profile, and, if you pick a suggestion, that suggestion’s identifier. Never your name, phone number, email address or any account identifier.

• Google (Places, for restaurants)

  Lists the restaurants near a meal you photographed, when you ask it to

  Only when you tap Find restaurant on a meal the app read and agree to the line shown first. The search sends either a point, which is your phone’s precise location read once at your tap or the location saved inside the photo you chose, or the name you typed, and asks for each place’s name, address, location and type. The point is not kept. We keep the places Google lists, by their identifier with their name, address and type, for up to 30 days, and your entry keeps only the identifier of the one you pick. To show that name after the 30 days, we send Google the identifier alone and keep its answer the same way. When you look up the restaurant’s menu, we send the identifier alone again to ask for its website, kept the same way for up to 30 days. That copy holds nothing about you. Separate from the address check above.

• Your browser vendor

  Delivers push notifications on the web

  Apple, Google, or Mozilla relay the notification to your device if you enabled notifications in a browser or the installed web app.

• PayPal

  Pays affiliate commissions

  Only for creators in the affiliate program, and only the PayPal address they gave us and the amount owed. Nobody else is ever named to PayPal.

• Google (Places, for businesses)

  Finds the listing of a business applying to fund giveaway prizes

  Only for business accounts, while applying. What the business types in the search, the center point of the ZIP code it searches near, and a random session identifier, then the identifier of the listing it picks. We keep only that identifier. The listing’s phone number and website are read from Google when a check needs them. We keep only the website’s domain and the phone’s last four digits, once a check uses them.

• Twilio

  Calls a business’s listed phone number with a code

  Only when a business chooses the phone check. The phone number on its Google listing, never a number anybody types. We keep its last four digits and whether the code was right.

• Stripe (for businesses)

  Bills a business’s plan and its giveaway service fees

  Only for business accounts that pick a plan: the business’s email address, its name and the address it confirmed. Card and billing details are typed on Stripe’s own checkout page, and Stripe sells the plan and the service fees through Link as the merchant of record, collecting and remitting sales tax.

• U.S. Census Bureau (Geocoder)

  Finds where an approved business is, from its address

  Only for business accounts, when staff approve one: the street address the business confirmed. Nothing about any member.

A few features publish information on purpose, and every one is entirely up to you:

• Recipe links. Creating a link publishes that one recipe, with its name, ingredients and steps, to an unlisted web address anyone with the link can open. Nothing about you appears on the page, it isn’t indexed by search engines, and you can switch the link off at any time from the recipe.
• Foods you share with the community. Sharing one of your saved foods from My Foods is your choice, one food at a time, and including its label photo is a second choice of its own. Members see its name, brand, serving and figures, never you or your log. Once your account is deleted, it can’t be withdrawn. Every member with a subscription or a free trial can find it, log it and report it. Before it is listed, its name, brand and serving, and the label photo if you include it, are checked against our rules (see OpenAI below). You can withdraw it from My Foods at any time, and deleting the saved food withdraws it too; an entry another member already logged keeps its own copy of the figures. A food several members report leaves the catalog until we review it. A label photo you shared stays with its food after your account is deleted too.
• Recipe reviews. Posting a review publishes its text, your rating, any photo you attach, and your first name on that dish’s public recipe page. You can delete your review at any time, which removes all of it.
• Workouts in a race. Everyone in this race sees the workouts that count: the day, the activity, how long and how far. In a regular challenge, including one created before this feature was introduced, every racer can open every other racer’s counted workouts in it, day by day: the activity, how long, how far, whether it came from a watch, the coach or the timer, and anything the daily limits left out. In a step race they see each day’s counted steps, whether they came through Apple Health or Health Connect, and how many typed steps were left out. Never the time of day, the route, heart rate, calories, a note, or anything outside the challenge’s dates, and never to anybody who has not joined. Giveaway rules govern those contests separately. Joining a regular race is agreeing to it.
• Shared posts and challenge cards. When you share one of your own posts outside the app, we make a page for it that anyone with the link can open. It shows your first name, your profile photo if you have one, and what that post records, such as a workout’s type, time and distance, a badge, or your place in a race, and never another member’s name, photo, comment or flame, your weight, calories or food log. The first time you share, we tell you this in one line before anything is made. It is not listed by search engines. Apps you send it to fetch the page to show a preview. Removing your profile photo takes it off every post you have shared. Stop sharing, deleting the post or deleting your account turns the link off; a preview an app already fetched can stay there until it refreshes. A challenge card you share is a picture made when you share it: it shows your first name and, once you have agreed to that line, your profile photo, with your place and score, and a finished public race’s card also shows the first three racers’ first names and profile photos where their profiles are public. It keeps the picture it was made with until you delete your account.
• Your profile, leaderboards, and friends. One switch, off unless you turn it on in Settings → Privacy. When on: your profile shows your first name, profile photo, bio and earned badges to anyone with its link, and shows your friends your workouts, steps, races, training streak and activity (the posts the feed already shows them); leaderboards rank you by effort only, meaning workouts finished, 10k-step days and badges, never weight or any health number; and other members can send you friend requests, which you accept or decline. Your profile never shows your weight, goals, calories, food log or progress photos, to anyone, you included. Nothing is indexed by search engines, and switching it off takes your profile, your board entries, and your posts in your friends’ feeds down immediately.
• Businesses you follow. Following a business brings its giveaway stories into your feed and can notify you when its next giveaway opens, subject to your giveaway notification settings. The business and people viewing its profile can see who follows it. Entering a giveaway also brings that business into your feed until 30 days after the giveaway ends; this ends if you leave or are removed. A lasting follow is your choice and never affects entry, winning or claiming a prize. You can unfollow from the business’s profile or Businesses on your profile. Blocking a business removes your follow.
• How your feed is ordered. To put what you have not seen first, we keep a note of which posts reached your screen, and of any you hide. Your feed is ordered from that, from how recent a post is, and from who you flame and comment with; nobody else sees any of it. A note of a post you saw is deleted after 30 days; a hidden post stays hidden until you undo it or delete your account.
• Calendar subscriptions. The private feed URL exposes only meal or session names and dates. Treat it like a password: anyone you give it to can read it.

Entry records, step source identifiers, the saved rules text and reviews, staff notes, and any winner details are visible to authorized Let's Get Hot staff only, and a winner can also see their own prizes and delivery details on the Prize winnings page. For a dispute or an audit, staff can assemble a contest file for one giveaway: its rules text, who accepted which version and when, the standings with each day’s counted steps, how any tie was settled, the staff notes, and the prize records. It names entrants by account identifier and holds no names, email addresses, delivery details or typed names. Other members see the standings and the winner’s first name, as they do in any challenge.

You can view and change everything about yourself on your profile and in Settings (Meal, Training, App preferences). Beyond that:

• Download your data. Settings → Your data exports the records tied to your account as a JSON file. Your prizes and any delivery details we still hold are not in the file; they are on your Prize winnings page.
• Delete your account. Settings → Delete account removes your account and the records tied to it immediately, apart from the few described under How long we keep it. It cannot be undone.
• Clear your approximate location. Settings → Privacy clears the rounded point we keep, if there is one.
• Turn off notifications any time on the Notifications page.

Depending on where you live, you may also have the right to correct your data, object to processing, or lodge a complaint with a data protection authority. To make any request, email support@letsgethot.app.

We keep your information for as long as your account exists, because your plans and history are the product. When you delete your account, we delete your profile, plans, grocery lists, workouts, workout history, saved recipes, weigh-ins, step logs, food log and its photos, conversations with Ember, push subscriptions, profile photo, progress photos (both the encrypted images and the key that opened them), and recipe links right away.

Five things intentionally survive. Cached dish photos, which are shared across all users and contain nothing personal. Records our payment processors must retain for financial and tax compliance, governed by their own policies. If you took part in the creator programme, your commission history: amounts, dates and payment references are financial records, kept so that money already owed can still be paid and audited, with your name and email attached for that purpose. Your referral link stops working immediately. If you won a giveaway, your prize record: what you won, when, its approximate value, its status, and whether a tax form was required. That is a financial record, kept after you delete your account for as long as tax law requires, with your name, email and account identifier removed from it. Your delivery address, phone number and typed name are not part of it. And any food you shared with the community and did not withdraw: members see its name, brand, serving and figures, never you or your log, and once your account is deleted it can’t be withdrawn. A label photo you shared with it stays with it. A food you withdrew is deleted with your account, and one taken out after reports is kept for our review with nothing on it that names you.

We keep your giveaway entry record and your step source identifiers until you delete your account. If you win, we keep your name, delivery address, and phone number until 90 days after we confirm the prize was delivered, and then delete them; you can ask us to delete them sooner, and they go at once when you delete your account. The standings and the steps behind them stay for as long as your account does. When you delete your account, your entry, the record of the rules you accepted and the state you chose, and any staff note about you are removed from the giveaway, any delivery details we still hold are deleted, and your steps, including their source identifiers, are deleted with the rest of your data. The giveaway itself and the entries of the other people in it stay, because they are the record of how the giveaway was run, along with the saved copies of its rules text and the staff review, which hold nothing about you. If you were the creator or the winner, the giveaway keeps the result with no name attached to it.

There is a step-by-step guide to deleting your account, which you can follow even if you have already uninstalled the app.

A business that funds giveaway prizes has its own account, separate from any member’s. It holds no health information. It never sees any member’s steps, standing, location, ZIP, distance or health data. For a prize the business ships itself, it receives the winner’s name, address and phone, once the winner agrees on the claim page, and only until that prize is delivered.

For each winner of its giveaways, a business sees the winner’s public handle, how far the prize has got, the tracking number it entered, and the winner’s thumbs up or down and line once the prize has arrived. At its counter it types or scans a winner’s pickup code to find that prize; the code is looked up only among the business’s own giveaways.

When a business applies, we confirm its email address with a six-digit code we send it, unless Google or Apple has already confirmed the address. To show it runs the business on its Google listing, it can take a call to the listing’s phone number, have us email a link to an address at the listing website’s domain, or ask our staff to check by hand, which can mean a call to the listing’s phone number. We keep a record of the business: its legal name, the identifier of its Google listing, which of these checks passed and when (with the domain or the last four digits of the phone), the agreement and attestation it accepted, and any strikes. The address it confirms is stored as its own.

The business search starts from a ZIP code we guess from the approximate location of the network the request came from. The business sees the ZIP and can change or clear it. Google receives only the center point of the ZIP code in that field, never the network location, and we store neither. This is never done for a member.

A business can instead type itself in: its name, address, phone number and website are kept on its record. Nothing it typed is called or emailed on its word. Our staff find the business on a public record, such as a state filing, a licence or a county DBA record, and call the number listed there; we keep the last four digits of that number and the record it came from. The website is shown on the business’s profile only once our staff confirm it is the business’s own, and the phone number it typed is never shown. Its address is shown only once our staff confirm customers can visit it. When the account is deleted, the phone number it typed is removed from the record.

When a business deletes its account, its profile goes with it. That record of the business is kept for two years, for disputes and chargebacks, and then deleted, with the account identifier and the names of the people who applied and signed removed.

A business on a plan has a record of what it paid: each plan payment and service fee, its amount, the tax on it, the date and Stripe’s reference for it. That record is kept after the account is deleted, like the record of the business, since it is a financial record. A business’s yearly statement lists its giveaways’ winners by their public handle only, never by name, address or any tax detail.

Passwords are hashed with bcrypt and never stored in readable form. Traffic runs over HTTPS, and the database is encrypted in transit and at rest. Access to private data is always scoped to your signed-in session on the server, never to an ID the browser can change. No system is perfectly secure, but we keep the amount of data we hold deliberately small.

Let's Get Hot is not intended for anyone under 13. Signing up asks you to confirm you are 13 or older, and a date of birth younger than that is refused. If you believe a child has created an account, email us and we will remove it.

If we change how we handle your information in a meaningful way, we’ll update the date at the top of this page and tell you in the app before the change takes effect.

Questions? Email support@letsgethot.app. See also Cookies & device storage and our Terms of Service.