Privacy Policy

Last updated: 10 Nov 2026

Beta. Qimma is in beta. This policy describes how Qimma works today and will be updated as the app develops.

1. Who we are

Qimma is a fitness and training application. Qimma, operated by Araz Mahserejian, Dubai, UAE.

This policy explains what personal information Qimma collects, why we use it, who may process it, how long we keep it, and the choices available to you.

2. Age requirement

Qimma is for people aged 16 or older. We ask for your date of birth during onboarding and use it to check age eligibility.

If we learn that an account belongs to someone under 16, we may restrict or close the account and delete the associated personal data in accordance with this policy and applicable law.

3. Information we collect

Depending on the features you use, Qimma may process:

Account and identity information

name;
email address;
sign-in method and linked authentication identity, such as Google;
account status and security/session information needed to operate authentication.

When you use Google sign-in, Qimma uses only your name and email. We do not request Google contacts, Drive files, birthday, gender or unrelated Google data.

Profile and onboarding information

date of birth;
height;
preferred units;
timezone and week-start settings;
training experience and goals;
optional wearable ownership/preferences;
other profile preferences you choose to provide.

Training and health-related information

workout history;
programs and schedules;
exercises, sets, repetitions, weights, timed work and cardio records;
progress, personal records and derived training statistics;
workout, program and exercise notes;
body measurements such as weight, body-fat information and circumferences;
optional pain, recovery or similar training-related fields that Qimma supports.

Some of this information may be sensitive health-related information. Qimma uses it only for the purposes described in this policy and the features you choose to use.

User-created content and files

profile photo;
user-private exercises;
data exports you request;
other files or content you intentionally upload or create in Qimma.

Connected AI services

If you choose to connect a certified AI client such as Claude or ChatGPT, Qimma may process:

the fact that the client is connected;
permissions you granted;
connection/revocation metadata;
Qimma data requested by that client within the permissions you approved;
audit information about actions performed through that connection.

Qimma does not give an AI client access merely because you have a Qimma account. You must choose to connect it and approve the requested access.

Technical, support and diagnostic information

Qimma may process limited technical information needed to secure the service, diagnose crashes and failures, respond to support requests, detect abuse and measure service reliability.

Ordinary diagnostic logging should not contain passwords, authentication tokens or raw sensitive workout/health data unless a separately approved and consented testing process explicitly requires it.

Optional pilot / AI diagnostic data

During limited testing, Qimma may separately ask you to opt in to detailed diagnostic recording of Qimma-visible AI export/import activity. This consent is separate, optional and off by default. Declining it does not prevent ordinary use of Qimma, and it is not consent for any unrelated processing.

4. How we use your information

We use personal information to:

create and secure your account;
provide workouts, programs, progress tracking and other training features;
personalize units, dates, schedules and profile preferences;
save and display your workout and measurement history;
provide data export and account-deletion tools;
operate connected services you explicitly choose to use;
send transactional emails such as verification, password reset and account-deletion messages;
maintain service reliability, security and fraud/abuse prevention;
diagnose technical problems and crashes;
respond to support requests;
perform optional pilot research only when you have separately opted in.

We do not sell your personal data. Qimma does not show advertising in the product and does not use personal training data to serve ads.

5. Service providers

We use trusted providers to operate Qimma. They may process personal data only as needed to provide their services to Qimma, subject to their own contractual and legal obligations. Current or planned categories include:

Supabase — authentication, database, storage and backend infrastructure. Qimma production data is intended to be stored in Supabase's Mumbai, India region.
Resend — transactional email delivery, including verification, password-reset and account-deletion messages. Click/open tracking is disabled for password-reset emails.
Google — optional Google sign-in when you choose it.
Claude / Anthropic and ChatGPT / OpenAI — only when you explicitly connect those AI clients and approve access to Qimma data.
Sentry — crash reporting and error diagnostics, so we can find and fix problems in the app.

We will update this policy if the provider list or material processing changes.

6. Where data is stored and international processing

Qimma is operated from the United Arab Emirates, while production application data is intended to be stored in Supabase's Mumbai, India region.

Some service providers may process limited data in other countries as part of providing authentication, email, AI connectivity, security, support or diagnostic services. Before public launch, Qimma will complete legal review of the applicable international-transfer requirements.

7. Connected services and AI clients

Connected services are optional. When you connect an AI client:

Qimma shows the verified client name;
Qimma shows the permissions requested;
you decide whether to allow the connection;
the client can access only data permitted by the granted scopes and Qimma's account-isolation controls;
you can revoke a connected AI client from Qimma;
revoking one AI client does not revoke unrelated Qimma sessions or another AI client.

Only certified/allowlisted AI clients may connect in production. Information sent to an external AI provider is also subject to that provider's own privacy terms.

8. Your choices and controls

Depending on the feature and applicable law, Qimma provides or plans to provide the ability to:

view and correct profile information;
edit or correct supported workout, program and measurement information;
download your data through the CSV export feature;
revoke connected AI services;
withdraw separate optional pilot/diagnostic consent;
request account deletion;
contact Qimma with a privacy request.

Additional rights may apply under the law that applies to you, such as rights concerning access, correction, deletion, restriction, objection or complaints to a relevant regulator.

9. Account deletion

How to request deletion

Email qimma.fit@gmail.com from the email address you use to sign in to Qimma and ask for your account to be deleted. Step-by-step instructions are on our Delete your account page. We may reply to confirm the request.

Deletion is completed within 30 days of your request. In-app account deletion from your Profile is coming soon.

Before you ask us to delete your account, you can use Download my data in the app to keep a copy of your records.

What is deleted

Qimma permanently deletes personal data associated with the account, including as applicable: profile and onboarding data; workouts, sets, notes and training history; measurements and body data; programs and schedules; user-private exercises; profile photos and user-owned files; connected AI authorization data; linked Google and other authentication identities; and the Qimma account itself.

Qimma retains only a non-personal record that the deletion occurred. It does not contain your name, email, health/training data or recoverable user content. We email you when the deletion is complete.

10. Backups

Deleted personal data may remain temporarily in encrypted backups for up to 90 days while those backups expire. Backups are not used to return deleted accounts to active service. If Qimma restores an older backup, completed account deletions are re-applied before that environment is used in production.

11. Data retention

While your account is active, Qimma keeps the information needed to provide the features you use unless a shorter retention period is specified. For account deletion, the 30-day completion period and up-to-90-day backup expiry described above apply. Other operational and security records are kept only as long as reasonably necessary for their purpose.

12. Security

Qimma uses technical and organizational safeguards intended to protect personal data, including:

authenticated access;
account-level authorization and database row-level security;
separation between development and production environments;
encrypted network transport;
encrypted backups;
restricted service credentials;
controlled access to production systems;
revocation controls for connected services.

No system can guarantee absolute security. Qimma will continue to review security controls as the product develops.

13. Password reset and account security

Password-reset links are sent through Qimma's authentication/email infrastructure and expire after 1 hour. Reset emails ask you to open the link on a phone with Qimma installed, and click/open tracking is disabled for them. A successful password reset signs out your other active sessions.

14. Changes to this policy

Qimma may update this policy when the product, providers, legal requirements or data practices change. Material changes will be communicated appropriately before they take effect where required. This page always shows the date it was last updated.

15. Contact and complaints

For privacy questions, requests or complaints, contact qimma.fit@gmail.com.

Qimma, operated by Araz Mahserejian, Dubai, UAE.

Depending on applicable law, you may also have the right to contact the relevant data-protection authority.

This website

The qimma.fit website uses no cookies, no analytics or tracking, and no third-party scripts. Fonts are loaded from Google Fonts, which receives your IP address and browser details to deliver them.