HEZI OÜ
Privacy Policy
What personal data hezi collects, why, who it is shared with, how long it is kept, and the rights you have.
Last updated: 27 October 2026
In short
- We collect what hezi needs to plan your training: your account, your basketball profile, your schedule and what you log.
- Body, sleep, food and injury information is used only with your explicit consent, and only to plan your training.
- Your data is stored in the European Union. We never sell it and never use it for advertising.
- You can download all your data, or delete your account and everything in it, at any time in the app.
- You must be at least 13 to use hezi. If you are under 16, you need permission from a parent or guardian.
1. Who we are
hezi is a basketball training app and website (hezi.ee) operated by HEZI OÜ, a private limited company registered in Estonia under registry code 17600460, at K. Kärberi tn 17-40, 13918 Tallinn, Estonia.
HEZI OÜ is the controller of your personal data. In this policy, "hezi", "we", "us" and "our" mean HEZI OÜ, and "you" means anyone who uses the app or the website. You can reach us about anything in this policy at info@hezi.ee.
2. What this policy covers
This policy applies to the hezi app for iPhone and to the website hezi.ee, including its waitlist form. It also applies to clubs and coaches who buy a Team plan.
3. Data we collect in the app
You give us almost all of this data yourself, when you create an account, answer the onboarding questions and use the app.
| Data | What it includes | Why we use it | Legal basis |
|---|---|---|---|
| Account | Email address and password. The password is stored only in hashed form; we never see it. | To create your account, let you sign in on any device, and send you emails about your account and subscription, such as confirming your email address or welcoming you to Premium | Contract (GDPR Art. 6(1)(b)) |
| Profile | Name, age, gender, playing position, dominant hand, years of experience, team level, sessions per week, goals, target event date, available equipment | To build a training plan that fits you | Contract |
| Skill self-assessment | Your answers about your shooting, ball handling, finishing, defense, conditioning, strength, jumping and similar | To choose drills that match your level | Contract |
| Schedule | Your team practice days and game days | To plan your week around practices and games | Contract |
| Training activity | Sessions and drills completed, drill ratings, streaks, achievements, practice logs (how hard practice was) and game logs (your stats and notes) | To track your progress and adjust your training load | Contract |
| Body, sleep, food and injury data | See section 4 | See section 4 | Explicit consent (GDPR Art. 9(2)(a)) |
| Profile photo | A photo you choose to add, if any | To show it on your profile | Contract |
| Subscription status | Whether you have Premium, which plan, and when it renews or ends. We never receive your card details. | To unlock Premium for your account | Contract |
| Usage events | Actions in the app, such as app opened, session started or completed, and screens viewed, with device type, operating system, app version and approximate country and city. Your IP address is not stored. After you sign in, these are linked to your account ID, never to your name or email. | To understand how hezi is used and to improve it | Legitimate interests (Art. 6(1)(f)) |
| Crash reports | Error details, device model, operating system and app version. Your IP address and account details are not included. | To find and fix faults | Legitimate interests |
Stored on your device
The app keeps your sign-in session on your phone in encrypted form, your onboarding answers until you create an account, and an identifier used for usage statistics. This storage is needed for the app to work and to measure how it is used.
Device permissions
The app asks for access to your photo library only when you choose a profile photo. It does not access your camera, microphone, location or contacts, does not read data from Apple Health, and does not send push notifications.
4. Body, sleep, food and injury data
Some of the information you give hezi is about your body and health. Under EU law this is special category data, and we use it only with your explicit consent, which we ask for when you create your account.
| Data | Where it comes from |
|---|---|
| Height and weight | Onboarding questions |
| Usual sleep, water intake and eating habits | Onboarding questions |
| Any physical limitation, and a note about it (for example an injury) | Onboarding questions; the note is optional |
| Daily calories, protein, carbohydrates and fat | You log them in the app |
| Daily water and hours of sleep | You log them in the app |
| How you felt after team practice, and how you felt in a game | You log them in the app |
How we use it: to set your daily food, water and sleep targets, to keep your training load safe (for example lighter sessions after a hard practice or around an injury), and to show your progress. We do not use it for advertising and do not share it with anyone except the service providers in section 6 that store it for us, and never with a coach (see section 7).
Withdrawing consent: you can withdraw your consent at any time by writing to info@hezi.ee or by deleting your account in the app. Because hezi cannot plan safe training without this information, withdrawing consent means we delete your account and all its data. Withdrawal does not affect use of the data before it.
Not medical advice: hezi gives training and general wellbeing guidance. It is not a medical service and does not diagnose or treat anything.
5. Data we collect on the website
| Data | Why we use it | Legal basis |
|---|---|---|
| Your email address and the time you joined, if you join the waitlist | To tell you when hezi launches | Consent (Art. 6(1)(a)), which you give by submitting the form |
| Visit statistics: the page viewed, the page you came from, device type, operating system, browser, screen size, and approximate country and city. Your IP address is not stored. | To understand how the website is used and to improve it | Legitimate interests |
| Your IP address and browser details in our hosting provider's server logs | To deliver the website and keep it secure | Legitimate interests |
| Your email address and message, if you write to us | To answer you | Legitimate interests |
No cookies. The website does not set cookies and does not store anything in your browser. Our statistics tool keeps a visitor identifier only in the page's memory, and it disappears when you reload or close the page. The website has no advertising trackers, social media plug-ins or session recordings, and loads no fonts or scripts from advertising networks.
6. Who we share data with
We do not sell personal data and we do not share it with advertisers. We use the service providers below to run hezi. They process data only on our instructions and under data processing terms, except Apple and Stripe, which handle payments as independent controllers under their own privacy policies.
| Provider | What it does for us | Data involved | Where |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | All account and app data, profile photos, waitlist email addresses | Ireland (EU) |
| PostHog | Usage statistics for the app and the website | Usage events, device information, account ID | Germany (EU) |
| Sentry | Crash reports | Error details and device information | Germany (EU) |
| RevenueCat | Managing subscriptions bought through the App Store | Account ID, subscription and purchase status, device information | United States |
| Apple | App distribution and in-app payments | Your purchase and payment details, handled by Apple | Determined by Apple |
| Stripe | Card payments for Team plans on hezi.ee | The buyer's name, email, billing and payment details | Ireland and United States |
| Expo | Delivering app updates | Technical device data, such as app version and operating system | United States |
| Netlify | Hosting the website | IP address and browser details in server logs | United States and global network |
| Google (Workspace) | Our email at info@hezi.ee, and sending the account and subscription emails we send you | Messages you send us, and your email address for the emails we send you | EU and United States |
We may also disclose personal data where the law requires it, for example to a court or a public authority, or to protect the rights and safety of our users.
7. Team plans and coaches
If you join a team on hezi with a team code from your coach or club, your coach can see your name, the sessions you complete, your streak and your training progress, so they can follow the team's work. Your coach cannot see your body, sleep, food or injury data, your notes, or your email address. You can leave a team at any time by contacting us, and your coach then no longer sees your activity.
When a club or coach buys a Team plan, we use the buyer's name, email address, club and team details and billing information to set up and invoice the plan, and the evidence they send us to confirm that the team exists. Legal basis: contract, and our legal obligation to keep accounting records.
8. Transfers outside the EU
We store your app data and waitlist data in the European Union. Some of our providers (RevenueCat, Stripe, Expo, Netlify and Google) are based in the United States or use staff and systems there. Where personal data is transferred outside the European Economic Area, we rely on safeguards recognised by EU law: the EU–U.S. Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses. You can ask us for details of these safeguards at info@hezi.ee.
9. How long we keep data
| Data | How long |
|---|---|
| Account and app data, including body, sleep, food and injury data | Until you delete your account or withdraw your consent |
| Profile photo | Until you remove it or delete your account |
| Usage statistics | Used for up to 12 months; deleted when you delete your account, or earlier on request |
| Crash reports | Up to 90 days |
| Waitlist email address | Until 12 months after hezi launches, or earlier if you ask us to remove it |
| Emails you send us | As long as needed to deal with your request, and no longer than 3 years after our last exchange |
| Team plan invoices and payment records | 7 years, as required by Estonian accounting law |
| Server logs | Up to 30 days |
Deleting your account: in the app, go to Me → Settings → Delete account. This permanently deletes your account, profile, profile photo, schedule, training history, logs and all body, sleep and food data from our database. Deleted data may remain in encrypted backups for up to 30 days before it is overwritten. Usage statistics linked to your account ID are deleted at the same time.
Deleting your account does not cancel a subscription bought through the App Store. Cancel it in your Apple ID settings.
10. Your rights
Under the General Data Protection Regulation (GDPR) you have the right to:
- Access your data and get a copy. In the app: Me → Settings → Download my data exports everything as a file.
- Correct inaccurate data. Most of your profile can be edited in the app.
- Delete your data, in the app or by writing to us.
- Restrict how we use your data in certain cases.
- Object to the use of your data based on legitimate interests, such as usage statistics.
- Data portability: receive the data you gave us in a machine-readable format (the "Download my data" file).
- Withdraw consent at any time, where we rely on consent.
- Complain to a data protection authority.
To use any of these rights, write to info@hezi.ee from the email address of your account. We answer within one month. If we cannot confirm that the request comes from you, we may ask for more information before acting on it.
You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, www.aki.ee, or to the data protection authority of the EU country where you live or work.
11. Children and young players
hezi is made for basketball players aged 13 and over. You must be at least 13 to create an account. If you are under 16, you may use hezi only with the permission of a parent or guardian, and you confirm this when you create your account. A parent or guardian who gives permission also agrees to this policy on the player's behalf.
If we learn that a player under 13 has an account, or that a player under 16 uses hezi without permission, we delete the account and its data. A parent or guardian can contact us at info@hezi.ee to see, change or delete their child's data.
12. Automated decisions
hezi's training engine uses your profile, schedule and logs to choose your drills and how hard each session is. This is how the plan is personalised. It does not make decisions that have legal or similarly significant effects on you, and you are always free to change your plan, train differently or ask a coach.
13. Security
- All data is encrypted in transit between your phone and our services.
- Access rules in our database allow each player to read and change only their own data.
- Profile photos are private: only you can load your photo.
- Passwords are stored only in hashed form.
- On your phone, your sign-in session is stored encrypted, with the key kept in the phone's secure storage.
- The website's waitlist form can add an email address but cannot read the list.
No system is completely secure. If a data breach is likely to put your rights at risk, we will inform you and the data protection authority as the law requires.
14. Changes to this policy
We may update this policy when hezi or the law changes. The current version is always available in the app and at hezi.ee/privacy, with the date of the last update. If a change significantly affects how we use your data, we will tell you in the app or by email before it takes effect, and ask for your consent again where the law requires it.