Privacy Policy

Version: 2
Last updated: 1 October 2026
Applies to: the Thrive Android app (net.element22.thrive) and the Thrive backend server software.

• Developer and publisher: Element22
• Contact: thrive@element22.net
• Primary instance: operated by Element22 on self-hosted hardware in Ontario, Canada

1. Two different parties

Thrive has two halves, and it matters which one you are dealing with.

Element22 wrote the Thrive app and the backend server software, and publishes the app. Element22 also operates the primary instance — the server most users connect to.

An instance operator is whoever runs the backend server your app talks to. Thrive is self-hosted software: anyone can run their own instance on their own hardware. For the primary instance, the operator is Element22. If you connect to a server run by somebody else, that person is the operator and the data controller for everything you put into it, and Element22 has no access to it, no control over it, and no responsibility for it.

You choose which server the app talks to by typing its address into the app. It never talks to any other one.

2. What Element22 receives

Crash reports, unless you turn them off. Nothing else.

• Thrive contains no analytics SDK, no advertising SDK, and no usage telemetry. Nothing records which screens you open, which features you use, or how long you use them.
• Thrive does contain one reporting SDK: Firebase Crashlytics, which sends Element22 a report when the app crashes. That report is the only thing the app sends anywhere other than your own instance, and the only data Element22 receives from instances it does not operate. §2.1 says exactly what is in one, and how to switch it off.
• There is no Element22 cloud collecting usage, health data, or device identifiers from Thrive installations.
• Apart from crash reports, the app sends your data to exactly one place: the server address you entered. If that server belongs to someone else, Element22 never sees any of it.
• Element22 does not sell data, does not share it with advertisers, and does not use it to profile you or train any model. Crash reports are used to fix bugs, and for nothing else.

2.1 Crash reports

When Thrive crashes, Crashlytics sends Element22 a report so the fault can be found and fixed. Without it, a crash that affects every user is invisible to us unless somebody happens to describe it in enough detail to reproduce.

A report contains:

• The stack trace — the position in Thrive's own code where the crash happened, and the error message that caused it.
• Device and app context — device model, Android version, Thrive's version, available memory and storage, whether the app was in the foreground, and how long it had been running.
• A Crashlytics installation identifier, generated by Google for this app on this device. It is not your Thrive account, your username, your email, your advertising ID, or any hardware serial number, and it is replaced if you reinstall Thrive or clear its data.

A report does not contain your health data, meals, workouts, photos, messages, cycle entries, location, password or authentication tokens. Thrive attaches no account information to it, and adds no logging of its own to the report.

One honest caveat: because a report includes the error message, and a network error names the address it was trying to reach, a crash during a request can contain your instance's server address and the API path involved — for example https://<your-server>/leaderboard. It never contains the request body, the response, or your credentials.

Crash reports are processed by Google (Firebase Crashlytics) on Element22's behalf, and Google retains them for 90 days.

You can turn this off. Settings → Privacy → Crash reporting. With it off, nothing is sent, no installation identifier is registered, and any report still waiting on your device is deleted. Every other part of Thrive behaves exactly the same. The setting is per device, deliberately: it is consent to describe this device, so it is not synced to your account and cannot be switched back on from somewhere else.

If you use the primary instance, then Element22 is also your instance operator, and Sections 4 onward describe what is stored there.

3. At a glance

• Your data lives on a single self-hosted server, not spread across a commercial cloud.
• Health data is read from Android Health Connect with your explicit permission, and is only sent to your server when Thrive syncs.
• Thrive also writes a small, specific set of records back to Health Connect — only the workouts, activities and GPS routes you record in Thrive (see §5.2).
• The AI features run on a model hosted on the instance operator's own infrastructure. Your photos, workouts, meals and health figures are not sent to OpenAI, Google, Anthropic, or any other AI provider.
• Progress photos, their AI analyses, and cycle-tracking notes are encrypted at rest with a per-user key.
• You can view, export, restrict the visibility of, and delete your data from within the app.
• The one thing that leaves your instance is a crash report to Element22 when Thrive crashes, which you can switch off in Settings → Privacy (see §2.1).

4. Information you provide

• Account details: username, display name, optional email address, optional phone number, and password.
• Body profile (optional): height, date of birth, biological sex, and activity level — used to personalise goals and estimates.
• Goals and preferences: daily targets (steps, calories, protein, water, sleep and wake times, weight target) and app settings (theme, accent colour, font, units, layout choices, reminder times).
• Nutrition and lifestyle entries: food and water logs, saved foods and meals, recipes, meal plans, grocery lists, and workouts you log in the app.
• Body measurements and progress photos (optional): measurements you type in, and photos you choose to take or upload.
• Social content: profile photo, cover image, friend requests and connections, activity-feed posts, reactions and comments, and participation in challenges, adventures and games.
• Messages: direct messages, party (group) messages, message attachments and reactions.
• Security data: if you enable two-factor authentication, a TOTP secret and one-time recovery codes are generated; if you set up account recovery, your security-question answers are stored as salted hashes.
• Integration credentials (optional): if you connect Hevy, the Hevy API key you supply.
• Legal acceptance: the version of this policy and of the Terms of Service you accepted, and when.

5. Health & fitness data (Health Connect)

5.1 What Thrive reads

With your explicit permission, granted through Android's Health Connect system screens, the app reads:

• Steps
• Active calories burned and total calories burned
• Distance
• Sleep, including sleep stages
• Heart rate, resting heart rate, and heart-rate variability
• Weight
• Height
• Body composition — body fat, lean body mass, bone mass, body water, basal metabolic rate
• Exercise sessions, including the name of the app that recorded them (a watch, Strava, Hevy, …)
• Exercise routes (GPS traces) recorded by other apps — only for the individual session you open, and only after Health Connect shows you its own per-route consent dialog
• Menstruation records — only if you turn cycle tracking on (see §8)

Two further permissions change when and how far back Thrive can read, not what:

• Health data history — lets your first sync back-fill history beyond Health Connect's default 30-day window. Declining only limits that back-fill.
• Health data in the background — required by Android for any read made while Thrive is not the app on screen. Without it, background sync silently does nothing. It is requested separately from the Health Connect settings screen, never bundled into the first-run grant.

You can revoke any of these at any time in Health Connect settings.

5.2 What Thrive writes

Thrive writes back to Health Connect only what you record in Thrive itself, so those activities count toward your day in other apps:

• Exercise sessions for workouts you log in the app, activities you log with the activity logger, and activities you record with GPS tracking.
• Estimated active calories for those sessions.
• The GPS route attached to an activity Thrive recorded itself.

Thrive never modifies or deletes records written by other apps, and never writes imported data back (a route imported from another app is never re-written as a Thrive record).

5.3 Android permissions

6. Information the app holds on your device

• Authentication tokens, encrypted with the Android Keystore, so you stay signed in.
• A cache of recently viewed screens (dashboard, nutrition, feed, profile, notifications, conversations) so the app opens instantly and works with the server unreachable.
• An offline outbox of entries you made while offline, held until they can sync.
• Your app settings, some of which sync to your account so a reinstall or a second device restores them.
• Network state, read to decide whether to show the offline banner.
• A Firebase Cloud Messaging registration token (see §11).
• A Crashlytics installation identifier, and any crash report not yet sent, while crash reporting is on. Turning it off deletes both (see §2.1).

The app does not collect advertising identifiers, contacts, device fingerprints, or your location outside an activity you are actively tracking.

7. What the server stores

When you sync, your instance's server stores the data needed to provide the service, associated with your account:

• Account & security: username, optional email and phone, display name, role, account timestamps, the app version and rough last-active time of your most recent session, and the version of the legal documents you accepted. Passwords are stored only as a salted Argon2id hash — never in plain text. Two-factor secrets are stored so logins can be validated; recovery codes and security-question answers are stored only as hashes.
• Sessions: refresh tokens stored as hashes (revocable), with the IP address and user-agent of the device that created the session, for security and session management.
• Health samples: the metrics in §5.1, with their timing, value and originating source app.
• Activities and routes: recorded and imported activity sessions, including GPS coordinates, per-point timing, heart rate and pace.
• Nutrition & lifestyle: food logs (with macro- and micronutrients), water logs, workouts, saved foods and meals, recipes, meal plans, recent foods and grocery items.
• Body profile, goals, readiness and derived metrics, and synced app settings.
• Body measurements and progress photos. Photo image data and any AI analysis of it are encrypted at rest (AES-256-GCM, per-user key).
• Cycle tracking (opt-in): cycle dates and predictions; symptom, mood and note details are encrypted at rest with the same per-user scheme.
• Social: friendships, profile and cover images, activity-feed events, reactions and comments, per-metric privacy settings, badges, XP and level, and challenge/adventure/game participation and results.
• Messages: conversation membership, message text, attachments, reactions and read markers. Messages are not end-to-end encrypted — they are stored on the instance's server, and whoever administers it has database access.
• Notifications: the notification records shown in the app, and whether each was delivered by push.
• Hevy integration (optional): your Hevy API key, stored so the server can pull your workouts on your behalf, together with the synced workout, exercise and set data.
• AI history (optional): the prompts you ran and the responses returned, so the AI hub can show your past sessions.
• Audit log: security-relevant actions (sign-in, password change, registration, acceptance of these documents, and similar), which may include the associated IP address, kept for security and abuse prevention.

A note on the Hevy API key. It is stored in a form the server can use to call the Hevy API on your behalf. Treat any instance and its database backups as sensitive.

8. Cycle tracking

Cycle tracking is off by default and only ever enabled by you. When it is on:

• Your logged period dates, predictions, symptoms, moods and notes are stored on your instance.
• Symptom, mood and note details are encrypted at rest under a key derived per user, so they cannot be read from a database dump without the server's key material.
• Menstruation records are imported from Health Connect only after you separately grant that permission.
• Cycle data is never shared with other users, never shown on the activity feed, and never used in leaderboards.
• Turning the feature off stops further collection; you can delete individual logs from the app.

9. Photos and camera

• Food photos you take for AI logging are uploaded to your instance's server and passed to the self-hosted vision model there (see §10). The plaintext image exists only in the server's memory while it is analysed.
• Progress photos are encrypted at rest on the server and are not visible to other users unless you explicitly turn that on (off by default).
• Profile and cover photos are visible to other users on your instance — that is their purpose.
• Message attachments are visible to the members of that conversation.
• Barcode scanning runs entirely on your device; camera images are never transmitted for it.

10. The AI features

The AI features (food-photo logging, recipe scanning, body-progress analysis, the training, sleep and cycle coaches, and "analyze my data") are optional, can be turned off entirely in Settings, and on some instances must be enabled per user by an administrator.

• They run against a language/vision model hosted on the instance operator's own infrastructure. No AI vendor receives your data — not OpenAI, Google, Anthropic, or anyone else.
• What is sent to that model is the specific input for the feature you ran: the photo, or a summary of the relevant workouts, meals, sleep or health figures.
• The statistics the AI features report ("Analyze my data", trends, personal records) are computed deterministically by the server. The model is used for wording and interpretation, not to invent numbers.
• Your prompts and the responses are stored in your AI history so you can revisit them; you can delete individual sessions.
• AI output is not medical advice. See the Terms of Service.

11. Notifications and push

Thrive delivers notifications two ways: a background poll to your own server, and — when the instance has it configured — Firebase Cloud Messaging (FCM), a Google service.

When FCM is in use:

• Your device registers an FCM token with Google, which the server stores so it can address your device.
• The notification's content (for example, "Alex sent you a message", or a game invite) passes through Google's infrastructure to reach your device. Push notifications are not end-to-end encrypted.
• If the instance has not configured FCM, no push is sent and notifications arrive only via the poll.

You control which categories of notification Thrive sends in Settings, and can silence individual games.

12. Visibility & sharing between users

Thrive is multi-user, so some data can be visible to other people on the same instance — but only as you allow:

• Profile basics (username, display name, profile/cover image, level) are visible to other users so social features can work.
• Per-metric privacy controls decide which health metrics, if any, friends can see — for example on leaderboards and on your profile. Nothing beyond what you enable is shared.
• Nutrition diary visibility to friends is a setting you control.
• Progress photos are hidden from friends by default.
• Badges are visible by default and can be hidden.
• Activity-feed posts, reactions and comments are visible to your friends.
• Games (bingo, duels, races, territory, tug of war, poker) show the participating players the activity figures the game is scored on.
• Messages are visible to the members of the conversation.
• Friend lists can be viewed by other users on the instance, and friend discovery by username search can be disabled server-wide by an administrator.

No data is shared with users on other instances — each server is independent.

13. How your data is used

Your data is used solely to provide Thrive's features: to show your dashboard, trends and diary; to calculate goals, streaks, readiness, badges, XP and game standings; to power the social and messaging features subject to your privacy settings; to send the notifications you have opted into; and to authenticate you and keep your account secure.

Under Canadian privacy law (PIPEDA), the basis for collecting and using this data is your knowledge and consent, given by accepting this policy, granting Health Connect permissions, and turning individual features on. Where GDPR or UK GDPR applies to you, the lawful bases are your consent (health data, cycle tracking, photos, AI features), performance of a contract (running the account and its features), and legitimate interests (security, abuse prevention, keeping the service working). You can withdraw consent by turning a feature off, revoking a Health Connect permission, or deleting your account.

14. Third-party services

To provide certain features, the server (and in some cases the app) contacts these external services. Thrive sends the minimum needed and never sends your account credentials or full health record.

Each of these has its own privacy policy and processes what it receives under its own terms. Health Connect and on-device barcode scanning are governed by Google's terms. Element22 is not responsible for how a third-party service handles what it receives.

15. Where data is stored & how it is protected

• Data is stored in a PostgreSQL database on the instance's server. The primary instance runs on self-hosted hardware in Ontario, Canada.
• The app talks to the server over HTTPS/TLS.
• Passwords use Argon2id; refresh tokens, 2FA recovery codes and security-question answers are stored only as hashes; access uses short-lived signed tokens with revocable refresh tokens.
• Repeated failed sign-ins are rate-limited and backed off.
• Progress photos, their AI analyses, and cycle-tracking details are encrypted at rest with AES-256-GCM under a key derived separately for each user.
• On your device, session tokens are encrypted with the Android Keystore.

No method of transmission or storage is completely secure. On an instance you do not run yourself, your data's safety also depends on how that operator configures and maintains their server.

16. Retention & deletion

• Your data is retained while your account is active.
• You can delete your account from within the app, in Settings → Account & security → Delete account. If you no longer have the app, write to thrive@element22.net from the email address on the account; the steps are also at https://thrive.element22.net/delete-account.
• What deletion erases, immediately and permanently: your health samples, activities and GPS routes, workouts, food, water and meal records, body profile, measurements and progress photos (and their AI analyses), cycle-tracking data, sleep and health-age history, discoveries, AI history, goals, settings, notifications, your profile and cover images, your friendships, your activity-feed posts (with the reactions and comments on them), badges, XP, your companion, your Hevy connection and synced Hevy workouts, and every sign-in credential: password, two-factor secret, recovery codes, security answers, sessions and push tokens.
• What remains, shown as "Deleted user": the messages you sent, your comments and reactions on other people's posts, and your turns and results in games and challenges you played with others. These are part of conversations and games that other people still take part in, so removing them would remove part of their history. Your account record is kept only as an empty placeholder they point to: your username is released for reuse, and your email, phone, name, password and profile details are cleared. The audit log of security events (§7) is also kept, for security and abuse prevention.
• On the primary instance, backups are encrypted, retained on a rolling basis, and aged out within 90 days, so deleted data is fully gone from backups within 90 days of deletion. To have the messages and game records that remain removed as well, write to thrive@element22.net.
• On another operator's instance, their retention practice is theirs to state.
• You can export a copy of your data at any time from Settings → Account & security → Export my data.

17. Children's privacy

Thrive is not directed at children and accounts are for people aged 16 or over, as set out in the Terms of Service. Element22 does not knowingly collect data from anyone younger on the primary instance; if you believe a child has created an account there, write to thrive@element22.net and it will be removed.

18. Your rights

Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal data, to object to certain processing, and to withdraw consent.

• On the primary instance, direct those requests to thrive@element22.net. Canadian users may also complain to the Office of the Privacy Commissioner of Canada.
• On any other instance, direct them to that instance's operator — Element22 cannot access, correct or delete data held on a server it does not run.

You can also exercise much of this directly in the app: edit your profile, change privacy settings, export your data, revoke Health Connect permissions, disconnect Hevy, turn off the AI features, or delete your account.

19. If you run your own instance

Running the backend yourself makes you the operator and the data controller for everyone on your server, including yourself. That means:

• You are responsible for complying with the privacy laws that apply to you. You are handling health data, which nearly every privacy regime treats as sensitive.
• You must publish your own privacy notice. You are welcome to adapt this document, but replace the Element22 contact details, hosting location and retention practice with your own, and do not represent Element22 as responsible for your instance.
• Element22 has no access to your server, is not your processor or service provider, and holds none of your users' data.
• One exception, and you must tell your users about it: the published app sends crash reports to Element22, not to you (§2.1). You do not receive them and cannot switch them off on your users' behalf — each user controls it on their own device in Settings → Privacy.

20. Changes to this policy

This policy may change as the software changes. The Version and Last updated fields at the top record the latest revision. When the version number changes, Thrive asks you to review and accept the updated documents the next time you open the app, and you can re-read both at any time from Settings → Legal.

21. Contact

• Developer and publisher: Element22
• Email: thrive@element22.net

For an instance Element22 does not operate, contact that instance's operator instead.