Privacy Policy
Last updated: October 16, 2026
This policy explains what data the Chócala app collects and what we do with it. It’s written in plain language on purpose. It covers the Chócala app and this website, chocala.mx, which uses no cookies or analytics of any kind.
What we collect
Your account. Your email address and the display name you choose. Authentication uses Amazon Cognito over SRP, so your password never reaches our servers and we cannot see it.
If you sign in with Google or Apple instead, that provider shares your email address and name with us to create the account — we never see your Google or Apple password, and we don’t post or read anything on those accounts.
Your training. The workouts you log: movements, weights, reps, times, rounds, your rate of perceived exertion (RPE), session duration, and any notes you write.
Body measurements (optional). If you use the nutrition calculator, we store sex, age, weight, height, activity level, and goal. If you don’t use it, we don’t collect any of this.
Health data from your phone or watch (optional). If you connect Apple Health (iPhone) or Health Connect (Android), Chócala reads the workouts recorded there: the type of session, when it started and how long it lasted, heart rate, distance, calories burned and elevation gained. We use it for one thing: so you can attach a session your watch recorded to the matching entry in your training log instead of typing it in. When you open the import screen we list your recent sessions, and we save only the ones you choose, with that workout, in your account. It is read-only — we never write anything to Apple Health or Health Connect — and we don’t use this data for advertising or share it with third parties. You can turn access off at any time in the app or in your phone’s Health / Health Connect settings; sessions you already imported stay in your log until you delete them.
Photos (deleted within 24 hours). If you photograph a whiteboard or notebook so the app can turn it into a workout, the image is sent for analysis, held only while the conversion job runs, and automatically deleted within 24 hours at most. We never keep your photos, and the app has no photo library or gallery storage of any kind.
Social activity. Comments, reactions, who you follow, your gym, and your leaderboard participation when your gym enables it.
Attendance. If your gym uses QR check-in, we record the date and time you checked in.
AI usage. Request counts, token counts, and cost. We use these to enforce spending caps and detect abuse — not to profile you.
What we don’t collect
- No tracking cookies and no third-party analytics SDKs.
- We don’t collect your location.
- We don’t access your contacts, your full photo library, or your microphone.
- We don’t sell your data. To anyone, ever.
- There is no advertising in the app, so nothing goes to advertisers.
How we use AI
Chócala uses Anthropic’s Claude models via Amazon Bedrock (us-east-1 region) for three things: converting workout text into structured data, reading photos of whiteboards, and generating training programs.
The text or image you submit is processed and the result is returned. That content is not used to train AI models and Bedrock does not retain it.
AI can be wrong. The programs and analyses it produces are suggestions, not medical or professional health advice.
Who can see your data
Your gym. If you belong to a gym, its coaches and owner can see your training activity at that gym. That’s how the product works — your coach needs to see your work in order to coach you.
Other members. Only what you post: comments, reactions, and your score on leaderboards your gym has enabled. You can mute any member and report comments from inside the app.
Us. Only to operate the service and respond to problems.
Where your data lives
Amazon Web Services, us-east-1 (United States). If you are in Mexico, this means your data is transferred outside the country. By using the app you consent to that transfer.
How to delete your account
In the app: Profile → Delete account. This erases your entire training history, measurements, comments, follows, and sign-in identity in a single operation.
If you no longer have the app installed, request it at chocala.mx/en/delete-account.
After deletion we retain de-identified AI usage totals (request, token, and cost counts per day) keyed to a one-way hash that cannot be reversed to identify you. We use them to detect service abuse. They contain no email, no name, and nothing about your training.
Your rights
If you are in Mexico, Mexico’s Federal Law on Protection of Personal Data Held by Private Parties gives you ARCO rights — to access your data, rectify what is inaccurate, cancel what you consider unnecessary, and object to its processing.
Access and rectification are available directly in the app. For cancellation, objection, or to withdraw consent, email us at the address below. We respond within 20 business days.
Children
Chócala is not directed at children under 13 and we do not knowingly collect their data. Minors aged 13–18 must have a parent or guardian’s consent.
Changes
If we change something material, we’ll update the date above and announce it in the app before the change takes effect.
Contact
Data controller: Evan O’Connor. Email: chocala@infralista.com