Privacy Policy

Effective October 18, 2026

Non Magic operates Mortis. This policy explains what Mortis collects, why it is used, how long it is kept, and the choices available to you.

Data Mortis collects

• Account and identifiers: email address, Mortis user ID, authentication credentials stored as a one-way password hash, and identifiers supplied by a connected wearable provider.
• Profile and user content: username, biography, avatar photo, and provider-supplied workout names, tags, or similar content.
• Health and fitness: HealthKit samples you authorize Mortis to read and health, activity, sleep, and body data delivered by wearable providers you connect through Terra.
• Location and device details: a connected wearable provider's raw delivery can include precise or coarse location, device identifiers or serial numbers, and related metadata.
• Usage and diagnostics: product interaction events, app or server error information, performance diagnostics, and basic device or app context.

Mortis does not use health or fitness data for advertising, cross-company tracking, or recommendation personalization. Health and fitness data is used for app functionality: syncing the sources you choose and showing their connection or sync status. Mortis does not sell personal data.

How data reaches Mortis

Apple Health data is read only after you grant HealthKit permission and is sent directly from the Mortis app to the Mortis backend. It is not routed through Terra. Other wearable services are connected through Terra's browser-based authorization flow. The redirect back to Mortis is only a signal to refresh; signed provider deliveries and authenticated status checks are the source of truth.

Service providers

Mortis uses service providers only to operate and protect the service:

• Google Cloud hosts the backend, database, private object storage, and the public-read bucket holding media attached to posts. Its Firebase Crashlytics and Performance Monitoring services process the app crash reports and sign-in timing described above. On iPhone, Apple Watch and Mac, Google's Firebase App Check confirms with Apple that requests come from the genuine Mortis app; it receives a device attestation, never your account or health data.
• Google, when you choose Sign in with Google, confirms your Google account; Mortis keeps your Google account ID and email and nothing else from Google.
• Apple, when you choose Sign in with Apple, confirms your Apple Account. Mortis keeps your Apple account ID, the email Apple shares (which may be a private relay address), the name you share the first time, and a token Mortis uses to end the connection at Apple when you delete your account.
• Terra connects non-Apple wearable providers and delivers their data. It also receives, and relays to Mortis, the live readings your iPhone or Mac streams as described under How data reaches Mortis: heart rate and RR intervals from a Bluetooth strap on Mac, and steps, step cadence, distance, floors climbed, acceleration and route coordinates from iPhone. Terra also writes a copy of each delivery it sends Mortis into a private Mortis bucket on Google Cloud.
• RevenueCat processes purchase and subscription history linked to your Mortis account.
• Stripe processes card payments for website purchases through RevenueCat, receiving your email, payment details and Mortis account identifier; deleting your account deletes your Stripe customer record, while Stripe keeps the payment records the law requires.
• Apple Push Notification service delivers the notifications and Live Activities you allow. Mortis stores the push tokens your devices issue and bounded delivery-attempt receipts used to prevent duplicate Live Activity starts. Attempts contain delivery metadata, not raw tokens or health readings. Mortis deletes tokens and attempts with your account, and removes a device token when you sign out there.
• Customer.io processes your Mortis account identifier, username, subscription status, a record of the social activity that triggers a notification, and the fact that a practice finished with its length, to send and measure the messages you receive. It also receives your message preferences: whether you want practice reminders and email updates, and the language and time zone your device reports; your email address, username and display name, so it can address messages to you. Customer.io reports back which messages were sent, delivered, opened, clicked, or bounced, and any unsubscribe or spam complaint. Mortis keeps only the kind and time of each report it acts on, for 30 days, to ignore repeats; an unsubscribe, bounce, or complaint turns the matching preference off. Message outcomes reach PostHog as product events. Nothing Customer.io reports is sent back to it. On iPhone, Customer.io's SDK also receives the device's push token, operating system, model, app version, locale, notification permission and the IP address of the device's requests to Customer.io, and fetches in-app messages for your Mortis account identifier.
• PostHog processes product and lifecycle events, the website's page views, clicks, performance and error signals, and session recordings of the app and the account website with inputs masked and passwords, recovery codes, sign-in codes and the account email never recorded. PostHog looks up a coarse location (city, region and country) from the network address of events the Mortis app and account site send, and discards the address itself; events the Mortis server or RevenueCat send are not located.
• Google Cloud Logging and Error Reporting keep the backend's operational logs and error reports. An error report contains the error type, where in the server code it happened, the server release, the request method and route pattern, a random request trace ID, and a fixed failure category. It never contains error messages, request URLs, bodies, headers, query strings, cookies, tokens, email or IP addresses, or health values. Google Cloud's request log records each request's time, method, path, status, IP address and app or browser user agent. Operational log lines may contain internal Mortis record IDs. Log lines and error reports from your signed-in requests also carry your Mortis account ID and analytics session ID.

These providers process data under their own security and retention controls. Mortis does not permit them to use Mortis data for advertising or cross-company tracking.

Retention

• Raw Terra deliveries are stored privately for up to 30 days for reliable processing, replay, and audit, then automatically deleted.
• Extracted health and fitness records, HealthKit samples, account details, and profile content remain until you delete your Mortis account.
• Replacing an avatar overwrites its content at the same private object reference. The current avatar is deleted with the account.
• PostHog data uses provider-managed retention. Google Cloud Logging deletes backend logs and error reports after 30 days; they cannot be deleted sooner for one account.
• Account deletion requests removal of the linked RevenueCat customer, the PostHog person, events, and recordings, and suppression of the Customer.io profile, and ends the Sign in with Apple connection at Apple. Customer.io deletes the profile; your opaque Mortis account identifier stays on Customer.io's suppression list so nothing sent later can recreate it.
• Firebase Crashlytics keeps crash reports for 90 days, then deletes them from Google's live and backup systems; Mortis's copies in BigQuery are deleted after 90 days. Deleting your account also deletes the crash reports that carry your account ID, at Firebase Crashlytics typically within a day and in BigQuery at once.
• A keyed, non-reversible deletion token and an expiry time are retained for 30 days so late Terra retries cannot recreate deleted data and pending processor cleanup can finish. The former account ID is not retained, and scheduled maintenance removes the token once all processor work is complete.
• Temporary backup copies may remain until the applicable provider-managed backup cycle expires and are not restored into active use after deletion.

Your choices

You choose which HealthKit types and wearable providers to connect. You can change HealthKit permission in Apple Health or Settings, pause direct HealthKit sync, or disconnect a Terra wearable. Pausing or disconnecting stops future sync but does not delete historical records.

Deleting your Mortis account offers two choices, and both start the same way: local account data is deleted or tombstoned immediately, and external cleanups are requested at once (Terra deauthentication, RevenueCat customer deletion, PostHog person, events, and recordings removal, Customer.io profile suppression, and private archive and avatar deletion). If an external cleanup request is temporarily unavailable, local deletion is still completed, and scheduled maintenance retries the remaining processor cleanups until finished. Customer.io deletes the profile; your opaque Mortis account identifier stays on Customer.io's suppression list so nothing sent later can recreate it.

Security

Mortis encrypts network traffic, keeps wearable credentials and signing secrets on the server, verifies Terra signatures before parsing deliveries, stores raw deliveries and avatars in private buckets, and returns short-lived avatar links only through an authenticated profile response.

Contact and changes

Questions about this policy or a privacy request can be sent to privacy@nonmagic.app. Material policy changes will be reflected by updating the effective date and the published policy.