Privacy Policy
Last Updated: August 20, 2026
Effective Date: August 20, 2026
Orion Designs LLC ("Orion," "we," "us," or "our") provides Metric, a health and fitness application that helps people understand health, fitness, nutrition, recovery, and longevity information. This Privacy Policy describes how we process personal information through the Metric iPhone and Apple Watch applications, widgets, website, APIs, communications, and related services (collectively, the "Service").
This Policy applies only to Metric. Third-party services that you choose to connect, such as Apple or Garmin, process information under their own privacy notices.
1. Who Is Responsible
Orion Designs LLC is the business or controller responsible for the personal information described in this Policy. Our mailing address is 6513 Harold Ave, Cocoa, FL 32927, USA. Privacy questions and requests may be sent to privacy@joinmetric.com.
2. Personal Information We Collect
Account, Profile, and Purchase Information
- Authentication and contact data. Supabase Auth and, when selected, Sign in with Apple process identifiers, session credentials, and information such as your name and email address. Orion does not receive your Apple ID password.
- Profile and relationship data. Username, first and last name, biography, avatar, preferred language, account privacy setting, social connections, and pending follow relationships.
- Purchase data. Apple may provide App Store product and transaction identifiers, purchase and expiration dates, entitlement status, price, currency, and related subscription-notification data. Apple processes payment-card information; Orion does not receive full payment-card details.
Health, Fitness, Nutrition, and Location Information
- Apple Health data. With the permissions you grant in iOS, Metric may read health and activity information from HealthKit, including workouts, workout routes, steps, distance, pace, energy, heart rate, resting heart rate, heart-rate variability, cardio fitness, sleep, body measurements, blood-oxygen data where available, nutrition, date of birth, biological sex, and height. Metric may write workouts and nutrition entries to Apple Health when you use those features.
- Metric health and fitness records. Depending on the features you use, Metric may send selected workout and health information to Orion's backend, including workout dates and duration, route or starting-location data, distance, pace, calories, heart rate, steps, device source, VO2 max, resting heart rate, heart-rate variability, body composition, sleep score, health goals, biological-age estimates, ageing-rate history, and related derived metrics.
- Nutrition records and iCloud. Food names, dates, meal type, serving size, calories, macronutrients, micronutrients, caffeine, photographs submitted for meal analysis, and nutrition goals. Saved nutrition entries are stored in Metric's local Core Data store and may sync across your Apple devices through CloudKit when iCloud is enabled.
- Workout location. Precise location and route points collected while recording supported workouts or included in a workout you upload, a route you save or share, or a live workout when you enable location sharing. Route privacy controls can hide points near the beginning and end of a route, but sharing a route may still reveal sensitive places.
Garmin Connect Information
Connecting Garmin is optional. If you connect Garmin Connect, Metric receives and stores OAuth access and refresh tokens, token-expiration dates, the granted scope, a Garmin user identifier, and the connection date. Garmin may send activity identifiers, workout type and name, dates, duration, distance, pace, calories, heart rate, steps, device name, starting location, samples, laps, and other fields included in Garmin activity payloads.
Disconnecting Garmin asks Garmin to revoke Metric's access, removes the current Garmin connection credentials from your Metric profile, and stops future imports. It does not automatically remove activity information already imported into Metric or information retained by Garmin under its own policies.
Social, Shared, and Live-Workout Information
- User content. Posts, workout summaries, photographs, captions, post layouts, comments, likes, follows, saved routes, route comments, achievements, and notification preferences, together with associated dates and other metadata.
- Live workouts. Session identifiers, workout type and title, status, elapsed time, distance, calories, heart rate, pace, current location and route when sharing is enabled, viewer join and leave events, reactions, comments, and engagement summaries. Metric uses Ably to transmit live-workout state and interactions between authorised participants. Orion's backend separately stores live-session records, the latest snapshot, view events, reactions, comments, and engagement summaries.
- Public or shared information. Information you make visible through a profile, post, route, live workout, or share link may be seen by the audience shown in Metric. Live workouts are currently shared with authorised followers.
AI Feature Information
When you use server-backed Cortex, AI nutrition analysis, or AI-generated training plans, Metric sends OpenAI the information needed to provide the requested feature. Depending on the request, this may include prompts, meal descriptions or photographs, generated responses, training goals and preferences, recent workout summaries, and health, fitness, sleep, nutrition, or body-measurement information returned by Metric tools. Orion also sends a pseudonymous safety identifier derived from your Metric user identifier.
Server-backed Cortex uses OpenAI response storage for conversation continuity. AI nutrition and training-plan requests use separate server-backed processing. If you select Apple Intelligence for Cortex and it is available, Cortex chat processing occurs on device; AI nutrition analysis and AI-generated training plans still use OpenAI.
Device, Communications, and Service Information
- Device platform, app version, preferred locale, push-notification token, notification preferences, requested URLs, timestamps, IP address, user agent, and technical request, security, or error information produced when the Service runs.
- Email address and name used for transactional messages. Metric uses Resend to deliver messages such as welcome emails. Configured Resend open tracking may record that an email was opened, together with related delivery and message metadata.
- Communications and support information based on your exchanges with us, including the content of support requests and feedback.
- If you grant Contacts permission, Metric reads names and phone numbers on device so you can choose a person to invite through Messages. The contact picker does not upload your address book to Orion's backend.
3. Sources of Personal Information
We collect personal information from the following sources:
- You, when you create an account, configure Metric, enter information, post content, contact us, or use a feature.
- Your devices, including Apple Health, location, notification, and other data you authorise Metric to access.
- Connected services, including Apple, Garmin, and Sign in with Apple.
- Other users, when they follow, mention, comment on, react to, or otherwise interact with you or your content.
- Service providers, such as providers of hosting, authentication, communications, payments, realtime messaging, and AI processing.
- Automatic collection, when the Service generates routine request, diagnostic, security, and interaction records.
4. Tracking and Other Technologies
The public joinmetric.com website does not currently use account cookies, analytics cookies, advertising cookies, advertising pixels, or interest-based advertising technologies. Website hosting systems still process routine request information such as IP address, user agent, requested URL, timestamps, and server errors. If we introduce optional website tracking technologies, we will update this Policy and provide any consent controls required by law before using them.
Transactional emails may contain Resend's open-tracking technology as described above. You may block remote images through your email client, though doing so can affect the display of image-based email content.
5. How We Use Personal Information
| Purpose | Examples | Typical legal basis where required |
|---|---|---|
| Service delivery and operations | Authenticate users, maintain accounts, sync workouts, store entries, operate social and live-workout features, and recognise purchases | Contractual necessity |
| Health, fitness, nutrition, and location features | Provide dashboards, workout recording, routes, biological-age insights, nutrition analysis, and live location sharing | Consent, including explicit consent where required; contractual necessity where permitted |
| Connected services | Import Garmin activities and sync nutrition records through CloudKit | Consent; contractual necessity |
| AI features | Provide Cortex, nutrition estimates, and personalised training plans | Consent for sensitive information; contractual necessity where permitted |
| Communications | Send transactional emails, push notifications, account notices, security alerts, and support replies | Contractual necessity; consent; legitimate interests |
| Safety, security, and improvement | Debug, prevent abuse and fraud, maintain reliability, respond to feedback, and develop or improve features | Legitimate interests; legal obligation |
| Compliance and protection | Respond to lawful requests, preserve required records, and establish or defend legal claims | Legal obligation; legitimate interests |
| Corporate transactions | Evaluate or complete a financing, reorganisation, acquisition, merger, or sale of assets | Legitimate interests; legal obligation |
We may create aggregated, deidentified, or anonymised information for lawful business purposes such as analysing and improving the Service. We do not attempt to reidentify information maintained as deidentified, except to test whether deidentification measures comply with law. We do not use personal information to train general-purpose AI models.
6. How We Disclose Personal Information
We disclose personal information in the following circumstances:
- At your direction. With users, followers, or people who open a share link when you publish or share a profile, workout, route, post, comment, reaction, or live workout.
- Apple. HealthKit for health and workout data, CloudKit for iCloud nutrition sync, Sign in with Apple for authentication, Apple Push Notification service for notifications, and the App Store for purchases and subscription events.
- Garmin. For the optional connection, token lifecycle, activity imports, permission changes, and disconnection.
- Supabase. For authentication, PostgreSQL database services, and storage for profile and social media files.
- Railway. To host Metric's public website, APIs, and worker services and process related network and service logs.
- Ably. For realtime delivery of live-workout state, presence, reactions, and comments using scoped tokens.
- OpenAI. For server-backed Cortex, nutrition analysis, and training-plan generation.
- Resend. For transactional email delivery and configured open tracking.
- Professional advisers. Lawyers, auditors, insurers, and other advisers where reasonably necessary and subject to appropriate duties.
- Legal and safety reasons. When reasonably necessary to comply with law, enforce our terms, investigate misuse, or protect users, Orion, or the public.
- Business transfers. In connection with an actual or proposed financing, reorganisation, acquisition, merger, bankruptcy, or sale of assets, subject to applicable law.
Orion does not sell personal information, share personal information for cross-context behavioural advertising, or use HealthKit or Garmin health data for advertising. We do not disclose sensitive personal information for purposes other than providing the features you request, securing the Service, and other purposes permitted by law.
7. Retention and Deletion
We retain personal information for as long as reasonably necessary to provide the feature for which it was collected, maintain and secure the Service, resolve disputes, meet legal, accounting, or reporting obligations, and establish or defend legal claims. We consider the amount, nature, and sensitivity of the information; the risk of harm from unauthorised use or disclosure; the purpose of processing; whether that purpose can be achieved another way; and applicable legal requirements.
- Metric backend. Profile, social, workout, health, Garmin-imported, training-plan, notification, and related records generally remain while your account or relevant feature is active, unless you delete content or request deletion.
- Apple Health and on-device data. Revoking Metric's Health permission stops future access but does not delete data already stored in Apple Health. Use Apple's controls to review or delete Apple Health and local app data.
- CloudKit nutrition data. Nutrition entries synced through CloudKit are associated with your iCloud account. Deleting an entry in Metric syncs that change through the Core Data and CloudKit store.
- Garmin. Disconnecting removes current credentials and stops new imports. Already imported activities remain separate Metric records unless deleted.
- AI records. OpenAI processes and may retain inputs and outputs under the applicable service configuration and its policies. Server-backed Cortex uses stored response objects for continuity. Generated training plans are stored in Metric's backend; saved nutrition entries are stored locally and may sync through CloudKit and Apple Health.
- Email and realtime records. Resend and Ably may retain delivery, tracking, message, or service records under their configurations and policies. Orion's backend separately stores the live-workout records described above.
When information is no longer required, we may delete it, anonymise it, or isolate it from further processing until deletion is possible. Deidentified information may be retained indefinitely. You may request account deletion in Metric or by emailing privacy@joinmetric.com. We may retain information where required or permitted by law, including in backups for a limited period.
8. Security
We use technical and organisational measures intended to protect personal information, including authenticated API access, access controls, and scoped credentials for supported integrations. The Service also depends on safeguards maintained by the providers listed above. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.
9. Your Choices and Controls
- Apple Health: manage each authorised data type in iOS Settings or the Health app, and use Apple controls to review or delete Health data.
- Garmin: connect or disconnect Garmin in Metric Settings. Disconnecting does not remove activities already imported.
- Profile and live workouts: make your account private, control live-location sharing, choose a route privacy radius, and select the audience shown for supported features.
- CloudKit: delete nutrition entries in Metric and manage Metric's iCloud data through Apple's iCloud controls.
- AI: select Apple Intelligence for Cortex when available. This choice does not change the OpenAI processing used for AI nutrition analysis or AI-generated training plans.
- Contacts, location, and notifications: change device permissions in iOS Settings and notification preferences in Metric Settings.
- Emails: block remote images through your email client to limit open tracking. Transactional messages necessary for your account or requested services may not offer a marketing unsubscribe.
- Account and content: delete supported content in Metric, use Delete Account to request account deletion, or contact us by email.
10. U.S. State Privacy Rights
Depending on where you live and whether the applicable law applies to Orion, you may have rights to request access to or a copy of personal information; correct inaccurate information; delete information; obtain portable information; opt out of sale, targeted advertising, or certain profiling; limit certain uses of sensitive information; or appeal a decision about your request. Orion does not sell personal information, use it for targeted advertising, or engage in profiling that produces legal or similarly significant effects.
Submit a request or appeal to privacy@joinmetric.com or the postal address in Section 16. Describe the right you want to exercise and the state where you live. We may ask for information reasonably necessary to verify your identity, residency, and request. If we deny a request, you may appeal by replying to our decision and stating that you wish to appeal. You will not receive discriminatory treatment for exercising a privacy right.
Where permitted by law, an authorised agent may submit a request for you. We may require proof of the agent's identity and authority and may ask you to confirm the request directly. We may decline requests where an exception applies or where we cannot reasonably verify the request.
11. U.S. Information-Practices Notice
The table below summarises our practices during the 12 months preceding the effective date of this Policy. Categories are described using terms from the California Consumer Privacy Act. Some information may fall into more than one category.
| Category collected | Examples and purposes | Categories of recipients | Sold or shared for cross-context advertising |
|---|---|---|---|
| Identifiers | Name, email, username, authentication identifiers, IP address, device or push token; used for accounts, communications, security, and Service delivery | Authentication, hosting, communications, and platform providers; recipients you direct | No |
| Commercial information | App Store product, purchase, and subscription records; used to provide entitlements and support transactions | Apple and relevant service providers | No |
| Internet or electronic activity | Service requests, technical logs, feature interactions, and email engagement; used to operate, secure, support, and improve the Service | Hosting, email, realtime, security, and support providers | No |
| Geolocation | Precise workout and live-location data; used for workout recording, maps, routes, sharing, and safety controls | Hosting, storage, realtime providers, and recipients you authorise | No |
| Audio, electronic, visual, or similar information | Profile and social images, meal photographs, posts, comments, prompts, and other content; used for requested features and sharing | Storage, AI, and hosting providers; recipients you authorise | No |
| Sensitive personal information | Health, fitness, nutrition, body measurement, account credentials, and precise location data; used to provide requested Metric features, maintain security, and comply with law | Apple, Garmin, Supabase, Ably, OpenAI, and other providers as applicable to the requested feature | No |
| Inferences | Readiness, biological-age, ageing-rate, nutrition, training, and other derived insights; used to provide and improve requested features | Hosting and AI providers as applicable; recipients you authorise | No |
We collect these categories from the sources in Section 3, use them for the purposes in Section 5, and retain them using the criteria in Section 7. We do not knowingly sell or share the personal information of consumers under 16. California residents may also request information under California's Shine the Light law by emailing privacy@joinmetric.com with the subject "Shine the Light Request," their name, mailing address, and confirmation that they are a California resident.
12. Notice to European Users
This section applies to individuals in the European Economic Area and United Kingdom (collectively, "Europe"). References to personal information include "personal data" as defined by applicable European data-protection law.
Controller and Legal Bases
Orion Designs LLC is the controller for the processing covered by this Policy and does not maintain an establishment in Europe. You may contact Orion directly using Section 16. Our principal legal bases are described in Section 5: contractual necessity to provide the Service you request; consent, including explicit consent where required for health or other special-category data; legitimate interests in operating, securing, supporting, and improving the Service; and compliance with legal obligations. Where we rely on legitimate interests, we consider whether those interests are overridden by your rights and interests.
You may withdraw consent at any time through the controls described in Section 9 or by contacting us. Withdrawal does not affect the lawfulness of processing completed before withdrawal. Providing account and feature data is generally necessary to provide the feature you request; without it, that feature may not work.
Your European Privacy Rights
Subject to applicable conditions and exceptions, you may ask us to:
- Access information about our processing and obtain a copy of your personal information.
- Correct inaccurate or incomplete personal information.
- Delete personal information where there is no lawful reason to continue processing it.
- Restrict processing, including while accuracy or an objection is reviewed.
- Transfer certain information in a structured, commonly used, machine-readable format.
- Object to processing based on legitimate interests and to direct marketing.
- Withdraw consent where processing is based on consent.
Submit a request using Section 16. We may request information necessary to verify your identity. Metric does not make decisions based solely on automated processing that produce legal or similarly significant effects. If you are not satisfied with our response, you may complain to the data-protection authority where you live or work, or where an alleged infringement occurred. The European Data Protection Board lists EEA authorities, and UK users may contact the Information Commissioner's Office.
International Transfers
Orion is based in the United States, and providers used by Metric may process information in the United States and other countries whose laws may provide different protections. When required for a transfer from Europe to a country without an adequacy decision, we rely on appropriate safeguards such as approved standard contractual clauses, a provider's valid participation in an approved data-transfer framework, or a permitted legal exception. You may contact us for more information about the mechanism applicable to your information.
13. Children
Metric is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. A higher minimum age may apply where local law requires it. If you believe a child has provided personal information to Metric in violation of this section, contact us so we can review the account and take appropriate action.
14. Health and Medical Disclaimer
Metric is a wellness and fitness product, not a medical device. It does not diagnose, treat, cure, or prevent disease and does not provide medical advice. Consult a qualified healthcare professional before making medical decisions or beginning an exercise or nutrition programme. Do not use Metric for emergencies.
15. Changes to This Policy
We may update this Policy as Metric or applicable requirements change. We will post the revised Policy with a new "Last Updated" date and provide additional notice when required by law. If we make a material change, the updated Policy will apply from the stated effective date.
16. Contact Us
Email: privacy@joinmetric.com
Mail: Privacy, Orion Designs LLC
6513 Harold Ave
Cocoa, FL 32927 USA