Privacy Policy

Data Controller

The controller responsible for processing your personal data under the EU General Data Protection Regulation (GDPR) is:

Information Collection and Use

The Application collects information when you download and use it. This information may include:

• Your device's Internet Protocol address (e.g. IP address)
• The pages of the Application that you visit, the time and date of your visit, the time spent on those pages
• The time spent on the Application
• The operating system you use on your mobile device

Location (gym check-in only): If you enable location access, the Application uses your device location to detect when you arrive at or leave a gym you have saved, so it can log your gym visits automatically (geofencing). This processing runs on your device to power the check-in feature. Your precise location is not transmitted to our servers, is not used for advertising, and is not shared with any analytics or other external service. You can revoke location access at any time in your device settings; only the check-in feature stops working.

AI Coaching Features and Third-Party AI Processing: The Application offers AI-powered coaching, training-plan generation, and photo analysis. When you use one of these features, the data you have explicitly permitted in the in-app "AI data consent" screen is transmitted to our AI infrastructure to generate your response. Requests are routed through our secure server infrastructure hosted by Supabase, Inc. (EU region, Ireland) to Scaleway SAS, a France-based EU cloud provider that hosts the Mistral AI models we use. All processing takes place within the European Union. Depending on the categories you allow, the data sent may include: your profile and body details (name, age, gender, height, weight, goals, injuries, lifestyle), your workout and gym-attendance history, your strength values and rank, your food log (calories and macros), your health and sleep metrics (steps, heart rate, HRV, sleep), and progress or meal photos you choose to analyze. This data is used solely to generate coaching responses for you. No data is sent to the AI provider until you grant permission in the app, and you can review, change or withdraw your permissions at any time in Settings → AI Data. Scaleway and Supabase act as our processors (Auftragsverarbeiter) and are contractually bound to protect this data; see the Scaleway Privacy Policy (scaleway.com) and Supabase Privacy Policy (supabase.com) for details.

The Service Provider may use the information you provided to contact you from time to time to provide you with important information, required notices and marketing promotions.

For a better experience, while using the Application, the Service Provider may require you to provide us with certain personally identifiable information, including but not limited to veeti1.hurskainen@gmail.com. The information that the Service Provider request will be retained by them and used as described in this privacy policy.

Legal Basis for Processing

We process your personal data on the following legal bases under the GDPR:

• Art. 9(2)(a) — explicit consent for the processing of your health-related, special-category data (body metrics, heart rate, HRV, sleep, food log, physique photos) by the AI coaching features. This consent is given through the granular in-app AI data consent screen and can be withdrawn at any time in Settings → AI Data. Nothing is sent to the AI provider until you grant it.
• Art. 6(1)(b) — performance of a contract for the core functions you request: storing your workouts, plans, gym visits and profile on your device and backing them up so you can use the service across devices.
• Art. 6(1)(f) — legitimate interests for keeping the service secure and preventing abuse (e.g. rate-limiting AI requests).

You are never required to consent to the AI features to use the core tracking functions of the Application.

Third Party Access & Processors

When you use the AI coaching features, the personal data you permit is processed by our processors as described in the "Information Collection and Use" section above. We do not sell your data and do not transmit it to advertisers or analytics services. The Application uses the following third-party service providers (processors), each subject to their own Privacy Policy and to a data processing agreement with us:

• Supabase, Inc. — secure backend / server infrastructure and encrypted data storage, EU region (supabase.com)
• Scaleway SAS — France-based EU cloud provider hosting the Mistral AI models that generate coaching responses from the data you permit (scaleway.com)
• Expo (Expo Application Services) — app build and delivery infrastructure (expo.dev)
• RevenueCat, Inc. — subscription management and receipt validation (revenuecat.com)
• Apple / Google — the App Store / Google Play platforms and, if you enable it, Apple Health / Health Connect for reading your own fitness data (which stays on your device unless you consent to share it with the AI coach)
• Optional watch and ring cloud connections — if you explicitly connect a wearable account in the app (Google Health / Fitbit, Polar, or Oura), we retrieve your daily activity, heart-rate, recovery and sleep metrics from that vendor's cloud (Google LLC, Polar Electro Oy, Oura Health Oy — each under its own privacy policy). Depending on the device, these metrics may include steps, active energy, distance, heart rate and resting heart rate, heart-rate variability, blood oxygen (SpO₂), respiratory rate, VO₂max, body-temperature deviation, sleep duration and quality, a recovery or readiness score, and your latest workout. The connection tokens are stored encrypted on our Supabase EU backend together with the latest retrieved metrics; nothing else from your account is accessed. Connecting is your explicit consent under Art. 9(2)(a) GDPR. Disconnecting the wearable in the app, or deleting your account, permanently removes the tokens and the stored metrics from our servers.
• Open Food Facts — when you search for a branded food product, your search text is sent to the Open Food Facts API (Open Food Facts, a project of the non-profit Open Food Facts Association, openfoodfacts.org) to look up nutrition data. The underlying dataset is used under the Open Database License (ODbL); no account or personal identifier is sent with these requests. A curated set of common foods is additionally sourced from USDA FoodData Central (U.S. Department of Agriculture, public domain data, fdc.nal.usda.gov) and stored locally / in our own food index — this is a one-way data source, not a processor of your personal data.

The Service Provider may disclose User Provided and Automatically Collected Information:

• As required by law, such as to comply with a subpoena, or similar legal process;
• When they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
• With their trusted services providers who work on their behalf, do not have an independent use of the information we disclose to them, and have agreed to adhere to the rules set forth in this privacy statement.

Your Rights under the GDPR

As a data subject you have the following rights regarding your personal data. You can exercise most of them directly in the Application; for anything else, contact us by email and we will respond within one month.

• Right of access (Art. 15): obtain a copy of the data we hold about you — use Settings → Data → Export in the app, or request it by email.
• Right to rectification (Art. 16): correct inaccurate data — edit your profile and entries directly in the app.
• Right to erasure (Art. 17): delete your account and all associated data at any time via Settings → Account → Delete Account. This permanently removes your data from your device and our servers.
• Right to restriction (Art. 18): withdraw AI consent in Settings → AI Data to stop AI processing while keeping your local data.
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format via Settings → Data → Export.
• Right to object (Art. 21) and the right to withdraw consent at any time (Art. 7(3)), without affecting the lawfulness of processing before withdrawal.

Right to lodge a complaint: you may contact a supervisory authority, in particular in the EU Member State of your residence or workplace. The authority competent for the controller is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf — www.ldi.nrw.de.

Opt-Out Rights

You can stop further collection and processing by disabling the relevant device permissions, disconnecting connected wearable services, withdrawing AI consent in Settings → AI Data, or uninstalling the Application. Uninstalling stops collection on that device, but it does not automatically remove data already stored in your account. To permanently erase that data, use Settings → Account → Delete Account or contact us by email.

Data Retention & Deletion

We retain your personal data only for as long as you use the Application. You are in control of deletion:

• Self-service deletion: open Settings → Account → Delete Account in the app to permanently and irreversibly delete your account and all associated data — profile, workouts, plans, strength data, AI conversations, nutrition log and cached health metrics — from both your device and our servers.
• Export before deleting: you can export a copy of your data first via Settings → Data → Export.
• Email fallback: if you prefer, email veeti1.hurskainen@gmail.com and we will delete your data within one month.

After deletion, residual copies in encrypted backups are purged within 30 days. Data required to be kept by law (e.g. billing records held by the app store / RevenueCat) is retained only for the legally mandated period.

Children

The Service Provider does not use the Application to knowingly solicit data from or market to children under the age of 13.

The Application does not address anyone under the age of 13. The Service Provider does not knowingly collect personally identifiable information from children under 13 years of age. In the case the Service Provider discover that a child under 13 has provided personal information, the Service Provider will immediately delete this from their servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact the Service Provider (veeti1.hurskainen@gmail.com) so that they will be able to take the necessary actions.

Security

Because your data includes health information (a special category under Art. 9 GDPR), we apply state-of-the-art technical and organizational measures to protect it, both in transit and at rest:

• Encryption in transit: all traffic between the Application, our servers and the AI provider is protected with TLS (HTTPS).
• Encryption at rest — server: data stored on our backend (Supabase, EU region) is encrypted at rest, and access is restricted to the authenticated owner through Supabase Row Level Security. Requests to the AI provider are authenticated server-side; the AI API key never ships in the app.
• Encryption at rest — device: sensitive data cached on your device (profile, health metrics, workout log, AI conversations) is stored in the platform's hardware-backed secure storage — Apple Keychain on iOS and the Android Keystore-backed encrypted store on Android — rather than in plain application storage.
• Access control & sign-in: account access uses Sign in with Apple (iOS) or a Supabase-authenticated session (Android); cloud data is bound to your verified identity.

No method of transmission or storage is completely secure, but we continuously work to protect your data in line with the "state of the art" required for health data.

Changes

This Privacy Policy may be updated from time to time. We will notify you of material changes by updating this page and, where required, through the Application. Continued use does not by itself constitute consent to any new processing of special-category data — such processing always requires your separate, explicit in-app consent.

This privacy policy is effective as of 2026-07-27.

Your Consent

For the health-related data processed by the AI coaching features, we rely on your explicit consent under Art. 9(2)(a) GDPR, given through the granular in-app AI data consent screen — not on your continued use of the Application. You may withdraw this consent at any time in Settings → AI Data, which stops any further processing of that data by the AI provider. For the core tracking functions, the legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR), as described in the "Legal Basis for Processing" section above.

Contact Us

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email.