Privacy Policy

Who is responsible

Aleksei Grezev, Jl. Bidadari No.36, Seminyak, Kec. Kuta, Kabupaten Badung, Bali 80361, Indonesia is the controller of the data described here. Write to [email protected] about anything in this policy, including a request to access or delete your data.

What we store

Only what the app needs to do its job:

• Account: your email, your name and a profile picture if you add one (or the one your Google account provides). If you sign in with Google or Apple, the identifier that service gives us — never your password there. An email shared through Sign in with Apple may be a private relay address; we use it like any other.
• Subscription, in the iPhone app: which plan you are on, when the free week started and ends, whether the subscription is active, renewing, cancelled or refunded as the App Store reports it, and which subscription offer you were shown. Apple takes the payment; we never see your card.
• The iPhone app: a random identifier it creates on first launch, so it can find your account again before you have an email or a password, and the push token that lets reminders reach your phone.
• About you: sex, date of birth, height, weight, your goal and target weight, how long you have been training, your language and units.
• Training: your programme, every session, every set with its weight and reps, how hard it felt, your rests, your personal records, and any joints or movements you have told us to avoid, including what you wrote in your own words.
• Nutrition, if you use it: your meal plan, the meals you log, your calorie and macro targets, and any dietary restrictions you give us.
• Trackers: body weight, water, steps, and — if you take them — progress photos.
• Google Fit, only if you connect it: your daily step counts. We ask for read access to activity data and nothing else.
• Apple Health, only in the iPhone app and only if you allow it: your daily step counts. We read steps and nothing else and never write to Apple Health. These counts are never sold and never used for advertising; they leave our server only as part of the context the AI coach reads, such as yesterday's steps in the morning insight.
• The AI coach: your chat messages and the facts the coach remembers about you, so it does not ask the same thing every week.
• Operational records: when the account was last active, how much AI it has used (model, tokens, cost) and when a request was refused for hitting a limit. Anything you send us through feedback.
• Product analytics: which screens you open, which flows you start and finish, whether a subscription offer was shown and a purchase started or cancelled, which tips were shown and which notifications you opened, together with the app's error reports. These events are tied to your account and to a random identifier for the app or browser. We use them to see how the app is used — for example, how many people with a given goal, sex, age, experience or training place finish onboarding — and never for advertising. At signup we also store where you arrived from (a campaign tag in the link, or the site that referred you).

We do not collect your precise location, we do not read your contacts, and there is no advertising or tracking network in the app.

Why we are allowed to

For most of the above, because we cannot provide the service without it: a training app that does not remember your training is not a training app. That is the performance of our contract with you.

Your body metrics, your injuries and your progress photos are health data, which needs more than that — we process them on your explicit consent, given when you enter them, and you can withdraw it by deleting the data or the account.

Steps from Apple Health are read on the consent you give in the iPhone's own permission screen. You can withdraw it there at any time (Settings → Privacy & Security → Health), and the app stops reading them.

Keeping the service secure and working — the usage records, the abuse limits, the error logs — is our legitimate interest.

If your subscription in the iPhone app ends, we may email you about an offer to come back to it — at most two emails for each subscription that ends: one when the offer is made and one a week before it runs out. Offering a former subscriber the same service again is our legitimate interest. Every such email has a link that stops them, and writing to us works too; emails about your account, such as a password reset, are not affected.

Who else sees it

Nobody buys it, and it is not shared for advertising. It reaches these processors only, and only as far as each one needs:

• AI providers (Anthropic and/or OpenAI, depending on the feature): the relevant part of your training context — your programme, recent sessions, goal, limitations, and what you type in chat — is sent so the coach can answer. Progress photos and meal photos are sent when you ask for them to be analysed. These providers process the request on our behalf and do not use it to train their models.
• Google: sign-in, if you use it, and Google Fit, if you connect it.
• Apple: the payment for a subscription bought in the iPhone app, Sign in with Apple if you use it, and the delivery of notifications to your iPhone.
• RevenueCat: confirms purchases with the App Store on our behalf and tells us when a subscription renews, is cancelled or is refunded. It receives your account identifier and the purchase record, not your training data.
• Our hosting provider, which runs the server and its backups.
• Email and push delivery, to send you a password reset, the reminders you have turned on and, after a subscription ends, the offer emails described above.
• Error tracking, if enabled, which receives technical details of a crash.

Some of these are outside the EU. Where that is so, the transfer is covered by the European Commission's standard contractual clauses.

How long we keep it

Your account data stays while the account exists. When you delete the account it is disabled at once and everything it owns — training, nutrition, photos, chat, trackers — is erased 30 days later. The 30 days exist so a deletion made by mistake can be undone; sign in during that time to cancel it.

Product analytics events are deleted automatically after 60 days. Records of AI usage are kept longer, without the content of the request, because they are what our costs and limits are calculated from.

Your rights

You can see and correct most of your data directly in the app. Beyond that you have the right to a copy of it, to have it corrected or erased, to restrict or object to processing, and to withdraw a consent you gave. Write to us and we will answer.

Deleting the account is the quickest route and needs nobody's help: open your profile and delete it there.

If you think we have handled your data wrongly, you can complain to your national data protection authority.

Security

Traffic is encrypted in transit. Passwords are stored hashed, never in a form anyone can read, and any API key you are given is stored encrypted. Access to the production database is limited to the operator.

No system is perfectly secure. If a breach ever affects your data, we will tell you and the regulator as the law requires.

Children

The service is not intended for anyone under 16, and we do not knowingly keep data about them. If you believe a child has created an account, write to us and we will remove it.

Changes

If this policy changes in a way that affects you, we will tell you in the app before the change takes effect.