Privacy policy

Who is responsible

The app and this website are run by the person below, who is the controller under the EU General Data Protection Regulation (GDPR). Write to this address with any question about your data.

What the app stores

Your account

You sign in with Sign in with Apple. Apple passes on an identifier for your Apple Account, your email address or the relay address Apple creates when you hide it, and, the first time you sign in, your name. The app stores these three. It never sees your Apple password.

Your training profile

Your goal, your training days, how long a session should be, how many sessions you want per week, whether runs are part of the plan, which set types your workouts may include, your notification choices and whether the screen stays on during workouts. Your bodyweight is stored only if you enter it. It is optional.

Your training

The weekly plans and workouts written for you, the sessions you start and finish, every set you log with its weight, repetitions and time, which exercises you completed and how hard they felt, the energy level you give before a workout, the runs you log, and the exercises you choose to use.

A training partner

If you add a training partner, the app stores the email address you enter. Once both of you have added each other, your partner sees your name, and workouts are planned that you both do. A workout you trained together belongs to both accounts.

Your devices

For each device you sign in on: a sign-in session, stored as a hash of the token your phone holds, with its expiry date. If you allow notifications: the push token that lets a notification reach that phone. From the app’s requests: the language it is set to, your phone’s time difference to UTC, and when the app was last used. The time difference is used to plan your next workout while it is night where you are.

What stays on your phone

A copy of your workouts and statistics so the app works offline, sets you logged that are still waiting to sync, your sign-in token in the iOS keychain, your language, your app icon, and reminders you scheduled. Signing out removes your workouts, statistics, reminders and sign-in token from the phone.

How your workouts are written

Workouts and weekly plans are written by a language model operated by xAI. Each time one is planned, the app’s server sends xAI what the model needs for it:

• your goal, your schedule and the set types you allow
• the exercises you use, with the muscles they train
• your training history: recent workouts, the weights and repetitions of your sets, your records, and the days you marked as low on energy
• the language to write in

Your name, your email address and your bodyweight are not sent. For a workout planned with a training partner, the exercises your partner will do are included, without their name.

The plan is a suggestion for your training. No decision with legal or similarly significant effect is made about you automatically. The app is not a medical product and gives no medical advice.

Who else handles your data

The app runs on services from the companies below. They process data on the operator’s behalf and only for the purpose named.

These companies are based in the USA, so your data is transferred there. The transfer relies on the EU-US Data Privacy Framework where the company is certified under it, and otherwise on the European Commission’s standard contractual clauses.

Your data is not sold, not used for advertising, and not passed to anyone else, unless a law requires it.

Notifications

The app sends notifications only if you allow them in iOS: when a workout is ready, when a rest is over, and a reminder on training days if you switch it on. “Workout ready” comes from the server and travels through Expo and Apple to your phone, with the push token and the text of the notification. Rest timers and reminders are scheduled on the phone itself. You can switch each one off in Profile, or all of them in iOS Settings.

No tracking

The app contains no advertising, no analytics tools and no trackers, and it does not follow you across other apps or websites. When the app starts it asks Expo’s update server whether a newer version is available. Like every request on the internet, this and the app’s requests to its own server carry your IP address and technical details such as the app version. Cloudflare keeps request logs for a short time to keep the service running and to spot misuse.

This website

This website sets no cookies and uses no analytics. Fonts and images are served from the site itself, so loading a page contacts no third party. Cloudflare, which delivers the pages, processes your IP address to do so.

Why this is allowed

• To provide the app you asked for (Art. 6(1)(b) GDPR): your account, your training profile, your training data, and sending what is needed to write your workouts.
• Your consent (Art. 6(1)(a) GDPR): notifications, your bodyweight if you enter it, and adding a training partner. You can withdraw consent at any time by switching the notification off, removing the partner, or deleting your account.
• Legitimate interests (Art. 6(1)(f) GDPR): request logs and limits on how many plans an account can request per day, to keep the service secure and affordable.

How long data is kept, and deleting it

Your data is kept for as long as you have an account. Sign-in sessions expire on their own.

To delete everything, open the app and go to Profile, then Delete account. This removes your account, your settings, your plans, your workouts, your sets, your runs, your sign-in sessions and your push tokens from the database right away. One thing remains: a workout you trained together with a partner stays in your partner’s account. Database backups held by Cloudflare are overwritten within 30 days.

If you cannot use the app, write to taut@guehring.io and the account is deleted for you.

Your rights

Under the GDPR you have the right to:

• know what data is stored about you and get a copy of it
• have wrong data corrected
• have your data deleted
• have its processing restricted
• receive your data in a common, machine-readable format
• object to processing that rests on legitimate interests
• withdraw a consent you gave, with effect for the future

Write to taut@guehring.io to use any of them. You can also complain to a data protection authority, for example the one where you live.

Changes to this policy

When the app changes what it stores or who it shares data with, this policy is updated and the date at the top changes.