Privacy Policy
Version 1 — effective 4 October 2026
Draft prepared for review by a qualified lawyer (including GDPR and Israeli Privacy Protection Law compliance) before publication. Placeholders in [brackets] must be completed.
This policy explains what personal data the Calisthenics Workout Trainer Service collects, why, how long it is kept, and your rights. The controller is [Operator legal name, address, contact e-mail].
1. Data we collect
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Identity: your sign-in provider ID, e-mail address and display name | Google or Apple sign-in via Firebase Authentication | Create and secure your account | Contract |
| Profile: sex (optional), birth year, height and weight (optional), equipment, goals, dietary preferences and allergies (optional), training days, reminder settings, language | You | Personalise starting levels, plans, reminders and nutrition suggestions | Contract / consent |
| Training data: planned workouts, sets, repetitions, hold seconds, form scores, RPE, progression state, custom steps | You, and counts produced on your device | Operate the progression engine and your history | Contract |
| Nutrition requests: an anonymous summary of a workout plus your declared goals/preferences/allergies, and the AI response | Generated by the Service | Provide the recovery suggestion you requested | Consent (each request) |
| Device push token and time zone (optional) | Your device, when you enable reminders | Send training-day reminders | Consent |
| Technical logs: IP address, request metadata, error reports | Automatic | Security, abuse prevention, debugging | Legitimate interest |
| Audit records of sign-in, export, deletion and acceptance of these documents | Automatic | Legal compliance and dispute resolution | Legal obligation / legitimate interest |
Camera. Camera-based counting runs entirely on your device. Video frames and body-landmark coordinates are processed in memory and are never stored or uploaded. Only numeric results (repetitions, hold seconds, partial reps, form score) are sent to our servers.
Health data. Training data and the optional body metrics may be considered health-related data. We process them only to provide the Service you requested; we do not sell them or use them for advertising.
2. How we protect your data
- All traffic is encrypted in transit (TLS). Databases and backups are encrypted at rest.
- Your e-mail address, display name and body metrics are additionally encrypted with a per-user key; destroying that key makes them unreadable, including in backups.
- Access is restricted to personnel who need it to operate the Service, under confidentiality obligations.
3. Processors and transfers
We use the following processors: Firebase Authentication and Cloud Messaging (Google) for sign-in and push reminders; [hosting provider] for servers and backups; Anthropic (Claude) and/or Google (Gemini) for AI nutrition suggestions, which receive only an anonymous workout summary and your declared preferences, never your name, e-mail or identifiers. Some processors are located outside your country; transfers are covered by standard contractual clauses or an adequacy decision where required.
3a. Information received from Google and Apple sign-in
When you choose "Continue with Google", Google shares with us only your name, e-mail address and Google account identifier (the basic openid, email and profile scopes). With "Sign in with Apple", Apple shares your account identifier and, if you allow it, your name and e-mail address (which may be an Apple private relay address). We use this information only to create your account, sign you in, show your name in the app and contact you about your account. We do not request access to your Gmail, contacts, Drive, calendar or any other Google data.
We do not sell this information, do not use it for advertising, do not use it to train AI models, and do not share it with anyone except the processors listed above that are needed to run the Service. You can disconnect the app at any time in your Google account under Security > Third-party apps (or Sign in with Apple in your Apple ID settings) and delete all your data with the in-app "Delete account" button.
The Calisthenics Workout Trainer's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. Retention
- Account and training data: for as long as your account exists.
- Nutrition requests and responses: 12 months, or until you clear them.
- Technical logs: up to 90 days. Audit records: up to [5] years, without personal identifiers after account deletion.
- Account deletion: when you delete your account in the app, your identity at the sign-in provider is removed, your encryption key is destroyed immediately, and all your records are permanently deleted from our systems within minutes; encrypted backups expire within 30 days.
5. Your rights
Depending on your country you may have the right to access, rectify, export (the app's "Export my data" button), restrict, object to, or erase your data (the app's "Delete account" button), to withdraw consent, and to lodge a complaint with a supervisory authority ([the Israeli Privacy Protection Authority] or your local authority). Contact [support e-mail] for any request.
6. Children
The Service is not directed to persons under 18 and we do not knowingly collect their data. If you believe a minor has created an account, contact us and we will delete it.
7. Cookies and local storage
The web app uses only the storage necessary for sign-in, offline operation and your preferences. No advertising or cross-site tracking cookies are used.
8. Changes
We will ask you to accept a new version of this policy in the app when it changes materially. The version and effective date appear at the top.
9. Contact
Siduron Apps — Israel — siduron10@gmail.com — Privacy requests: siduron10@gmail.com (no data protection officer has been appointed)..