Last updated: 31 August 2026
This Privacy Policy explains how Sweatora (“we”, “us”, or “our”) collects, uses, and protects your personal data when you use our website at sweatora.fit, our mobile application, and our web portal at app.sweatora.fit (collectively, the “Service”). We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR).
The data controller responsible for your personal data is:
SweatoraWe have not appointed a Data Protection Officer; the address above reaches the same team for every data-protection question.
We collect the following categories of personal data:
We don't ask for medical diagnoses, medication, or injury history, and there is no field in the Service designed to collect them. Your body metrics and training data (height, weight, reps, RPE, and so on) are ordinary personal data, processed under section 4 like the rest of your fitness profile.
The Service does give you free-text places — post-workout notes, and messages with a coach if you use one — where you might choose to mention something health-related, such as an injury. If you do, we process that on the basis of your explicit act of providing it (Art. 9(2)(a) GDPR). Please keep any such detail to what's useful for your training, and see Terms and Conditions, section 4, for why the Service is not a substitute for professional advice.
We process your personal data under the following legal bases:
Your workout programs, exercise alternatives, and periodic AI Coach reviews are generated by Google's Gemini models. To produce them, we send Gemini the relevant parts of your fitness profile — such as gender, height, weight, activity level, experience level, training days, goal, and equipment — plus, for reviews, your recent training history, body-weight trend, and any notes you've written about a session. We never send your name, email address, or account ID to Gemini.
This isn't a decision that produces a legal or similarly significant effect about you within the meaning of Art. 22 GDPR — nothing is applied to your account or acted on without you seeing it first, and you can always disregard, edit, or ignore what's generated. See Terms and Conditions, sections 4 and 5, for how AI output should be used.
The Service publishes a public leaderboard of the heaviest logged lifts across users, for a small set of barbell movements. Entries are pseudonymised — shown under a handle generated from your account, with initials and a colour, never your name, email address, or chosen display handle. If you separately choose to show your Instagram or TikTok handle on the leaderboard, that handle is published too.
Every account appears on the leaderboard by default. You can turn this off at any time from Privacy settings in the app, or by emailing us — the leaderboard is rebuilt roughly every six hours, so removing yourself takes effect within that window.
If you redeem an invite code from a coach, or someone redeems yours, that link gives the coach access to your profile — including your email address, age, gender, height, weight, gym details, and social handles if set — your workout programs, sessions and logs, and your body-weight history, so they can build and follow your program. Your coach's own client roster also keeps your name and email address for as long as you stay linked.
You can unlink from your coach at any time from the app, which removes their access to everything above. Notes and messages you've already exchanged remain as history for both of you — see Terms and Conditions, section 7.
If you enable notifications, we use a device push token to send you workout reminders, weight check-in prompts, streak nudges, leaderboard rank alerts, and — if you use a coach — activity from your coach or client. You can turn each of these on or off individually in Notification settings, and remove the device token entirely by disabling notifications for the app.
On our website (sweatora.fit), we use cookies and browser storage to operate the Service and, with your consent, to understand how you use it:
| Category | Cookie / Technology | Purpose | Consent required |
|---|---|---|---|
| Necessary | Firebase session | Authenticates signed-in users and keeps you logged in. | No |
| Necessary | Turnstile (cf_clearance) | Bot protection on sign-up forms (Cloudflare). | No |
| Analytics | _ga, _gid, _ga_* | Measures page views and user journeys (Google Analytics 4). | Yes |
You can change your cookie choice at any time using the “Cookie settings” link in the website footer.
Our mobile app and web portal (app.sweatora.fit) use on-device storage instead of cookies, for the same purposes: keeping you signed in, remembering your language and display preferences, and, only if you opt in from Privacy settings, anonymised usage analytics. Your training data (workouts, weight log) is also cached on your device for offline use, and is cleared automatically when you sign out.
We share personal data with the following processors, each under an appropriate data processing agreement:
We do not sell your personal data to third parties, and we do not use it for advertising profiling.
Your account data, training history, and cloud functions run in Google Cloud's europe-west1 (Belgium) region. The public leaderboard runs in a separate, EU multi-region database. Brevo, our transactional email provider, is based in the EU.
Some processors — Google's Gemini and Analytics services, Cloudflare, Slack, and Vercel — are based outside the European Economic Area (EEA). Where data is transferred to them, we rely on the safeguards named in section 10, such as the EU Standard Contractual Clauses.
We keep your data for as long as your account is active. If you delete your account — from Settings → Data in the app, or by emailing us — here's what happens to each category:
We don't otherwise delete individual pieces of training data — such as a single old workout — while your account stays active; the point of that history is to track your progress over time.
As a data subject under the GDPR, you have the following rights:
Access and erasure are self-service: use Settings → Data in the app for a copy of your data, or to delete your account outright.
To exercise any of these rights, email hello@sweatora.fit. We will respond within one month, extendable by a further two months for complex requests. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or the data protection authority in your country of residence.
The Service is not intended for anyone under 16, and we do not knowingly collect data from them. If we learn that an account belongs to someone under 16, we will close it and delete the associated data. See Terms and Conditions, section 2.
We encrypt all traffic to and from the Service with TLS, restrict access to your data with security rules scoped to your own account (and, if applicable, your linked coach), require your current password before an account can be deleted, and keep API keys and other credentials out of our source code. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.
If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Finnish Data Protection Ombudsman within 72 hours of becoming aware of it, and notify you directly without undue delay where the breach is likely to result in a high risk to you, as required by Art. 33 and 34 GDPR.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the app or by email at least 14 days before the change takes effect. The “Last updated” date at the top of this page indicates when the policy was last revised.
Questions about this Privacy Policy or how we handle your data? Contact us at hello@sweatora.fit.
