Privacy Policy

The data controller responsible for your personal data is:

We collect the following categories of personal data:

• Contact information — your email address when you join our waitlist or create an account.
• Fitness profile — training goals, available equipment, schedule preferences, and fitness level that you provide during onboarding.
• Workout data — completed workouts, exercise logs, and progress metrics generated while using the app.
• Usage data — pages visited, features used, and interactions with the Service, collected via analytics cookies when you consent.
• Technical data — IP address, browser type, device type, and operating system, collected automatically for security and service reliability.

We process your personal data under the following legal bases:

• Consent (Art. 6(1)(a) GDPR) — analytics cookies and marketing communications. You may withdraw your consent at any time via the cookie banner or by emailing us.
• Performance of a contract (Art. 6(1)(b) GDPR) — account creation, delivering personalised workout plans, and maintaining your fitness profile.
• Legitimate interests (Art. 6(1)(f) GDPR) — fraud prevention, network security, improving the Service, and communicating service-critical information.

We use cookies and similar technologies to operate the Service and, with your consent, to understand how you use it. Your cookie preferences are stored in your browser and can be changed at any time by clearing your browser's local storage.

• To create and manage your account.
• To generate personalised AI workout plans and exercise suggestions. This involves sending relevant parts of your fitness profile — such as gender, height, weight, activity level, experience level, training days, goal, and equipment — to Google's Generative Language API (Gemini).
• To track your progress and provide insights over time.
• To send transactional emails (account, password reset).
• To analyse aggregate usage patterns and improve the Service (analytics only when consented).
• To detect and prevent fraud, abuse, and security incidents.

We share personal data with the following processors under appropriate data processing agreements:

• Google Firebase — authentication, database, and cloud functions (Google LLC, USA; Standard Contractual Clauses apply).
• Google Generative Language API (Gemini) — generates your personalised workout programs and exercise alternatives from your fitness profile data (Google LLC, USA; Standard Contractual Clauses apply).
• Google Analytics 4 — web analytics, only when you consent. IP anonymisation is enabled.
• Cloudflare Turnstile — CAPTCHA / bot protection (Cloudflare Inc., USA; Standard Contractual Clauses apply).

We do not sell your personal data to third parties, and we do not use it for advertising profiling.

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we erase your personal data within 30 days, except where retention is required by law. Analytics data is automatically anonymised by Google Analytics after 14 months.

Some of our processors are based outside the European Economic Area (EEA). Where data is transferred to a third country, we ensure appropriate safeguards are in place, such as the EU Standard Contractual Clauses (SCCs) approved by the European Commission.

As a data subject under the GDPR, you have the following rights:

• Right of access — to receive a copy of the personal data we hold about you.
• Right to rectification — to correct inaccurate or incomplete data.
• Right to erasure— to request deletion of your personal data (“right to be forgotten”).
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object — to processing based on legitimate interests.
• Right to restriction — to limit how we use your data in certain circumstances.
• Right to withdraw consent — at any time for consent-based processing, without affecting the lawfulness of prior processing.

To exercise any of these rights, email hello@sweatora.fit. We will respond within 30 days. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or the data protection authority in your country of residence.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the app or by email at least 14 days before the change takes effect. The “Last updated” date at the top of this page indicates when the policy was last revised.

Questions about this Privacy Policy or how we handle your data? Contact us at hello@sweatora.fit.