Privacy policy

1. Data controller and contact

The data controller is Adrian Szabłowski, ul. Ludwika Zamenhofa 2/33, 33-300 Nowy Sącz, Poland, Tax ID (NIP): 7343649264, Business ID (REGON): 540236581.

Email: hello@trackist.me

If you are in the EU, you can also complain to your local data protection authority. In Poland that is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

2. Personal data we collect

When you use Trackist, we collect:

• Account data: the name you give in the intake questions, which the coach uses to address you, the email address your sign-in provider gives us (with Sign in with Apple this can be a private relay address), and the identifier from Sign in with Apple or Sign in with Google. If you sign in with Google, we also keep the full name on your Google account and the link to your Google profile picture, which Google passes on at sign-in. The App uses that name only if you did not give one in the intake questions. We do not store the name Apple can pass on. There is no password
• Your answers to the intake questions: goal, gender, age, current and goal body weight, experience, equipment, any joint that hurts and the movements that set it off, focus areas, training style, movements to avoid, training weekdays, session length and commitment
• Workout data: your plans (days, exercises, sets, rep targets and rest times), every set you log (weight, reps or seconds, RPE, distance for cardio), notes you add to an exercise, and the training date
• Reports and check-ins: reports that a session was too hard or too easy, pain reports (the exercise, the joint, a severity from 1 to 5 and any note you write), and the sleep, soreness and energy answers you give before a session
• Body measurements: body weight, goal weight, chest, waist, hips, and left and right arm, thigh and calf, only the ones you enter
• Results we work out for you: your Strength Score history, weekly recaps, and the coach memory, which is 3 to 5 short notes about your training that the coach uses when it writes your next plan
• Apple Health data: only if you connect Apple Health. We read your step count, body weight and the workouts you recorded (such as walks, runs and rides). We use them to prefill your weight, fill in cardio and walks in your plan, and set your daily step average, which the coach uses when it writes your plan. We write the body weight you log in Trackist back to Apple Health. See section 7
• Settings: weight and distance units, language, and reminder settings
• Subscription status: whether you have Trackist Pro and when it ends, which we get from RevenueCat. We never see your payment details
• Feedback: messages you send through the in-app feedback form, with the app version, platform, language and whether you had Pro at the time
• Usage analytics: events such as screens viewed and the main buttons you tap, intake answers (goal, gender, age range, experience, equipment, focus areas, training style, movements to avoid, training days, session length, commitment, units, and whether your goal weight is below or above your current one, never the weights), that a set was logged (the exercise and set number, not the weight or reps), that a workout was completed with how many sets you logged, the type of a report you send (too hard, too easy or pain) and exercise swaps, and paywall and purchase events. They are sent to Amplitude with your account identifier and device data (see section 4)

We do not collect: passwords, photos or videos of you, precise location, contacts, microphone or camera data, or card numbers. We do not use the advertising identifier (IDFA) and we do not track you across other apps or websites.

Data kept only on your phone: your intake answers until you sign in, and small flags such as whether you have seen a recap. These stay on the device and are not sent to us.

Server logs: our hosting provider (Supabase) logs IP addresses and requests for security and to fix faults. It keeps these logs under its own retention policy.

3. How we use your data and our legal basis

We use your personal data to:

• run Trackist: build and store your plans, log your workouts and measurements, suggest the next load and show your progress (contract, GDPR Art. 6(1)(b))
• have the AI coach write and adjust your plans, pick replacement exercises and write your weekly recap (contract, GDPR Art. 6(1)(b)), see section 18
• check your subscription and unlock Pro (contract, GDPR Art. 6(1)(b))
• sign you in and keep your account secure (legitimate interest, GDPR Art. 6(1)(f))
• show training-day, weekly recap and rest-over reminders, which are scheduled on your phone (consent, GDPR Art. 6(1)(a), which you give or withdraw in your notification settings)
• understand how people use the app so we can fix faults and improve it (legitimate interest, GDPR Art. 6(1)(f))
• answer your feedback and support requests (legitimate interest, GDPR Art. 6(1)(f))
• meet legal obligations (GDPR Art. 6(1)(c))

Health data: joint limitations, pain reports, body weight and measurements, sleep, soreness and energy answers, and Apple Health data are health data under GDPR Art. 9. We process them only because you choose to enter them or connect Apple Health, which is your explicit consent under Art. 9(2)(a). You can withdraw it by deleting the entry, disconnecting Apple Health or deleting your account. Withdrawing does not affect what was processed before.

We do not use your data for advertising, we do not sell it, and we do not make decisions about you that have legal or similarly significant effects.

4. Who processes your data

We do not sell your personal data.

We share data only with the providers we need to run Trackist:

• Supabase Inc.: sign-in, database and server functions, hosted on Amazon Web Services in the United States (us-east-1). Stores your account and everything listed in section 2 except analytics
• Anthropic PBC: the AI model that writes and adjusts your plans, picks replacement exercises and writes your weekly recap. Processes data in the United States. See section 18 for what we send
• Amplitude, Inc.: usage analytics, stored on Amplitude's EU servers. Receives the events and properties in section 2, your account identifier, and device data: device model, operating system, language, mobile carrier and the iOS vendor identifier (IDFV). We turn off the collection of your IP address and of the advertising identifier. We do not send your name, email, the weights and reps you lift, your body measurements, your joint limitations, your sleep, soreness and energy answers, or the joint, severity and note of a pain report
• RevenueCat, Inc.: subscription management. Receives your account identifier and your App Store purchase records
• Apple Inc.: Sign in with Apple (if you choose it), App Store payments and Apple Health, which stays on your phone
• Google LLC: Sign in with Google (if you choose it)
• Expo (650 Industries, Inc.): delivers app updates. It receives technical data such as the app version and a device identifier for updates, not your training data

Each provider processes data only to provide its service to us, under a data processing agreement, and with industry-standard security.

Your data stays private. Trackist has no social features. Your logs, measurements and progress are never shown to other users. Share cards leave your phone only when you share them yourself.

Transfers outside the EU: your account and training data are stored in the United States by Supabase, and AI processing by Anthropic happens in the United States. RevenueCat, Apple and Google may also process data outside the EU. These transfers are protected by the European Commission's Standard Contractual Clauses, or by the EU-US Data Privacy Framework where the provider is certified under it. Analytics stay on Amplitude's EU servers.

5. How long we keep your data

• Account and training data: for as long as your account exists. It stays after Pro ends, because the free tier keeps working. Deleting your account in the app removes it straight away
• Feedback messages: kept after you delete your account, with the link to your account removed
• Data sent to Anthropic: kept by Anthropic only for a limited period under its commercial terms, and not used to train its models. The plans and recaps it writes live in your account and go when it goes
• Usage analytics: kept by Amplitude under its retention policy. When you delete your account, write to us and we will ask Amplitude to delete the events linked to it
• Subscription records: kept by RevenueCat and Apple under their own policies and tax law
• Support emails: 3 years from your last message

Deleting your account: in the app, go to More, then Profile, then Delete account. It happens at once. If you no longer have the app, use the account deletion page. We confirm within 7 days and delete within 30 days. Deleting your account does not cancel a Trackist Pro subscription. Cancel it in your iPhone subscription settings.

6. Your privacy rights

If you are in the EU (GDPR):

• access your personal data
• correct inaccurate data
• have your data deleted
• restrict processing
• get your data in a portable format
• object to processing based on legitimate interest
• withdraw consent at any time
• complain to a supervisory authority

If you are in California (CCPA):

• know what personal data we collect, use and disclose
• have your personal data deleted
• correct inaccurate personal data
• opt out of the sale or sharing of personal data (we do neither)
• not be discriminated against for using these rights

You can edit most of your data in the app and delete your account there. The app has no export button. To get a copy of your data or use any other right, email hello@trackist.me. We reply within 30 days (GDPR) or 45 days (CCPA).

7. App permissions and Apple Health

Trackist asks for these permissions only:

• Notifications: training-day and weekly recap reminders, a message when you have been away, and a rest-over alert. They are scheduled on your phone, not sent from our servers
• Apple Health: read step count, body weight and workouts, and write body weight. Trackist only deletes weight entries it wrote itself
• Add to photo library: to save a share card you made. Trackist cannot read your photos

You can turn any of these off in iOS Settings at any time, and the rest of the app keeps working. Trackist does not ask for location, camera, microphone, contacts, calendar or tracking permission.

How we treat Apple Health data: we use it only to provide Trackist to you. We never use it for advertising or marketing, never sell it, and never send it to our analytics provider. The only Apple Health figure that leaves your phone is your daily step average, which is stored in your account and sent to Anthropic as part of the request that writes your plan. Your weight and workouts from Apple Health are stored in your account only when you save them as a check-in or a logged cardio session.

8. Cookies and tracking

The app has no advertising SDKs and does not track you across other companies' apps or websites. The only analytics are the Amplitude events in section 2. Your sign-in session is stored on your phone so you stay signed in.

This website (trackist.me):

• Vercel Web Analytics counts page views without cookies and without storing your IP address (legitimate interest, GDPR Art. 6(1)(f))
• Google Analytics 4, run by Google Ireland Limited, shows us which pages visitors read and how they found the site. It sets cookies only after you accept them in the banner (consent, GDPR Art. 6(1)(a)). They are named _ga and _ga_* and last up to 2 years. Google can process this data in the United States under the EU-US Data Privacy Framework
• the trackist-locale cookie remembers the language you picked, for one year. Your cookie choice is kept in your browser's local storage

To change or withdraw your consent, select Cookie settings at the bottom of any page. When you withdraw it, the Google Analytics cookies are deleted from your browser.

9. Data security

We protect your data with:

• encrypted connections between the app and our servers (TLS)
• encrypted storage with Supabase, which holds a SOC 2 Type II report for its service and runs on Amazon Web Services infrastructure
• row-level security, so each account can only read its own data
• AI requests made from our servers, so the app never holds the AI provider's keys

No system is completely secure, so we cannot guarantee absolute security.

10. Data breaches

If a breach happens, we will:

• assess the risk within 24 hours
• tell the supervisory authority within 72 hours, as GDPR requires
• tell you if there is a high risk to your rights
• act at once to contain it and prevent another

11. Sign in with Apple and Sign in with Google

You sign in with Apple or Google after you answer the intake questions. There is no email and password sign-in. Supabase Auth handles both methods.

Sign in with Apple: Apple shares your email or a private relay address. Apple can also share your name the first time you sign in, but Trackist does not store it. You can manage this in your Apple account settings. See Apple's privacy policy.

Sign in with Google: Google shares your email, your full name, the link to your profile picture and your Google account identifier. You can remove Trackist's access in your Google account security settings. See Google's privacy policy.

12. Subscription and payments

• Apple takes all payments through the App Store and charges your Apple Account
• RevenueCat tells us whether your subscription is active. We never see your card details
• See RevenueCat's privacy policy

13. Children's privacy

Trackist is intended for adults 18 years or older. We do not knowingly collect data from children under 18 (or 16 in the EU). If you are a parent and believe your child has given us personal data, email hello@trackist.me and we will delete it straight away.

14. Changes to this policy

• we will tell you about material changes 30 days in advance, by email or in the app
• we post minor changes here with a new date at the top
• if you keep using the app after a change takes effect, the updated policy applies

15. International users

Trackist is on the App Store in many countries. Wherever you are, your account and training data are stored in the United States as described in section 4, and we apply GDPR protections to all users.

16. Do not sell my personal information (CCPA)

We do not sell, rent or trade your personal information, and we do not share it for cross-context behavioural advertising.

17. Your fitness data

Your plans, logged sets, notes, measurements, check-ins and anything read from Apple Health belong to you. We process them only to provide Trackist, including the AI coach described in section 18. We never sell them, never use them for advertising, and never show them to other users.

To get a copy, email hello@trackist.me. When you delete your account in the app, this data is deleted straight away.

18. AI features

Anthropic PBC ("Anthropic") provides the AI model behind the coach. It writes your plan and your next plan after a block, rewrites a day or rebuilds a block after your reports, picks a replacement when an exercise hurts, and writes the text of your weekly recap. The load suggestion on each exercise is not AI: the app works it out from your last session with fixed rules.

What we send: only what the coach needs for the task. That can include the name you gave in the intake questions and your gender (so the coach can address you), age, current and goal body weight, goal, experience, equipment, training days and session length, joint limitations, focus areas, training style, movements to avoid, your daily step average, your logged training and its trends, body weight and measurement changes, your reports and the notes you wrote with them, sleep, soreness and energy answers, and the coach memory. We do not send your email address or account identifier.

How Anthropic handles it: Anthropic processes the request in the United States only to produce the answer. Under its commercial terms it does not use this data to train its models and keeps it only for a limited period. The transfer is covered by Standard Contractual Clauses. See Anthropic's privacy policy.

AI plans and suggestions are produced automatically and can be wrong. They are general fitness guidance, not medical advice. Train within your limits and talk to a doctor or physiotherapist before you start a new programme, especially if something hurts.