Privacy policy

1. Data controller and contact

The data controller is Adrian Szabłowski, ul. Ludwika Zamenhofa 2/33, 33-300 Nowy Sącz, Poland, Tax ID (NIP): 7343649264, Business ID (REGON): 540236581.

Email: hello@trackist.me

If you are in the EU, you can also complain to your local data protection authority. In Poland that is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

2. Personal data we collect

When you use Trackist, we collect:

• Account data: the name you give in the intake questions, which the coach uses to address you, the email address your sign-in provider gives us (with Sign in with Apple this can be a private relay address), and the identifier from Sign in with Apple or Sign in with Google. If you sign in with Google, we also keep the full name on your Google account and the link to your Google profile picture, which Google passes on at sign-in. Supabase Auth keeps both in your sign-in record, and the App copies only the name from it and never reads or shows the picture. The App uses that name only if you did not give one in the intake questions. We do not store the name Apple can pass on. There is no password
• Your answers to the intake questions: goal, gender, age, current and goal body weight, experience, equipment, any joint that hurts and the movements that set it off, focus areas, training style, movements to avoid, training weekdays, session length and commitment
• Workout data: your plans (days, exercises, sets, rep targets and rest times), every set you log (weight, reps, seconds or metres, and RPE), what you log on a cardio card (time, and distance, floors, calories or incline), notes you add to an exercise, and the training date
• Reports and check-ins: reports that a session was too hard or too easy, pain reports (the exercise, the joint, a severity from 1 to 5 and any note you write), and your answers to the questions before a session: how you slept, how sore you are and your energy, each from 1 to 5, and, when soreness is 3 or more, where you are sore (upper body, lower body or whole body). We also keep whether you closed the questions without answering, and whether you took the lighter session the app offered, with the sets and rest your plan had, so the full session can come back. If Apple Health has last night's sleep, the app fills in the sleep answer for you, and you can change it
• Body measurements: body weight, goal weight, chest, waist, hips, and left and right arm, thigh and calf, only the ones you enter
• Results we work out for you: your Strength Score history, weekly recaps, and the coach memory, which is 3 to 5 short notes about your training that the coach uses when it writes your next plan
• Apple Health data: only if you connect Apple Health. We read your step count, body weight, sleep, the workouts you recorded, including Apple Watch workouts (such as walks, runs, rides and strength sessions), and your heart rate during them. We use them to prefill your weight, fill in cardio and walks in your plan, count your activity toward Momentum and your weekly and block recaps, tell the coach how much you moved when it writes your next plan, and work out your daily step average, which we keep in your account for the coach to use when it writes your plan. We use your sleep to fill in the sleep answer before a session, offer a lighter session after a short night, and show how you slept on the day summary and in your weekly and block recaps. We also show a workout's heart rate and other details on your phone. For each workout we store its type, start time, duration, distance, calories and elevation in your account, and the workout's Apple Health identifier, so the same workout is not copied twice. For each night we store the date, the minutes you were asleep (not the time in bed) and whether the night came from an Apple Watch or another source. Heart rate stays on your phone. We write the body weight you log in Trackist back to Apple Health. See section 7
• Settings: weight and distance units, language, and reminder settings
• Subscription status: whether you have Trackist Pro and when it ends, which we get from RevenueCat. We never see your payment details
• Feedback: messages you send through the in-app feedback form, with the app version, platform, language and whether you had Pro at the time
• Usage analytics: events such as screens viewed and the main buttons you tap, intake answers (goal, gender, age range, experience, equipment, focus areas, training style, movements to avoid, training days, session length, commitment, units, and whether your goal weight is below or above your current one, never the weights), that a set was logged (the exercise and set number, not the weight or reps), that a workout was completed with how many sets you logged, the type of a report you send (too hard, too easy or pain) and exercise swaps, that you answered the questions before a session or closed them (not the answers), that the app offered you a lighter session because of those answers (not which answer), whether you took a lighter session or undid it, that a summary screen showed a line about those answers or how regularly you train (not what it said), whether you connected Apple Health and whether a weight you saved came from it (not the weight), and paywall and purchase events. They are sent to Amplitude with your account identifier and device data (see section 4)

We do not collect: passwords, photos or videos of you, precise location, contacts, microphone or camera data, or card numbers. We do not use the advertising identifier (IDFA) and we do not track you across other apps or websites.

Data kept only on your phone: your intake answers until you sign in, small flags such as whether you have seen a recap, and the Apple Health workout details we do not store in your account, such as heart rate, pool lengths and whether a workout was indoors. These stay on the device and are not sent to us.

Server logs: our hosting provider (Supabase) logs IP addresses and requests for security and to fix faults. It keeps these logs under its own retention policy.

3. How we use your data and our legal basis

We use your personal data to:

• run Trackist: build and store your plans, log your workouts and measurements, suggest the next load, offer a lighter session when you slept badly, have low energy or are sore, and show your progress (contract, GDPR Art. 6(1)(b))
• have the AI coach write and adjust your plans, pick replacement exercises and write your weekly recap (contract, GDPR Art. 6(1)(b)), see section 18
• check your subscription and unlock Pro (contract, GDPR Art. 6(1)(b))
• sign you in and keep your account secure (legitimate interest, GDPR Art. 6(1)(f))
• show training-day, weekly recap and rest-over reminders, which are scheduled on your phone (consent, GDPR Art. 6(1)(a), which you give or withdraw in your notification settings)
• understand how people use the app so we can fix faults and improve it (legitimate interest, GDPR Art. 6(1)(f))
• answer your feedback and support requests (legitimate interest, GDPR Art. 6(1)(f))
• meet legal obligations (GDPR Art. 6(1)(c))

Health data: joint limitations, pain reports, body weight and measurements, your answers before a session and your sore area, the lighter sessions you take, and Apple Health data, including your sleep, are health data under GDPR Art. 9. We process them only because you choose to enter them or connect Apple Health, which is your explicit consent under Art. 9(2)(a). You can withdraw it by deleting the entry, disconnecting Apple Health or deleting your account. Withdrawing does not affect what was processed before. Disconnecting Apple Health stops new reads, but the workouts and nights already copied stay in your account until you delete your account or ask us by email to remove them.

We do not use your data for advertising, we do not sell it, and we do not make decisions about you that have legal or similarly significant effects.

4. Who processes your data

We do not sell your personal data.

We share data only with the providers we need to run Trackist:

• Supabase Inc.: sign-in, database and server functions, hosted on Amazon Web Services in the United States (us-east-1). Stores your account and everything listed in section 2 except analytics and the Apple Health data that stays on your phone (section 7)
• Anthropic PBC: the AI model that writes and adjusts your plans, picks replacement exercises and writes your weekly recap. Processes data in the United States. See section 18 for what we send
• Amplitude, Inc.: usage analytics, stored on Amplitude's EU servers. Receives the events and properties in section 2, your account identifier, and device data: device model, operating system, language, mobile carrier and the iOS vendor identifier (IDFV). We turn off the collection of your IP address and of the advertising identifier. We do not send your name, email, the weights and reps you lift, your body measurements, your joint limitations, your answers before a session or sore area, the joint, severity and note of a pain report, or any value read from Apple Health, such as your steps, weight, sleep or workouts
• RevenueCat, Inc.: subscription management. Receives your account identifier and your App Store purchase records
• Apple Inc.: Sign in with Apple (if you choose it), App Store payments and Apple Health, which runs on your phone. Section 7 says what we copy from it
• Google LLC: Sign in with Google (if you choose it)
• Expo (650 Industries, Inc.): delivers app updates. It receives technical data such as the app version and a device identifier for updates, not your training data

Each provider processes data only to provide its service to us, under a data processing agreement, and with industry-standard security.

Your data stays private. Trackist has no social features. Your logs, measurements and progress are never shown to other users. Share cards leave your phone only when you share them yourself.

Transfers outside the EU: your account and training data are stored in the United States by Supabase, and AI processing by Anthropic happens in the United States. RevenueCat, Apple and Google may also process data outside the EU. These transfers are protected by the European Commission's Standard Contractual Clauses, or by the EU-US Data Privacy Framework where the provider is certified under it. Analytics stay on Amplitude's EU servers.

5. How long we keep your data

• Account and training data: for as long as your account exists. It stays after Pro ends, so your plan and logs are there if you subscribe again. Deleting your account in the app removes it straight away
• Sleep from Apple Health: each time it syncs, the app copies your last 14 nights. A night you delete in Apple Health is removed from your account at the next sync if it is one of those 14 nights. Older nights stay until you delete your account
• Feedback messages: kept after you delete your account, with the link to your account removed
• Data sent to Anthropic: kept by Anthropic only for a limited period under its commercial terms, and not used to train its models. The plans and recaps it writes live in your account and go when it goes
• Usage analytics: kept by Amplitude under its retention policy. When you delete your account, write to us and we will ask Amplitude to delete the events linked to it
• Subscription records: kept by RevenueCat and Apple under their own policies and tax law
• Support emails: 3 years from your last message

Deleting your account: in the app, go to More, then Profile, then Delete account. Without a subscription, tap Delete account on the subscription screen the app opens on. It happens at once. If you no longer have the app, use the account deletion page. We confirm within 7 days and delete within 30 days. Deleting your account does not cancel a Trackist Pro subscription. Cancel it in your iPhone subscription settings.

6. Your privacy rights

If you are in the EU (GDPR):

• access your personal data
• correct inaccurate data
• have your data deleted
• restrict processing
• get your data in a portable format
• object to processing based on legitimate interest
• withdraw consent at any time
• complain to a supervisory authority

If you are in California (CCPA):

• know what personal data we collect, use and disclose
• have your personal data deleted
• correct inaccurate personal data
• opt out of the sale or sharing of personal data (we do neither)
• not be discriminated against for using these rights

You can edit most of your data in the app and delete your account there. The app has no export button. To get a copy of your data or use any other right, email hello@trackist.me. We reply within 30 days (GDPR) or 45 days (CCPA).

7. App permissions and Apple Health

Trackist asks for these permissions only:

• Notifications: training-day and weekly recap reminders, a message when you have been away, and a rest-over alert. They are scheduled on your phone, not sent from our servers
• Apple Health: read step count, body weight, sleep, workouts and heart rate, and write body weight. Trackist only deletes weight entries it wrote itself. Apple Health is on iPhone only, and Trackist reads it only after you allow it
• Add to photo library: to save a share card you made. Trackist cannot read your photos

You can turn any of these off in iOS Settings at any time, and the rest of the app keeps working. Trackist does not ask for location, camera, microphone, contacts, calendar or tracking permission.

How we treat Apple Health data: we use it only to provide Trackist to you. We never use it for advertising or marketing, and never sell it. Our analytics provider, Amplitude, receives no value read from Apple Health and nothing we work out from your sleep there. We send no event because Apple Health recorded a short night. Amplitude learns whether you connected Apple Health and whether a weight you saved came from it, never the weight. For each workout we store its type, start time, duration, distance, calories and elevation in your account, so it counts toward Momentum and your weekly and block recaps. We also store its Apple Health identifier, so the same workout is not copied twice. Heart rate and the other workout details, such as pool lengths and whether it was indoors, are read on your phone and never leave it. For each night we store the date, the minutes you were asleep and whether the night came from an Apple Watch or another source, not the time in bed or your sleep stages. We store your daily step average in your account. Your weight from Apple Health is stored in your account only when you save it as a check-in. In the intake questions, Apple Health can prefill your current weight, and the weight you save there is your first check-in.

What goes to Anthropic: 3 things built from Apple Health are sent to Anthropic, the AI provider in section 18. Your daily step average goes with the request that writes your plan. Your sleep goes only as words, never as hours or minutes: the request that writes your weekly recap gets whether the week's average night was short, in range or long against the 7 to 9 hours advised for adults, or unknown when fewer than 4 nights of at least 2 hours were recorded, whether most or few of the week's nights were recorded, and whether this was the third long week in a row. If you keep the sleep answer that Apple Health filled in before a session, that answer, a figure from 1 to 5, can go to Anthropic as section 18 describes. Your activity, which includes your Apple Health workouts, goes in 2 forms. The request that writes your next plan, or rebuilds the current one, gets your weekly average of activity minutes and workouts during the block, and how many of those minutes were cardio outside your plan. The request that writes your weekly recap gets only whether you did cardio or other activity that week and whether the week kept Momentum, with no minutes and no workout types. Anthropic never receives your heart rate, the minutes of any night, or the workout details listed above.

8. Cookies and tracking

The app has no advertising SDKs and does not track you across other companies' apps or websites. The only analytics are the Amplitude events in section 2. Your sign-in session is stored on your phone so you stay signed in.

This website (trackist.me):

• Vercel Web Analytics counts page views without cookies and without storing your IP address (legitimate interest, GDPR Art. 6(1)(f))
• Google Analytics 4, run by Google Ireland Limited, shows us which pages visitors read and how they found the site. It sets cookies only after you accept them in the banner (consent, GDPR Art. 6(1)(a)). They are named _ga and _ga_* and last up to 2 years. Google can process this data in the United States under the EU-US Data Privacy Framework
• the trackist-locale cookie remembers the language you picked, for one year. Your cookie choice is kept in your browser's local storage

To change or withdraw your consent, select Cookie settings at the bottom of any page. When you withdraw it, the Google Analytics cookies are deleted from your browser.

9. Data security

We protect your data with:

• encrypted connections between the app and our servers (TLS)
• encrypted storage with Supabase, which holds a SOC 2 Type II report for its service and runs on Amazon Web Services infrastructure
• row-level security, so each account can only read its own data
• AI requests made from our servers, so the app never holds the AI provider's keys

No system is completely secure, so we cannot guarantee absolute security.

10. Data breaches

If a breach happens, we will:

• assess the risk within 24 hours
• tell the supervisory authority within 72 hours, as GDPR requires
• tell you if there is a high risk to your rights
• act at once to contain it and prevent another

11. Sign in with Apple and Sign in with Google

You sign in with Apple or Google after you answer the intake questions. There is no email and password sign-in. Supabase Auth handles both methods.

Sign in with Apple: Apple shares your email or a private relay address. Apple can also share your name the first time you sign in, but Trackist does not store it. You can manage this in your Apple account settings. See Apple's privacy policy.

Sign in with Google: Google shares your email, your full name, the link to your profile picture and your Google account identifier. You can remove Trackist's access in your Google account security settings. See Google's privacy policy.

12. Subscription and payments

• Apple takes all payments through the App Store and charges your Apple Account
• RevenueCat tells us whether your subscription is active. We never see your card details
• See RevenueCat's privacy policy

13. Children's privacy

Trackist is intended for adults 18 years or older. We do not knowingly collect data from children under 18 (or 16 in the EU). If you are a parent and believe your child has given us personal data, email hello@trackist.me and we will delete it straight away.

14. Changes to this policy

• we will tell you about material changes 30 days in advance, by email or in the app
• we post minor changes here with a new date at the top
• if you keep using the app after a change takes effect, the updated policy applies

15. International users

Trackist is on the App Store in many countries. Wherever you are, your account and training data are stored in the United States as described in section 4, and we apply GDPR protections to all users.

16. Do not sell my personal information (CCPA)

We do not sell, rent or trade your personal information, and we do not share it for cross-context behavioural advertising.

17. Your fitness data

Your plans, logged sets, notes, measurements, check-ins and anything read from Apple Health belong to you. We process them only to provide Trackist, including the AI coach described in section 18. We never sell them, never use them for advertising, and never show them to other users.

To get a copy, email hello@trackist.me. When you delete your account in the app, this data is deleted straight away.

18. AI features

Anthropic PBC ("Anthropic") provides the AI model behind the coach. It writes your plan and your next plan after a block, rewrites a day or rebuilds a block after your reports, picks a replacement when an exercise hurts, and writes the text of your weekly recap. The load suggestion on each exercise is not AI: the app works it out from your last session with fixed rules.

What we send: only what the coach needs for the task. That can include the name you gave in the intake questions and your gender (so the coach can address you), age, current and goal body weight, goal, experience, equipment, training days and session length, joint limitations, focus areas, training style, movements to avoid, your daily step average, your logged training and its trends, whether you did cardio or other activity that week and whether that week kept Momentum, your weekly average of activity minutes and workouts during a block and how many of those minutes were cardio outside your plan (including workouts from Apple Health, see section 7), body weight and measurement changes, your reports and the notes you wrote with them, and the coach memory. We do not send your email address or account identifier.

Your answers before a session and sleep: when you report a session as too hard or too easy, the request that changes the day gets that day's answers, as figures from 1 to 5 for sleep, soreness and energy. The request that writes your weekly recap gets your week only as words: the sleep words in section 7, whether your sleep or energy answers ran low, or your soreness high, on several or most sessions, and whether you took a lighter session. The requests that write or rebuild a plan, or pick a replacement exercise, get no sleep and none of your answers before a session. Anthropic never receives your sore area or the minutes you slept.

How Anthropic handles it: Anthropic processes the request in the United States only to produce the answer. Under its commercial terms it does not use this data to train its models and keeps it only for a limited period. The transfer is covered by Standard Contractual Clauses. See Anthropic's privacy policy.

AI plans and suggestions are produced automatically and can be wrong. They are general fitness guidance, not medical advice. Train within your limits and talk to a doctor or physiotherapist before you start a new programme, especially if something hurts.