Privacy Policy

Last updated: March 7, 2026

1. Data Controller

Onset Fitness
Email: contact@onsetf.fitness

2. Data We Collect

Category	Data	Purpose
Identity	Name, username, email, phone, country	Account and profile
Biometric	Weight, height, sex, date of birth	Weight estimation, programming
Health	Declared joint limitations	Exercise adaptation
Training	Full workout history (exercises, sets, reps, weights, durations)	Volume tracking, progression
Location	Gym address and coordinates (optional)	Training context
Image	Profile photo	Social display
Device	Device identifier, app version, platform	Analytics and improvement
Motion	Daily step count (iOS sensor)	Activity tracking
Contacts	Address book (if permitted)	Friend discovery

3. Legal Basis (GDPR)

Consent — for health/biometric data collection (Article 9)
Contract performance — for account management and service delivery
Legitimate interest — for analytics and service improvement

4. How We Use Your Data

Provide and personalize the training tracking service
Generate weight estimates and program recommendations
Generate AI-powered program explanations (via Groq Inc.)
Enable social features (friend discovery, activity feed)
Process subscription payments (via RevenueCat / Apple)
Improve the application through anonymized analytics

5. Third-Party Processors

Service	Purpose	Location
Supabase Inc.	Database, authentication, file storage	AWS (EU/US)
RevenueCat Inc.	Subscription management	United States
Groq Inc.	AI content generation	United States
Apple Inc.	Payment processing, app distribution	United States

International data transfers are governed by the European Commission's Standard Contractual Clauses.

6. Data Sent to AI

When generating program explanations, the following data is sent to Groq Inc.:

Training goal, experience level, training frequency
Program structure (days, exercises, volume targets)
Sex and weight (for contextual recommendations)

This data is transmitted without personal identifiers (no name, email, or user ID).

7. Data Retention

Active account: data retained as long as the account is active
Account deletion: data deleted within 30 days of request
Analytics: anonymized data retained for up to 24 months

8. Your Rights

GDPR Rights (EU Residents)

Right of access — obtain a copy of your personal data
Right to rectification — correct inaccurate data
Right to erasure — request deletion of your data
Right to data portability — receive your data in a structured format
Right to object — object to data processing
Right to withdraw consent — withdraw consent at any time

To exercise these rights, contact: contact@onsetf.fitness

You may also file a complaint with your local Data Protection Authority (e.g., CNIL in France).

CCPA Rights (California Residents)

Right to know what personal information is collected
Right to request deletion of personal information
Right to opt out of the sale of personal information

Onset Fitness does not sell personal information.

9. Cookies and Tracking

The Application does not use cookies. Device identifiers (IDFA on iOS) may be collected for analytics purposes. You can disable ad tracking in your device settings (Settings > Privacy > Tracking).

10. Children's Privacy

The Application is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Data Security

All data transmitted via HTTPS/TLS encryption
Authentication via Supabase (JWT tokens)
Local data encrypted by iOS at rest
API access protected by authentication and rate limiting

No system is 100% secure. We cannot guarantee absolute security but take reasonable measures to protect your data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be communicated via the Application. Continued use after notification constitutes acceptance.

13. Contact

For any questions about this Privacy Policy:

Email: contact@onsetf.fitness