Privacy Policy

1 · Who We Are

WorkoutPilot is an iOS application developed and operated by Cyril Daime ("we", "us", or "our"), an independent developer. You can contact us at cyril.daime@gmail.com.

This Privacy Policy explains what data WorkoutPilot collects, how it is used, and what rights you have over your data.

2 · Data We Collect

Account data

When you create an account, we collect your email address and a hashed password. No name, phone number, or social login is required. You may also use the app as a guest without creating an account; in that case, data is stored locally on your device only.

Workout & training data

If you log workouts, we store the data you voluntarily enter:

• Training programs and session templates you create
• Completed workout sessions (date, duration, gym location)
• Exercise performance per set: reps, weight, duration, distance, speed, cadence, and other metrics you choose to track
• Session notes and per-exercise notes

This data is linked to your account and stored on our servers. It is never shared with third parties for advertising or profiling purposes.

Custom content

Content you create is private to your account:

• Custom exercises (name, muscle group, equipment, metrics tracked)
• Custom muscle group taxonomy entries
• Gym locations you add
• Personal photos attached to exercises

Imported data

If you use the CSV import feature, we store the workout history you choose to import. The import file is processed directly on your device and our servers only receive the resulting structured data, not the original file.

Device & usage data

We collect minimal technical data to keep the app functioning correctly:

• App version and operating system version
• Crash reports and error logs (anonymised)
• Subscription status (Pro or Free)

We do not track advertising identifiers, browsing behavior, or usage analytics beyond what is strictly necessary for the app to function.

3 · Third-Party Services

Supabase (database & authentication)

WorkoutPilot uses Supabase to securely store your account and workout data. Supabase is hosted on AWS infrastructure in the EU region. Supabase acts as a data processor on our behalf and does not access or use your data independently.

Supabase Privacy Policy: supabase.com/privacy

RevenueCat (in-app purchases & subscriptions)

Subscription management (WorkoutPilot Pro) is handled by RevenueCat. RevenueCat processes your App Store transaction data to verify and manage your subscription. Payment details (credit card, Apple ID) are handled entirely by Apple and are never transmitted to us or RevenueCat.

RevenueCat Privacy Policy: revenuecat.com/privacy

Resend (transactional email)

WorkoutPilot uses Resend to deliver transactional emails such as account verification codes (OTP) and password reset codes. Resend only receives your email address and the content of the email being sent; no other personal data is transmitted. These emails are sent solely in response to actions you initiate in the app.

Resend Privacy Policy: resend.com/legal/privacy-policy

Apple (App Store, StoreKit)

All payments are processed by Apple. Apple's privacy practices are governed by the Apple Privacy Policy.

4 · How We Use Your Data

We use the data we collect exclusively to:

• Provide the core functionality of the app (logging workouts, tracking performance, displaying statistics and personal records)
• Authenticate you securely and sync your data across devices
• Enable offline use by caching your data locally on your device
• Manage your subscription status
• Send account verification and password reset codes via email
• Diagnose and fix technical issues

We do not:

• Sell your data to any third party
• Use your workout or health data for advertising
• Share your data with data brokers or analytics platforms
• Profile you for purposes beyond delivering the app's core features

5 · Data Retention

Your data is retained for as long as your account exists. If you delete your account, all associated data (workout history, custom exercises, programs, photos, account information) is permanently deleted from our servers within 30 days.

Guest-mode data is stored locally on your device only and is not sent to our servers. It is removed when you uninstall the app or clear the app's local storage.

6 · Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Objection — object to the processing of your data

How to delete your account

You can delete your account and all associated data directly from the app:

Settings → Account → Delete Account

Alternatively, send an email to cyril.daime@gmail.com with the subject "Account Deletion Request" and we will process your request within 30 days.

7 · Data Security

All data transmitted between the app and our servers is encrypted using HTTPS/TLS. Passwords are hashed and never stored in plain text. Access to the database is restricted and protected by Supabase's Row Level Security (RLS) policies, ensuring each user can only access their own data. The shared exercise catalogue is readable by all authenticated users but cannot be modified by any user account.

8 · Children's Privacy

WorkoutPilot is designed for adults aged 17 and older and is not intended for use by children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us and we will delete it promptly.

9 · Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via an in-app notice or email. The "Last updated" date at the top of this page reflects the most recent revision.

10 · Contact

For any privacy-related question, data access request, or account deletion request, contact us at: