Privacy Policy

Training data (fitness data). The app stores your workouts, exercises, sets, and statistics. This is health-related data and sensitive data under Article 9 GDPR. It is processed on your device only and is never transmitted to us. There is no account and no server-side copy – without your action, we never see your training history.

Usage analytics (GoatCounter). The app sends lightweight, anonymous usage events (such as "app opened", "banner shown", "affiliate link tapped") to GoatCounter, a privacy-friendly, EU-based analytics service. Events carry no identifiers, no personal data, and no cookies; IP addresses are anonymized on arrival. These events let us measure how the app is used without building any profile of you.

Crash reports (Sentry). The app uses Sentry to collect anonymous crash and error reports so we can fix bugs. Reports include technical details (device model, operating system version, app version, and the error's stack trace) but no personal data (PII is disabled) and no training data. Reporting is opt-out – you can turn it off at any time in Settings → Diagnostics.

Purchase data (RevenueCat). A one-time "Lifetime Access" purchase that removes advertising is processed with RevenueCat, a storefront-agnostic purchase platform. RevenueCat receives a pseudonymous, randomly generated app-user ID and your purchase/entitlement status so we can recognize and restore your purchase across devices and reinstalls. It does not receive your name, email, or payment card data.

Store account data (Apple / Google). Your app-store account (Apple ID / Google account), your download, and – where applicable – your payment are processed by Apple and Google as the operators of the respective store, in accordance with their own privacy policies and terms. We do not receive payment card numbers.

Communications. If you email us, we process the content of your message and your email address solely to respond. We do not add you to marketing lists.

We use data only to operate and improve the app: to run its core features, to process purchases, to diagnose and fix crashes, to measure anonymous usage, and to respond to your messages. We do not sell personal data. We do not use your fitness data for advertising, marketing, or profiling – Apple requires this for health-related data, and we agree with it.

The app works offline. Your training history is stored in a local database on your device (IndexedDB) and remains there. You can export your data at any time as CSV or a full JSON backup, and delete it by deleting the app or using the built-in data tools. Because data never leaves your device by default, there is no server holding your history and no profile that could be breached.

To deliver the app we rely on a small number of external services, listed below. Each of them processes only the minimum data described in section 1. None of them receives your training data.

No personalized advertising. The app contains no advertising SDK and shows no personalized ads. Banners you may see are first-party "house ads" displayed by the app itself. We do not track you across apps or websites, and no advertising identifiers (IDFA/GAID) are used. As a result, the app does not request the iOS "Allow Tracking" (ATT) permission.

Affiliate and promotional banners. The app may display promotional banners and links to selected partner shops (Allegro Affiliate and Amazon Associates). Tapping such a banner opens the partner's website in your system browser.

• →  We do not transmit any personal data to these partners. The only data the partner may receive is what your browser sends to any website you visit.
• →  Offer matching (e.g. local currency and prices) is performed by the partner's server or based on your device's language/locale settings. The app does not collect or send your location.
• →  On the partner's website, their own privacy policy and cookie rules apply. We have no control over them – please read them before browsing.

A one-time, optional Lifetime Access purchase removes advertising banners entirely.

We rely on the following bases under GDPR:

• (a)  performance of a contract for purchases (Article 6(1)(b));
• (b)  our legitimate interest in operating, securing, and improving the app, including anonymous usage analytics and crash reporting (Article 6(1)(f));
• (c)  consent where we ask for it explicitly, such as enabling crash reporting on iOS (Article 6(1)(a));
• (d)  legal obligation where required (Article 6(1)(c)).

Fitness data stored locally on your device is under your control; we never access it remotely.

Training data is retained on your device until you delete it. Anonymous analytics events are retained by GoatCounter in aggregate. Crash reports are retained for a limited period (typically 90 days) and then automatically purged. Communications are retained only as long as needed to handle your request. Purchase records are kept as required by tax law and the relevant store's policies.

You have the right to request access, rectification, erasure, restriction of processing, and data portability, and to object to processing. You may also withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email contact@holistcraft.dev. You also have the right to lodge a complaint with a supervisory authority – for Polish users, the President of the Personal Data Protection Office (Prezes UODO, uodo.gov.pl).

Some of our service providers (in particular Sentry and RevenueCat) are based in the United States. Where data is transferred outside the European Economic Area, the transfer is based on appropriate safeguards, including the European Commission's Standard Contractual Clauses. GoatCounter stores data in the EU.

Our services are not directed at children. If you believe a child has provided us with personal data, contact us and we will delete it.

We follow reasonable technical and organizational measures to protect data, including encryption in transit (HTTPS) for any data transmitted to our service providers. Because your training data lives on your device, the most important security control is in your hands – and we never collect it centrally.

We may update this policy from time to time. The current version, with its "last updated" date, is always available here. Material changes will be announced in the app and on this website.

The data controller for this service is IT Piotr Sioch (operating as Holistcraft).

For any privacy question, request, or to exercise your rights, email contact@holistcraft.dev.