Privacy Policy

Last updated: October 2026

This policy explains what personal data the Adaptum app and this website process, why, and what rights you have. Adaptum works without an account: unless you create one, your training data stays on your device, apart from the exceptions described in section 3.

1. Controller

The controller responsible for data processing under the EU General Data Protection Regulation (GDPR) is:

No data protection officer has been appointed at this time.

2. In short

• Without an account, your profile, plans and workout history stay on your device; we receive none of it. On iPhone they are also part of the phone's own device backup if you have that turned on (section 3).
• An account is optional. It needs only an email address and a one-time code (or sign-in with Google or Apple); there is no password.
• Cloud backups are encrypted on your device with a recovery phrase that only you hold, so our server cannot read them.
• Adaptum shows no advertising, does no cross-app tracking and does not sell personal data.
• Diagnostics (crash and error reports) are off unless you turn them on.

3. Data stored on your device

To build and adapt your plan, the app stores on your device: your training profile (goal, experience, schedule, workout length, progression preference and, if you enter them, age, height and weight), your training environments and their equipment, excluded exercises and movement patterns, your plans, your workout history (workouts, sets with weight, reps and notes, effort ratings and exercise feedback, including notes about pain or discomfort) and app settings such as language, notifications and reminder time.

This data is kept with standard on-device storage and is processed on your device; plans are generated and adapted on the device. Your training data leaves the device only if you create an account and back it up, encrypted (sections 4 and 5); the optional diagnostics (section 7) never contain it. Workout reminders are scheduled on your device.

Device backups. On iPhone, the app's data is included in the phone's own device backup (iCloud or a computer backup), like the data of other apps, if you have device backups turned on. That backup is made by your phone under your own settings, not by us. On Android, the app's data is excluded from device backups.

You can erase everything stored on your device at any time in the app under You → Account & Data → Reset all data: your training data, settings, sign-in session, recovery phrase and consent records. This does not delete anything on our servers; deleting your cloud backup or your account are separate actions on the Account screen (section 12). You can also uninstall the app.

4. Optional account and sign-in

You can create an account to back up your training and restore it on another device. For this we process:

• your email address;
• a one-time sign-in code, sent to that address from noreply@adaptum.app (there is no password) or, if you choose it, sign-in with Google (Android) or Sign in with Apple (iPhone), see below;
• technical account data: a user ID, when the account was created and last signed in, and session tokens stored on your device to keep you signed in;
• technical request data (such as IP address, time and app/client information) that our hosting provider records when the app talks to the server. Supabase keeps these request logs (IP address, time, request details) for about one day.

Sign-in with Google (optional, Android). Instead of the emailed code you can sign in with your Google account. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) confirms your identity and passes us your email address, your name and your Google account ID. We store the email address and the Google account ID with your account; we do not keep your name. Legal basis: Art. 6(1)(b) GDPR. For your Google account itself, Google acts as an independent controller under its own privacy policy.

Sign in with Apple (optional, iPhone). Instead of the emailed code you can sign in with your Apple account. Apple Distribution International Ltd. (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) confirms your identity and passes us an email address, which can be a private relay address (“Hide My Email”) if you choose that. We store the email address and the Apple account ID with your account; the app does not keep your name. Legal basis: Art. 6(1)(b) GDPR. For your Apple account itself, Apple acts as an independent controller under its own privacy policy. With either option there is still no password.

Providing an email address is voluntary; without it you can use every feature of the app except cloud backup. You can change the address in the app under Account → Change email.

Legal basis: performance of the contract you enter into by using the account feature (Art. 6(1)(b) GDPR) and, for technical request data, our legitimate interest in operating a secure service (Art. 6(1)(f) GDPR).

5. Cloud backup

Once you are signed in, a backup is made automatically when you leave the app, but only if something changed since the last one. You can also back up at any time yourself. Signing out stops automatic backups.

A backup contains:

• your training profile, including age, height and weight if you entered them;
• your training environments and which one is active;
• excluded exercises and movement patterns;
• a strength calibration summary (for each exercise, the last working weight and rep range);
• your custom plans, plan customizations and plan schedule, and which plan is active;
• your training history: logged workouts, every set with its weight, reps and any note you wrote, effort ratings, and exercise feedback, including notes about pain or discomfort. There is no paid subscription today, so this is included for every account; if we introduce one, we will update this policy before it can change what is backed up.

We keep your current backup and your last ten previous backups, so you can restore an earlier version. Access is restricted so that only your signed-in account can read, update or delete your own backups. Backups are stored with Supabase in the EU (Frankfurt, Germany; see section 9).

Backups are encrypted on your device, with a recovery phrase that only you hold, before they are uploaded. Our server (and Supabase) therefore stores only encrypted data and cannot read the contents of your backups.

We do not upload your location, contacts or anything else from your device beyond the contents listed above.

Legal basis: performance of the contract for the backup feature you chose to use (Art. 6(1)(b) GDPR). Body measurements and notes about pain or discomfort can be health data (Art. 9 GDPR); these are processed on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give by ticking a separate box before you ask for a sign-in code. You can withdraw this consent at any time with effect for the future on the Account screen of the app (signed in, under You → Account & Data → Account), using Withdraw consent. This stops all uploads and deletes the cloud backups stored for your account, including the older backup versions; your account itself remains. Delete cloud backup only erases what is currently stored; it does not withdraw consent, so a new backup is made the next time something changes unless you also withdraw consent or delete your account. None of this affects the lawfulness of the processing before that point.

Record of your consents. When you accept the terms (and, for a backup, give the health data consent), the app stores the version of the terms and the time on your device. Once you have confirmed your address, the same record is stored with your account, so that we can demonstrate your acceptance and consent. Legal basis: our legal obligation to demonstrate consent (Art. 7(1), Art. 6(1)(c) GDPR) and our legitimate interest in documenting the contract (Art. 6(1)(f) GDPR).

6. Training tips by email

When you create an account you can tick “Email me training tips” (at most twice a month). The box is never pre-ticked, and once you are signed in you can switch it off, or on again, at any time with the switch Email me training tips on the Account screen of the app (You → Account & Data → Account). We store your email address, whether you agreed or declined, the time you agreed or withdrew, and where in the app you were asked. The record is only created after you have confirmed your address with the sign-in code. We do not currently send training-tips emails to anyone: no sending provider is connected yet. Before we start, we will add a separate confirmation step for the newsletter itself — German case law on § 7 UWG treats this as distinct from the sign-in code, which only confirms your address — and name the sending provider here.

Legal basis: your consent (Art. 6(1)(a) GDPR). We keep the record of your choice to be able to prove consent (Art. 7(1) GDPR, Art. 6(1)(c) GDPR).

You can withdraw your consent at any time with effect for the future with that switch in the app or by writing to privacy@adaptum.app. Once we do send training-tips emails, each one will also carry its own unsubscribe link.

7. Diagnostics

The app has a switch You → App → Send diagnostics. It is off until you turn it on, and you can turn it off at any time with the same switch.

Diagnostics are crash and error reports. A report contains technical context only: your device model, operating system version, app version and a pseudonymous installation ID. It contains no health data, no training data and no email address. Diagnostics cover three things, none of which include user-entered content such as weights, reps, exercise names, notes, body measurements or your email address: usage events from a fixed list (the app was opened; onboarding was started or completed; a workout was started; a set was logged, with its set type only; a workout was finished, with the number of exercises and a duration range such as “30–60 min”; a plan was generated, with the goal and days per week; a premium screen was shown or a premium feature was not available); reports of errors the app handled; and, on Android, an automatic report if the app crashes or stops responding. We configure the crash-reporting tool to not attach a screenshot or a copy of the screen's content, and not to include your IP address by default. Because of the installation ID, these reports are pseudonymous, not anonymous.

If you turn on Send diagnostics, these reports are sent to Sentry (Functional Software, Inc., USA; see section 9) using Sentry's EU data region, so the data is stored in Germany. Transfers to the USA are covered by the EU-U.S. Data Privacy Framework (Sentry is certified) and Standard Contractual Clauses. Crash reporting is implemented for Android only today. Nothing is sent unless you turn this switch on.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future by turning the switch off again.

8. This website and email contact

This website uses no cookies, no analytics, no tracking and no external fonts or scripts. When you visit it, our hosting provider Cloudflare processes technical data that every web request contains (IP address, date and time, requested page, browser information) to deliver the site and protect it from attacks. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). We have not enabled Cloudflare's log-retention add-on or any analytics for this site, so these request logs are not stored beyond what Cloudflare needs to serve the page and are not available to us afterward.

If you email us, or write to us using the contact form on the Support page, we use your address and message to answer you. The form asks for your name (optional), your email address and your message; nothing else is read from your device. It sends this as an email to the same mailbox, processed the same way, without you needing to open your own mail app — Cloudflare's Worker that runs the form does not store a copy anywhere; if sending fails, the page shows a fallback mailto: link instead of silently dropping your message. We keep the email itself only as long as needed to handle your request (see section 10) — please do not include health or training details, such as pain, injuries or body measurements, in a support message unless they are actually necessary for your question. Legal basis: Art. 6(1)(b) GDPR where your request concerns the app, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Emails to adaptum.app addresses, including one sent by the contact form, are delivered by Cloudflare's email service to the operator's mailbox. From there they are delivered to the operator's Gmail mailbox — see section 9 for why that mailbox is not our processor.

9. Service providers and recipients

We use the following processors, each bound by a data processing agreement under Art. 28 GDPR, acting only on our instructions:

• Supabase Pte. Ltd (Singapore) – database, authentication and server functions for accounts, backups and account deletion. The project is hosted in the AWS region EU Central (Frankfurt, Germany). Supabase's data processing agreement (Art. 28 GDPR) is part of its terms of service; for any access from outside the EU it includes the EU Standard Contractual Clauses.
• Sendinblue SAS, trading as Brevo (106 boulevard Haussmann, 75008 Paris, France) – delivery of sign-in code emails from noreply@adaptum.app via SMTP; processes your email address and the email content. Brevo's data processing agreement under Art. 28 GDPR is part of Brevo's terms. Brevo hosts this service in the EU (infrastructure in France and Germany, with backups in Belgium); Brevo's own privacy policy discloses that some processing, such as support, may involve providers outside the EEA, covered by Standard Contractual Clauses.
• Cloudflare, Inc. – hosting of this website, the contact form's Worker (section 8) and forwarding of email sent to adaptum.app addresses. Cloudflare's data processing agreement is incorporated into Cloudflare's self-serve subscription terms. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework and also uses Standard Contractual Clauses.
• Functional Software, Inc., d/b/a Sentry (45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA) – crash and error reports (device model, OS version, app version, pseudonymous installation ID), only if you turn on Send diagnostics (currently Android only). We use Sentry's EU data region, so this data is stored in Germany. Transfers to the USA are covered by the EU-U.S. Data Privacy Framework (Sentry is certified) and Standard Contractual Clauses.

Google Ireland Limited is not our processor. The mailbox behind support@adaptum.app and privacy@adaptum.app is currently a personal Google account (Gmail); Google states that it does not offer a data processing agreement for a consumer Gmail account and does not act as a processor for it. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) therefore receives and stores the content of emails sent to those addresses in its own right, as an independent controller under its own privacy policy, not on our instructions. We rely on our legitimate interest in using this mailbox to run support and data-protection requests (Art. 6(1)(f) GDPR); we intend to move to a mail provider that can act as our processor, at which point this section will be updated.

Where a provider processes data outside the EU/EEA, this happens only on the basis of an adequacy decision (such as the EU–US Data Privacy Framework, where the provider is certified) or Standard Contractual Clauses (Art. 44 et seq. GDPR).

When you download the app, Google Play (and, later, the App Store) process data as independent controllers under their own privacy policies. The same applies to Apple for Sign in with Apple (section 4).

We do not sell personal data or share it for advertising.

10. How long data is kept

• Data on your device: until you use Reset all data (which erases everything stored on the device) or uninstall the app. On iPhone, copies in your own device backups remain until you delete those backups.
• Account and cloud backup: until you delete your cloud backup or your account; withdrawing your health-data consent deletes the backups at once. Of your previous backups, only the last ten are kept; older ones are removed automatically. We do not currently delete an account just because it has been inactive; nothing about the data becomes unnecessary purely from time passing, since you can resume at any point.
• Records of your consents (terms, health data, training tips): until your account is deleted; the record on your device until you use Reset all data or uninstall the app.
• Emails to support or privacy: as long as needed to handle your request, then deleted, unless we are required to keep them longer by law.
• Technical logs at our providers: Supabase keeps request logs for about one day. Cloudflare does not retain identifiable request logs for this site, since we have not enabled any log-retention or analytics add-on. Brevo keeps delivery logs for the sign-in emails it sends according to its own policy, available to us on request.

11. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• receive your data in a portable format (Art. 20) – the app exports all the data we hold on your device as one machine-readable JSON file under You → Account & Data → Export data: your profile, plans, workout history, body-metric (weight) history, the recorded consents (terms version and times) and the app settings;
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)) – health-data consent, training tips and diagnostics can be withdrawn in the app (sections 5, 6 and 7).

To exercise your rights, write to privacy@adaptum.app, ideally from the email address of your account. We answer within one month. Legal basis for handling that request: our legal obligation under the GDPR (Art. 6(1)(c) GDPR); a general support question you send the same way is instead handled under section 8.

12. Deleting your data

In the app, open your Account screen (You → Account & Data → Account) and choose Delete cloud backup to delete your backups but keep your account, or Delete account to delete your account, all backups including previous versions, and your consent records from our servers; this also removes the sign-in session and the stored recovery phrase from your device. Withdraw consent stops all uploads and deletes your backups while keeping the account (section 5). Data on your device stays until you use You → Account & Data → Reset all data, which erases everything stored on the device (training data, settings, sign-in session, recovery phrase and consent records) but deletes nothing on our servers, or until you uninstall the app. If you can no longer sign in, email privacy@adaptum.app from your account's address and we will delete your account. See also Support.

13. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live, work or where the alleged infringement took place (Art. 77 GDPR). The authority responsible for us is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

14. Children

You must be at least 16 years old to use Adaptum; you confirm this when you accept the terms, and if you are 16 or 17, your parent or legal guardian must agree on your behalf. The app is not directed at anyone younger, and we do not knowingly collect their data.

Automated decisions: Adaptum adapts your training plan automatically on your device. This has no legal or similarly significant effect on you and is not automated decision-making within the meaning of Art. 22 GDPR.

15. Changes to this policy

If the app or this policy changes, we will update this page and the “last updated” date above.

16. US Consumer Health Data Privacy Notice (Washington & Nevada)

If you are a resident of Washington State or Nevada, this section is your Consumer Health Data Privacy Notice under Washington's My Health My Data Act and Nevada's Consumer Health Data Privacy Act (SB 370). It adds to, rather than replaces, everything above, and describes the same practices required elsewhere on this page in the specific categories these two laws ask for.

"Consumer health data" under these laws is broader than GDPR's "health data" and can include information that identifies your health status or that could be associated with it — for Adaptum, this means the body metrics, effort ratings and exercise-feedback notes described in section 5 (Cloud backup), if you create an account and back up your training. Adaptum does not read, request or infer any other health-related information about you.

• Categories collected and their purpose: the body metrics (age, height, weight), effort ratings and exercise-feedback notes (including notes about pain or discomfort) listed in section 5, collected solely to provide the backup and restore feature you chose to use — never to advertise to you, build a profile of you for advertising, or for any purpose beyond running the app. This only happens if you have an account with cloud backup turned on.
• Sources: only what you type into the app yourself. We do not buy, license or infer this data from any other source.
• Consent: collection starts only after you separately tick the health-data consent box described in section 5 — a distinct, freeform choice from accepting the terms, not bundled into it. We do not share your consumer health data with anyone beyond what is listed below without asking you again first.
• Sold, or shared for advertising: never, and we have never sought your written authorization to do so because we do not do it.
• Categories of third parties or affiliates it is disclosed to: only the processors named in section 9 that touch this data — Supabase for storage, and Sentry only if you separately turn on diagnostics — each under a written agreement restricting them to providing the service to us. Adaptum has no corporate affiliates and discloses consumer health data to no one else. See section 9 for exactly which processor may see what.
• Your rights and how to exercise them: you may confirm whether we process your consumer health data, request its deletion, and withdraw your consent for its collection or sharing, by writing to privacy@adaptum.app or using the contact form. The in-app Withdraw consent, Delete cloud backup and Delete account actions (sections 5 and 12) do this immediately without needing to write to us at all — withdrawing consent and deleting the account each remove every stored backup version, not only the most recent one, and take effect immediately rather than on a delay. We respond to a written request within 45 days, extendable once by a further 45 days when reasonably necessary, with notice to you of the extension and why. If we deny a request, you may appeal by replying to our decision; we will decide an appeal within 45 days of receiving it, and if we uphold the denial, we will tell you how to contact your state Attorney General.

Nevada's law additionally requires separate, affirmative consent before collecting consumer health data and, again separately, before sharing it — both of which section 5's dedicated consent box already provides for every account, regardless of which state you are in. Nevada enforces its law through the state Attorney General rather than through an individual right to sue, unlike Washington's law.

This section covers Washington State and Nevada specifically and is not a general statement of worldwide compliance. Adaptum is available outside the EU, Washington and Nevada, and other jurisdictions — including other US states — may have their own requirements for health-adjacent data that are not separately addressed on this page today.