Privacy Policy

Last updated: September 2026

This policy explains what personal data the Adaptum app and this website process, why, and what rights you have. Adaptum works without an account: unless you create one, your training data never leaves your device.

1. Controller

The controller responsible for data processing under the EU General Data Protection Regulation (GDPR) is:

No data protection officer has been appointed. [TO VERIFY: confirm that no data protection officer is required]

2. In short

• Without an account, your profile, plans and workout history are stored only on your device.
• An account is optional. It needs only an email address and a one-time code; there is no password.
• Adaptum shows no advertising, does no cross-app tracking and does not sell personal data.
• Diagnostics are off unless you turn them on.

3. Data stored on your device

To build and adapt your plan, the app stores on your device: your training profile (goal, experience, schedule, workout length, progression preference and, if you enter them, age, height and weight), your training environments and their equipment, excluded exercises and movement patterns, your plans, your workout history (workouts, sets with weight, reps and notes, effort ratings and exercise feedback, including notes about pain or discomfort) and app settings such as language, notifications and reminder time.

This data is kept with standard on-device storage and is processed on your device only; plans are generated and adapted on the device. We have no access to it unless you create an account and back it up (sections 4 and 5). Workout reminders are scheduled on your device.

You can erase all of it at any time in the app under Profile → Account & Data → Reset all data, or by uninstalling the app.

4. Optional account and sign-in

You can create an account to back up your training and restore it on another device. For this we process:

• your email address;
• a one-time sign-in code, sent to that address from noreply@adaptum.app (there is no password and no sign-in with Google or Apple);
• technical account data: a user ID, when the account was created and last signed in, and session tokens stored on your device to keep you signed in;
• technical request data (such as IP address, time and app/client information) that our hosting provider records when the app talks to the server. Supabase keeps these request logs (IP address, time, request details) for about one day.

Providing an email address is voluntary; without it you can use every feature of the app except cloud backup. You can change the address in the app under Account → Change email.

Legal basis: performance of the contract you enter into by using the account feature (Art. 6(1)(b) GDPR) and, for technical request data, our legitimate interest in operating a secure service (Art. 6(1)(f) GDPR).

5. Cloud backup

Once you are signed in, a backup is made automatically when you leave the app, but only if something changed since the last one. You can also back up at any time yourself. Signing out stops automatic backups.

A backup contains:

• your training profile, including age, height and weight if you entered them;
• your training environments and which one is active;
• excluded exercises and movement patterns;
• a strength calibration summary (for each exercise, the last working weight and rep range);
• your custom plans, plan customizations and plan schedule, and which plan is active;
• your training history: logged workouts, every set with its weight, reps and any note you wrote, effort ratings, and exercise feedback, including notes about pain or discomfort. [TO VERIFY: whether training history backup will be limited to a paid subscription at launch; the current app build includes it for every account because paid plans are not live yet]

We keep your current backup and your last ten previous backups, so you can restore an earlier version. Access is restricted so that only your signed-in account can read, update or delete your own backups. Backups are stored with Supabase in the EU (Frankfurt, Germany; see section 9).

We do not upload your location, contacts or anything else from your device beyond the contents listed above.

Legal basis: performance of the contract for the backup feature you chose to use (Art. 6(1)(b) GDPR). Body measurements and notes about pain or discomfort can be health data (Art. 9 GDPR); these are processed on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give by ticking a separate box before you ask for a sign-in code. You can withdraw it at any time with effect for the future by deleting your cloud backup or your account (Profile → Account & Data); this does not affect the lawfulness of the processing before the withdrawal.

Record of your consents. When you accept the terms (and, for a backup, give the health data consent), the app stores the version of the terms and the time on your device. Once you have confirmed your address, the same record is stored with your account, so that we can demonstrate your consent. Legal basis: our legal obligation to demonstrate consent (Art. 7(1), Art. 6(1)(c) GDPR) and our legitimate interest in documenting the contract (Art. 6(1)(f) GDPR).

6. Training tips by email

When you create an account you can tick “Email me training tips” (at most twice a month). The box is never pre-ticked. We store your email address, whether you agreed or declined, the time you agreed or withdrew, and where in the app you were asked. The record is only created after you have confirmed your address with the sign-in code. [TO VERIFY: a separate confirmation email (double opt-in) before the first newsletter is sent, as German case law on § 7 UWG expects; the sign-in code confirms the address, not the newsletter consent]

Legal basis: your consent (Art. 6(1)(a) GDPR). We keep the record of your choice to be able to prove consent (Art. 7(1) GDPR, Art. 6(1)(c) GDPR).

You can withdraw your consent at any time with effect for the future by writing to privacy@adaptum.app. [TO VERIFY: unsubscribe link in each email and the provider that will send these emails]

7. Diagnostics

The app has a setting Profile → Privacy → Send diagnostics. It is off until you turn it on, and you can turn it off at any time.

Diagnostics cover two things. First, anonymous usage events from a fixed list: the app was opened; onboarding was started or completed; a workout was started; a set was logged (with its set type only); a workout was finished (with the number of exercises and a duration range such as “30–60 min”); a plan was generated (with the goal and days per week); a premium screen was shown or a premium feature was not available. Second, reports of errors the app handled. Diagnostics never contain weights, reps, exercise names, notes, body measurements, your email address or other identifiers.

In the current version of the app, diagnostics are only written to the app log on your device and are not transmitted to us or to anyone else. If we add a diagnostics service, we will name it in this policy before any data is sent. [TO VERIFY: diagnostics backend before release]

Legal basis: your consent (Art. 6(1)(a) GDPR).

8. This website and email contact

This website uses no cookies, no analytics, no tracking and no external fonts or scripts. When you visit it, our hosting provider Cloudflare processes technical data that every web request contains (IP address, date and time, requested page, browser information) to deliver the site and protect it from attacks. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). [TO VERIFY: Cloudflare log retention for this site]

If you email us, we use your address and message to answer you. Legal basis: Art. 6(1)(b) GDPR where your request concerns the app, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Emails to adaptum.app addresses are forwarded by Cloudflare Email Routing to the operator's mailbox. From there they are delivered to the operator's Gmail mailbox, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).

9. Service providers and recipients

We use the following processors, bound by data processing agreements under Art. 28 GDPR:

• Supabase Pte. Ltd (Singapore) – database, authentication and server functions for accounts, backups and account deletion. The project is hosted in the AWS region EU Central (Frankfurt, Germany). Supabase's data processing agreement (Art. 28 GDPR) is part of its terms of service; for any access from outside the EU it includes the EU Standard Contractual Clauses.
• Sendinblue SAS, trading as Brevo (106 boulevard Haussmann, 75008 Paris, France) – delivery of sign-in code emails from noreply@adaptum.app via SMTP; processes your email address and the email content. Brevo's data processing agreement under Art. 28 GDPR is part of Brevo's terms. [TO VERIFY: Brevo server location / any sub-processor transfers outside the EU]
• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – Gmail mailbox that receives email forwarded from support@adaptum.app and privacy@adaptum.app.
• Cloudflare, Inc. – hosting of this website and forwarding of email sent to adaptum.app addresses. Cloudflare's data processing agreement is incorporated into Cloudflare's self-serve subscription terms. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework and also uses Standard Contractual Clauses.

Where a provider processes data outside the EU/EEA, this happens only on the basis of an adequacy decision (such as the EU–US Data Privacy Framework, where the provider is certified) or Standard Contractual Clauses (Art. 44 et seq. GDPR).

When you download the app, Google Play (and, later, the App Store) process data as independent controllers under their own privacy policies.

We do not sell personal data or share it for advertising.

10. How long data is kept

• Data on your device: until you reset the app's data or uninstall it.
• Account and cloud backup: until you delete your cloud backup or your account. Of your previous backups, only the last ten are kept; older ones are removed automatically. [TO VERIFY: whether inactive accounts are deleted after a period]
• Records of your consents (terms, health data, training tips): until your account is deleted; the record on your device until you reset the app's data or uninstall it.
• Emails to support or privacy: as long as needed to handle your request. [TO VERIFY: concrete retention period]
• Technical logs at our providers: for the period the provider keeps them. Supabase keeps request logs for about one day; Brevo and Cloudflare keep their logs according to their own policies. [TO VERIFY: Brevo and Cloudflare log retention]

11. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• receive your data in a portable format (Art. 20) – the app can export all your data as a file under Profile → Account & Data → Export data;
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)).

To exercise your rights, write to privacy@adaptum.app, ideally from the email address of your account. We answer within one month.

12. Deleting your data

In the app, open your Account screen (Profile → Account & Data) and choose Delete cloud backup to delete your backups but keep your account, or Delete account to delete your account, all backups including previous versions, and your consent records from our servers. Data on your device stays until you reset it or uninstall the app. If you can no longer sign in, email privacy@adaptum.app from your account's address and we will delete your account. See also Support.

13. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live, work or where the alleged infringement took place (Art. 77 GDPR). The authority responsible for us is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

14. Children

You must be at least 16 years old to use Adaptum; you confirm this when you accept the terms. The app is not directed at anyone younger, and we do not knowingly collect their data.

Automated decisions: Adaptum adapts your training plan automatically on your device. This has no legal or similarly significant effect on you and is not automated decision-making within the meaning of Art. 22 GDPR.

15. Changes to this policy

If the app or this policy changes, we will update this page and the “last updated” date above.