Privacy Policy

1. Introduction

This Privacy Policy explains how Athlora collects, uses, stores, shares, and protects personal information when you use the Athlora mobile application, related services, and this website.

Athlora is operated by Zdravko Stanin, an independent developer based in Bulgaria.

For the purposes of applicable data-protection law, including the General Data Protection Regulation of the European Union, Zdravko Stanin is the data controller for personal data processed through Athlora.

Contact: zdravko.stanin@gmail.com

By using Athlora, you acknowledge the practices described in this Privacy Policy.

2. Scope

This Privacy Policy applies to:

• The Athlora mobile application
• Athlora accounts
• Fitness and workout functionality
• Progress tracking
• Coach and athlete functionality
• Subscription and purchase functionality
• Athlora’s legal and support website

It does not govern Apple, Google, Supabase, PowerSync, RevenueCat, or other third-party services operating under their own privacy policies.

3. Information We Collect

3.1 Account and authentication information

Athlora may process:

• Your email address
• Your Athlora account identifier
• Your chosen display name and profile preferences
• Authentication-provider information
• Information showing whether you use email, Sign in with Apple, or Google Sign-In
• Language, time-zone, and application preferences
• Account creation, authentication, and security timestamps

Authentication is provided through Supabase and supported identity providers.

Athlora does not store plaintext passwords. When email authentication is used, authentication codes and sessions are handled through Supabase.

3.2 Fitness and training information

Depending on the features you use, Athlora may process:

• Custom exercises
• Exercise preferences and references
• Workout routines
• Routine folders, tags, favourites, and ordering
• Planned workouts
• Recurring workout schedules
• Workout titles and notes
• Completed and active workout sessions
• Exercises, sets, repetitions, loads, durations, distances, resistance, assistance, and rest periods
• Workout history and progress information
• Body measurements
• Personal training preferences
• Rest-timer preferences
• Reminder preferences
• Progress-photo metadata
• Other information that you voluntarily enter into workout or progress fields

Some fitness information may be considered sensitive or health-related information under applicable law.

Athlora processes this information only to provide the features you request, maintain your training history, synchronize your devices, generate progress information, and support Coach functionality that you explicitly enable.

3.3 Progress photos

Athlora allows you to add private progress photos using your device camera or photo library.

When you use this feature, Athlora may process:

• The selected or captured image
• The date and time associated with the entry
• The pose or category you select
• Notes you add
• Technical image properties needed to process and synchronize the image

Before upload, Athlora normalizes supported images and removes embedded metadata such as EXIF information, GPS information, original file names, comments, and other unnecessary embedded metadata.

Progress photos are stored privately and are not publicly shared by Athlora.

Downloaded progress photos are stored in an encrypted, account-specific cache on the device.

3.4 Coach and athlete information

If you use Athlora Coach or connect with a Coach, Athlora may process:

• Coach-athlete relationship status
• Invitations, acceptance, revocation, and relationship history
• Permissions granted by an athlete to a Coach
• Routine and planned-workout assignments
• Assignment titles, notes, exercises, sets, and optional Coach messages
• Information showing whether an assignment was accepted, declined, or withdrawn
• Subscription-sponsored access associated with a Coach relationship
• Coach-plan usage and client-capacity information

Coach access is permission-scoped and denied by default.

A Coach may only access athlete information made available through an active relationship and the permissions granted by the athlete. Workout access and progress-photo access may be controlled separately.

Ending a relationship or revoking a permission removes the Coach’s continuing access to the affected information.

When an athlete accepts a Coach-assigned routine or workout, Athlora may create an independent copy owned by the athlete. That independent copy may remain in the athlete’s account even if the Coach later deletes their account or the relationship ends.

Athlora does not currently provide unrestricted public sharing or general-purpose public messaging.

3.5 Subscription and purchase information

Purchases are processed by Apple or Google.

Athlora does not receive or store your full payment-card details.

Athlora and RevenueCat may process:

• The Athlora account identifier associated with a purchase
• Store and platform information
• Product and plan identifiers
• Subscription status
• Entitlement status
• Purchase and restoration status
• Renewal and expiration information
• Trial or introductory-offer information
• Limited transaction metadata supplied by Apple or Google
• Information required to prevent duplicate access or restore purchases

3.6 Technical and diagnostic information

Athlora may process limited technical information necessary to operate, secure, and troubleshoot the service, including:

• Application version
• Operating system and platform
• General device compatibility information
• Synchronization status
• Network and configuration failures
• Security and authentication events
• Privacy-safe diagnostic categories
• Dates and times of service operations
• Internet Protocol address where processed automatically by infrastructure providers

Athlora’s diagnostics are designed not to include workout content, progress photos, email addresses, authentication tokens, purchase receipts, payment details, private file paths, or secret credentials.

Athlora does not currently use third-party behavioural analytics, advertising SDKs, cross-app tracking, or advertising identifiers.

3.7 Website information

This website is hosted by Vercel.

When you visit it, Vercel may automatically process standard technical request information, such as your IP address, browser type, requested page, and request time, for website delivery, reliability, and security.

Athlora does not use website analytics, advertising cookies, marketing trackers, or user accounts on this website.

4. Device Permissions

Athlora may request:

Camera

Used only when you choose to capture a progress photo.

Photo library

Used only when you choose to select a progress photo.

Notifications

Used when you enable workout reminders or rest-timer notifications.

Notification permission is not requested automatically without an associated user action.

Athlora does not currently request access to:

• Contacts
• Precise location
• Background location
• Microphone
• Bluetooth
• Calendar
• Apple Health or HealthKit
• Google Health Connect

If Athlora introduces additional permissions in the future, this Privacy Policy and the application’s disclosures will be updated.

5. How We Use Information

Athlora uses personal information to:

• Create and secure your account
• Authenticate you
• Provide offline and synchronized application functionality
• Save workouts, routines, plans, measurements, photos, and preferences
• Synchronize information between your devices
• Provide progress and training insights
• Operate Coach relationships and assignments
• Process and restore subscriptions
• Provide customer support
• Generate user-requested data exports
• Process account-deletion requests
• Detect errors, abuse, fraud, or security threats
• Comply with legal obligations
• Establish, exercise, or defend legal claims
• Improve service reliability without behavioural advertising or user profiling

6. Legal Bases for Processing

Where the GDPR applies, Athlora relies on one or more of the following legal bases:

Performance of a contract

Processing necessary to create your account, provide the application, synchronize your information, process subscriptions, provide Coach features, and deliver functionality you request.

Consent

Processing based on choices you make, including optional progress photos, camera or photo-library access, notifications, and sharing selected information with a Coach.

Where information is considered sensitive or health-related under applicable law, Athlora relies on your explicit and voluntary choice to provide and process that information, where consent is required.

You may withdraw consent by disabling the relevant permission, deleting the relevant content, revoking Coach access, or deleting your account. Withdrawal does not affect processing that occurred lawfully before withdrawal.

Legitimate interests

Processing necessary for security, abuse prevention, service integrity, troubleshooting, limited diagnostics, subscription reconciliation, and protecting Athlora and its users.

Legal obligations

Processing necessary to comply with tax, accounting, consumer-protection, data-protection, court, or regulatory obligations.

7. How Information Is Shared

Athlora does not sell personal information.

Athlora does not use personal information for third-party advertising.

Athlora does not share information with data brokers.

Athlora may share limited information with service providers that are necessary to operate the service.

Supabase

Used for authentication, hosted database functionality, private file storage, server functions, and account deletion.

PowerSync

Used to synchronize account-scoped application data between local encrypted storage and Athlora’s hosted backend.

RevenueCat

Used to retrieve products, process subscription status, manage entitlements, restore purchases, and synchronize purchase events.

Apple

Used for Sign in with Apple, App Store purchases, subscription management, and Apple platform functionality.

Google

Used for Google Sign-In, Google Play purchases, subscription management, and Google platform functionality.

Vercel

Used to host this website.

Service providers may only process information as necessary to provide their services and under their own contractual and legal obligations.

Connected Coaches

Information may be shared with a Coach only when:

• An active Coach relationship exists
• The athlete has granted the relevant permission
• The information is necessary for the Coach feature being used

Athlora may also disclose information where reasonably necessary to comply with law, enforce legal rights, investigate abuse, protect users, or respond to a valid legal request.

8. Artificial Intelligence and Automated Decisions

Athlora does not currently send personal fitness data, workout content, progress photos, or Coach information to third-party artificial-intelligence providers.

Athlora does not currently use personal information to train external artificial-intelligence models.

Athlora does not currently make decisions producing legal or similarly significant effects through automated profiling.

This section will be updated before any such functionality is introduced.

9. Data Storage and Security

Athlora uses technical and organisational safeguards designed to protect personal information.

These safeguards include:

• Encrypted network connections
• Account-scoped access controls
• Row-level database security
• Encrypted local application databases
• Account-specific encryption keys
• Encrypted downloaded progress-photo storage
• Private cloud storage for progress photos
• Metadata removal from uploaded progress photos
• Limited and privacy-safe diagnostics
• Separation between accounts on the same device
• Authentication and session protections
• Restricted server-side administrative access

No system can guarantee absolute security. You are responsible for protecting access to your device, email account, Apple account, Google account, and Athlora authentication method.

10. Offline Storage and Synchronization

Athlora is designed to work offline.

Some account data may be stored locally on your device in encrypted form and synchronized when a connection becomes available.

Changes made offline may remain queued on the device until synchronization succeeds.

Signing out or switching accounts closes the active account’s database and prevents another signed-in account from accessing that account’s local information.

11. Data Retention

Athlora retains account information while your account remains active and for as long as necessary to provide the service.

Specific records may be retained as follows:

• Workout and fitness information remains until you delete it or delete your account.
• Progress photos remain until you delete them or delete your account.
• Local downloaded-photo copies remain until cleared, removed during account deletion, or removed by application maintenance.
• Subscription information may remain while necessary to recognize purchases, restore access, prevent fraud, comply with accounting obligations, or resolve disputes.
• Security and diagnostic records may be retained for a limited period necessary to protect the service.
• Completed account-deletion recovery records may be retained for up to 30 days.
• A minimal, non-reversible hashed deletion record may be retained to prevent deleted accounts or stale authentication tokens from recreating data.
• Information required by law may be retained for the legally required period.
• Service providers may retain backup or transaction information under their own retention policies and legal obligations.

Data exported by you and saved outside Athlora is under your control. Athlora cannot delete copies saved to your device, cloud drive, email, or another destination chosen through the operating-system share sheet.

An independent routine or workout already accepted and copied into another user’s account may remain in that other user’s account because it is owned and controlled by that user.

12. Data Export

Athlora provides an account-scoped data-export feature under:

Profile → Privacy & Data

Exports may include structured fitness and account data available on the device.

Progress-photo metadata may be included, but image files are excluded from the export.

Athlora does not automatically upload the generated export. You choose where to save or share it through your device.

13. Account and Data Deletion

You may delete your account inside Athlora by navigating to:

Profile → Privacy & Data → Delete Account

You may also request deletion through: /delete-account

Or by emailing: zdravko.stanin@gmail.com

Athlora may require verification that you control the relevant account.

Account deletion is designed to remove:

• Athlora authentication access
• Profile information
• Workouts and routines
• Planned workouts and schedules
• Workout history
• Body measurements
• Rest preferences
• Progress-photo metadata
• Private progress-photo files
• Coach relationships and assignments involving the deleted account
• Account-specific encrypted local data
• Account-specific local encryption keys

Deleting your Athlora account does not automatically cancel an Apple App Store or Google Play subscription. You must separately cancel an active recurring subscription through the relevant store account.

14. Your Data-Protection Rights

Depending on your location, you may have rights to:

• Access your personal information
• Correct inaccurate information
• Delete your information
• Restrict certain processing
• Object to certain processing
• Receive portable copies of information
• Withdraw consent
• Lodge a complaint with a data-protection authority

You may exercise these rights through available in-app features or by contacting: zdravko.stanin@gmail.com

Athlora may request reasonable information necessary to verify your identity before completing a request.

EU and EEA users may lodge a complaint with the data-protection supervisory authority in their country of residence, place of work, or place of the alleged infringement.

15. International Data Transfers

Athlora and its service providers may process information in countries outside your country of residence.

Where required, Athlora relies on appropriate legal safeguards for international transfers, including contractual protections, adequacy decisions, or other mechanisms recognised by applicable data-protection law.

16. Children’s Privacy

Athlora is not intended for children under 18.

You must be at least 18 years old to create or use an Athlora account.

Athlora does not knowingly collect personal information from children under 18. If you believe that a child has created an account or provided personal information, contact: zdravko.stanin@gmail.com

17. Changes to This Privacy Policy

Athlora may update this Privacy Policy when the service, legal requirements, or data-processing practices change.

The updated version will be published on this page with a revised “Last updated” date.

Where required, Athlora will provide additional notice inside the application.

18. Contact

For privacy questions, requests, or complaints, contact:

Athlora
Operated by Zdravko Stanin
Bulgaria
Email: zdravko.stanin@gmail.com