Privacy Policy

Welcome to Liftune ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application Liftune (the "App") and our website at liftune.com (the "Website"), collectively referred to as our "Services."

Please read this Privacy Policy carefully. By using our Services, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access the Services.

2.1 Personal Information You Provide

We may collect personal information that you voluntarily provide, including:

• Account Information: Name, email address, and password when you create an account
• Profile Information: Age, gender, height, weight, fitness goals, and experience level
• Workout Data: Exercise logs, sets, reps, weights, workout duration, and personal records
• Health Data: Body measurements and fitness assessments (only when you choose to provide them)
• Payment Information: Processed securely through Apple's App Store; we do not store your payment details
• Communications: Information you provide when contacting our support team

2.2 Camera and Image Data

With your permission, we access your device camera to scan existing workout programs using our "Scan Program" feature. When you use this feature:

• Photos you take are uploaded to our cloud services for text extraction
• We use AI services (including Google Cloud Vision and OpenAI) to process and extract workout information from your images
• Images may be retained on our servers for service improvement and to allow you to access your imported programs
• You can delete imported programs and associated images through the app

You control camera access through your device settings and can revoke permission at any time.

2.3 Information Collected Automatically

When you use our Services, we may automatically collect:

• Device Information: Device type, operating system, unique device identifiers, MAC address, mobile carrier
• Usage Data: Features used, time spent in app, interaction patterns, frequency and duration of activities
• Log Data: IP address, browser type, pages visited, time and date of visits, referring URLs
• Push Notification Tokens: If you enable push notifications, we collect and store a device token to deliver notifications to your device. This token is used solely for delivering notifications and does not contain personal information.

2.4 Cookies, Pixel Tags, and Other Technologies

We, as well as third parties that provide content or functionality on our Services, may use cookies, pixel tags, local storage, and other technologies ("Technologies") to automatically collect information through your use of our Services.

• Cookies: Small text files placed in device browsers that store preferences and facilitate your experience
• Pixel Tags/Web Beacons: Pieces of code embedded in our Services that collect information about engagement. We may include web beacons in emails to understand whether messages have been opened, acted on, or forwarded.
• Local Storage: Technologies that store data locally on your device

Our uses of these Technologies fall into the following categories:

• Operationally Necessary: Technologies that allow you access to our Services, are required to identify irregular behavior, prevent fraudulent activity, and improve security
• Performance-Related: Technologies used to assess the performance of our Services and understand how users interact with them
• Functionality-Related: Technologies that allow us to offer enhanced functionality, such as remembering your preferences

See Section 8 to understand your choices regarding these Technologies. You may stop or restrict the placement of Technologies on your device or remove them by adjusting your preferences as your browser or device permits.

2.5 Session Recording and Analytics

We use PostHog, an analytics platform, to understand how users interact with our Services. This helps us identify usability issues and improve your experience.

PostHog may collect:

• Screen recordings of your app sessions (with sensitive information automatically masked)
• Interaction patterns (taps, scrolls, navigation flow)
• Feature usage and timing data
• Technical performance metrics

Privacy protections in place:

• All text inputs are automatically masked in recordings
• Images and sensitive content are obscured
• No payment information is ever captured
• Recordings are used solely for product improvement

Important: Analytics data is NOT used for advertising or sold to third parties.

You can opt out of analytics and session recording at any time through the app settings (Settings > App Preferences > Analytics). See Section 8 for more details on your rights.

2.6 Error Tracking and Crash Reporting

We use Sentry, an error tracking service, to monitor app stability and identify bugs. When the app encounters an error or crash, Sentry may automatically collect:

• Error messages and stack traces
• Device information (model, OS version, app version)
• App state at the time of the error
• Breadcrumbs (recent user actions leading to the error)

This information helps us identify and fix bugs quickly to improve your experience. Error data is used solely for debugging and product improvement purposes.

2.7 Information from Third Parties

With your permission, we may collect data from:

• Apple Health: Workout data, activity metrics, and health information you choose to share (see Section 2.8 for details)
• Sign-in Services: Basic profile information if you sign in with Apple
• Social Media Platforms: If you interact with our social media pages (Facebook, Instagram, Twitter/X), those platforms may collect information about your interactions. Your interactions with these platforms are governed by their respective privacy policies.

2.9 Surveys, Sweepstakes, and Contests

We may contact you to participate in surveys. If you decide to participate, you may be asked to provide certain information which may include personal information.

We may also collect personal information you provide for any sweepstakes or contests that we offer. In some jurisdictions, we are required to publicly share information of sweepstakes and contest winners.

2.8 Health and Fitness Data (Apple HealthKit)

With your explicit permission, Liftune can integrate with Apple Health (HealthKit) to enhance your fitness experience. This integration is entirely optional.

Data We May Access from Apple Health:

• Workout data (exercises, duration, calories burned)
• Activity metrics (steps, active energy)
• Body measurements (weight, height)
• Heart rate data (during workouts)

How We Use Health Data:

• To sync your workouts between Liftune and Apple Health
• To provide more accurate fitness recommendations
• To track your overall fitness progress

Data We May Write to Apple Health:

• Workouts completed in Liftune
• Active energy burned during Liftune workouts

Important Protections for Health Data:

• Health data is NEVER used for advertising or marketing purposes
• Health data is NEVER sold to third parties
• Health data is NEVER shared with third parties for their marketing
• Health data sync is entirely optional — you control what is shared
• You can revoke HealthKit access at any time in your device settings

Apple HealthKit Compliance: Our use of HealthKit data complies with Apple's HealthKit guidelines. We maintain all HealthKit information in accordance with Apple's development requirements and only use this data to provide and improve our fitness services to you.

To manage Apple Health permissions:

1. Open the Settings app on your iPhone
2. Tap "Health"
3. Tap "Data Access & Devices"
4. Find and tap "Liftune"
5. Toggle permissions on or off as desired

We use the information we collect to:

• Provide and Improve Services: Deliver personalized workout programs, track your progress, and enhance app functionality
• AI Personalization: Use your fitness data to generate and adapt workout programs tailored to your goals and progress
• Analytics and Research: Understand how users interact with our Services to improve user experience
• Communications: Send service-related notifications, respond to inquiries, and provide customer support
• Security: Protect against unauthorized access, fraud, and other illegal activities
• Legal Compliance: Comply with applicable laws, regulations, and legal processes

3.1 Marketing Communications

With your consent, we may send you marketing communications including:

• New feature announcements
• Tips and workout suggestions
• Special offers and promotions
• Newsletters and fitness content

You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Adjusting your notification preferences in the app settings
• Contacting us at privacy@liftune.com

Please note that even if you opt out of marketing communications, we may still send you transactional messages related to your account, such as:

• Account verification emails
• Password reset requests
• Subscription confirmations and receipts
• Important service updates affecting your account

We will never send marketing communications without your prior consent, in accordance with GDPR and applicable laws.

3.2 AI-Powered Program Generation

We use artificial intelligence to create personalized workout programs tailored to your goals. When generating your program, we share the following with our AI service providers:

• Your fitness goals and experience level
• Available equipment and workout preferences
• Body metrics you've provided (age, height, weight)
• Your workout history and progress data

Our AI providers include services from OpenAI, Anthropic, Google, and Vercel. These providers process your data to generate workout recommendations.

Important notes about AI processing:

• Your data is sent to AI providers via secure, encrypted connections
• AI-generated programs are stored in your account for your use
• We do not use your health or fitness data for advertising purposes
• AI providers may have their own data retention policies; we encourage you to review their privacy policies

3.3 AI Model Training and Your Data

Important Disclosure: We want to be transparent about how your data may be used in relation to AI systems:

• Our AI Providers: When we send your data to third-party AI providers (OpenAI, Anthropic, Google, Vercel), we use API configurations that request your data NOT be used for training their general AI models. However, these providers may retain data temporarily for abuse monitoring and service improvement as described in their respective privacy policies.
• Aggregated and Anonymized Data: We may use aggregated, de-identified data that cannot reasonably be used to identify you to improve our own algorithms and Services.
• No Sale of Training Data: We do not sell your personal data to AI companies for model training purposes.

Your Control Over AI Processing:

• You can request deletion of your data at any time, which will remove your information from our systems
• You can contact us at privacy@liftune.com to request information about how your data has been processed by AI systems
• If you object to AI processing of your data, please contact us; however, note that AI-powered features are core to our Services and opting out may significantly limit functionality

Third-Party AI Provider Policies:

• OpenAI: openai.com/policies/privacy-policy
• Anthropic: anthropic.com/privacy
• Google: policies.google.com/privacy

We work with the following categories of service providers:

All service providers are bound by data processing agreements and are required to protect your information in accordance with applicable laws.

4.1 Data Storage Location

Your data is primarily stored on servers located in the European Union (EU) through our cloud infrastructure provider, Supabase. When data is processed by AI services, it may be temporarily transferred to servers in other regions as required by those services.

We do not sell your personal information. We may share your information with:

• Service Providers: Third-party vendors who assist in operating our Services (as listed in Section 4) under strict confidentiality agreements. This includes IT support, hosting, payment processing, customer service, and related services.
• APIs and SDKs: We use third-party Application Program Interfaces ("APIs") and software development kits ("SDKs") as part of the functionality of our Services. For more information about our use of APIs and SDKs, please contact us.
• Legal Requirements: We may access, preserve, and disclose your information if we, in good faith, believe doing so is required or appropriate to comply with law enforcement or national security requests and legal process, such as a court order or subpoena; protect your, our, or others' rights, property, or safety; enforce our policies or contracts; collect amounts owed to us; or assist with an investigation or prosecution of suspected or actual illegal activity.
• Business Transfers: If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, your information may be sold or transferred as part of such a transaction, as permitted by law and/or contract.
• With Your Consent: When you explicitly authorize us to share your information

Important: We do not use or disclose to third parties data gathered in the health and fitness context for advertising, marketing, or other use-based data mining purposes.

We take steps to ensure that your information is treated securely and in accordance with this Privacy Policy. We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Secure authentication mechanisms including password hashing
• Regular security assessments and penetration testing
• Access controls limiting employee access to personal data on a need-to-know basis
• Secure cloud infrastructure with industry-standard protections (SOC 2 compliant providers)
• Appropriate safeguards requiring our third-party service providers and partners to have appropriate safeguards as well
• Regular employee security training
• Incident response procedures

Unfortunately, no system is 100% secure, and we cannot ensure or warrant the security of any information you provide to us. To the fullest extent permitted by applicable law, we do not accept liability for unauthorized disclosure.

By using our Services or providing personal information to us, you agree that we may communicate with you electronically regarding security, privacy, and administrative issues relating to your use of our Services.

6.1 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the Supervisory Authority: We will notify the relevant data protection authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33
• Notify Affected Individuals: If the breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, as required by GDPR Article 34
• Documentation: We will document all breaches, including the facts surrounding the breach, its effects, and the remedial action taken

Breach notifications to you will include:

• A description of the nature of the breach
• The name and contact details of our data protection contact
• A description of the likely consequences of the breach
• A description of the measures taken or proposed to address the breach

We may notify you by email to the address associated with your account, by posting a notice on our Services, or by other means as required by applicable law.

We retain your personal information for as long as your account is active or as needed to provide you Services. We may also retain and use your information as necessary to:

• Comply with legal obligations
• Resolve disputes
• Enforce our agreements
• Support business operations

7.1 Specific Retention Periods

7.2 Account Deletion

When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law. Specifically:

• Your profile, workout data, and preferences will be permanently deleted
• Backup copies may persist for up to 90 days before being automatically purged
• Some information may be retained in anonymized form for analytics purposes
• Transaction records will be retained as required by German commercial and tax law

To delete your account, go to Settings > Account > Delete Account in the app, or contact us at privacy@liftune.com.

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate personal information
• Deletion: Request deletion of your personal information
• Portability: Request a portable copy of your data
• Opt-Out: Opt out of certain data processing activities
• Withdraw Consent: Withdraw consent where processing is based on consent
• Automated Decision Review: Request the review of decisions taken exclusively based on automated processing if they could affect your rights
• Third-Party Disclosure: Be informed about third parties with which your personal information has been shared

To exercise these rights, please contact us at privacy@liftune.com.

8.1 Opting Out of Analytics

Mobile App:

You can opt out of analytics and session recording in the Liftune app:

1. Open the Liftune app
2. Go to Settings (gear icon)
3. Tap "App Preferences"
4. Toggle off "Analytics"

When you opt out:

• We stop collecting usage analytics from your device
• Session recording is disabled
• Your preference is saved and respected across sessions
• The app continues to function normally

Website:

When you first visit our website, you'll see a cookie consent banner. You can click "Decline" to opt out of analytics cookies, or change your preference at any time via the cookie settings link in our footer.

Additional Opt-Out Resources:

• Network Advertising Initiative: optout.networkadvertising.org
• Digital Advertising Alliance: optout.aboutads.info
• European Digital Advertising Alliance: youronlinechoices.eu

Device-Level Controls:

• iOS: Settings > Privacy > Tracking
• Android: Settings > Privacy > Ads

Note: Opting out of analytics does not affect essential app functionality. You can still use all features of Liftune.

Our Services are not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn we have collected personal information from a child under 18, we will delete that information promptly. If you believe we have collected information from a child under 18, please contact us.

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws different from your country. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy.

As a company based in Germany, we comply with the General Data Protection Regulation (GDPR). This section provides additional information for users in the European Economic Area (EEA), United Kingdom, and Switzerland.

Data Controller

The data controller responsible for your personal data is:

Liftune UG (haftungsbeschränkt)
Germany
Email: privacy@liftune.com

Legal Basis for Processing

We process your personal data based on the following legal grounds:

Special Categories of Personal Data

Some information we collect may constitute "special categories of personal data" under GDPR Article 9, including health-related data such as:

• Physical fitness information and body measurements
• Workout performance and exercise data
• Health data synced from Apple Health/HealthKit

We process this data only with your explicit consent (GDPR Article 9(2)(a)), which you provide when you voluntarily enter this information or enable HealthKit integration. You may withdraw your consent at any time, though this may affect your ability to use certain features of our Services.

Your Rights Under GDPR

As an EU resident, you have the following rights:

• Right of Access (Art. 15): Request a copy of your personal data
• Right to Rectification (Art. 16): Request correction of inaccurate data
• Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to Restriction (Art. 18): Request limited processing of your data
• Right to Data Portability (Art. 20): Receive your data in a portable, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests, including profiling
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal
• Right to Lodge a Complaint (Art. 77): File a complaint with a supervisory authority
• Rights Related to Automated Decision-Making (Art. 22): Not be subject to decisions based solely on automated processing that significantly affect you

To exercise these rights, contact us at privacy@liftune.com. We will respond within 30 days. If your request is complex or we receive numerous requests, we may extend this period by up to two additional months, in which case we will inform you of the extension.

Data Processing Agreements

We have entered into Data Processing Agreements (DPAs) with our service providers who process personal data on our behalf, as required by GDPR Article 28. These agreements ensure that our processors implement appropriate technical and organizational measures to protect your data.

Supervisory Authority

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with a data protection supervisory authority. For Germany, this is the relevant state data protection authority (Landesdatenschutzbeauftragter) or the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit - BfDI).

You may also lodge a complaint with the supervisory authority in your country of residence or place of work if you believe that our processing of your personal data infringes the GDPR.

International Data Transfers

Your data is primarily stored in the EU (Supabase EU servers). When we transfer data outside the EU/EEA, we ensure appropriate safeguards are in place:

• Adequacy Decisions: Transfers to countries with an EU adequacy decision
• Standard Contractual Clauses (SCCs): EU-approved contractual terms with our processors
• Supplementary Measures: Additional technical and organizational safeguards where required

You may request a copy of the safeguards we use for international transfers by contacting us at privacy@liftune.com.

If you are located in the United Kingdom, your personal data is protected by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This section supplements the information provided in Section 11.

Your Rights Under UK GDPR

You have the same rights as outlined in Section 11 above, as the UK GDPR mirrors the EU GDPR. These rights are enforceable under UK law.

UK Supervisory Authority

If you are in the United Kingdom and wish to lodge a complaint, you may contact the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

International Transfers from the UK

When we transfer your data outside the UK, we rely on UK-approved transfer mechanisms, including the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs, or transfers to countries covered by UK adequacy regulations.

This section applies to California residents under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

Categories of Personal Information Collected

In the past 12 months, we have collected the following categories:

Do Not Sell My Personal Information

Liftune does not sell your personal information. We do not exchange your data for monetary or other valuable consideration with third parties.

Your Rights Under CCPA/CPRA

As a California resident, you have the right to:

• Right to Know: Request what personal information we collect, use, disclose, and sell (if applicable), including the categories of personal information, the sources, the business purposes, and the categories of third parties with whom we share it
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information that we maintain about you
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information or share it for cross-context behavioral advertising. If this changes, we will provide a "Do Not Sell or Share My Personal Information" link
• Right to Limit Use of Sensitive Personal Information: Request that we limit our use of your sensitive personal information (such as health data) to only what is necessary to provide the Services
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights, including by denying goods or services, charging different prices, providing different quality, or suggesting you will receive different treatment

To exercise these rights, contact us at privacy@liftune.com or use the in-app account deletion feature. You may also submit a request through our support page.

Sensitive Personal Information

Under CPRA, we may collect "sensitive personal information" which includes:

• Health information (fitness data, workout history, body measurements) when you provide it
• Precise geolocation (we do not collect this, but if we did, you would have the right to limit its use)

We use sensitive personal information only to provide you with the Services you have requested. We do not use or disclose sensitive personal information for purposes other than those specified in California Civil Code Section 1798.121.

Verification

To protect your privacy, we will verify your identity before fulfilling requests. We may ask you to confirm your email address, provide information that matches what we have on file, or provide additional information. If we cannot verify your identity, we may deny your request.

Authorized Agents

You may designate an authorized agent to make requests on your behalf. To do so, you must provide the agent with written permission signed by you, and we may require you to verify your identity directly with us. Alternatively, your agent may provide a power of attorney pursuant to California Probate Code sections 4000-4465.

Response Timing

We will respond to verifiable consumer requests within 45 days. If we need more time, we will inform you of the reason and extension period in writing (up to an additional 45 days).

Financial Incentives

We do not offer financial incentives or price differences in exchange for the retention or sale of personal information.

Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature that signals to websites that you do not want your online activity tracked. There is currently no universally accepted standard for how to respond to DNT signals.

Our Services do not currently respond to DNT signals. However, you can opt out of analytics tracking through our in-app settings or cookie consent preferences as described in Section 8.

For Nevada Residents

If you are a Nevada resident, you have the right to opt out of the sale of certain personal information to third parties. Liftune does not sell your personal information as defined under Nevada law.

If you are a Nevada resident and would like to submit a request regarding the sale of your information, please contact us at privacy@liftune.com with the subject line "Nevada Privacy Request."

California Shine the Light

Under California Civil Code Section 1798.83 (California's "Shine the Light" law), California residents may request information about how we share certain categories of personal information with third parties for their direct marketing purposes.

Liftune does not share personal information with third parties for their direct marketing purposes. If you are a California resident and would like more information, please contact us at privacy@liftune.com.

Our Services use automated processing to generate personalized workout programs and recommendations. This section explains how we use automated decision-making and your rights in relation to it.

14.1 How We Use Automated Processing

We use automated processing in the following ways:

• Workout Program Generation: Our AI analyzes your fitness data, goals, and preferences to create personalized workout programs
• Exercise Recommendations: We suggest exercises based on your history, equipment availability, and progress
• Progress Analysis: We analyze your workout data to provide insights and adjust recommendations
• Difficulty Adjustments: Programs may be automatically adjusted based on your performance data

14.2 No Solely Automated Legal/Significant Decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The automated processing we use is limited to providing personalized fitness recommendations and does not:

• Affect your legal rights
• Determine your access to services (beyond personalization)
• Impact your financial standing
• Make decisions about your health treatment

14.3 Your Rights Regarding Automated Processing

Under GDPR Article 22, you have the right to:

• Request information about the logic involved in automated decision-making
• Request human review of any automated decision that significantly affects you
• Express your point of view and contest automated decisions
• Object to profiling for direct marketing purposes

To exercise these rights, contact us at privacy@liftune.com.

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

If you have questions or concerns about this Privacy Policy, please contact us:

• Email: privacy@liftune.com
• Support: liftune.com/support

This Privacy Policy uses industry-standard technologies and was developed in line with the World Wide Web Consortium's Web Content Accessibility Guidelines (WCAG), version 2.1.

If you wish to print this policy, please do so from your web browser or by saving the page as a PDF. If you experience any accessibility issues with this Privacy Policy, please contact us at privacy@liftune.com.