Privacy policy

In short

We collect only what the app needs: your account, your training log and technical data. We don't sell data and there are no ads in the app. You can delete your account and all your data yourself in the app settings.

1. Who is responsible for your data

The controller of your data in the SmartWorkout app, the SmartWorkout Coach app and on smartworkout.app is Arkadiusz Chrabąszczewski, running a sole proprietorship under the business name Arkadiusz Chrabaszczewski, ul. ks. Jana Twardowskiego 45/1, 81-198 Pogórze, Poland, tax ID (NIP) 5871721001, REGON 382855375. In this policy we call him "SmartWorkout" or "we".

For anything about your data, write to contact@smartworkout.app. We have not appointed a data protection officer, so we answer ourselves.

2. What data we collect and why

Data Why Legal basis
Apple or Google account ID, the email address of that account (Apple may hide it), username Your account and sign-in performance of a contract (Art. 6(1)(b) GDPR)
Sex, date of birth, height, training level, goal, equipment Fitting plans, volume zones and suggestions to you performance of a contract
Body weight, body fat percentage, circumferences and other body measurements Charts, analyses and suggestions your explicit consent (Art. 9(2)(a) GDPR), given when you enter this data
Training log: exercises, sets, weights, reps, RIR, notes, plans, templates The log itself and sync between devices performance of a contract
Watch data: heart rate during the workout, average and maximum heart rate, calories, watch model, times when sets were completed Heart rate chart and workout summary your explicit consent (Art. 9(2)(a) GDPR), given when you allow the watch or Garmin Connect to access this data
Photos and videos you add to workouts Storing and showing them in the app performance of a contract
Chat messages, public profile, shared workouts and templates Social features and working with a coach performance of a contract
Purchase data: product, transaction ID, subscription status, AI credit balance Unlocking Premium and credits, accounting performance of a contract and legal obligation (Art. 6(1)(c) GDPR)
Push notification token Sending the notifications you allow on your phone performance of a contract
Technical data: device model, operating system, app version, installation IDs, IP address, crash reports, in-app events Security, fixing bugs, usage statistics and testing new versions legitimate interest (Art. 6(1)(f) GDPR)
Messages to support and their content Answering your request legitimate interest
Email address for the newsletter Sending the news, reports and offers you tick your consent (Art. 6(1)(a) GDPR)

Giving us data is voluntary. Without signing in with Apple or Google you use a guest account. You can skip body data: the app works without it, only some analyses will be less precise.

Guest account

When you choose "Continue without an account", we create an anonymous account on our server, linked to your device, and store your log in it. You don't give us an email address, but if you delete the app before signing in with Apple or Google, you can't get that data back. A guest account nobody uses for 90 days is deleted automatically.

Apple Health

If you allow it, the iPhone app writes your workouts, body weight and body fat percentage to Apple Health and reads body weight and body fat percentage from it. We don't use Apple Health data for advertising, don't sell it and don't share it with anyone except the providers who store data on our behalf. You can revoke access at any time in your iPhone settings.

Watches: Apple Watch, Wear OS and Garmin

When you train with the SmartWorkout app on an Apple Watch or a Wear OS watch, the watch measures your heart rate and calories during the workout. It sends them to the phone app together with the sets you completed, the watch model and the times when you completed each set, and we save them with the workout in your log. Apple Watch does this only if you allow it to access Apple Health; you can revoke that in your iPhone or watch settings.

The SmartWorkout app for Garmin watches connects to our server through the Garmin Connect app on your phone: it downloads your plans and exercises and sends back the sets you completed. You link your SmartWorkout account to the watch with a code that the watch shows and you enter in the phone app.

If you connect your Garmin Connect account, with the consent you give on Garmin's page, we download your activities from Garmin Connect (time, heart rate, calories and the data Garmin attaches to them) and the health data you allow, for example resting heart rate and sleep, and attach them to the workouts in your log. With your consent we can also send workouts from your plans to your Garmin Connect calendar. You can disconnect in the app settings or in Garmin Connect: we then delete our access to your Garmin account and stop downloading data. We don't use Garmin data for advertising, don't sell it and don't share it with anyone except the providers who store data on our behalf.

AI features

When you use an AI feature, for example generating a plan, importing a plan or your workout history, or asking for an AI progression suggestion, we send OpenAI the text of your request and the data needed to answer it, such as your goal, level, available equipment, sex, age, body weight and part of your training history. OpenAI processes it on our behalf, does not use it to train its models and keeps it for no more than 30 days to detect abuse. We don't send OpenAI your name or email address.

Progression suggestions

Weight and rep suggestions are calculated by an algorithm from your results. This is automated processing, but it has no legal or similarly significant effect on you: you decide whether to follow a suggestion.

Working with a coach

When you accept an invitation from a coach in SmartWorkout Coach, the coach sees your workouts, plans, body measurements, analyses, the forms you fill in and your chat with them. The coach is responsible for how they use this data outside the app. You can end the collaboration in the app at any time, and the coach then loses access to new data.

Invitations and install sources

When you open a coach's invitation link or tap the App Store button on our website, we record your IP address or part of it, the time, browser and device data (operating system, screen, time zone, language) and the invitation or page ID. After installation we match this with data from the app, to show you the coach's invitation and to learn which pages bring new users. The match is approximate and can be wrong when several people share a network. Visit and click records are removed by a cleanup that covers entries older than 48 hours. The install source we attribute stays stored with the device.

On iPhone, once after installation, the app gets an Apple AdServices token from the system and sends it to Apple to check whether the install came from an Apple Search Ads campaign. Apple answers only with campaign data, without your personal data.

On Android, Firebase Analytics also reads your device's advertising ID, so that Google Ads can measure which installs and in-app actions come from our ads. You can reset or delete the advertising ID at any time in Android settings: Settings, Google, Ads.

Statistics on the website

On smartworkout.app we publish aggregated, anonymised statistics from training logs, for example the typical weight drop in a drop set. We calculate them only for groups of at least 50 people and never show data of individual users or anything that could identify them.

3. The smartworkout.app website and cookies

The website's server logs the IP address, time, page visited and browser data. We need them to run and protect the website.

The website stores a few things in your browser that it needs to work: your choice in the cookie banner, the progress you tick on a plan page and, only until you close the tab, the page you arrived on, so a tap on a store button can be attributed to it.

Google Analytics and Google Ads run only after you consent in the banner. They store cookies, count visits and page views, measure whether our ads bring people to the website and add visitors to lists we can later show our ads to on Google. This data goes to Google, including in the US (legal basis: your consent, Art. 6(1)(a) GDPR). You can withdraw consent at any time in the website footer, under "Cookie settings".

4. Who processes data for us

These providers process data on our behalf under data processing agreements:

  • OVH (servers in Warsaw, Poland): app servers and databases;
  • Google (Firebase Analytics, Crashlytics, Performance Monitoring, Remote Config, Cloud Messaging; Google sign-in; Google Analytics and Google Ads on the website, after your consent): statistics, crash reports, push notifications and sign-in;
  • Functional Software (Sentry): crash reports;
  • OpenAI: the AI features described above;
  • Backblaze: storage of workout photos and videos;
  • Twilio (SendGrid): sending emails;
  • Apple: Sign in with Apple, push notifications, Apple Health and Apple Search Ads.

Payments for subscriptions and credits are handled by Apple (App Store) and Google (Google Play) as independent controllers under their own terms. We never see your card details.

Garmin processes the data from your watch and your Garmin Connect account as an independent controller under its own terms. We receive only what you allow when you connect your account.

Other users see only what you share yourself: your public profile, chat messages, shared workouts and templates, and the data you give a coach access to. We don't sell data. We may disclose it to public authorities where the law requires it.

5. Transfers outside the European Economic Area

Google, OpenAI, Sentry, Backblaze and Twilio also process data in the United States. We transfer it on the basis of the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) or standard contractual clauses approved by the Commission. Write to contact@smartworkout.app for a copy of the safeguards.

6. How long we keep data

  • Account data and training log: as long as you have an account.
  • Guest account: as long as you use it; after 90 days without activity we delete it automatically.
  • Purchase data: for the period required by tax and accounting law, usually 5 years from the end of the year of purchase.
  • Support messages: while we handle your request and then until claims become time-barred.
  • Crash reports and analytics data: up to 90 days in Sentry and up to 14 months in Firebase Analytics.
  • Visit and click records from invitations: until the next cleanup after 48 hours.
  • Server backups: made by OVH and overwritten automatically, at the latest after 30 days. Data you delete may stay in a backup for that long and disappears with it.
  • The copy on your phone: the app also works offline, so your log is stored on your phone too. It goes when you delete your account or the app.

7. Your rights

You have the right to:

  • get a copy of your data and information on how we process it;
  • correct inaccurate data;
  • erase your data, including your whole account;
  • restrict processing;
  • data portability: you can export your training log yourself in Settings, under "Export workout data";
  • object to processing based on our legitimate interest;
  • withdraw consent at any time; this doesn't affect the lawfulness of processing before you withdrew it.

Write to contact@smartworkout.app and we will reply within one month. You can also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the supervisory authority in your own EU country.

8. Deleting your account

You can delete your account in the app: Settings, Profile Settings, Delete my account. We then delete your account, training log, body measurements, templates, plans, photos and videos, chats, forms and AI credits. We keep only:

  • purchase records, detached from your account, because the law requires us to keep them;
  • a hash of your phone's ID, so that the free welcome credits and free progression suggestions are not granted twice on the same phone;
  • anonymised counters for statistics, such as the date the account was deleted, with nothing that could identify you.

Deleting your account does not cancel your subscription in the App Store or Google Play: do that separately in the store settings.

9. Age

SmartWorkout is for people aged 16 and over. We don't knowingly collect data from younger people. If you are a parent or guardian and know that your child under 16 has an account, write to us and we will delete it.

10. Security

Data travels between the app and the server over an encrypted connection. Only the administrator has access to the servers and databases, and our providers act under data processing agreements. No system is fully immune to attacks, but if a breach puts your rights at risk, we will notify you and the authority as the GDPR requires.

11. Changes to this policy

When we change how we process data, we update this page and the date at the top. We will tell you about significant changes, such as a new purpose or a new recipient of data, in the app or by email before they take effect.

Train with a plan and see your progress

SmartWorkout is free: log your workouts, follow ready-made plans, look up exercises in the library and watch your progress on charts. For iPhone and Android.