Privacy Policy

The controller of personal data of app users (account, training and subscription data) is (hereinafter: “we”, “us”):

Jakub Pokora - Trener Personalny Wrocław
Wrocław, Poland
NIP (Polish tax ID): 8982318310 · REGON: 541153207
Email: carvolune@wp.pl

For data that a trainer enters about their own clients, the trainer is the controller and we process that data on the trainer’s behalf as a processor (Art. 28 GDPR), only to provide the app.

• Account data: first name, last name, email address, phone number.
• Trainer profile data: city, bio, certifications, specializations, profile photo.
• Client data: first name, last name, email, phone, photo — entered by the trainer.
• Training data: sessions, plans, exercises, personal records (PRs), notes.
• Health data (optional): steps, calories, distance, sleep, workouts — synced with Apple Health only with your consent.
• Body and health data entered in the app: body weight, body measurements, progress photos, supplements, health notes and injuries — entered by you or by your trainer.
• Financial data: income and expenses entered by the trainer in the payments module.
• Technical data: device identifier, error logs.

• Providing the app’s services (Art. 6(1)(b) GDPR — performance of a contract).
• Handling subscriptions and payments (Art. 6(1)(b) GDPR).
• Complying with legal obligations (Art. 6(1)(c) GDPR).
• Legitimate interest — security and stability of the app (Art. 6(1)(f) GDPR).
• Health data you enter yourself — your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw by deleting the data.

The app is not intended for people under 16.

Health data retrieved from Apple Health (steps, calories, distance, sleep, workouts) is used solely to display progress within the Carvolune app. It is not shared with third parties and is not used for advertising or profiling. Syncing with Apple Health is optional and requires the user’s explicit consent. Access can be revoked at any time in iOS Settings → Health → Access to Data and Devices.

We store data on Supabaseservers (AWS infrastructure in the EU region). Health data synced from Apple Health is stored on Supabase servers. Where a subprocessor listed below is located outside the EEA (e.g. in the USA), the transfer is based on the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

We do not sell personal data. Data may only be shared with:

• Supabase Inc. — database and authentication hosting.
• RevenueCat Inc. — subscription and in-app purchase handling.
• Google LLC — optional sign-in with Google.
• Apple Inc. — optional sign-in with Apple, App Store purchases, push notifications.
• Groq Inc. and Google LLC (Gemini API) — only when you use the AI plan generator: the details needed to build the plan (e.g. goal, level, training days, notes) are sent to generate the plan and are not used by us for advertising.

All subprocessors operate under appropriate data processing agreements.

In-app purchases are handled by the Apple App Store. Payment card data never reaches our systems. Subscriptions are managed through Apple ID account settings.

• Access to your data and a copy of it.
• Rectification of inaccurate data.
• Erasure of data (“right to be forgotten”) — available directly in the app under Profile → Delete account.
• Restriction of processing.
• Data portability.
• Objection to processing.

Requests can be sent to: carvolune@wp.pl

You can delete your account and all associated data at any time in the app: Profile → Settings → Delete account. Data will be permanently removed from our servers. A backup copy may be retained for up to 30 days in line with Supabase’s retention policy.

The carvolune.com website uses cookies necessary for its operation (session, preferences). The mobile app uses localStorage to store session and settings locally on the device. This data is not transmitted to advertising parties.

We will notify you of material changes to this privacy policy via the app or by email. The current version is always available at carvolune.com/privacy.

You have the right to lodge a complaint with the Polish Data Protection Authority (UODO — Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. If you are located in another EEA country, you may also contact your local supervisory authority.

This section applies to residents of US states with consumer health data laws (including Washington’s My Health My Data Act, Nevada and Connecticut).

• What we collect: body weight, body measurements, progress photos, supplements, health notes and injuries, workout history, and — only if you allow it — data from Apple Health (steps, calories, distance, sleep, workouts).
• Sources: you, your trainer (if you train with one), and Apple Health.
• Why: only to provide the app — track progress, plan training and show it to you and your trainer.
• Sharing: only with your trainer (if you are their client) and the processors listed in section 6. We never sell consumer health data and do not use it for advertising.
• Consent: we collect this data only with your consent, given when you enter it or connect Apple Health. You can withdraw consent at any time by deleting the data, disconnecting Apple Health in iOS Settings, or deleting your account.
• Your rights: you can confirm whether we hold your health data, access it, ask for the list of third parties it was shared with, and ask us to delete it. Write to carvolune@wp.pl — we reply within 45 days. If we decline a request, you can appeal by replying to our answer.