Privacy

What it stores

• Your account: email, name, username, profile photo, language and units.
• Your workouts: exercises, sets, notes, photos, the place if you type it, and your records.
• Your routines, your body measurements and your custom exercises.
• If you use the social features: who you follow and who follows you, your likes, who you've blocked and any reports you make.
• Rest-end alerts are scheduled by your own phone and nothing is sent to any server. Only if you use the web version and turn them on, your browser's notification address is stored. For the iPhone shortcut we only store a fingerprint of the code, never the code itself.

Why

Only to make the app work: your history, your records, your charts and, if you use it, sharing workouts with your friends. Nothing is sold or shared outside LYFTS. The admin only sees totals (how many accounts and workouts there are) and whatever someone reports.

Legal basis

• Your account, your workouts and the social features: because they are the service you ask for when you use LYFTS (performance of a contract, GDPR art. 6.1.b).
• Your body measurements: only with your explicit permission, asked for before the first one (GDPR art. 9.2.a). You can withdraw it at any time in Settings → Your account, and withdrawing it deletes your measurements.
• Security: limits against spam and abuse, review of reports and encrypted backups (legitimate interest, GDPR art. 6.1.f).

What others see

• When you save each workout you choose who sees it: «Private», only you; «Friends», the people who follow you; «Public», also anyone on LYFTS if your account is open. New accounts start with «Friends»; you can change it in Settings or on each workout.
• Your account is private by default: people have to ask to follow you and you decide. Change it in Settings → Privacy.
• From a shared workout others see the name, date, exercises, sets, photos and likes; never your notes, measurements, body weight or email.
• You can block anyone: neither of you will see the other. If you report someone, a photo or a workout, it reaches the admin without saying who reported it.

Reports and moderation

Reports are reviewed by the admin, who sees the reported content, the reason and the comments, but not who reported it. They can remove photos, hide workouts from the social features and suspend accounts that break the terms.

Where and with whom

• Supabase stores the database and photos and handles sign-in, with servers in Ireland (EU).
• Vercel serves the website and the app's server, in the EU.
• Resend sends the account emails (confirming your email and resetting your password).
• Google Gemini, only if you use the app's AI coach: it receives your goal, level, equipment, days and a summary of your history to suggest routines, never your name or email.
• RevenueCat manages LYFTS Premium subscriptions bought on iPhone: it receives your user ID and the purchase history Apple passes on, never your card. If you request a refund from Apple, RevenueCat sends Apple information about your use of LYFTS Premium so it can decide.
• Every night an encrypted backup of the database is made and kept for 30 days on GitHub.

Cookies

The web version uses only two essential cookies: your session and your language. The iPhone app uses no cookies. None are for advertising or analytics.

On your phone

In the app, your workout in progress, workouts not yet uploaded and a copy of the exercise catalogue are stored on your phone so you can train without signal; they are deleted when you sign out. If you choose a profile photo or attach photos to a workout, the app asks for permission to access your photos and only uploads the ones you pick.

Anonymous usage statistics

The iPhone app sends anonymous usage statistics to TelemetryDeck (TelemetryDeck GmbH, Germany): which screens are opened, when a workout starts or ends, how long each app session lasts and technical details such as the iPhone model, iOS version and language. They carry a random, encrypted identifier of the installation that is not linked to your account; your name, email, workouts, weights, measurements or anything you type are never sent. They are not used for advertising or combined with other data. They help us improve the app (legitimate interest, art. 6(1)(f) GDPR) and you can turn them off at any time in Settings → Usage statistics.

Your data is yours

You can access your data, correct it, delete it (Settings → Your account), take it with you as CSV and object to its processing. Deletion is immediate; whatever remains in the encrypted backups is gone after 30 days. For any of these rights write to us at soporte@lyfts.es, and if you're not happy with the answer you can complain to the Spanish Data Protection Agency (aepd.es).

Children under 14

If you're under 14, you need permission from your parent or legal guardian to create an account and for us to process your data. They can ask us at any time to see or delete your account by writing to soporte@lyfts.es. If we learn that an account belonging to a child under 14 was created without that permission, we will delete it.

Questions

Write to us at soporte@lyfts.es.