Privacy Policy

Account information. When you create an account, we collect your email address and, if you choose, a display name. If you sign in with Google, we receive basic profile information from Google (such as your name and email) as permitted by your Google account settings.

Profile and preferences. You may provide age, height, weight, fitness goals, injury notes, timezone, and unit preferences. On iPhone, you may optionally connect Apple Health (HealthKit) to import body metrics you authorize — we only access categories you explicitly allow.

Workout data. We store workout plans, exercise logs (sets, reps, weight, duration, notes), session history, personal records, and derived analytics (such as weekly volume and training frequency) so you can track progress across devices.

Subscription status. If you subscribe to Pro on iPhone, Apple processes payment. We store subscription entitlement status (for example, active or expired) to unlock Pro features — we do not receive your full payment card details.

API keys (optional). If you create developer API keys in your profile, we store a hashed key, label, and usage metadata (such as last-used time) to authenticate API requests.

Usage and technical data. On the web, we may use Firebase Analytics (Google) to understand aggregate usage, such as page views and feature adoption, when enabled. We also collect standard server logs (IP address, browser type, timestamps) for security and reliability.

We use the information we collect to:

• Provide, maintain, and improve the Service;
• Sync your workouts, plans, and analytics between web and mobile when you are signed in;
• Send workout-day reminders on iPhone when you enable them;
• Process Pro AI features (plan generation, workout analysis, and insights) when you have an active subscription;
• Authenticate API requests and prevent abuse;
• Respond to support requests and communicate about the Service;
• Comply with legal obligations and enforce our Terms of Service.

Pro features may send relevant portions of your profile, workout history, and text extracted from workout plan PDFs you upload on the web to our AI provider (OpenRouter and underlying model providers) to generate plans, analyses, or coaching text. Uploaded PDF files are processed in memory and are not stored after import. We send only what is needed for the request. Do not include sensitive medical information you do not want processed. AI output is for wellness and fitness guidance only — not medical advice.

We do not sell your personal information. We share information only in these situations:

• Service providers who help us run the Service, including Google Firebase (authentication, database, hosting, and optional analytics) and our AI infrastructure provider, under contractual obligations to protect your data;
• Apple when you use Sign in with Apple, the App Store, or in-app purchases, subject to Apple's policies;
• Legal requirements if we believe disclosure is required by law, regulation, legal process, or to protect rights, safety, and security;
• Business transfers in connection with a merger, acquisition, or sale of assets, with notice where required by law.

We retain your account and workout data while your account is active. You can delete your account in the iOS app (Profile → Account → Delete account), on the web (Profile → Delete account), or contact us via our support page. We will delete personal information within a reasonable period, except where we must retain it for legal, security, or backup purposes.

You can update profile information in the app. You can disable HealthKit access in iOS Settings at any time. You may opt out of non-essential web analytics by using browser privacy controls or ad/analytics blockers where applicable.

Depending on where you live, you may have rights to access, correct, delete, or export your personal data, or to object to certain processing. To exercise these rights, contact us at support@soki-creative.com. We may need to verify your identity before responding.

We use industry-standard measures, including encrypted connections (HTTPS) and access controls on our backend. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

The Service is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.

We operate from the United States. If you use the Service from other regions, your information may be processed in the United States or where our service providers operate, which may have different data protection laws than your country.

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the "Last updated" date. Continued use after changes means you accept the updated policy.

Questions about this Privacy Policy or our data practices:
Soki Creative LLC
support@soki-creative.com