Privacy Policy

1. Data we collect

Account data: your name, email address, password (stored only as a secure hash), language, units, leaderboard preference and coach/athlete setting. If you sign in with Google, we receive your Google account identifier, name, email address and profile picture. If you sign in with Apple, we receive your Apple account identifier, your email address (or a private relay address if you choose to hide it) and, the first time only, your name; we also keep a token from Apple so we can revoke the sign-in when you delete your account.

Training data: programs, workouts, scheduled dates, results, per-set logs, 1RM and other test results, notes, comments, difficulty ratings, reactions and the custom exercises and library workouts you create.

Connection data: who you are connected with as a coach or athlete, invite links and which programs are shared with whom.

Device and technical data: push notification tokens, device platform, app version, and server logs such as IP address, time of request and error information.

App usage data: which screens you open and which main actions you take (for example creating a program, logging a workout or opening the subscription screen), with an anonymous device identifier or, when you are signed in, your internal user ID. It never includes your name, email address or the content of your workouts, notes or comments. Crash reports with technical details of the error.

Purchase data: if you buy a subscription, your plan, purchase, renewal and expiry dates, the store (Apple or Google), and product and transaction identifiers. We never receive your payment card details — payments are processed by Apple or Google.

AI requests: if you use AI features, the text you submit and the response the AI returned, kept for 30 days to investigate and fix wrong results, plus usage counts.

Website data: if you join the waitlist, your email address, language and the page you signed up from. Google Analytics cookies are set only if you accept them in the cookie banner.

Guest mode: programs and results you create without an account stay on your device and are not sent to us. To show the public exercise and workout library, the app still contacts our servers, which creates ordinary server logs.

2. Health information

Workout results such as weights, times and repetitions are used to run the Service, not to assess your health. Please do not enter medical diagnoses, injuries or other health details unless they are needed for your training. If you choose to enter such information in a note or comment, it is only stored and shown to you and the people you share it with, and you can delete it at any time.

3. How and why we use data

To provide the Service you asked for — your account, programs, timers, results, connections, leaderboards and notifications (performance of our contract with you).

To keep the Service secure, prevent abuse, fix errors and improve features, using aggregated or minimal data where possible (our legitimate interests).

To send service emails such as verification codes and password resets (contract), and, if you joined the waitlist, one launch announcement (your consent).

To measure website use with Google Analytics (your consent, which you can withdraw in “Cookie settings”).

To understand how the app is used and fix crashes, using app usage data and crash reports (our legitimate interests). You can turn usage data off at any time in the app under Profile → “Share anonymous usage data”.

To comply with legal obligations and to establish or defend legal claims.

We do not sell your personal data, do not use it for advertising, and do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Who can see your data

Other users you choose: coaches and athletes you connect with see the programs, results and comments you share with them. If you take part in leaderboards, other users who logged the same workout can see your name, profile picture and result — for public library benchmarks this can be any vZali user who logged that workout. You can turn leaderboards off in your profile.

Service providers that process data on our behalf, only as needed to provide their service: our hosting provider (servers and database), Zoho (email delivery), Expo together with Apple and Google push services (notifications), Apple (Sign in with Apple), Google (sign-in and, with consent, website analytics), RevenueCat (managing in-app subscriptions, which receives your account identifier and purchase data from the app stores), OpenAI (AI features, as described in our Terms), PostHog (app usage analytics, stored in the EU) and Sentry (crash reports).

Authorities or other parties when required by law, or to protect the rights and safety of users and the Service. If the Service is reorganised, merged or sold, data may be transferred to the new operator under this Privacy Policy.

5. International transfers

Some providers, such as Google, RevenueCat and OpenAI, may process data outside Ukraine and the European Economic Area, including in the United States. Where required, transfers rely on appropriate safeguards such as adequacy decisions or the European Commission’s standard contractual clauses.

6. How long we keep data

We keep account and training data while your account exists. When you delete your account, we delete your personal data from our active systems; copies in backups are removed when those backups expire. Some data may be kept longer only where the law requires it or to resolve a dispute. Content you shared with others may remain in their copies (for example a program you assigned). Waitlist emails are kept until the launch announcement is sent or until you ask us to delete them. Text you submit to AI features and the AI’s responses are deleted after 30 days; usage counts are kept while your account exists. App usage data is kept for up to 12 months and crash reports for up to 90 days.

7. Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, restrict or object to certain processing, and withdraw consent at any time (this does not affect processing before withdrawal). You can delete your account yourself in the app (Profile → Delete account), turn off leaderboards in your profile and notifications in your device settings, and change cookie choices on the website.

To exercise your rights, email support@vzali.com. We may need to confirm your identity and will reply within one month. You also have the right to complain to a data protection authority — in the EU, the authority in your country; in Ukraine, the Ukrainian Parliament Commissioner for Human Rights.

8. Security

We use encrypted connections (HTTPS), store passwords only as hashes, and limit access to personal data. No system is completely secure, so please use a strong, unique password and keep your device protected.

9. Children

The Service is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child under 16 has given us personal data, contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy. If changes are material, we will notify you in the app or by email before they take effect. The date at the top shows the latest version.

11. Contact

Questions or requests about your personal data: support@vzali.com.