Privacy Policy

Last updated: September 13, 2026

ToTrain ("we", "us", or "our"), registered under KVK number 80183719 in the Netherlands, operates the ToTrain mobile application and website (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our Service.

1. Data Controller

ToTrain is the data controller for your personal data. You can reach us at info@totrain.app.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• First and last name
• Email address
• Password (stored securely hashed)
• Profile photo (optional)

2.2 Third-Party Authentication

If you sign in via Google or Apple, we receive your name, email address, and profile identifier from these providers. We do not receive or store your Google or Apple password.

2.3 Health & Fitness Data

With your explicit consent, we may collect:

• Workout logs (exercises, sets, reps, weight)
• Training plans and templates
• Body measurements and progress data
• Apple Health measurements and workout records you choose to import, which may include activity, heart rate, sleep, energy and body measurements, after you grant device permission
• Nutrition data (meals, macronutrients, calorie intake)
• Optional profile details, including date of birth, training preferences and injury notes

Imported health and workout data may be stored in your ToTrain account to provide training history and related features. Device permission to import Apple Health data is separate from your choice to include that data in AI requests. Manual workout logging works without Apple Health access.

2.4 AI Coach Data

AI features are optional. In Settings, AI Data Controls lets you separately enable messages and plan requests sent to Anthropic, web trainer messages sent to OpenAI, and food photos sent to Anthropic for nutrition estimates. Messages, instructions and images you choose to send may themselves contain personal or health information.

Separate controls determine whether enabled coaches may also use your training history or health and nutrition context. These choices start off. Turning a choice off and saving it stops new requests using that permission; it cannot recall information already sent. Providers process and retain requests under their applicable policies and agreements.

Read Anthropic's commercial data-use information and OpenAI's business data privacy information for information about these providers. You can use manual planning, workout logging and food entry without enabling AI sharing.

2.5 Technical Data

The Service and its providers process technical information such as:

• Device type and operating system
• IP address
• Browser type (web)
• App version
• Error reports and technical diagnostics

2.6 Purchases and Subscriptions

Apple processes purchases made through the App Store. RevenueCat receives purchase and subscription history and your ToTrain account identifier to validate purchases, restore access and report subscription activity. These records are linked to your ToTrain account. Stripe processes purchases made through the website. ToTrain does not receive your full payment-card number from these checkout services.

2.7 Content and Social Features

We store content you provide, including workout notes, posts, comments, uploaded media and following relationships. Content you share is available according to its audience settings. Changing the default audience for new workout posts does not change the audience of existing posts. Reports and relevant content may be reviewed to investigate abuse or support requests.

2.8 Food Search and Barcode Lookup

When you search for food or scan a product barcode, we may send the search terms or barcode to Open Food Facts to retrieve product information. If your device contacts this service directly or displays its product images, the service also receives connection information, such as your IP address. You can enter food information manually without using this lookup.

3. How We Use Your Data

We use your personal data to:

• Provide, maintain, and improve the Service
• Personalize your training experience and AI coaching
• Authenticate your account
• Send transactional emails (verification, password reset)
• Validate purchases, restore paid access and understand subscription activity
• Ensure the security of the Service
• Comply with legal obligations

4. Legal Basis for Processing (GDPR)

We process your data based on:

• Contract performance — to provide the Service you signed up for
• Consent — for health data collection, AI coaching, and optional features
• Legitimate interest — to improve the Service and ensure security
• Legal obligation — to comply with applicable laws

5. Data Sharing & Third Parties

We use the following providers and other recipients to operate the Service. The information involved depends on which features you use and the choices you make.

We do not sell your personal data or use your workout, health or AI conversation content for advertising. We use technical diagnostics to maintain the Service and RevenueCat purchase analytics to understand subscription activity. We do not use these records to track you for advertising across other companies' apps and websites.

6. International Data Transfers

Storage and processing locations depend on the provider and service configuration. Some providers may process data in the United States or other countries outside the European Economic Area. For applicable international transfers, we use appropriate safeguards under GDPR, including adequacy arrangements and Standard Contractual Clauses where applicable. Contact us for information about the safeguards relevant to your data.

7. Data Retention

We retain your data for as long as your account is active. When you delete your account:

• Personal data is deleted within 30 days
• Workout history and health data are permanently deleted
• Anonymized aggregate data may be retained for analytics
• Data required by law may be retained for the legally mandated period

8. Your Rights

Under the GDPR, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data
• Restriction — limit how we process your data
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interest
• Withdraw consent — at any time for consent-based processing

To exercise any of these rights, contact us at info@totrain.app. We will respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

9. Children's Privacy

The Service is intended for users aged 13 and older. In the European Economic Area, users under 16 must have verifiable parental or guardian consent to use the Service. We do not knowingly collect data from children under 13. If we learn we have collected data from a child under 13, we will promptly delete it.

10. Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS) and at rest, secure password hashing, and access controls. However, no method of transmission over the Internet is 100% secure.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Contact

For privacy-related questions or to exercise your rights, contact us at:

ToTrain
KVK: 80183719
Email: info@totrain.app