Privacy Notice

Data we collect and why

• Account data (email address, display name, login credentials managed by our authentication provider, sign-in via Google if you choose it) — to create and secure your account. Legal basis: performance of our contract with you.
• Profile and health data (age, sex, height, weight, blood pressure, VO2 and other metrics you enter, goals, equipment, dietary preferences and allergies) — to generate and personalise your training and meal plans and to show your progress charts. Health data is special-category data; legal basis: your explicit consent, which you give by entering it and can withdraw at any time by deleting the entries or your account.
• Plan and activity data (generated training blocks, meal plans, shopping lists, completed sessions, adherence) — to provide the Service. Legal basis: contract.
• Language and settings preferences — to show the app in your language. Legal basis: contract.
• Subscription and payment status (plan, status, renewal date, credits, payment event records) — to grant access to paid features and keep billing records. Legal basis: contract and legal obligation. Card details are collected and processed by Paddle, not by us.
• Support messages — to answer your questions. Legal basis: legitimate interests in supporting our users.
• Technical and security data (IP address, device and browser information, log and error data) — to keep the Service secure, prevent fraud and fix problems. Legal basis: legitimate interests in security and reliability.

Automated plan generation

To create your plans, the goals, preferences and relevant metrics you provide are sent to our AI model provider for processing. This produces a plan for you; it does not make legal or similarly significant decisions about you.

Who we share data with

• Service providers / subprocessors — cloud hosting and database, authentication, AI model providers, and error and performance monitoring.
• Merchant of Record (Paddle) — for sale of the product, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where we are required to disclose by law.

We do not sell your personal data or use your health data for advertising.

International transfers

Some of our providers process data outside the EEA/UK. Where that happens we rely on adequacy decisions or Standard Contractual Clauses with appropriate additional safeguards.

Retention

We keep account, profile, health and plan data for as long as your account is active, and delete or anonymise it within 90 days of account deletion. Billing and transaction records are retained for as long as tax and accounting law requires (typically 5–7 years). Security logs are kept for up to 12 months.

Your rights

Subject to applicable law you have the right to access your data, correct it, have it erased, restrict or object to processing, receive it in a portable format, and withdraw consent at any time (without affecting processing already carried out). Email support@kineticaitrainer.lovable.app and we will respond within one month. If you are in the EEA/UK you also have the right to complain to your supervisory authority — in Norway, Datatilsynet.

Security

We apply appropriate technical and organisational measures, including encryption in transit, encryption at rest with our hosting provider, row-level access controls so users can only reach their own records, and restricted, role-based administrative access.

Cookies and local storage

We use strictly necessary cookies and browser storage to keep you signed in, remember your language, and hold your shopping-list tick state and administrative session. We do not use advertising cookies. You can clear or block them in your browser settings, though the app may not work correctly without the necessary ones.

Children

Kinetic is not intended for children under 16, and we do not knowingly collect their data.