Privacy Policy

01Who we are and how to reach us

Trainic is built and run by Valentin Voaides, a private individual based in Romania. In legal terms, I am the data controller: I decide what data is collected and why.

For anything to do with your data, write to contact@trainic.app. There is no separate data protection officer - your message comes straight to me and I answer it personally.

02What we collect and why

We only collect what you type into the app, plus the bare technical minimum needed to run it. Nothing is gathered quietly in the background. Everything is tied to your account.

Your account

Email address and password. We need them so you can sign in and find your data on any phone. The password is stored in hashed form by Supabase Auth - we never see it and we cannot read it.

Your profile

Name, date of birth, sex, height, activity level, goal (lose weight, maintain or build muscle) and calorie target. These are what your daily calories and macros are calculated from.

Body and progress

The weigh-ins and body measurements you enter: waist, chest, hips, neck, biceps, thigh, calf and body fat percentage. Purpose: to show you how things change over time, in charts.

Progress photos

If you choose to add photos of your body, they are stored in a private bucket. They are never public, they never appear in any shared gallery, and they can only be opened through temporary signed links that expire after 5 minutes. They exist for one reason: so you can compare your own progress.

Nutrition

The meals you log, calories, macronutrients, meal templates, per-meal budgets and added sugar intake. Purpose: to track what you eat against your goal.

Activity

Workouts (plans, days, exercises, sets, reps and weights), push-ups and gym check-ins. Purpose: to keep a record of your training and show you how consistent you are.

Health and lifestyle

Water intake, sleep (bedtime, wake-up time, duration and quality), your recovery score (the stress and soreness you report), habits, goals and streaks. Purpose: to give you the whole picture, not just your weight.

Notification preferences

Which reminders you want and when. Purpose: so you never get notifications you did not ask for.

A technical log of AI calls

When you use an AI feature, we save the date and the name of the function that was called - that is all. The content of the request is not stored in this log. It serves one purpose: making sure the shared API key is not abused.

03The legal basis for using it

The GDPR requires a lawful reason for every category of data. Ours are three:

• Performance of a contract (Art. 6(1)(b)) - your account, your profile and every feature of the app. Without this data the app simply cannot do what it promised.
• Your consent (Art. 6(1)(a)) - progress photos and location access. You give it only if you want to, and you can withdraw it at any time.
• Legitimate interest (Art. 6(1)(f)) - crash reports, usage analytics and the anti-abuse technical log. The interest is simple: keeping the app running, fixing what breaks and preventing abuse.

Health data carries one extra condition, explained below.

04Health data

A good part of what you enter into Trainic counts, in GDPR language, as data concerning health: your weight, body measurements, body fat percentage, progress photos, sleep, water, recovery score, meals and workouts.

This falls into a special category (Art. 9 GDPR) and is protected more strictly than the rest. We process it on the basis of your explicit consent (Art. 9(2)(a)), which you give when you accept this policy and choose to enter that kind of data into the app.

We use it for exactly one purpose: to calculate and show you your own progress, inside your own account. We do not use it for advertising, we do not sell it, we do not pass it on for commercial analysis and we do not build profiles from it.

05Location

The app asks for location permission for one thing only: to find out the current outside temperature and adjust your water target for that day. When it is hot, you need more water.

Your coordinates are never stored anywhere. They are used once, in the phone's memory, for the weather request to open-meteo, and then they are gone. They are not written to the database, not kept in any history and not linked to your account.

If you decline the permission, the app works exactly as before. You just lose the automatic weather-based water adjustment.

06Camera and photo library

The app asks for camera or photo library access only at the moments when you choose to:

• scan a product barcode;
• photograph a plate of food so it can be estimated;
• add a progress photo.

Otherwise the camera stays closed and the library is not read. We do not browse your photos.

07The emails we send you

We write to you in three situations, and only from salut@trainic.app:

• Address confirmation, when you create your account.
• The password reset link, if you ask for it.
• The weekly summary - but only if you turn it on yourself under Settings - Notifications. It is off by default.

The first two are needed for you to use your account, so they are sent on the basis of our contract with you. The weekly summary is sent on the basis of your consent, which you can withdraw at any time: from inside the app, or with a single click on the link at the bottom of every email. Withdrawal takes effect immediately and affects nothing else.

The summary contains only your own numbers from the week that passed. If you logged nothing in a given week, you receive no email at all. We send no advertising, we do not send email on anyone else's behalf, and we give your address to nobody.

08Who else receives your data

To work, the app relies on a handful of outside services. Each one receives only what it needs and uses it only on our behalf, never for its own purposes.

09The transfer to the United States

We have to say this plainly: PostHog processes data in the United States, so a transfer outside the European Union takes place there.

What that means: US law does not automatically offer the same guarantees as European law, and US authorities can, under certain conditions, gain access to data stored on their territory. The transfer takes place under the data processing terms in PostHog's standard contract, which apply to all of their customers.

What actually goes there: app usage events and a technical identifier. No photos, no measurements and no health numbers - which is exactly why automatic event capture is turned off.

Every other service that holds your data - Supabase and Sentry - is in the European Union.

10How long we keep your data

For as long as your account exists. We set no artificial deadlines and we keep no copies on the side.

When you delete your account, the data is gone immediately - the deletion cascades through every table and includes the photos in storage. No hidden copy stays with us. The action cannot be undone.

Crash reports at Sentry and usage analytics at PostHog remain with those providers for as long as their own retention policies specify.

11Your rights and where to tap

Three of them you can use yourself, right now, without asking us. They are in the app under Settings - My account:

• Export my data - you get a file containing everything in your account.
• Delete all data - everything you entered is erased, but the account stays, so you can start over.
• Delete account permanently - the account and absolutely all data disappear, including the photos in storage. It asks for two confirmations, because there is no way back.

On top of that, the GDPR gives you the following rights, which you can exercise by writing to contact@trainic.app:

• Access - find out what data we hold about you.
• Rectification - have wrong data corrected (most of it you can fix yourself, in the app).
• Erasure - the right to be forgotten.
• Restriction - have processing paused while something is being sorted out.
• Objection - object to processing based on legitimate interest.
• Portability - receive your data in a format you can take elsewhere.

We answer within one month at the latest. It costs you nothing.

12How we protect your data

No big words and no promises we cannot keep. Concretely, this is what we do:

• Every table in the database has row level security: at database level, your account can only read your own rows. It is not just a check inside the app.
• Photos sit in a private storage bucket, not a public one. They open only through signed links that expire in 5 minutes.
• The authentication token is never stored in plain text: it is encrypted, and the encryption key itself is kept in the phone's system vault (Keychain on iOS, Keystore on Android).
• All traffic between the app and the servers is encrypted over HTTPS.
• Administrator access to the database is mine alone.

We hold no security certifications and we have not been through an external audit - we would rather not pretend otherwise. No system is perfectly secure, but if we learn of a problem that puts your data at risk, we will tell you and notify the authority, as the law requires.

13Minimum age

Trainic is for people aged 16 and over. It is not an app for children and we do not knowingly create accounts for them.

If you are a parent and you believe your child has created an account, write to contact@trainic.app and we will delete the account together with all its data.

14What we never do

• We never sell your data. To anyone.
• We never use it for advertising, and there are no ads in the app.
• We never use it for commercial profiling.
• We never hand it to data brokers.
• We never read your contacts and we do not track what you do in other apps.
• We use no advertising identifiers.
• We never store your coordinates.

The app is free: no subscriptions, no payments, no in-app purchases. We make no money from your data.

15This website

These legal pages are plain static files. They use no cookies, no analytics, no tracking scripts, and they load no fonts or other resources from other sites. Nothing about your visit is recorded.

16When we change this policy

If something changes - a new feature, a new service - we update this page and change the date at the top. If the change is a significant one (for example a new type of data, or a new service receiving it), we will also tell you inside the app before it takes effect.

It is worth checking back here from time to time. The version published on this page is the one that applies.

17Contact

Valentin Voaides, Romania
Email: contact@trainic.app

Write to us about anything: a question, a data request or something above that is not clear. We answer in English or Romanian.