Privacy Policy

1. Introduction

This Privacy Policy explains how OWNSET handles personal information in its iPhone gym and training application. OWNSET is operated by Matilda Johansson, the data controller identified in section 17. References to “we,” “us” and “our” mean this operator.

This policy describes the current OWNSET application, including accounts, training information, Cloud Backup, subscriptions and optional device integrations.

2. Information We Collect

• Account information: your email address and unique Supabase user identifier. Email and password credentials are used for authentication through Supabase.
• Profile and training setup: your first name, training goals, experience level and training days per week.
• Training information: generated or current training plans, custom workouts, Freestyle workouts, completed workout sessions and history, exercises, sets, weight or load, repetitions, workout duration, partial or completed state, workout notes and user preferences.
• Subscription information: subscription and purchase-entitlement information managed through Apple’s App Store and RevenueCat, associated with your pseudonymous OWNSET account identifier.
• Optional Apple integration: information handled through permitted Apple Health and Apple Watch functionality, as described in section 8.

The current OWNSET implementation does not use third-party behavioral analytics or crash platforms such as Firebase Analytics, Mixpanel, Amplitude, PostHog or Sentry.

3. How We Use Information

We use information to authenticate your account, provide profile and training functionality, maintain your plans and workout history, apply your preferences, back up and restore eligible information, manage subscription access, provide permitted optional features and process account deletion.

Where the GDPR applies, the legal bases are:

• Performance of contract / provision of service: account functionality, onboarding and profile, training plans, workouts and history, user preferences, Cloud Backup and restore, and core OWNSET functionality.
• Legitimate interests: service security, reliability, fraud and abuse prevention, and necessary technical diagnostics, subject to your rights and interests.
• Legal obligations: processing or retaining information where required by applicable law.
• Consent: optional functionality such as notifications and Apple Health access, where consent is the applicable basis. Device permissions also control access to these optional features.

Apple’s device permission controls determine whether OWNSET can use the relevant device functionality. You can change these permissions in Apple’s system settings.

4. Account and Authentication

OWNSET uses email/password authentication through Supabase. Your account is associated with your email address and a unique Supabase user identifier (UUID). You can request password recovery.

Your identifier associates your account with its cloud records. It is also used as RevenueCat’s App User ID to associate subscription entitlements with the correct OWNSET account.

5. Training and Workout Data

OWNSET stores training information needed to provide the service. This may include your generated or current plan, custom and Freestyle workouts, completed sessions and history, exercises, sets, weight or load, repetitions, duration, partial or completed state, notes and preferences.

Cloud Backup uses Supabase to back up eligible account and training data and restore eligible information. Backup and restore processes may reconcile eligible records with information already held in OWNSET. Cloud Backup does not guarantee full bidirectional synchronization of all app data.

The current Cloud Backup implementation does not upload Apple Health or HealthKit data to Supabase. OWNSET does not keep a Supabase cloud copy of HealthKit data.

6. Subscriptions and Purchases

Apple handles App Store purchases and payment processing. RevenueCat handles subscription and entitlement management for OWNSET.

RevenueCat uses your Supabase user identifier as its App User ID. This identifier is pseudonymous but is linked internally to your OWNSET account; it is not anonymous.

The current integration does not intentionally send RevenueCat your first name, email address or workout history. Automatic RevenueCat device identifier collection is disabled in the current implementation.

Apple processes purchase and payment information under its own terms and privacy policies. OWNSET does not directly receive or store your full payment-card information.

7. Notifications

Workout and rest reminders are optional and are currently primarily scheduled locally on your device. You control notification permissions through your device settings.

The current application does not upload an Expo push token to the OWNSET backend or use that token elsewhere. Current reminders therefore do not involve server-side collection of that push token.

8. Apple Health and Apple Watch

Apple Health and Apple Watch integration is optional and controlled by Apple’s permission system. Where supported and permitted, OWNSET may write workouts recorded in OWNSET to Apple Health. Apple Watch functionality may use heart-rate access with separate permission.

The current OWNSET Cloud Backup / Supabase implementation does not upload Apple Health or HealthKit data to Supabase. It does not store a cloud copy of HealthKit data.

Disconnecting OWNSET from the integration does not automatically revoke Apple permissions or remove records already stored in Apple Health. Manage permissions through Apple’s system settings and previously saved workouts separately through Apple Health.

9. Service Providers

• Supabase: email/password authentication, database and storage, Cloud Backup, restore and account infrastructure.
• RevenueCat: subscription and entitlement management.
• Apple: App Store purchases and payments, optional Apple Health and Apple Watch integration, and platform functionality.

These providers do not necessarily receive every category of information described in this policy. Their access depends on their role and the features you use. Apple’s own terms and privacy policies govern its processing of information through its services.

10. Data Storage and Security

Supabase stores account and training information and provides account infrastructure, Cloud Backup and restore. User-owned cloud records are protected using Supabase Row Level Security policies and authenticated account controls. OWNSET uses account isolation protections to restrict access to user-owned information and associate subscription entitlements with the correct account.

No technical system can guarantee absolute security. These controls do not guarantee that unauthorized access, alteration or loss can never occur.

Current workout/rest reminders are primarily scheduled locally. Apple Health and HealthKit data are not uploaded to Supabase Cloud Backup.

11. Data Retention and Account Deletion

We retain account and training information while your account remains active or for as long as reasonably necessary to provide OWNSET.

Delete Account is available in the app. Using it initiates deletion of your OWNSET account and user-owned cloud information through an authenticated flow. For account-deletion assistance, contact support@getownset.com.

Limited information may remain temporarily in backups, technical or security logs, or provider systems. Information may also be retained where required by applicable law. Deletion is not instantaneous across every backup or provider system.

Deleting your OWNSET account or removing the app does not automatically cancel an Apple App Store subscription. Manage and cancel subscriptions separately through Apple.

Account deletion does not automatically remove workouts previously written to Apple Health. Manage those records separately through Apple Health.

12. User Rights and Choices

You can request password recovery, use Delete Account in the app, control notification permissions and choose whether to grant Apple Health or Apple Watch permissions.

Where applicable under data protection law, you may request access to or a copy of your personal information, correction, deletion, restriction of processing, objection to processing, and portability of eligible information. Where consent is the legal basis, you may withdraw it without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights or ask a privacy question, contact support@getownset.com. Rights are subject to applicable legal conditions and exceptions. You may also contact your local data-protection supervisory authority where applicable.

13. Children’s Privacy

OWNSET is intended for users aged 16 or older (16+). It is not intended for children under 16.

If you believe a child under 16 has provided personal information to OWNSET, contact support@getownset.com so we can address the concern and arrange deletion where appropriate.

14. International Data Processing

Our service providers may process personal information outside Sweden or the European Economic Area (EEA). Data protection laws in other countries may differ from those in your country.

Where required by applicable law, appropriate safeguards are used for international transfers, such as Standard Contractual Clauses or equivalent lawful transfer mechanisms. For information about safeguards applicable to your information, contact support@getownset.com.

15. Changes to This Privacy Policy

We may update this policy when OWNSET’s data practices change or to reflect applicable legal requirements. The updated policy will be published on this page with a revised “Last updated” date. Where required by law, we will provide additional notice or obtain consent before relevant changes take effect.

16. Contact

For privacy questions, requests concerning your information or help with account deletion, contact support@getownset.com.

Website: getownset.com.

17. Legal Operator / Data Controller

The operator of OWNSET and controller responsible for the personal information described in this policy is: