Avaloops

Privacy Policy

1. Controller

The controller under the GDPR is:
Mario Margarone
Avaloops
Kastanienweg 7
74417 Gschwend
Germany
Email: info@avaloops.com

2. Data we process and purposes

We process the following personal data:

  • Account data: email address and encrypted password (authentication via Supabase Auth)
  • Profile data: name, age, height, weight, sex, training goals, fitness level, language, optional profile photo — to create personalized training plans
  • Training data: completed exercises, weights, reps and sets — for progress tracking and plan adaptation
  • Nutrition and energy data: optional meals, macros, calorie goals and body weight — for the energy area and personalized recommendations
  • Activity data: steps, active calories, sleep duration, resting heart rate, distance, and optionally heart rate during cardio — from manual entry or (with your consent) Apple Health / Health Connect
  • Coach messages: text and optional voice messages between coach and client (voice recordings are stored as audio files)
  • Weight history: optional body-weight measurements — for statistics
  • Payment data: billing via Apple (App Store In-App Purchases) and/or Stripe — card details are processed only by Apple/Stripe, not on our servers
  • Push notifications (app): device token (FCM) for training reminders if you enable them
  • Usage and event data: e.g. app opens, plan created, workout started — in our database for product improvement
  • Technical data: IP address, browser/app information, error logs — when operating the website and app

3. Health and activity data (Apple Health & Health Connect)

Connecting Apple Health (iOS) or Google Health Connect (Android) is optional. Without a connection you can still enter activity values manually in the app.

3.1 Data that may be read

When you connect the tracker and grant the relevant OS permissions, the app may read the following data types from Apple Health or Health Connect on your device:

  • Steps and derived distance
  • Active calories (energy burned through activity)
  • Sleep duration
  • Resting heart rate
  • Heart rate during ongoing cardio workouts (only when you start training and permission is granted)
  • Current heart rate in the app header (display while using the app; no lasting storage outside a workout you log)

We do not read health data in the background without your active connection and without the permissions you set in the OS. You can disconnect in the app or revoke permissions in Apple Health / Health Connect settings at any time.

3.2 Purposes of processing

  • Showing your daily activity in the energy area and weekly overviews
  • Syncing recent days to our server so your data is available across devices
  • If you are linked to a coach: aggregated activity values for the last 7 days (steps, sleep, calories, resting heart rate) in the coach view — so your coach can contextualize progress
  • Storing heart-rate values in workout logs when you do cardio with heart-rate tracking

Health and activity data are not used for advertising, marketing profiling, or sale to third parties. They are not sent to the AI coach as raw data.

3.3 Legal basis

Processing of health-related data is based on your explicit consent (Art. 6 (1)(a) and Art. 9 (2)(a) GDPR), given by connecting the tracker and confirming the system dialog. You may withdraw consent at any time (disconnect in the app, revoke OS permission, delete account).

3.4 Storage and transfer

Daily activity totals are stored in our database (Supabase, EU Frankfurt region where configured). Tracker connection status (provider, last sync time) is also stored. Technical flags may be kept in localStorage on the device (e.g. whether sync is active).

Apple Health and Health Connect are operated by Apple and Google. Processing on your device is subject to their policies: Apple Privacy Policy, Health Connect privacy.

4. Legal basis (general)

Processing is based, depending on purpose, on Art. 6 (1)(b) GDPR (performance of a contract) for account, profile and training data; Art. 6 (1)(a) GDPR (consent) for optional features (e.g. push notifications, microphone for voice messages, Apple Health / Health Connect — see section 3); and Art. 6 (1)(f) GDPR (legitimate interest) for stability, security and limited product analytics (event data in our database; health-tracker area only on errors).

5. Processors and third parties

  • Supabase Inc. (USA) — database, authentication, file storage (e.g. avatars, voice messages). EU (Frankfurt) region where configured. Data processing agreement (DPA) with Standard Contractual Clauses.
  • Vercel Inc. (USA) — hosting of the web app avaloops.com. Standard Contractual Clauses (SCCs).
  • Anthropic PBC (USA) — AI model for training plans and coach replies. Profile and training context are sent without email; names only as needed for useful plans. DPA / SCCs.
  • Apple Inc. — App Store billing and Apple Health / HealthKit on iOS. Apple Privacy Policy
  • Stripe Payments Europe Ltd. — payment processing where Stripe is used. Stripe Privacy Policy
  • Google Ireland Limited — Firebase Cloud Messaging (push) and Health Connect on Android. Google Privacy Policy

6. Retention

Data is stored while the account is active. After account deletion, personal data is deleted within 30 days unless statutory retention applies (e.g. invoices 10 years under German tax law). Details: Delete account and data.

7. Your rights

You have the right to:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR)
  • Withdraw consent (Art. 7 (3) GDPR)

Delete your account in the app: Delete account and data (public instructions and email request). Signed in: Profile → Edit profile → Delete account. Other requests: info@avaloops.com

You may also lodge a complaint with the competent supervisory authority (for Baden-Württemberg typically the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

8. Cookies and local storage

We do not use tracking or advertising cookies. We use:

  • Necessary: auth cookies (Supabase), language cookie, technical settings (e.g. skin, native-app flag)
  • Functional (web/app): localStorage for drafts (e.g. ongoing workout), coach chat history in the browser, optional technical tracker-sync flags (no raw health data)

You can delete or block cookies in the browser; login or settings may then work only partially.

9. Subscriptions and payment data

User and coach subscriptions may be billed via Apple (App Store) and/or Stripe. Credit card and bank details are not stored on our servers.

10. Hosting and transfers to third countries

Providers based in the USA (Supabase, Vercel, Anthropic, Apple/Google where applicable) are used only with appropriate safeguards (Standard Contractual Clauses, data processing agreements). See each provider's privacy notice for details.

Last updated: June 2026