Privacy Policy

Last updated: 2026-10-05

This policy explains how Exercisable GmbH processes personal data when you use the Simple Calisthenics app (iOS, Android, web app at app.simple-calisthenics.com) and the website www.simple-calisthenics.com (together, the "Service").

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

Exercisable GmbH Leharstraße 12 70195 Stuttgart, Germany Managing Director: Jonas Wallmann Amtsgericht Stuttgart HRB 800487 Email: info@simple-calisthenics.com

2. Data protection contact

For questions about data protection, contact us at privacy@simple-calisthenics.com.

3. What we process, why, and on which legal basis

We process personal data only in accordance with the GDPR and the German Telecommunications Digital Services Data Protection Act (TDDDG). Some of the data you give us concerns your health (for example injuries, pain, body weight). This is a special category of personal data under Art. 9 GDPR, and we process it only with your explicit consent (Art. 9(2)(a) GDPR).

3.1 Account

• Data: email address, password (stored only as a hash by Google Firebase Authentication), display name, sign-in method (email, Google, Apple), app language, platform, sign-up date.
• Purpose: to create and manage your account and to sign you in.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.2 Personal training program and questionnaire

• Data: gender, birth year (age), height, weight, goal weight, everyday activity, nutrition goal and pace, injuries and movements that cause you pain, training experience, goals and skills, available equipment, training days and schedule, muscle-group priorities, and free-text notes you add.
• Purpose: to generate and adapt your personal training and nutrition program. The program is generated by a rule-based algorithm from your answers (profiling, see section 11).
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for health data (injuries, pain, body data) your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time in the app or by email with effect for the future.

3.3 Workout tracking, videos, rep counting and progress media

• Workout data: workout logs, exercises, sets, repetitions, weights, effort, rest times and workout notes.
• Rep counting with the camera (optional): if you turn on the camera during a workout, the app detects your movement on your device (Google ML Kit). Camera images and body keypoints are processed only on your device. The app stores the resulting repetition count with your workout.
• Video recordings and rep snapshots (optional): if you record a set, the video stays on your device. If you have a premium membership and keep the setting "Save Video Recordings" switched on, the video is uploaded to our video provider Bunny, and still images taken at the top and bottom of each repetition are uploaded to Google Cloud Storage, so you can review them later.
• Form check (optional): if you submit a set for a form check, our coaching team reviews your video and gives you feedback.
• Progress photos and body measurements (optional): stored in a private storage area at Bunny and in our database.
• Purpose: to let you track your training and progress and review your technique.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for progress photos and body measurements your explicit consent (Art. 9(2)(a) GDPR).

3.4 AI features

The Service contains features based on artificial intelligence (AI). When you use them, you are interacting with an AI system, not with a person.

What the AI features do

• AI assistant (chat): answers questions about training and the app, creates and edits workouts and exercises, explains and adjusts your personal program, and answers nutrition questions. Changes to your program are shown as a preview that you save yourself. Changes to a running workout, your nutrition settings or newly created workouts are applied only when you ask for them, and you can undo them.
• Workout assistant: changes the workout you are currently doing.
• Notes in the workout generator: if you add notes (for example about an injury), an AI model reads them and adapts the generated workout, for example by leaving out exercises that load an injured area.
• Search: to find exercises and workouts by meaning, we create a numerical representation (embedding) of workout and exercise names, including the names of workouts and exercises you create, and of search requests the assistant formulates from your chat.

What data the AI receives

• your messages and the course of the current conversation;
• the screen you are using and its content, for example the workout you are doing (exercises, sets, weights, notes) or the workout you are editing;
• if you have a personal program: your program and your questionnaire answers, including gender, age, height, weight, goal weight, nutrition answers and injuries;
• results the assistant looks up for you, such as your workout history and statistics or your nutrition targets;
• your notes in the workout generator.

The AI does not receive your name or email address.

Who processes it

• OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C., USA): language models for the assistant and the workout generator notes.
• Google Cloud Vertex AI (Google Cloud EMEA Ltd. / Google LLC, USA): Gemini models for helper tasks (for example matching equipment names, translating exercise names) and the embeddings for search. Vertex AI may process requests outside the EU.
• Anthropic (Anthropic, PBC, USA): AI-assisted analysis of conversation logs as part of our quality review (see below).

Under the providers' business terms, the data we send is not used to train their models.

Conversation logs and quality review

We store each conversation with the AI assistant (your messages, the context sent with them, the AI's answers and the actions it carried out) and the feedback you give on answers. We use these logs to fix errors, improve the assistant and detect misuse. Members of our team review conversations, partly with the help of AI tools from Anthropic.

Analytics of AI use

Our product analytics provider PostHog receives technical data about each AI request (model used, number of tokens, response time, cost). It does not receive the content of your messages or of the answers.

Limitations

AI answers can be wrong or incomplete. They are general training information and not medical advice. If you have pain, an injury or a health condition, consult a doctor or physiotherapist.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for providing the features; our legitimate interest in a safe and working assistant (Art. 6(1)(f) GDPR) for the conversation logs and their review; your explicit consent (Art. 9(2)(a) GDPR) for health data you share with the AI.

3.5 Payments and subscriptions

• In the app: subscriptions are sold by Apple (App Store) and Google (Google Play). We receive purchase status, product, price, store country and transaction identifiers through RevenueCat, which manages subscriptions for us. On iOS, RevenueCat also receives an Apple Search Ads attribution token to tell us whether a purchase came from an Apple Ads campaign.
• On the website: payments are processed by Stripe. We create a Stripe customer with your email address and user ID. Stripe collects your billing address and payment details directly. For some purchases, Stripe's Link service acts as the merchant of record; it is then a separate controller for that purchase. Earlier purchases were processed by Lemon Squeezy as merchant of record.
• Purpose: to sell and manage memberships, prevent fraud, fulfil tax obligations and attribute purchases to our advertising.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR); legal obligations (Art. 6(1)(c) GDPR); our legitimate interest in measuring our advertising (Art. 6(1)(f) GDPR).

3.6 Product analytics

• Data: usage events (screens opened, features used, purchases), device and app information, an analytics identifier, your user ID and email address, approximate location derived from your IP address, and some of your questionnaire answers as event properties.
• Tools: Mixpanel (data stored in the EU), PostHog (EU cloud), Google Analytics for Firebase. PostHog also records sessions in the app as screen recordings in which all text and images are masked.
• Purpose: to understand how the Service is used and to improve it.
• Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). You can object at any time (section 9).

3.7 Crash reports, performance and logs

• Data: crash reports and error diagnostics, device model, operating system and app version, IP address, time of use, server logs.
• Tools: Firebase Crashlytics, Firebase Performance Monitoring, Sentry, Google Cloud Logging.
• Purpose: to find and fix errors and keep the Service stable.
• Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

3.8 Apple Health and Health Connect

• Data: finished workouts (type, duration, calories) and, where you record them, body measurements such as weight and body fat.
• Purpose: to write your workouts and measurements to Apple Health (iOS) or Health Connect (Android). The app does not read data from these apps.
• Legal basis: your explicit consent (Art. 9(2)(a) GDPR), given through the system permission. You can withdraw it in the system settings at any time.

3.9 Emails

• Service emails: purchase confirmations, payment problems, replies to your support requests. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Personal messages from our team: after your first workouts, after a cancellation or at the end of a trial we may ask for your feedback by email and in the in-app chat.
• News and offers: only if you agreed to receive them (checkbox at sign up). Legal basis: your consent (Art. 6(1)(a) GDPR, § 7(2) UWG). You can withdraw it at any time.
• Tool: Google Workspace.

3.10 Push notifications and in-app messages

• Data: a device token for push notifications (Firebase Cloud Messaging), message content.
• Purpose: to notify you of new messages in the in-app chat with our team. Workout reminders are scheduled on your device.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and your permission in the system settings, which you can withdraw at any time.

3.11 Support

• Data: your message, email address, user ID, app version, device and operating system, membership status, attachments, and, if you report an AI answer, the conversation identifier and the reported answer.
• Purpose: to answer your request.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.12 Website

• Hosting: the website and the web app are hosted by Vercel. Each visit transmits your IP address, browser information and the page requested.
• Analytics on the website: Vercel Web Analytics (without cookies), Mixpanel and Google Analytics 4.
• Currency and country: to show prices in your currency, the website looks up your country from your IP address with ipapi.co.
• Sign-up and checkout: Google Firebase Authentication and Stripe.
• Legal basis: our legitimate interest in a working and secure website (Art. 6(1)(f) GDPR) for hosting; your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) for analytics tools.

3.13 Country and currency

We determine your country from your IP address, your app store account or your billing address in order to show prices in your currency, apply the rules of your country (for example tax and consumer law) and send messages in your language. Legal basis: performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c) GDPR).

4. Recipients

We use the following service providers. Unless stated otherwise, they process data on our behalf under a data processing agreement (Art. 28 GDPR).

Our main database is located in the EU. Some server functions (including payment processing and account deletion) and our file storage run in Google's US region.

5. Transfers to third countries

Some recipients are located in the USA or may process data there. Where a recipient is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). Otherwise we have agreed Standard Contractual Clauses (Art. 46(2)(c) GDPR) with the recipient. You can request a copy from privacy@simple-calisthenics.com.

6. Cookies and similar technologies

• App: the app does not use cookies. It stores identifiers on your device for analytics and crash reporting (Firebase installation ID, Mixpanel and PostHog identifiers) and settings you choose.
• Website: only technically necessary storage is used without your consent (§ 25(2) TDDDG):

You can withdraw your consent at any time in the cookie settings linked in the footer.

7. Retention

8. Security

We protect your data with appropriate technical and organisational measures (Art. 32 GDPR), including encrypted transmission (TLS), encrypted storage at our providers, access controls and role-based access for our team.

9. Your rights

You have the right to:

• access your data (Art. 15 GDPR);
• rectification (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• object to processing based on legitimate interest (Art. 21(1) GDPR);
• object at any time to the use of your data for direct marketing, including profiling for that purpose (Art. 21(2) GDPR);
• withdraw your consent at any time with effect for the future (Art. 7(3) GDPR);
• lodge a complaint with a supervisory authority (Art. 77 GDPR). Ours is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de.

To exercise your rights, write to privacy@simple-calisthenics.com.

10. Deleting your account

You can delete your account in the app under Settings, or by writing to privacy@simple-calisthenics.com. An active subscription has to be cancelled first.

When you delete your account we delete your profile, questionnaire, program, workouts, workouts and exercises you created, progress photos and body measurements, videos and files you uploaded, and your AI conversation logs. We keep payment records for the legal retention period and a short record that the account was deleted, so that late payment notifications can be handled correctly. Data at analytics providers is deleted according to their retention periods.

11. Automated decisions and profiling

Your personal program is generated automatically from your questionnaire answers (profiling within the meaning of Art. 4(4) GDPR). AI features adapt workouts and programs when you ask for it; notes you add in the workout generator can lead the AI to leave out exercises for an injured area in that workout. None of this produces legal effects or similarly significantly affects you (Art. 22 GDPR). You can change or ignore every program and workout at any time.

12. Children

The Service is not directed at persons under 16. We do not knowingly collect personal data of children under 16. If you believe a child has given us personal data, contact privacy@simple-calisthenics.com and we will delete it.

13. Links to other sites

The Service contains links to third-party websites, for example social media. Their operators are responsible for their own data processing.

14. Changes to this policy

We update this policy when our Service or the law changes. We announce material changes in the app or by email before they take effect. The date of the last update is shown at the top.

15. Contact

Exercisable GmbH Leharstraße 12 70195 Stuttgart, Germany privacy@simple-calisthenics.com