Skip to main content
Athlo

Athloapp privacy notice

Last updated: 29 October 2026

Athloapp is provided by Lightcore. We are the controller for the personal data described in this notice. Contact us at support@athlo.si.

What Athloapp stores

Athloapp is designed to work offline. The app keeps a local database on your device containing your profile, settings, routines, custom exercises, workout history, personal records, cardio sessions, body measurements and health connection status. Custom exercise photos and attached form videos are saved on the device and can also be backed up as described below. Detailed heart-rate samples and raw GPS records are not uploaded by cloud sync; saved route geometry and training summaries can be synced privately. Sign-in tokens and the database encryption key are kept in the device's secure storage.

If you sign in and use cloud features, Athloapp also processes:

Athloapp does not receive your full payment-card details when Apple handles a purchase.

### Private media backup

When you sign in with a permanent account, Athloapp automatically backs up custom exercise photos and attached form videos to private account storage in Supabase after the related exercise or workout has synced. No separate backup switch or Pro subscription is required. Exercise photos can restore during account sync; form videos download when you choose them. Backup status identifies pending uploads, errors and conflicts. Pending backup is not confirmation that a cloud copy exists. These media backups are not shared through public workouts or profiles.

Removing a photo or video queues its cloud backup for removal. Account deletion includes the account's cloud exercise-photo and form-video storage and its local media on the device completing deletion. This does not remove independently exported copies or promise immediate cleanup on other devices.

### Contact discovery

Contact discovery is optional. When you choose to scan contacts and grant device permission, Athloapp reads contact email addresses and sends them to Supabase to match verified accounts that allow email discovery. Contact names and phone numbers are not sent. The application does not save your address book or submitted email list; the service stores your discovery preference and lookup usage counts.

"Let contacts find me by email" is off by default and separate from contact access. Enabling it lets people who know your verified email find your profile, including a private profile, without exposing private workouts.

### AI weekly recaps

AI weekly recaps are optional and require Pro and a permanent account. After you review the totals and choose Generate AI recap, Athloapp sends the reviewed weekly training totals and activity counts to OpenAI through Supabase. These include workout and training-day counts, duration, sets, reps, load volume, and cardio distance and moving time. Routes, names, notes, body measurements, raw heart-rate samples and media are excluded. Athloapp saves the resulting recap and request information for retrieval.

Health and location permissions

On iPhone, you can choose whether Athloapp may read heart rate, resting heart rate, body weight and steps from Apple Health. You can also choose whether it may write completed strength and cardio workouts, workout routes and active energy to Apple Health. Athloapp uses this data to show your training, calculate training summaries and carry out the imports or exports you request. We do not use health or fitness data for advertising.

Location permission is used to record an outdoor workout, including while the screen is off if you allow background location. Raw GPS records stay on the device unless you export them, including to Apple Health. After you save a cardio session, an encoded route can be included in private cloud sync. Social cardio cards do not include a route or heart-rate values.

You control Apple Health and location access in iOS Settings. Turning off permission stops future access but does not remove information already imported into Athloapp or copies already written to Apple Health. Delete those copies in the service where they are stored.

Android and Health Connect support is planned for a later release. This notice must be checked against the Android build before that release.

Why we use the data

We process account, training, sync, social and subscription data to provide the service you request and perform our agreement with you. We process optional health data with your explicit permission. We process limited security and diagnostic data to keep Athloapp reliable, prevent abuse and protect accounts and the service. We process records when necessary to meet legal obligations or establish, exercise or defend legal claims.

We do not sell personal data. We do not use your health, fitness or location data for advertising, marketing profiles or data-broker services.

What other people can see

Saving a workout does not publish it. You must choose to publish an eligible saved activity.

Your handle, display name, avatar, bio, private-account status and follower counts are visible through athlete search. A public account can be followed immediately. A private account must accept a follow request before the requester can see follower-only activity.

Published workout cards can show the workout title, date, duration, total volume, set count, exercise names, personal-record count, likes and comments. Published cardio cards can show activity type, date, duration, distance, pace, elevation and calories. Social views exclude private notes, body measurements, health connection details, heart-rate values, raw GPS points, saved route geometry, email addresses and authentication identifiers.

You can hide or delete an activity, make your account private, remove a follower, block a user or report content. Deleting an account removes the account's published content from Athloapp.

Service providers

Athloapp uses service providers only where needed to run the service:

These providers process data under their own service terms and privacy commitments. Some may process data outside your country. Where data protected by EU or EEA law is transferred outside the EU or EEA, we use an applicable legal transfer mechanism and safeguards required by law. Contact us for information about the safeguards relevant to your data.

How long we keep data

We keep account and cloud training data while your account is active, unless you delete individual content or request account deletion. The confirmed operational retention schedule is:

While an account deletion is unfinished, we keep the information needed to finish it safely. Once deletion is complete, we remove that linked record and retain only a confirmation hash, without an account ID, installation ID or timestamp. This allows a device that missed our response to confirm deletion later. The confirmation is removed when the device acknowledges that it has erased its local data. A device may remain offline for a long time, so unacknowledged confirmations have no fixed expiry. The device keeps a protected recovery reference until it can acknowledge completion.

The app removes raw GPS records after the related Apple Health export finishes or is skipped. Saved route geometry can remain in your training history and private cloud sync. Discarding an unsaved route removes its local points. Local data remains on your device until you delete it in Athloapp, delete your account after server confirmation, or remove the app and its data. Copies written to Apple Health remain there until you remove them through Apple Health.

Children

Athloapp is not intended for children under 13. The app asks for your age the first time it opens and stores only whether the check was passed on that device, never the age itself. Until the check is passed, the app does not create an account, sync or send diagnostics. If we learn that a child under 13 has an account, we delete it. Parents and guardians can contact support@athlo.si.

Cookies and tracking

The Athloapp app uses no cookies, no advertising identifiers and no cross-app tracking. If a human-verification step is shown during sign-in, it opens a web page that runs Cloudflare Turnstile, which may set a strictly necessary security cookie. That page sets no analytics or advertising cookies, so no cookie consent prompt is shown.

Your choices and rights

You can change health, location, contacts and notification permissions in iOS Settings. You can change profile privacy, email discovery and diagnostics in Athloapp.

In Settings, Export device data creates a ZIP of the current local data for your account, containing JSON, CSV and available media files. The export includes saved encoded routes, retained raw route records and pause events, retained heart-rate samples for your workouts and cardio sessions, health connection metadata and media backup metadata. Only media available on the exporting device is included. The manifest records availability for media referenced by the export; it is not a complete cloud-media inventory. Device export does not fetch cloud data or query additional samples from Apple Health. It excludes other people's data, other people's feed items and raw route points already released from the device.

While signed in, Export account data also includes your cloud account records and requires a connection. Cloud records reflect the time each page is read, rather than one simultaneous snapshot. Cloud-only media is listed by metadata; its files are not downloaded into the archive.

Depending on the law that applies to you, you may ask for access, correction, deletion, restriction or portability of your personal data, object to some processing, or withdraw consent. Withdrawing consent does not affect processing that was lawful before withdrawal. Some rights have legal exceptions. You may also complain to your local data-protection authority. In Sweden, that authority is Integritetsskyddsmyndigheten (IMY).

Use the in-app controls where available or contact support@athlo.si. We may need to verify your identity before acting on a request.

Account deletion

You can start deletion in Athloapp under Settings. The app asks you to sign in again if your latest sign-in is more than ten minutes old. See the Account deletion page for the data removed, subscription steps and limits.

Changes to this notice

We may update this notice when Athloapp or the law changes. We will show the new date above and give any additional notice required by law when a change materially affects how we use personal data.