Privacy Policy

1. Data Controller

Your personal data is controlled by:

Jakub Zakrzewski Consulting
Sole Proprietorship (JDG)
Tax ID (NIP): 5213997741
Address: al. Jana Pawla II 27, 00-867 Warszawa
Email: privacy@pullyapp.com

(hereinafter: "we", "us", "Pully")

2. What Data We Collect

2.1 Account Data (legal basis: performance of contract, Art. 6.1.b GDPR; consent records: legal obligation, Art. 6.1.c GDPR)

2.2 Training Data (legal basis: performance of contract, Art. 6.1.b GDPR)

• Workouts: date, duration, status, notes
• Sets: weight (kg), reps, RIR, set type
• Training plans: name, structure, exercises, goals
• Workout templates: name, exercises, usage count
• Personal records (PRs): record type, value, date achieved
• Custom exercises: name, muscle group, description (created by you)

When you delete a workout, plan, template, exercise or measurement in the app, a record of it marked as deleted stays on the server so that the deletion reaches your other devices. That record, together with its content, stays on the server until you delete your account (measurements: until you withdraw consent or delete your account).

2.3 Body Measurements (legal basis: explicit consent, Art. 6.1.a in conjunction with Art. 9.2.a GDPR)

Body measurements are health-related data under Art. 9 GDPR. We collect them only with your explicit consent:

• Body weight, body fat percentage
• Circumferences: neck, chest, biceps (L/R), waist, hips, thigh (L/R), calf (L/R)

You can withdraw consent at any time in Settings > Privacy. Withdrawal results in deletion of all measurements from our servers.

2.4 Apple Health Data (legal basis: explicit consent, Art. 6.1.a in conjunction with Art. 9.2.a GDPR)

If you enable Apple Health integration:

• We write: strength training workouts (date, duration) to the Health app on your phone
• We do NOT read any data from Apple Health
• Pully does not send Apple Health data to our servers
• Apple may sync data from the Health app (e.g. through iCloud) according to your Apple settings and Apple's terms
• You control permissions in iOS Settings > Health > Pully

2.5 Analytics (legal basis: consent, Art. 6.1.a GDPR)

With your consent, we collect pseudonymised usage data via PostHog (EU cloud). The kinds of events are described below. Their properties are numbers, values from closed lists, yes/no, and our own identifiers (e.g. of a product, an announcement, a ready-made plan).

• Account and sign-in: account created, sign-in and sign-out (method: Apple, email, anonymous account), session restored and expired, sign-in revoked by Apple, time taken to create the account, terms accepted again.
• Onboarding: steps viewed and skipped, the answers chosen (goal, experience level, workouts per week, units, number of muscle groups picked), the path chosen (I have a plan, build a plan, single workout), returning to an interrupted onboarding, the onboarding variant.
• Purchases and subscription: the purchase screen shown and closed (and where it was opened from), a purchase started, completed and failed, the product chosen, free trial, purchases restored, renewal and expiry, cancellation (with a reason from a list), a pause offered and accepted, the choice of active plan and the banner after losing Premium.
• Workouts: started (from where), paused and resumed, minimised, finished, abandoned and recovered, taken over on another device, duration in minutes, the number of sets and exercises, the set type, whether RIR was used, an exercise added, removed, swapped, reordered or borrowed, a variant changed, supersets and drop sets, automatic advance to the next exercise, the number of new records (not their values), use of the quick weight-change button (the step size only, e.g. 2.5 kg), the direction of the volume change against the previous workout (more, less, the same), workout preview and summary, saving as a plan or template.
• Rest timer and Live Activity: a rest started, changed and skipped, its length, use of the lock-screen buttons.
• Plans and templates: created, edited (which part changed, e.g. the name or the exercises, not the new content), a day added (how) and removed, empty days, duplicated, archived, deleted, activated, the number of days and exercises, the split type (e.g. PPL), where the plan came from, the plan's age in weeks, plan creation handed over to the Assistant, and for a ready-made plan or template from the Pully library: which one it was.
• Exercises: an exercise description opened (muscle group, whether it is a custom exercise), a search (the number of results only), a muscle-group filter, a custom exercise created and deleted (muscle group, number of modifiers), suggested alternatives, an animation opened.
• History: history and a workout opened (its age in days), a workout repeated, deleted and shared, the calendar, the history limit.
• Home screen, stats and measurements: taps on Home and profile cards, which charts, reports and cards you open, the period and zoom chosen, a tap on a Premium feature, a record share card opened, a body measurement added and deleted (the number of fields filled in only, no values).
• AI Assistant: the information screen shown and accepted, a message sent (no content), the kind of reply, error codes, the daily limit reached, a reply reported (a reason from a list), whether the Assistant recognised the exercise or plan you asked about (the outcome only, no name).
• Feedback and app rating: the App Store rating request shown, the feedback request shown and closed, feedback sent (the 1-5 rating only, no text).
• In-app announcements: which announcement and slide were viewed, the button used.
• Settings: units, training profile (which field) and plate set (their number) changed, Apple Health turned on, privacy settings changed and consent withdrawn, export (format, range, number of rows), account deleted.
• Sync: started, duration, number of items, queue size, error codes and the names of our tables (no content).
• Notifications: permission requested and the answer, a notification sent and tapped.
• App launches: launch (whether it is the first, days since the last one), moving to the background and back, session length.
• Events added automatically by the PostHog library: install, update (with the previous version), app opened and moved to the background. The library also fetches feature-flag settings from the PostHog server. When the app checks a feature flag, PostHog records an event about it ($feature_flag_called).
• Technical data with every event: device model, operating system and its version, app version and build number, language, time zone, screen size, connection type (Wi-Fi or cellular), session identifier, whether it is a test build, library version.

We do not collect anything you type yourself, nor the names of exercises, plans or templates (apart from which ready-made plan or template from the Pully library you picked). We do not collect the weights you lift, reps or measurement values. We do not record the screen, and we do not automatically log the screens you visit or taps on elements of the app.

In versions 3.0.x the PostHog library also sent an event for a series of quick taps in one place ($rageclick), with a description of the tapped element, including its label. It is turned off from version 3.1.0. We have asked PostHog to delete all such events.

We do not store your IP address: PostHog discards it after receiving the event. Onboarding events from before you answer the consent question are kept only in your phone's memory. We send them if you agree and delete them if you refuse.

About the identifier, precisely. Analytics receives a random install identifier generated by the analytics library on first launch and stored on the device. It is not a number issued by the operating system, and not a value we hash ourselves; it is not tied to your account. Our analytics providers never receive your name, your email address or your account identifier, and we never join these events to your identity in our own database. We call this data pseudonymised rather than anonymous: the identifier is stable for a given install, so it can tell devices apart, which under the GDPR is not anonymisation.

You can disable analytics in Settings > Privacy.

2.6 Crash Reporting (legal basis: consent, Art. 6.1.a GDPR)

With your consent, we send Sentry reports that help us find and fix errors. As we have configured it, these are:

• Crash reports (stack traces) and reports of the app being terminated by the system (e.g. for lack of memory)
• App-hang reports and reports of errors raised by the app
• Breadcrumbs of what the app did before the error: app state changes (e.g. going to the background and back), system events (e.g. low memory, battery level, screen rotation, a time zone change), network connection changes and our diagnostic markers (counts and timings). From version 3.1 we do not record moves between screens, taps or network requests, so no plan, plan day, template or exercise names and no text you type reach a report. Versions 3.0 and earlier also record moves between screens with their titles (which can contain the name of a plan, plan day, template or exercise) and taps on buttons with their label, until you update the app
• A 10% sample of performance measurements (launch time, screen loading, file and database operations)
• Diagnostic information about the device and the app (model, operating system, memory, language, time zone, app version)

We never send Sentry your name, email address or account identifier - email and display name are stripped before sending. Reports carry a pseudonymous install identifier issued by Sentry. Storing of IP addresses is disabled on Sentry's side.

You can disable crash reporting in Settings > Privacy.

2.7 Subscription Data (legal basis: performance of contract, Art. 6.1.b GDPR; legitimate interest, Art. 6.1.f GDPR for revenue analytics)

• Payment is handled by Apple in the App Store (StoreKit 2) as an independent controller. We do NOT receive your payment card details
• From the App Store we receive: product identifier, subscription status, expiration dates and transaction data
• RevenueCat (our processor) stores the app user identifier (your Pully account identifier, including the anonymous account in section 2.9), the device identifier Apple assigns for our apps, and your purchase and transaction history - to operate and synchronise subscriptions and for revenue analytics. This is not anonymous data: the identifier links purchases to your account
• Deleting your Pully account, or the automatic deletion of an anonymous account, does not delete the data held by RevenueCat. You can ask for it to be deleted: privacy@pullyapp.com. Your App Store purchase history stays with Apple under Apple's terms

2.8 AI Assistant Data (legal basis: performance of contract, Art. 6.1.b GDPR)

The AI Assistant ("Asystent", premium) processes your training data to answer your questions in context. When you send a message, we transmit the following to our AI sub-processor:

• Sent: a summary of your training (workout counts, weekly frequency, volume in kg, per-exercise performance including percent change and trend, exercise names, last-workout dates, a weekly activity breakdown, muscle-group distribution), your active plan name and structure (plan/day names, exercises, target sets/reps), your profile preferences (goal, experience level, units), and the message you type. Values of individual sets (weights/reps) are referenced by internal identifiers only - never sent as text.
• Never sent from data in the app: email, name, Apple/device identifiers, body measurements, Apple Health data, payment data, or workout notes. Buddy does not take your body weight or measurements from the app. If you type them into a message yourself, they reach the model provider (Google Gemini) and the conversation history, like the rest of the message. Messages that our filters recognise as being about pain, injury or another health problem are refused before they reach the model, and we do not store them.

Your data is processed by Google Cloud Poland Sp. z o.o. (Gemini API services) as our sub-processor (Art. 28 GDPR); processing may also be carried out by other Google group entities and their sub-processors outside the EEA, under the Data Processing Addendum and Standard Contractual Clauses. Google does not use your prompts or responses to improve its products (we use the paid Gemini API). Google may log prompts and responses for a limited period, solely to detect and prevent violations of its safety policies and to meet legal obligations. This data may be stored transiently in any country where Google or its agents maintain facilities.

When you report a response from the Assistant (the report-response feature), we store: a copy of the reported response (as the app sent it) with its origin marker (AI-generated, written by the app, or unknown), the reason you chose from a list, the message and account identifiers, and the date. We do not copy the conversation context; when reviewing, we may compare the copy with the message stored in the conversation history. Purpose: moderation and improving the quality of the Assistant (Art. 6.1.f GDPR - our legitimate interest in service safety and quality). Access is limited to authorised persons. We keep the copy of the response until the report has been reviewed and for 30 days after that, then delete it. The report entry itself, without the content (reason, date, identifiers), stays until you delete your account.

To enforce the daily and monthly limits and to account for costs, we keep a register of requests to the Assistant. For each request we record: the date, the model, the number of tokens, the cost, the status, and the account, conversation and request identifiers. This register holds no message content. We delete its entries after 35 days, and earlier together with the account. Legal basis: performance of contract (Art. 6.1.b GDPR), and for cost control our legitimate interest (Art. 6.1.f GDPR). Before the entries are deleted, we add them up into monthly totals (month, model, number of requests, tokens, cost) without an account identifier. With a small number of users such totals could be linked to a particular person, so we treat them as personal data. We keep them for 24 months for cost accounting (our legitimate interest, Art. 6.1.f GDPR).

Buddy is not designed to process information about your health.

The AI Assistant is part of your Premium subscription. It is informational only and is not a medical or mental-health tool. You can stop using it at any time. The conversation history stays on the server until you delete your account: the app does not currently let you delete a single conversation. Deleting your account erases the conversation history, reports and the request register from our systems. What remains is only the safety logs kept by our AI sub-processor, for its own limited period, and the monthly cost totals without an account identifier (24 months).

2.9 Account Created by "Let's go" (legal basis: steps taken at your request before entering into a contract, Art. 6.1.b GDPR)

When you tap "Let's go" on the welcome screen, the app creates an anonymous account on our server (Supabase). It lets onboarding save your progress before you create your real account, and it makes the purchase screens in onboarding work.

• What is on the server: a random account identifier, a flag that the account is anonymous, the dates of creation and last sign-in, and sign-in session data (as in section 2.1). There is no email address, name or Apple identifier.
• What stays on your phone: your onboarding answers (goal, experience, workouts per week, chosen muscle groups, units) and any draft plan. They reach the server only after you create an account.
• RevenueCat: we pass the same identifier to RevenueCat so that the purchase screens work. The automatic deletion of an anonymous account does not remove it from RevenueCat (section 2.7).
• Creating an account: when you create an account (Apple or email), the same account becomes a regular account with the same identifier, and your progress is kept. If you instead sign in to an account you already have, we discard the onboarding progress on your phone.
• Deletion: an anonymous account that did not become a regular account is deleted automatically 90 days after it was created. There is no button in the app that deletes it sooner. You can create an account and delete it right away in Settings > Account > Delete Account. Deleting the app erases the data on your phone at once.

2.10 In-App Feedback (legal basis: legitimate interest, Art. 6.1.f GDPR)

After some workouts the app asks for your feedback. If you send it, we store on our server (Supabase):

• a rating from 1 to 5 and a text of up to 2000 characters (both optional, one of them is enough),
• the app version and the number of completed workouts after which the request appeared,
• your account identifier and the date it was sent.

Purpose: to reply to your feedback and to improve the app. Our legitimate interest is knowing what works in the app and what needs fixing. Only the controller reads feedback. We keep it as long as it is needed for a reply or a fix, and no longer than 24 months from sending. Deleting your account deletes your feedback too. If you want us to delete your feedback sooner, write to privacy@pullyapp.com.

Do not include information about your health in your feedback.

3. Where We Store Data

Pully is offline-first - your data is always available on your device, even without internet. Sync is a background process.

4. Who We Share Data With

We do not sell your data. Ever.

4.1 Processors (acting on our instructions, Art. 28 GDPR)

4.2 Independent controllers

4.3 Transfers outside the EEA

Supabase, PostHog, Sentry, RevenueCat and Google are companies outside the EEA or groups that include companies outside the EEA. When data leaves the EEA (storage at RevenueCat, processing within the Google group, service access by the other providers), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, included in the data processing agreements. Sentry is also certified under the EU-US Data Privacy Framework. You can request a copy of these safeguards: privacy@pullyapp.com.

5. How Long We Keep Data

6. Your Rights (GDPR Art. 15-22)

You have the following rights:

6.1 Right of Access (Art. 15)

In Settings > Export you can download, in JSON or CSV format, the data stored on your phone: workouts with exercises and sets, body measurements, plans and templates (in JSON together with their days and exercises), custom exercises, personal records and AI Assistant conversations. The export does not include account and profile data, consent and terms acceptance records, in-app feedback, the AI request register, reports of responses or subscription data. We will send you a full copy of all your data, including these, on request by email: privacy@pullyapp.com.

6.2 Right to Rectification (Art. 16)

You can edit your data directly in the app (workouts, plans, measurements, profile).

6.3 Right to Erasure (Art. 17)

You can delete your account and the data linked to it in Settings > Account > Delete Account. Deletion is:

• Immediate on your device (all local data)
• Immediate on the server: we erase every table linked to the account, including records deleted earlier in the app, the conversation history, reports, feedback and the AI request register
• Irreversible - we recommend exporting your data first

Account deletion does not cover: backups (gone within 30 days), data held by RevenueCat (we delete it at your request, section 2.7), the monthly AI cost totals without an account identifier (24 months), and analytics data and crash reports, which are not linked to your account and expire after the periods in section 5.

If you sign in to Pully only with Apple and ask Apple to delete your Apple Account, Apple notifies us. We then end, at once, every session you were signed in with up to that moment on any device (the app asks you to sign in again when the current sign-in expires, usually within an hour) and, after 30 days, delete your Pully account together with its data - unless you sign in again during that time (or shortly before the request), which cancels the deletion.

6.4 Right to Data Portability (Art. 20)

Export in JSON and CSV formats is always free (including free-tier users). Settings > Export. The scope of the export is described in section 6.1.

6.5 Right to Restriction of Processing (Art. 18)

Contact us at: privacy@pullyapp.com

6.6 Right to Object (Art. 21)

On the basis of our legitimate interest (Art. 6.1.f GDPR) we process:

• in-app feedback (section 2.10),
• subscription data for revenue analytics (section 2.7),
• the AI request register as far as cost control is concerned, and the monthly cost totals (section 2.8),
• reports of Assistant responses for moderation (section 2.8).

You can object at any time on grounds relating to your particular situation: write to privacy@pullyapp.com and say which processing you object to. We will stop processing that data for that purpose unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims. If you object to us keeping your in-app feedback, we will simply delete it.

Analytics and crash reporting are based on consent, not on legitimate interest. You turn them off by withdrawing consent (section 6.7).

6.7 Right to Withdraw Consent (Art. 7.3)

You can withdraw consent for:

• Body measurements - Settings > Privacy (data will be deleted)
• Analytics - Settings > Privacy
• Crash reporting - Settings > Privacy
• Apple Health - iOS Settings > Health > Pully

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6.8 Right to Lodge a Complaint (Art. 77)

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. In Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, www.uodo.gov.pl

7. Data Security

We implement the following technical and organizational measures:

• Row Level Security (RLS) - each user can only access their own data on the server
• Encryption in transit - TLS 1.2+ for all network communication
• Encryption at rest - AES-256 on the server, device encryption on iOS
• Keychain - sensitive identifiers stored in iOS Keychain
• Deleting in the app - a record deleted on your phone is marked as deleted on the server so that the deletion reaches your other devices; that record stays until account deletion (section 5)
• Data minimization - we collect the data the app needs to work, and analytics and crash reports only with your consent
• No cross-app tracking - we do not use IDFA or device fingerprinting

8. Notifications

All notifications are local (UNUserNotificationCenter). We do not send server-side push notifications.

Notification types:

• Rest timer completed
• Unfinished workout reminder
• Body measurement reminder
• Personal record celebration (premium)
• Monthly training summary (premium)
• Subscription reminders (trial expiry, grace period)

You can manage notifications in Settings > Notifications.

9. Cookies and Tracking

Pully does not use cookies. The app contains no web browser or web components. We do not use:

• Tracking pixels
• IDFA
• Device fingerprinting
• Cross-app tracking

10. Children

Pully is not intended for persons under 18 years of age. This threshold follows from the terms of the language-model provider used by the AI Assistant (Buddy) and is higher than the consent threshold in Art. 8 GDPR. We do not knowingly collect data from persons under 18 and we do not collect dates of birth. If you learn that a person under 18 is using the app, please contact us - we will promptly delete their data.

11. Changes to This Privacy Policy

We will tell you about material changes in the app. Previous versions of this policy are available upon request.

12. Contact

For data protection inquiries:

• Email: privacy@pullyapp.com
• Response time: within 30 days (per Art. 12.3 GDPR)

13. Automated Decision-Making

Pully does not employ automated decision-making or profiling within the meaning of Art. 22 GDPR. Calculations displayed in the app (estimated 1RM, personal records, session comparisons) are mathematical computations for display purposes only - they do not make decisions affecting your rights.

The AI Assistant generates informational, advisory observations and answers using a language model. This is not automated decision-making under Art. 22 GDPR - its outputs do not produce legal effects or similarly significantly affect you, and no decisions about your account, subscription, or feature access are made based on them.

14. What We Do NOT Collect

For clarity - Pully never collects:

• Location / GPS data
• Phone contacts
• Photos or media
• Biometric data (Face ID/Touch ID is used for device unlock, we do not collect this data)
• Browsing history
• Audio/video recordings
• Data from other apps