🏔

SelfPeak

LEGAL

Privacy Policy

Last updated: July 22, 2026

This Privacy Policy explains how the SelfPeak mobile application ("SelfPeak", "the App", "we", "our", or "us") collects, uses, stores, and protects your personal data, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Croatian Act on the Implementation of the GDPR.

1. Data Controller

The data controller responsible for your personal data is:

• Marko Batur
• Zagreb, Croatia
• Contact: selfpeak.app@gmail.com

2. Information We Collect

We collect the following categories of personal data:

• Account information — email address and password (stored only as a salted hash) when you create an account.
• Profile data — display name and profile photo you optionally provide.
• Fitness data — workout sessions, duration, exercise types, calorie estimates, goals, and training preferences you log in the App.
• Body metrics — optional height, weight, and related body measurements you enter to personalise your experience.
• Health data (special category) — your self-reported fitness level and any injuries or physical limitations you choose to enter so the AI can adapt your plan. This is special-category data under GDPR Article 9 and is processed only with your explicit consent (see Section 4).
• AI usage data — a count of AI workout/coaching generations, stored on our servers to enforce free-plan quotas and prevent abuse.
• Purchase data — subscription status handled by RevenueCat. We never see or store your payment card details.
• Diagnostic data — crash reports and technical diagnostics (device type, OS version, and IP address as processed by our crash-reporting provider). We have disabled screen recording / session replay so your app screens are never captured.

3. How We Use Your Information & Legal Bases

We process your data on the following GDPR Article 6 legal bases:

• Performance of a contract — to create and authenticate your account, sync your data across devices, display your statistics, and provide the core service.
• Explicit consent (Art. 6(1)(a) + Art. 9(2)(a)) — to send your fitness level and injuries to Google Gemini for AI personalisation, and to send workout-reminder notifications. You can withdraw either consent at any time.
• Legitimate interests — to keep the App secure, prevent abuse of AI quotas, and diagnose crashes. We balance these against your rights.
• Legal obligation — to comply with applicable law where required.

4. AI Personalisation & Health Data

SelfPeak generates workouts and coaching using the Google Gemini API. When you enable AI Personalisation, the data needed for a plan — which may include your fitness level and any injuries you entered — is sent to Google for processing. Because injuries are health data, we ask for your explicit consent before any AI request is made, and no AI call happens without it. You can withdraw consent at any time in the App under Profile → AI Personalization; withdrawing disables AI features while the rest of the App keeps working.

5. Data Storage and Security

Your account and synced data (workout history, plans, and profile) are stored on Supabase servers located in the European Union (Frankfurt, Germany). A copy is also kept locally on your device for offline use. Authentication tokens are stored in the device's hardware-backed secure storage (iOS Keychain / Android Keystore). All traffic is encrypted in transit over HTTPS.

We do not sell, trade, or rent your personal information to third parties.

6. Third-Party Services

SelfPeak relies on the following processors, each with its own privacy policy:

• Supabase — authentication, database, and data sync (supabase.com/privacy).
• Google Gemini API — AI workout and coaching generation (policies.google.com/privacy).
• RevenueCat — in-app subscription management (revenuecat.com/privacy).
• Sentry — crash reporting and diagnostics; processes device/OS information and IP address for error triage (sentry.io/privacy).
• Expo / EAS — app build, delivery, and push-notification infrastructure (expo.dev/privacy).

7. International Data Transfers

Some of our processors — including Google (Gemini), Sentry, and RevenueCat — may process data on servers located in the United States or other countries outside the European Economic Area. Where data is transferred outside the EEA, it is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses. By enabling AI Personalisation you also consent to your fitness level and injuries being processed by Google in the US for the purpose of generating your plan.

8. Notifications

If you enable workout reminders, we use Expo Notifications to send push notifications to your device. You can disable notifications at any time through your device's system settings or in the App under Profile → Reminders.

9. Children's Privacy

SelfPeak is not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Your Rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure ("right to be forgotten") — you can delete your account and all associated data directly in Profile → Delete Account.
• Restrict or object to certain processing.
• Data portability — request a copy of your data in a machine-readable format.
• Withdraw consent (for AI Personalisation or notifications) at any time, without affecting prior lawful processing.
• Lodge a complaint with your supervisory authority — in Croatia, the Personal Data Protection Agency (AZOP, azop.hr).

To exercise any of these rights, contact us at the email below.

11. Data Retention

We retain your account and synced data for as long as your account is active. When you delete your account, your server-side data (authentication record, synced state, and AI usage record) is deleted, and local data on your device is cleared. Crash diagnostics are retained only for as long as needed to investigate and fix issues.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the date at the top of this page. Your continued use of SelfPeak after changes are posted constitutes your acceptance of the updated policy.