Privacy Policy

In short

• We store your account and training data on secure servers (Supabase, EU region) — it does not remain solely on your device.
• We collect your email address and the data you enter yourself. We do not sell your data and do not share it for advertising purposes.
• We do not use advertising cookies, tracking pixels, or external analytics. When something breaks, a technical error report (with your account identifier, but not your email, name or IP address) goes to our error-tracking service, Sentry, so we can fix it.
• We do not collect health data within the meaning of Article 9 GDPR.

1. Who is the data controller

The controller of personal data processed in the Kinect application is Jakub Borkowski, operating the application as unregistered business activity (Polish: działalność nierejestrowana), Plac Wilsona 4/24, 01-626 Warsaw, Poland. For data-protection matters, write to us at contact@getkinect.app.

2. What data we process and why

For the application to work, we process the following data:

• Account data — email address and password (stored only as an encrypted hash), or the Google or Apple account identifier when you sign in with Google or Apple; in order to create and operate your account and to log you in. If you use Sign in with Apple and choose to hide your email address, Apple gives us a private relay address instead of your real one.
• Profile data — nickname, profile picture, profile visibility settings, and the gender and height you enter; in order to personalize your account, present your profile within communities (nickname and picture only) and calculate your metrics.
• Training and body data — logged workouts, exercises and sets (weight, reps), training goals, and voluntarily entered body measurements (including body weight, dimensions); in order to track progress and calculate metrics (including Power Score, Body Readiness).
• Community data — community membership and the tribe invite codes you create or use; in order to operate the Tribe feature.
• Invitations — the personal invite code assigned to your account and, if you joined through a friend's link or code, which account invited you; in order to show each user how many friends joined through their link. No reward is tied to this. On iOS, the first time the app opens before you sign in, it checks the clipboard once for a copied Kinect invite link, so an invite you copied carries over; nothing else on the clipboard is read or stored.
• App usage — when you open and use the app, for how long, on which platform (iOS or web) and in which app version; in order to understand how Kinect is used and to improve it, based on our legitimate interest (Article 6(1)(f) GDPR). We record this ourselves — no analytics company receives it — and nothing is stored on your device for this purpose. It is deleted together with your account.
• Survey answers — if you answer the in-app question about how likely you are to recommend Kinect (asked at most three times: about a week, a month and three months after you sign up), your score from 0 to 10, your optional comment, when you answered, and the platform and app version; in order to understand what users think of Kinect and to improve it, based on our legitimate interest (Article 6(1)(f) GDPR). Answering is voluntary. When you delete your account, the comment and the link to you are deleted; the score stays only as an anonymous statistic.
• Push notifications (iPhone app) — if you allow notifications, your device's push token (an identifier Apple gives the app for your phone), the app version, which notifications you have switched on, and a log of the notifications we sent you (type, when, delivered or not), kept for 30 days; in order to send the notifications you have allowed (a new tribe member, someone passing you in a tribe, your weekly recap, training reminders) and to keep them within their limits. You can switch each type off in the app's settings, or all of them in your iPhone's settings. Signing out removes the token from that phone; deleting your account removes all of it.
• Kinect Pro — if you buy Kinect Pro in the iPhone app, Apple handles the payment. From Apple we receive which subscription you have (monthly or yearly), its status (free trial, active, billing problem, expired, refunded), its dates (start, renewal or end), whether it renews automatically, Apple's transaction identifiers and whether it was a test purchase; the purchase is linked to your Kinect account through your account identifier, which the app attaches to it. We never receive your card or payment details or your Apple ID. If Kinect Pro is granted to you free of charge, we record from when, until when and why. We also count how many of the 3 free AI sessions you have used. In order to unlock Kinect Pro on every device you use and to keep it in step with your subscription, based on the performance of the contract (Article 6(1)(b) GDPR). It is deleted together with your account (the subscription itself stays with Apple until you cancel it).
• Consent records — your acceptance of the Terms and Privacy Policy (which versions, when) and your marketing choice, together with the IP address and browser details (user agent) of the device you signed up from; as proof of consent, based on our legal obligation and legitimate interest (Article 6(1)(c) and (f) GDPR). The IP address and browser details are kept for as long as you have an account and erased when you delete it; only a pseudonymous record of which versions you accepted and when is kept after that.
• Technical data and reports — your email preferences, your time zone, a record of the emails we sent you (delivery status), a daily count of your AI feature uses (to enforce the daily limit; kept for 30 days), and reports submitted via the contact form; in order to send only the emails you have agreed to, at a sensible local time, keep AI use within limits, handle reports, and improve the application.
• Error reports — when the application or our servers run into an error, or the iPhone app crashes or freezes, a technical report: what went wrong and where in the code, the device model, operating system and browser, the app version, and your account identifier — not your email address, name or IP address; in order to find and fix bugs and keep the service working, based on our legitimate interest (Article 6(1)(f) GDPR). The reports are kept by Sentry for up to 90 days and then deleted automatically.

We do not collect: PESEL number (Polish national identification number), location data, or health data within the meaning of Article 9 GDPR. Please do not enter health information or medical diagnoses into the application — the body-related fields serve training purposes only.

3. Artificial-intelligence features

In order to generate next-session suggestions and weekly recaps, your training data is processed using AI services provided by Anthropic (Claude models). The weekly recap also includes your gender and body weight, so that its advice fits you. Data is transferred only to the extent necessary to generate a given feature. The AI features do not make decisions concerning you that produce legal effects or similarly significant effects.

4. Legal basis (GDPR)

• Article 6(1)(b) GDPR — processing necessary for the performance of the service contract (operating your account, logging workouts and community features).
• Article 6(1)(a) GDPR — your consent, e.g. to receive product updates by email or to use optional features.
• Article 6(1)(f) GDPR — the controller's legitimate interest: ensuring the security of the application, preventing abuse, finding and fixing errors (error reports), handling reports, and developing the application.
• Article 6(1)(c) GDPR — compliance with legal obligations of the controller, e.g. handling complaints.

5. Where we store data and for how long

Data is stored in a Supabase database (PostgreSQL, TLS-encrypted connection) in the European Union region (Frankfurt, Germany). We make automatic backups, stored in secure storage; we keep a limited number of the most recent backups, with older ones overwritten.

We store data for as long as you have an account, except for the daily count of AI feature uses, which is kept for 30 days. After an account is deleted, the data is removed — except for a pseudonymous record of your consent (which Terms and Privacy versions you accepted and your marketing choice, linked to a keyed hash of your email address instead of your identity, without IP address or browser details) and that same hash on a do-not-contact list, so that we can prove consent and never send marketing to that address again; except for survey scores, kept only as anonymous statistics without your comment or any link to you; and except for data we are required to retain for accounting purposes or to defend against claims, for the period resulting from applicable law. Data contained in backups is removed as part of the backup rotation cycle.

6. Who we entrust data to

To provide the service, we use trusted processors that process data on our behalf:

• Supabase — database hosting, authentication, file and backup storage;
• Vercel — hosting of the website and the web application;
• Anthropic — processing of training data (and, for the weekly recap, gender and body weight) for artificial-intelligence features;
• Resend — sending emails (account emails such as sign-up confirmation and password reset, and the emails you have agreed to receive);
• Apple — delivering push notifications to your iPhone (Apple Push Notification service); Apple receives the device token and the text of the notification. For Kinect Pro, Apple sells and bills the subscription in the App Store under its own terms and privacy policy, and tells our server the subscription's status.
• Sentry (Functional Software, Inc.) — collecting technical error reports from the applications and our servers, so that we can find and fix bugs; the data is stored in the European Union (Frankfurt, Germany).

We do not sell personal data and do not transfer it for marketing purposes.

7. Transfers outside the EEA

Data is stored in the European Union region. If any processor processes data outside the European Economic Area, this takes place on the basis of appropriate safeguards, in particular standard contractual clauses approved by the European Commission.

8. Cookies and analytics

The application uses only the essential technical mechanisms it needs to work. In the web application, the browser's local storage keeps: your login session; your theme (light or dark); sign-in hints — your marketing choice and the sign-in method you picked, until sign-up or sign-in completes; an invite code you opened before signing in, until it is used; an unsaved workout draft, so a session in progress isn't lost if the page closes; whether you dismissed the “add to home screen” hint; and a technical marker used when the application updates itself. This data stays on your device, is not used to track you, and you can remove it by clearing your browser's site data. We do not use advertising cookies, tracking pixels, Google Analytics, or any other external analytics tools — which is why we do not display a cookie consent banner. When an error occurs, the application sends a technical error report to Sentry (see sections 2 and 6). This is error reporting, not analytics: it stores nothing on your device, sets no cookies, and does not record your screen or how you use the application.

9. Your rights (GDPR)

You have the right to:

• access your data,
• rectify, erase, or restrict the processing of your data,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time (without affecting the lawfulness of processing carried out before withdrawal).

You can review and edit most of your data yourself in the application, and delete it by deleting your account. For other matters, write to contact@getkinect.app. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

10. Data security

We store passwords only as an encrypted hash. Access to data is protected by database-level security mechanisms (Row Level Security), under which a user has access only to their own data and data shared within communities they belong to. The connection to the application is encrypted with the TLS protocol.

11. Visibility of data within communities

If you join a community (Tribe), your nickname, profile picture, and selected achievements and statistics may be visible to other members of that community. You can limit the scope of this visibility in your profile settings.

12. Children

The application is intended for persons aged 16 and over. We do not direct the application at children below that age and do not knowingly collect their data.

13. Changes to this policy

We will inform you of material changes to this policy in the application or by email. The date of the last update is always shown at the top of this page.

Questions? contact@getkinect.app

Kinect · last updated 6 October 2026