Privacy Policy

The controller within the meaning of the GDPR is Timo Weber, Oneaxis Engineering (sole proprietor), Hauptstraße 233f, 28816 Stuhr, Germany, support@elvthypertrophy.com. This policy covers the ELVT – Hypertrophy by Design app for iOS and Android and the website elvthypertrophy.com.

ELVT needs no user account; only Circles, the optional community, uses a sign-in. Your workouts, plans, progress and profile are stored in a database on your device. We do not sell personal data. A few features talk to other services, and each of them is listed below: ads in the free version, subscriptions, the AI coach, optional backups, crash reports, feedback and the website.

Your training log, mesocycles, custom exercises, settings and profile (for example a name or nickname, your bodyweight, units and an optional avatar photo) are kept in the app’s local storage. We cannot see them. Progress photos and videos you take are kept there too. The app asks for camera or photo access only when you take a progress photo or set an avatar. Training and bodyweight data can relate to your health, which is why we do not receive it unless you choose to send it, for example inside an AI prompt. Deleting the app deletes this data.

Notifications: the app asks for permission to show notifications when you turn on rest timer alerts or a reminder, or when you sign in to Circles. Your device plans and shows rest timer alerts and reminders; nothing about them leaves it. If you use Circles, you also get push messages about what happens there: reactions, comments and replies to your posts and comments, new posts in your private Circles, and people who join a Circle or wait to be let in. For this, your device’s push token, its platform (Android or iOS) and the app language are stored with your Circles sign-in, and the messages are delivered through Firebase Cloud Messaging (Google) and, on iPhone, the Apple Push Notification service. A message names the Circle, the person and what happened, never what a post or comment says. You can turn Circles notifications off in the app’s settings or in your device settings; the push token is deleted when you sign out of Circles or delete your Circles account. Legal basis: Art. 6(1)(b) GDPR (the feature you use).

If you turn on backup, an encrypted copy of your data is stored in your own Google Drive or, on iOS, in Apple iCloud. Progress photos and videos, if you include them, are stored there as separate image and video files that ELVT does not encrypt, so your other devices can show them; like your other files there, they are protected by your Google or Apple account. Sign-in is handled by Google or Apple. We only receive the access needed to write and read the backup file, and the file stays in your account, not on our servers. Legal basis: Art. 6(1)(b) GDPR (the feature you request). You can revoke access in your Google or Apple account at any time.

When you use the AI Hypertrophy Coach, the AI assistant or the AI Microcycle Blueprint Builder, your message and the workout details needed to answer it (for example muscle groups, target volume, exercise selection and recent training figures) are sent over an encrypted connection to cloud AI services. This happens either directly (such as the Google Gemini API) or through our own AI gateway hosted on Google Cloud, which forwards the request to a generative AI provider: currently Zhipu AI (Z.ai) and Groq. The gateway verifies requests with Firebase App Check (a Google service that confirms the request comes from a genuine ELVT app) and processes them in memory. We do not store your prompts or the answers on our servers.

We do not send your real name, email address, passwords or payment details. Please do not type personal or health information into the chat. The providers process data under their own terms: Google AI Terms and Google Privacy Policy, Z.ai Terms of Use and Z.ai Privacy Policy, Groq Terms of Service and Groq Privacy Policy. Depending on those terms, inputs may be used to improve and train models, and the providers may be located outside the EU/EEA, including in the United States and China.

Legal basis: Art. 6(1)(b) GDPR (you ask for the answer). For transfers to countries without an adequate level of data protection, your explicit consent by sending the message (Art. 49(1)(a) GDPR). All core tracking works without these features.

Circles, the optional community, is only used if you sign in to it.

Your account. You sign in with Google or, on iPhone, with Apple. We do not store the email address or name of that account: your Circles account is a pseudonymous id derived from the sign-in with a one-way, keyed hash, so it does not tell us who you are. If you sign in with Apple, we keep a token from Apple so that we can revoke ELVT’s access to your Apple ID when you delete your Circles account. Others see the name you give your Circles profile. You can keep several Circles profiles on one phone; each is a separate account of this kind.

What is stored. Your Circles name, your age confirmation, the number of workouts you have logged (it unlocks sharing links), the Circles you are in or hide, the people you follow or block, your notification choices, when you last posted, commented or sent a message (to slow down spam), and what you share: posts, comments, reactions, messages, the records and workout figures you post, and links to posts on other platforms. Your profile shows only what you choose to share (by default only your name) and a public encryption key that lets others invite you and write to you.

Tags and favourites. When you tag someone with # in a post or comment, it keeps whom you tagged (their account id and name; in a private Circle the names are encrypted with it), so that they can be told. Only people close to you who can read it can be tagged. The conversations you mark as favourites are kept with your account.

Profile picture. Only if you add one: a small copy (128 × 128 pixels) of a photo you pick (from your gallery, your camera or your ELVT profile photo), made on your phone without location or camera data. Everyone signed in to Circles can see it next to your profile’s name, also when your profile is private. It is deleted when you remove it or delete your Circles account; our moderators can remove it if it breaks the community rules.

Circle pictures. A Circle’s owner and admins can give it a picture: a small copy (128 × 128 pixels) made on their phone without location or camera data. The members of a private Circle see it, and for a public Circle everyone signed in to Circles. It is deleted when they remove it or the Circle is deleted; our moderators can remove it if it breaks the community rules. Apart from profile and Circle pictures, ELVT keeps no photos or videos in Circles.

Encryption. Private Circles and messages are end-to-end encrypted on your devices: we store them only encrypted and cannot read them. Their key stays in your own account (iCloud Keychain on iPhone, otherwise a hidden app folder in your Google Drive) and never reaches our servers. Gym Floor and public Circles are not encrypted; everyone signed in to Circles can read them.

Translations. When you translate a post, a comment or a message, your phone does it with Google ML Kit’s on-device translation: the text never leaves your phone, also not in encrypted Circles. Each language (about 30 MB) is downloaded from Google once, when you agree.

Where. Circles data is stored in Google Cloud Firestore and processed by our functions on Google Cloud in the EU (Belgium); sign-in uses Firebase Authentication. Google processes this data on our behalf. So that only the genuine app reaches Circles, your device is checked with Google Play Integrity or Apple App Attest (Firebase App Check).

Reports. A report is stored with your account id and the reported content; for an encrypted post, your device reveals the reported content in a way that proves it is what was posted. Our moderators see reports and, to keep Circles clean, which Circles exist, with their name, whether they are public and how many members they have; never who is in a private Circle or what is written there.

Posts from other platforms. A link to YouTube, Instagram, TikTok or another platform is shown with that platform’s own player when you look at it. The platform then receives your IP address and may set cookies, as described in its privacy policy. ELVT stores only the link and removes it once the post is no longer available there.

Deleting. Circle account › Delete circle account in the app deletes your account, profile, memberships, reactions, invitations, follows, linked sign-ins, devices, keys and the Apple token. Your posts and comments become placeholders without content or name, so the replies of others keep their place.

Legal basis: Art. 6(1)(b) GDPR (the community you choose to use); for moderation, spam protection and the app check, Art. 6(1)(f) GDPR (our interest in a safe, genuine service).

ELVT Free shows ads from Google AdMob. To serve and measure ads and prevent fraud, Google may process your device’s advertising identifier, your IP address, and information about how you interact with ads. In the EEA, the UK and other regions where it is required, a Google-certified consent form asks for your choice before personalised ads can be served. On iPhone, the advertising identifier is only used if you allow tracking in Apple’s prompt. You can review or change your choice in the app’s Settings and in your device settings. ELVT Pro shows no ads. Legal basis: consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Purchases are processed by Apple or Google, and we never see your payment details. To unlock Pro features we use RevenueCat, Inc. (USA). It receives your purchase receipt and an anonymous app user ID created by the app, and tells the app whether your subscription is active. Legal basis: Art. 6(1)(b) GDPR. Where data leaves the EU/EEA, we rely on adequacy decisions or standard contractual clauses as far as the providers offer them.

If the app crashes or hangs, it sends a report to Sentry (Functional Software, Inc.), hosted in the EU. A report contains technical details such as the app version, device model, operating system version and a trace of what the app was doing. We do not attach your name or email address. Legal basis: our legitimate interest in a stable app, Art. 6(1)(f) GDPR.

If you send feedback from the app, we receive your message, a screenshot of the screen you were on, the app version and the name and version of your operating system. We store it as an issue and an image with GitHub (GitHub, Inc., USA) so we can fix problems. A screenshot can show your training data, so hide anything you do not want to share before you send it. Legal basis: your submission, Art. 6(1)(a) GDPR.

The Knowledge tab loads articles from elvthypertrophy.com. Like any request to the website, this reaches our web server (see the next section). The request does not contain your training data.

When you visit elvthypertrophy.com, our web server and our hosting provider, acting on our behalf, process your IP address, the date and time, the requested page, your browser and the referring page in server logs. This is needed to deliver the site and keep it secure (Art. 6(1)(f) GDPR), and the logs are kept only as long as that requires.

The site sets no cookies and uses no analytics, tracking or advertising services. Fonts and images are served from our own server. The only thing stored in your browser is the language you pick (local storage entry preferred_lang), which is needed to remember that choice and is not sent to us. Links to the app stores and to our Instagram, YouTube and TikTok profiles are plain links: nothing is passed on until you click one. The one exception is a Circle invite link (elvthypertrophy.com/join/…): on an Android phone without ELVT, that page opens Google Play by itself and passes the invite code along in the store link. On other devices nothing happens until you tap a button.

We publish our own videos on our YouTube channel with an internal tool that uses YouTube API Services. The tool signs in only to our own channel. It does not access, collect, store or share any data about you or other YouTube users; it keeps only the IDs of our own videos, so there is no personal data to delete. When you watch our videos on YouTube, Google processes your data under the Google Privacy Policy, and YouTube is subject to the YouTube Terms of Service. Access granted to the tool can be revoked at any time on the Google security settings page.

If you write to us through the contact form or by email, we process your name, email address, message and, for form submissions, the IP address and time to answer you (Art. 6(1)(b) and (f) GDPR). The form reaches us by email through our mail server. We delete the correspondence once your request is resolved, unless a legal retention duty applies.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR), and you can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Because ELVT has no accounts, we usually cannot identify you: to exercise your rights about purchase records or crash reports, email us the ELVT user ID shown in Settings. You can lodge a complaint with a data protection authority, for example ours: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany (lfd.niedersachsen.de).

ELVT is not designed for children under 16, and we do not knowingly collect their data. If you believe a child has sent us personal data, contact us and we will delete it.

We update this policy when features or services change. The date below shows the latest version.