Bodyper Privacy Policy

Version: 1.2.0 Language: English (en) Effective at: 2026-10-14T18:30:00Z Status: Approved

Summary

• Watches. With the Apple Watch or Wear OS companion, you can record workouts on your watch and sync them through your phone or directly to your account. During a workout the watch can measure your heart rate and energy; Wear OS calories include energy used at rest. Your phone's workout screen can show your live heart rate: that reading travels only between your watch and phone, is kept only in the phone's memory and is never sent to Bodyper's servers. Watch features use no GPS or routes and send no raw sensor readings to Bodyper's cloud. Device permissions and cloud choices are separate.

• Saving workouts to Apple Health or Health Connect is optional and off until you turn it on. Your phone then saves each finished workout once, including workouts finished on your watch, with heart rate and active calories only when your watch measured them. Bodyper never estimates them.

• Progress photos. Photos start on your device. Backup is optional, off by default and needs a separate explicit choice. Turning it off erases cloud copies, not your device photos.

• Who we are. Perplatform Oy in Turku, Finland, is the controller of your personal data in Bodyper. Contact: support@bodyper.com.

• Without an account, your workouts and measurements stay on your device. We do not receive them.

• With an account, we store your workouts, body measurements, goals, progress and reports in our cloud service only with your separate, explicit consent, because this data can reveal information about your health. You can withdraw it at any time in Privacy choices; we then erase the cloud copies.

• No selling or ads. We do not sell personal data, show ads or send marketing. Our app and websites do not use advertising or analytics trackers. Apple Health and Health Connect are optional connections; Watch sensor use and saving have separate choices. These features do not use GPS or your location.

• Where your data is. Bodyper's cloud storage for your training and measurement data is configured in the EU, in Ireland. Some of our service providers are in the United States; section 9 explains the safeguards.

• Error reports. The app can send error and crash reports that do not contain your name, email address or training data. You can turn them off.

• Your control. You can export your data and delete your account in the app, free of charge. Deleting your account does not cancel an app-store subscription.

• Your rights. You can access, correct, delete and move your data, object to some processing and complain to the Finnish Data Protection Ombudsman (section 10).

What changed in version 1.2.0

• Wear OS companion: workout recording with heart-rate and energy measurement on the watch, direct sync to your account with a revocable watch session, and the paired phone as a fallback route.

• Progress photos and separate optional cloud backup, optional titles, editable dates, check-in and individual-reading links, local gallery statistics, comparison images and sharing.

• Optional Apple Health and Health Connect measurement connections, source information and separate platform copies.

• Apple Watch workout synchronization, device linking and watch heart-rate and active-energy readings.

• Live heart rate from your watch on your phone's workout screen, kept only in the phone's memory and never sent to Bodyper's servers.

• Saving workouts to Apple Health and Health Connect by the phone, once per workout, with exercises, sets, repetitions and load, and heart rate and active calories only when a watch measured them.

• A read-only offline goal copy, records start date, saved workout versions and recovery notices.

• Export and erasure distinguish cloud data, local copies, platform copies and files you share.

• Home-screen widgets, controls and shortcuts, including possible display on your Mac.

• Authorized Admin access and marketing commission records, their recipients, account-link removal and ten-year retention.

• Updates to account choices, billing, notifications, error reporting and privacy operations.

• Measurement guide sheets downloaded on demand and cached on your device.

• Exercise-catalogue video and picture storage in Cloudflare R2 in the EU.

Photo backup is a separate choice, not granted by reviewing these documents. Existing device photos are uploaded only after you select them. A photo can link to up to 20 of your own individual reading IDs, without copied values.

1. Controller and contact

The controller of your personal data is Perplatform Oy, Business ID 3568783-4, Vilkastuksenkatu 7, 20320 Turku, Finland. Email: support@bodyper.com. You can write to us in English or Finnish.

This Policy covers the Bodyper mobile app, including use without an account (“guest use”), Bodyper accounts, our public website, synchronization, the exercise catalogue, subscriptions, reports and support. It does not cover the independent services of an app store or a sign-in provider, which have their own privacy notices. Contact us with privacy questions or requests about your rights. Please do not send passwords, identity documents or unnecessary health information by email.

Companion-device features are within this Policy's scope; section 2 describes the Wear OS companion separately.

This Policy describes data processing when you use the features. Listing a feature does not mean we collect its data from every user; your choices and the relevant permissions apply.

Publishing this Policy does not enable a feature, device permission or cloud choice. Feature availability depends on your app version, platform and compatible devices. The descriptions below apply when the relevant feature is available and you use it; publication is not a statement that a new phone or watch release has been distributed or approved by an app store.

2. Personal data we process

Account, sign-in and security

We process an account identifier, your email address, your sign-in methods, session and security information, and password-verification data handled by our authentication service (Supabase Auth). With Sign in with Apple or Google, the provider gives us the identity and the email address or profile details you authorize in that flow; we never receive the password to your Apple or Google account. Sign in with Apple is available on iPhone and iPad; Bodyper asks Apple only for your email address, and Apple may give us a private relay address instead. On iPhone and iPad, Google sign-in uses Google's own sign-in software inside the app, and Google processes the data that software collects as an independent controller under its own privacy policy; on Android, Google sign-in opens in your browser. Our authentication service sends account emails, such as password-recovery and email-change messages and one-time email codes, through Resend. When you change your email address, you confirm the new address; the current flow does not require confirmation from both the old and new inboxes. Email codes also confirm sensitive privacy actions where you request them in Bodyper; they do not introduce passwordless sign-in.

An email address and a password, or an Apple or Google sign-in, are needed to create an account; without them we cannot provide one. If you start a Google or Apple sign-in but do not finish creating the account, our authentication service may already have created a basic sign-in record containing your provider identity and email address, and after a Sign in with Apple we may also hold the encrypted Apple token described below. This gives no access to Bodyper, and you can ask us to delete it. If an account is deleted before its registration was finished, for example after an interrupted Sign in with Apple, we also delete the technical log and retry records it created.

You can connect and remove sign-in methods in Connected sign-in methods (Settings → Account settings). An account always keeps at least one sign-in method. Removing one does not sign out your devices.

Sign in with Apple

When you sign in with Apple, connect Apple as a sign-in method or confirm your identity with Apple, the app also sends our backend a one-time authorization code from Apple. Our backend exchanges it with Apple for a refresh token, but keeps the token only if it belongs to the Apple identity connected to your account. We store the token encrypted (AES-256-GCM), separately from your other account data, together with a hash of your Apple user identifier, and use it only to revoke Bodyper's access to your Apple Account when you remove Apple from your sign-in methods or delete your account (section 8). We never use it to read your Apple data. We keep the token only while Sign in with Apple is connected to your account and, after you remove Apple, only until we have used it to revoke access. The app keeps your Apple user identifier, with the identifiers of your account and session, in the secure storage (keychain) of your iPhone or iPad, without tokens or email addresses, to check your Sign in with Apple status.

Apple can send our backend server-to-server notifications when you stop using Sign in with Apple for Bodyper, delete your Apple Account, or turn email forwarding to a private relay address off or on. We check that each notification comes from Apple and use it only once. We record an entry of what happened and what we did, without your Apple identifier, your email address or the content of the notification, and it is erased with your account.

• You stop using Sign in with Apple for Bodyper, for example in your Apple Account settings: we erase a stored token issued before the notification. If you can still sign in with another method and have not signed in with Apple since, we also remove Apple from your sign-in methods, as if you had removed it in the app.
• You delete your Apple Account: we erase a stored token issued before the notification. If you can also sign in in another way, we remove Apple from your sign-in methods, as above, and your account stays. If Sign in with Apple is your only way to sign in to Bodyper, you can no longer sign in to your account, so we delete it and its data 30 days after the deletion Apple reports (section 8).
• Email forwarding turned off or on: nothing changes in your account. While forwarding is off, our emails to a private relay address, such as email codes, do not reach you.

If you signed in with Apple on your iPhone or iPad, the app checks with Apple when it starts, after you sign in and when you return to it whether Sign in with Apple is still allowed for Bodyper. If you have turned it off, the app signs you out. Changes that are waiting to be synchronized stay on the device. This does not sign out your other devices or sessions that use another sign-in method.

Confirming sensitive actions with an email code

Downloading an account-data export and deleting your account require that you have confirmed your identity within the last 10 minutes. You can do this with your sign-in method or with a short-lived one-time code sent to your account email address. The app requests the code directly from our authentication service, which creates and checks it and sends it through Resend. The code works only for your account, and it cannot be used to change your sign-in methods. Anyone who has both your unlocked, signed-in phone and access to your mailbox could use it, so protect both.

Profile and settings

Your profile contains your optional display name, language, time zone, weight unit (kilograms or pounds), first day of the week and records start date. Your profile is stored with your account and synchronized to your devices. The records start date limits record calculations, not stored history; finalized reports keep their calculation context. Weekly reports, goals and summaries use your first day of the week.

When you start using Bodyper, the app chooses your default units from your device's region settings, for example pounds and miles in the United States and kilograms and kilometres in Finland. On an iPhone, it reads the measurement system of your Region setting. On Android, it reads your language and region settings and the country of your SIM card, your mobile network and your time zone. This happens only on your device, and these values are not stored or sent to us; only the resulting weight unit becomes part of your profile. You can change your units at any time in Settings.

Other settings stay on your device and are not synchronized or exported: theme, date and time formats, distance unit, the workout view, compact completed sets, warm-up steps, plate and bar settings, the settings for timer notifications, Workout on lock screen and crash reports, the figure (female or male) and view of the muscle map, and your measurement shortcuts (section 3). Email changes and privacy requests also create verification and workflow records.

If you create a new account on a device where you have used Bodyper without an account, your weight unit, language (your phone's language if you followed it), your first day of the week if you chose Monday or Sunday, and your phone's current time zone become the new account's profile settings. Your other guest settings are copied only to the new account's area on the device. Your workouts, measurements and other guest data are uploaded only if you choose to upload them (section 6). Signing in to an existing account keeps that account's own settings.

Using Bodyper without an account

You can review and discard locally stored guest data in Settings instead of uploading it to an account. This includes automatically created starter data. Discarding that local data cannot be undone and does not delete an account's existing cloud records.

When you choose Continue without an account, the app creates a separate local guest area on your device with a generated local identifier. No Bodyper account or authentication identity is created. The workouts, programs, custom exercises, body measurements, history, corrections, local statistics and settings you create as a guest are stored in that local area. Our servers do not receive them, and cloud synchronization, subscriptions, server receipts and cloud processing are not used for guest data. If you use a paired companion watch, selected workout information can be exchanged locally between your phone and watch as described below in this section.

The app includes a published exercise catalogue for initial offline browsing without an account. When connected, it checks our backend for catalogue updates and fetches exercise thumbnails or videos as needed. These requests carry no account identifier and no guest data. Like any internet request, they reveal standard technical information, such as your IP address and request details, to Vercel for API requests and to Cloudflare for media downloads. Our backend uses the address briefly to limit abusive request rates. The published catalogue is the same for everyone. Unless you turn crash reporting off, the app can also send error and crash reports, which contain no guest workouts, measurements or other training data (see “Error and crash reports” below). The app does not start Google's Play Billing Library on Android or Apple's StoreKit on iPhone in guest mode. If you used purchases while signed in earlier in the same app process, the initialized library can remain after you sign out (see “Subscription information” below).

Training data

You may record programs and workout days, workout names and times, selected exercises and their order, sets and set types such as warm-ups, repetitions, load or assistance, duration, distance, effort ratings such as RPE (rate of perceived exertion), planned repetitions or repetition ranges, rest times, supersets, which exercise replaced another during a workout, completion status, notes on workouts, workout days and exercises, and corrections with their reasons. Synchronization stores identifiers, ordering, revisions, timestamps, retry state and conflict information needed to avoid losing or duplicating changes.

Body measurements

Optional body measurements include body weight, body-fat percentage and circumferences of the neck, shoulders, chest, waist, abdomen, hips, upper arms, forearms, thighs and calves. The upper arms, forearms, thighs and calves can be recorded separately for the left and right side. Each reading has a date and time and a source (entered by you or imported). You can add a note of up to 500 characters to a reading. You can record several readings together as one check-in; the readings then share the same date and time, the same note and a check-in identifier.

You can correct a reading, including its date and time, or delete it, and a manual correction or deletion needs a reason of up to 500 characters. Health-source values and dates are corrected through source synchronization, not ordinary manual edits; those source corrections and reviewed removals may have no user-written reason. We keep the reading's change history, with the values and times before and after each change and their reasons, while your account exists. A deleted reading's value and time remain in that history; its note is removed. Changing a note does not create a new reading version: we record only that the note changed, when and how many times, not the earlier text.

Values are stored in metric units; the units you see can differ.

Progress photos and optional backup

You can take a photo in Bodyper or choose one from your photo library. The app also lets you select several library photos and review them one at a time. Only photos you accept are saved; cancelling the remaining review keeps photos already saved. Unaccepted selections are temporary, not backed-up photos. Library originals are not changed or deleted. The app keeps its own JPEG and thumbnail in private device storage, outside device backups and transfers, and does not change the library original or add photos to your library. The JPEG's longest edge is at most 2048 pixels; camera and location metadata are removed on the device and again by our backend for backup. The API accepts an upload up to 3 MiB (3 × 1,048,576 bytes); the re-encoded cloud photo stored afterwards is at most 4 MiB. These are different limits: a local photo too large to upload stays on your device.

Without photo backup, we do not receive these photos or their photo details. This does not stop ordinary measurement records from synchronizing under your separate cloud choice; photo links do not replace that choice. With backup on, your chosen existing photos and new photos saved while it is on are backed up privately. You can show and download available backed-up photos after a fresh install signed in to the same account. Cloud-only photos that you have not downloaded are lost when their cloud copy is erased.

Bodyper does not analyse photos, judge your appearance, derive body measurements or health conclusions from pixels, or use them for advertising or AI training. Progress photos are separate from support images and exercise-catalogue media.

Guest photos stay in the separate guest area and are not included in the guest-data upload to an account. Enabling an account's photo backup does not automatically upload guest photos.

Photos start on your device. Cloud backup is off by default and requires a separate explicit photo-backup choice and valid cloud consent. We store a private processed photo and thumbnail, an optional title, captured date and time, view, source, an optional check-in link and individually selected reading identifiers, technical identifiers, revisions, checksums and upload/retry state. Upload processing strips embedded image metadata; the recorded date and title are separate fields. Images are not public.

You can add, edit or clear a title, edit the captured date and view and link or unlink your own existing check-in or up to 20 individually selected readings, including standalone readings. The individual-reading links store only account, photo and Bodyper measurement identifiers, not copies of measurement values, dates or types. These identifiers and their associations are health-related personal data, not anonymous data. Local-only photos keep their links on your device; with photo backup enabled, the cloud copy includes the links. We do not infer measurements or links from matching dates. Metadata edits do not change the stored image or measurement values. Deleting a reading can leave a historical check-in or individual-reading link on a photo until you unlink it. A deleted or missing linked reading is shown as unavailable, not with its last value as current. Once an individual-reading link to a deleted reading is removed, it cannot be added again. Current photo metadata, including the title, rather than a history of metadata edits, is exported. Internal command and upload-identity hashes support retries; they are not exported.

Title search, date/view filters and gallery counts use locally available photo records. Comparison statistics use elapsed dates and current, explicitly linked measurements from the same account, not image analysis. Resolving a link can display the reading's current value without copying it into link storage. Missing or ambiguous readings are not guessed. These local calculations add no separate cloud upload; backed-up metadata still follows the separate photo choice.

Comparison images are made on your device. The shared copy is unbranded, with dates and measurements only when you select them, and carries no camera or location metadata. Bodyper does not receive the copy you share or your sharing destination; this does not mean that a previously backed-up source photo is absent from our cloud. Sharing uses the destination you choose; review the image and any displayed dates or measurements before sharing. The shared image can contain resolved measurement values even though the link storage itself contains only identifiers. A recipient may keep it. Deletion in Bodyper cannot recall a shared file.

The app removes its temporary share file after the share operation; the sharing plugin's cache is cleaned at the next share, session change or launch. Interrupted cleanup can therefore leave a temporary device copy until cleanup runs. These controls do not delete a recipient's copy.

Apple Health and Health Connect

Connection and saving options depend on your app version and platform. These optional connections use permissions you choose in the operating system. On iPhone, supported measurements are weight, body-fat percentage and waist circumference; on Android Health Connect they are weight and body-fat percentage. Permission to read and permission to write are separate. Where you enable supported writing, Bodyper can create copies of your Bodyper readings in that platform. Supported workout writing has its own saving controls. We do not use these data for advertising, sale or unrelated data mining.

Before you enable supported Health exchange, Bodyper shows a purpose-specific notice about Perplatform's optional local processing. Measurement connection and phone workout saving have separate choices: on iPhone, I agree and connect and I agree to enable workout saving. Operating-system permission, the cloud choice and photo backup are separate. Connection still depends on platform and app version; an Android notice does not itself enable a connection. Declining leaves ordinary Bodyper workouts available.

The relevant account or guest area on that device keeps a local receipt of the statement version and hash, displayed language, affirmative time, platform and operation generation. An old connected setting is not a prior affirmative receipt. This is current local admission evidence, not an indefinite consent-history archive or a receipt uploaded merely to create cloud proof.

Each Bodyper account and the guest area have their own connection on each device. A connection starts off and does not carry over when you switch accounts. Connect only your own data: the device's health store can contain readings from other apps or another person using the device. Signing out stops the exchange for that account. Connecting or granting operating-system permission does not grant cloud processing. Without an account, imported readings stay in the guest area and are excluded from the guest-data upload to an account. After cloud withdrawal, Health readings retained on your device can be uploaded again to the same account only through your explicit re-upload choice.

Imported readings can be stored in your Bodyper account under your cloud choice. They include value, time, platform source and available source-app name/identifier, device model and recording method. We do not send the platform's record identifiers, synchronization cursors or local write-ownership links in the account measurement payload. These linking records stay on the device. A device model is not the device's personal name.

Source corrections and removals are handled through Health synchronization and review; a source removal can be kept in Bodyper or removed after your review. Resolving a duplicate in Bodyper does not itself erase the source platform's record. Turning off a connection stops that connection; it is not a request to delete all existing Bodyper data. Where removal of Bodyper-written platform copies is offered, choose whether to keep or remove them. Manage other platform records in Apple Health or Health Connect. OS permissions do not replace Bodyper's cloud consent.

Disconnect withdraws measurement exchange and offers keeping or removing Bodyper-owned platform copies. Your Bodyper readings and other apps' platform records remain. Turning phone workout saving off withdraws that separate purpose and leaves already saved Health entries. Removing a local choice does not withdraw cloud consent; section 6 describes that separate choice.

Saving workouts. Phone workout saving is off until you turn it on for the account or guest area on that phone and accept its purpose notice (I agree to enable workout saving). A choice accepted under an earlier version of that notice must be accepted again before saving resumes. When it is on, the phone saves each completed Bodyper workout once: workouts finished on that phone and workouts finished on your paired Apple Watch or Wear OS watch and brought to that phone. Workouts finished on another phone and workouts imported from files are not saved. A paired watch does not save its own copy while your phone saves workouts. Saving starts with workouts you finish after turning it on; you can separately choose, once, to add eligible workouts from the previous 30 days.

A saved workout contains its mapped activity type, start and end times, pauses and its exercises with their names, sets, repetitions and load. On iPhone with iOS 16 or later each exercise is a separate activity with that detail as metadata; with iOS 15 only the title and the number of exercises are added. In Health Connect the workout is an exercise session with strength segments and repetitions where a matching exercise type exists. The time window of each exercise is estimated from when you confirmed its sets. Heart rate and active calories are added only when your watch measured them during that workout; Bodyper never estimates calories, and a workout recorded only on the phone has neither. Notes, distance, your account identifiers and data imported from other apps are not included. Each saved entry carries a Bodyper identifier made with a one-way hash of your account and workout identifiers, which does not reveal them, so that a correction updates Bodyper's saved copy and deleting the workout in Bodyper removes it where the platform allows. Permission to write heart rate and active calories is asked only when a workout has such readings; declining it does not prevent saving the rest of the workout.

Saved entries are then held in Apple Health or Health Connect under Apple's or Google's controls, and other apps that you allow to read your health data can read them. If you delete an entry there, Bodyper does not add it again.

Apple Watch

The linked watch can hold workouts and queued changes and send completed workouts through the phone or directly to your Bodyper account. Cloud authorization applies to both routes. We keep link authorization and watch-session records, including installation identifier, creation and revocation status, to authorize and disconnect the watch. The account export includes watch-session information, not secret linking grants or session tokens.

Before app-directed Health session and sensor collection, including a companion session, the watch requires its separate I agree to Health recording choice. Existing operating-system permission alone is not enough. The watch keeps its local statement version/hash, language, affirmative time, platform and generation receipt in the relevant account or guest device partition. Showing your live heart rate on the iPhone and keeping the watch's samples for the iPhone's saved workout are used only after you accept a version of that statement that describes them; a choice accepted under the earlier statement does not cover them.

During an admitted watch workout, heart rate and active energy are shown on the watch. These sensor readings are not fields in Bodyper's workout relay or cloud workout record. When your iPhone has told the watch that it saves Bodyper workouts to Apple Health, the watch does not save its own Apple Health workout: the heart-rate and active-energy samples its session recorded stay in Apple Health for the single workout your iPhone saves. Otherwise, for example when phone workout saving is off, you can choose on the watch to save the workout to Apple Health, decline saving, or enable the always-save setting. Failed or declined saves have a retrying cleanup path for Bodyper's HealthKit recording. Do not assume a remote account deletion instantly wipes an offline watch or records already saved in Apple Health.

Save, Don't save and Always save concern final saving, not retrospective permission for earlier collection. Turning Always save off does not withdraw Health recording. In watch settings, Withdraw Health recording removes that admission, fences earlier operations and stops and cleans pending Bodyper recording after in-flight operations settle. Cleanup can remain pending for retry; this is not a promise of instantaneous physical erasure. Already saved Health entries remain. This withdrawal is separate from cloud withdrawal.

The watch workout session can create HealthKit samples while it runs, before the final saving choice. Declining or discarding invokes cleanup of Bodyper-created samples; failures can leave cleanup pending until a later retry. This does not promise deletion of Apple's own measurements.

While you log a workout on iPhone, the companion can also display heart rate on the watch with Health permission and the separate Health recording choice, and send it live to the iPhone's workout screen. The watch sends only the current heart rate in beats per minute, the time it was measured and pseudonymous pairing tokens for the phone's open workout, directly over Apple's WatchConnectivity link while the iPhone is reachable, at most every three seconds. Nothing is queued for later delivery. The iPhone keeps only the latest reading in its memory, hides it 15 seconds after it was measured and does not store, log, synchronize, export or send it to Bodyper's servers or error reports. That display can create Bodyper HealthKit samples. When your iPhone saves the workout to Apple Health, they are kept for that saved workout; otherwise they are cleaned up. The companion session does not save another Apple Health workout or send raw readings to Bodyper's cloud. Cleanup failures can remain pending for retry.

The phone and watch exchange workout display/actions, a bounded program and recent-set copy, and completed workout records. Watch storage and its glance/widget copy are separate device locations. The watch account session is held in its secure storage. Turning off the phone's lock-screen details does not turn off the companion's details: the device-wide Show workouts on Apple Watch setting is on by default. Account/guest deletion sends an erase instruction; an offline watch can retain its copy until reconnection. Check delivery and device state before relying on erasure elsewhere.

The phone records the erase instruction before removing the local account or guest area. If recording it fails or its result is uncertain, local removal stays pending for retry. A private queue on the phone keeps an opaque routing token until the watch confirms erasure. The token is pseudonymous, not anonymous; the queue contains no workout facts, Health readings or sign-in credentials. Recording the instruction is not confirmation that the watch has been erased.

Small delivery and replay-protection records on the phone and watch also use pseudonymous routing identifiers, current device-pair identifiers and ordering counters to reject old messages. They are not retained workout facts. Pending delivery instructions remain until the devices' exact confirmation is recorded; an offline device can leave delivery pending indefinitely. Shared replay protection is not reset by account deletion and remains while old transfers could still arrive. A coordinated retirement of that protection is not yet available. Deleting only the watch's local copy does not delete phone or cloud workouts, and a fresh copy from the current account can return.

The phone also keeps one private original-identity binding in platform-secure storage, with an original local account or guest identifier, its kind, a random installation epoch and whether its local area has been deleted. This lets you request the original device-only delivery and deletion records after deleting that local area and reopening the app. It contains no workouts or sign-in credentials and cannot sign you in, restore workouts, reset pairing or authorize server access. Another admitted identity replaces or makes the earlier proof unusable before becoming available; a failed or cancelled sign-in alone does not retire it. If replacement cannot be securely stored, old binding bytes can remain but are unusable. There is no timed automatic erasure of this binding.

Wear OS companion

When you use the Wear OS companion, you can record workouts on the watch and sync them, with heart-rate and calorie readings on the watch, no GPS or routes and no raw sensor uploads to Bodyper's cloud. Displayed readings are device estimates, not medical measurements.

Heart-rate and calorie readings are your choice, are off until you enable them and require the watch's sensor permissions. With them on, a workout on the watch uses a Health Services exercise session that measures heart rate and calories, including energy used at rest. Bodyper does not treat that calorie figure as active energy. Account workout sync follows the separate cloud choice in section 6.

A completed workout reaches your account by one route, never both: directly from the watch, or through the paired Android phone. For direct sync, your phone issues a short-lived link grant that the watch redeems for its own watch session. The watch encrypts the session in its private, no-backup storage using a device-bound key held in Android Keystore; the session is not stored as plaintext. You can disconnect the watch, which revokes the session. We keep the same link authorization and watch-session records as for Apple Watch, including installation identifier, creation and revocation status; the account export includes watch-session information, not secret link grants or session tokens. The paired Android phone sends a limited program copy to the watch and receives completed workouts over Google's paired-device Data Layer. The watch keeps its local workout history and pending transfers; a matching confirmation means durable storage on the phone, not successful cloud synchronization. Account changes do not move a pending workout to another account. Deleting the account or guest area on the phone queues an erase instruction; an offline watch can retain its local copy until it reconnects. Signing out is not an instruction to erase these device copies.

During a workout, the watch can send your current heart rate to the phone's workout screen over the Data Layer, with the same limits as on Apple Watch: only the current value, the time it was measured and pseudonymous pairing tokens, at most every three seconds, never queued, kept only in the phone's memory and never sent to Bodyper's servers. Heart-rate and energy readings are not saved in Bodyper's workout history or sent to Bodyper's cloud. When phone workout saving to Health Connect is on (see "Saving workouts" above), the watch can hand its measured heart-rate series to the phone for that save, and the phone saves the workout once. The phone does not write the watch's calorie figure as active energy, because that figure includes resting energy. The watch itself does not write workouts or readings to Health Connect. Displayed calories belong to the current measurement session.

The phone keeps a verified, account-scoped copy of handed-over watch readings in separate private storage excluded from device backup while its Health writer processes them. This is separate from the memory-only live reading described above and from Bodyper's workout history. The copy is released after the Health write, when workout saving is disabled or withdrawn, or when its local area is erased. Retention checks run when the store is used and remove entries older than 14 days, with at most 100 workout entries kept; these checks are not a promise of a background deletion at an exact wall-clock deadline. The copy is not synchronized to Bodyper's servers or included in the cloud account export. Viewing this Policy, agreeing to Terms or buying Premium grants neither device permissions nor consent to additional processing. Apple Watch's on-watch Apple Health saving options do not apply to Wear OS merely because you use a companion device.

Home-screen widgets, controls and shortcuts

Widgets you add can display recent weight and averages, check-in date/count, program or workout information and weekly activity. Show my data in widgets is device-wide and on by default. Turning it off shows neutral launchers. Other people can see values on an unlocked screen, and Apple's settings can make iPhone widgets available on your Mac. Lock Screen and StandBy rendering depend on device settings and protection; the iPhone implementation uses complete file protection and a neutral placeholder while locked.

A small replaceable snapshot is kept in a phone app-group file on iOS and app-private settings on Android, excluded from app backup. It contains display text and opaque routing tokens, not account identifiers, photos, notes or Health platform record links. It is not synchronized, exported as account data or uploaded by the widget. Guest widgets use the active local guest area. Sign-out, account switch, deletion or disabling widget data replaces personal content with neutral launchers; OS refresh can affect when a display updates. Widgets, controls and shortcuts open the app for confirmation and do not write records themselves.

Goals, progress and reports

Goals can concern workout frequency, strength or a body measurement. Goal definitions are authoritative in our cloud service. Your device may keep the last complete, confirmed list as a read-only offline copy (section 3); it is not re-uploaded. Progress calculations produce training totals, exercise history, estimated strength, personal records, comparisons, muscle-group analyses, goal progress and weekly and monthly summaries. The app calculates many of these on your device, and our backend calculates others, such as the exercise charts and reports it serves. Stored report snapshots and the report archive are kept in our cloud service. Reports and performance exports can contain these values. They describe your recorded training; they are not medical diagnoses or guarantees.

Private exercises and catalogue use

Your own exercises can include names, equipment, body regions, movement and tracking types, and notes. They belong to your account and are not published to other people. The exercise animations and thumbnails in the catalogue are catalogue content, not images of you. Catalogue media downloaded to your device supports browsing and offline playback.

We store exercise-catalogue videos and pictures in Cloudflare R2 storage in the European Union. These are catalogue reference materials, separate from the workouts, body measurements and private progress photos you create.

Muscle-group maps and statistics derive from exercise-catalogue information and your recorded training, not your photos or sensor measurements. Finnish-labelled guide art and light/dark variants are reference assets; downloading a guide does not itself upload your body measurements or photos.

Subscription information

We process the store and product, billing period, purchase evidence and transaction history, verification and acknowledgement status, the start, end, renewal and status of your access, including cancellation, grace periods and payment problems reported by the store, refund and revocation events, restore and reconciliation records, and any Premium access granted by us manually. Restricted purchase evidence is stored encrypted and separately from normal account data. Stores send status updates that keep your access correct. The app keeps a copy of your access status signed by our backend, with the time it was issued and received, so that Premium keeps working offline for a limited time. The stores' own purchase and account records follow their privacy policies.

Google Play Billing Library on Android. On Android, Bodyper starts Google's Play Billing Library only when you are signed in and use Premium purchases: when you open the Premium subscription screen, buy Premium or restore purchases, when an interrupted purchase restore needs to collect purchase information from Google Play, or, for up to seven days after the app records a pending payment, while a Google Play payment you started is still pending. It never starts in guest mode or in app versions where purchases are turned off. Once started, the library remains initialized for the rest of that app process. Closing the Premium screen or signing out does not shut it down or erase its queued technical logs.

The library connects to Google Play's billing service. Once connected, it records technical logs about its own operation and sends them to Google, sometimes later in the background. Google describes them as information about how the library is used, such as whether billing requests succeed or fail and problems connecting to the service. Google's transport adds device details: the device model and manufacturer, the Android version and build, language and country, the mobile network code, the network type, the time zone offset and the app's version number, but no advertising identifier or Android ID. Google says it uses these logs to improve the library's performance and to provide better support for errors; it processes them under its own privacy policy. Until they are sent, the logs wait in a database in the app's private storage for at most a week.

On iPhone, Bodyper starts Apple's StoreKit purchase listener, part of iOS, only when you are signed in and purchases are enabled, to receive and finish App Store purchase updates. It does not start the listener in guest mode. Once started, the store plugin remains initialized for the rest of that app process, including after sign-out.

Marketing commission records

Bodyper pays a marketing partner a commission on new paying customers. When your first paid subscription payment through the App Store or Google Play is verified, we record the store, subscription product, date, the value assigned from the store's finance reports, commission amount and currency, and a link to your Bodyper account. For Google Play we keep a keyed code of the order number, not the order number itself, for matching the first payment. These commission records do not contain your name, email address, training data or other account content. Renewals do not create new first-payment records; refunds and chargebacks are corrections. The partner receives monthly totals, never customer rows.

Finance administration also keeps Bodyper store-report rows and source checksums, commission agreements and statements, recorded payouts/payments and reversals. The ledger records payments made elsewhere; it does not transfer money. Raw reports containing other apps are not retained by the import. These finance records have their own restricted access and retention, separate from purchase evidence used to verify your Premium access.

Support and contact messages

In-app contact, bug reports and feature requests can contain a title, message, category, reproduction details or suggestions, a reply email address if you give one, app version, build, platform and language, status and our replies. If you choose a screenshot, only that image is uploaded. The upload process normalizes the image and removes its metadata; the image stays private to your account and authorized support staff.

The contact form on our website processes your name, email address, topic, message and language. It does not accept attachments or access your account. Messages sent through the form are not stored in our database, but they are kept in our support mailbox. The password-reset page on our website sends the email address you enter to our authentication service, which emails password-recovery instructions if the address belongs to an account. On both pages, Cloudflare Turnstile checks that the page is not being used by a bot; its result is verified before the request is processed. Ordinary emails to support can include attachments you choose to send. Please do not include passwords, other people's information or unnecessary health details in any support message.

Account export and export-ready email

When you request an account export, we prepare a private ZIP file from the account data stored on our servers. If email notification is available, we send an operational message to your current verified account email address through Resend when the export is ready. It explains when the file expires and how to download it in the app. It is not a marketing message.

The email has no attachment, workout details, account identifier or private download link, and its help-page link does not give access to your data. Downloading requires the app and a recent identity confirmation. If the email fails, you can still download an available export in the app before it expires.

We record delivery attempts, timestamps, language, delivery status and a fingerprint of the message to prevent duplicate or misdirected notifications, but not another copy of your email address or the message text. Resend processes the recipient address, the message and delivery information; it does not receive the ZIP file. Deleting your account removes our notification records, but cannot recall an email already delivered to your mailbox.

Legal choices

When you register or sign in, and when you agree to a new version of the Terms or acknowledge a new version of this Policy, we record the Terms version you agreed to, the Privacy Policy version presented to you, the action you took, the language of the app and the server time. Each record identifies the exact texts of that version. This version is in English. We also record your cloud-consent choices, including any withdrawal, with the statement version shown. Restoring a session or updating the app never creates such a record.

When you continue without an account, the app records on your device the Terms and Privacy Policy version and the links that were shown to you. This record is not sent to us. If you later register or sign in, a separate account record is made; the guest record is not converted into one.

Operations and security

Our backend processes request identifiers, timestamps, error codes, job status, limited security information, records of actions taken by our authorized staff and content-free records of certain actions on your account, such as that a measurement note changed or that Apple sent a notification. Our hosting providers process network information, such as IP addresses and request details. Our backend keeps IP addresses only briefly in memory to limit request rates. Our application logs are designed to leave out tokens, purchase evidence, message contents and training values.

Authorized staff can inspect limited account, subscription, privacy-request and operational status according to server-checked capabilities and staff assurance. Access and privileged commands are audited. Support, finance and marketer access are distinct; the marketer has no customer inspection, training-data or privacy-export access. Operational queue and recovery views use restricted status information, not unrestricted copies of account contents.

Our internal dashboard shows service and subscription totals; it is not advertising analytics. The app's rating prompt uses timing and attempt counters stored on your device. We do not learn whether you rated Bodyper or what rating you gave through that prompt. To warn you if your device's clock is wrong, the app compares it with the time in our server's responses; this comparison stays in the app's memory.

Error and crash reports

We use Sentry, a service of Functional Software, Inc., to detect and fix errors and crashes in the mobile app, our backend and our websites (the public website and the Admin Console used by our staff). We use Sentry only for error and crash reports, not for performance tracing, session replay, screenshots, profiling, analytics or advertising.

Mobile app. A report can contain the type of error; fixed technical details of the error or a stable failure code; the stack trace (the program code involved) and identifiers of the app's program files needed to read it; the route patterns of the screens you visited before the error, such as “history/:workoutId”, without the actual identifiers; the app's name, version, build, build type and bundle identifier, when it started, whether it was in the foreground and how much memory it used; the environment, such as production; the time; the name, version and build of your device's operating system, its kernel version, whether the device is rooted or jailbroken and whether it uses a light or dark theme; the device model, family, brand, manufacturer and type, processor architecture and number of processors, graphics processor, screen size, density and orientation, whether it is an emulator, its total and free memory and whether memory is low; your language and region settings, calendar, time zone and 24-hour-clock setting; and the fixed user label “anonymous”, which is the same for everyone.

Reports about crashes and freezes in the app's native Android or iOS code can also contain the states of all app threads, battery level and charging state, the device's temperature state, and the memory available to the app. On Android they can also contain battery temperature, whether the device is online and its connection type, total and free storage, processor frequency and chipset, which permissions Bodyper has been granted, such as notifications, and whether the app was installed from an app store.

Mobile reports never contain your account identifier, email address, name or device name; workout, measurement or other training data or notes; legal or billing information; authentication tokens or request contents; web addresses with query strings or fragments; or screenshots, logs or accessibility settings. The app does not add your IP address to reports; Sentry receives the network address of the connection when a report is delivered, as any internet service does, and our Sentry projects are set not to store IP addresses. Sentry's software can create a technical device identifier for crashes of the app's native Android or iOS code (on Android, a random installation identifier; on iOS, a code specific to Bodyper). The app removes these identifiers from every report on your device before it is sent. Reports waiting to be sent are stored temporarily on your device.

Send crash reports. In the app, Send crash reports (Settings → Data and privacy) is on by default. The choice applies to the whole device, including when you use Bodyper without an account, and the app remembers it. If you turn it off, the app disables new reporting and closes the reporting software. An upload already in progress may finish. The app attempts to delete reports still waiting on your device, but deletion can fail and those files may remain until cleanup succeeds. Cleanup is retried at a later launch when the stored choice is off, and before reporting is turned back on after a recorded cleanup failure. Reinstalling the app turns the setting back on. App builds that do not send reports do not show this setting.

Backend. Reports from our backend contain a fixed technical error category and the fixed diagnostic “Unexpected backend failure”, not the original error message or lines of source code. They can contain bounded stack line and column numbers and relative code-file locations positively matched to Bodyper's own program files, how the error was raised and linked to other errors, the software release and runtime, the environment, the time, a technical report identifier, and the HTTP method and registered route pattern of the request, such as “/api/v1/history/:workoutId”, or an indication that a scheduled job failed. They contain no account identifiers, request contents or IP addresses.

Websites. Our websites send reports through our own server, so Sentry does not receive your browser's IP address. Reports contain a fixed technical error category and the fixed diagnostic “Unexpected application failure”, not the original error message. They can contain bounded stack line and column numbers and links between errors, technical report identifiers, explicitly allowed application, error-code and request-method categories, registered page and request route patterns without origins, supplied dynamic segments, query strings or fragments, recent navigations and network requests reduced to those patterns, and the software release and environment. They can also contain allowed browser, operating-system and runtime names with technical version numbers. Arbitrary tags, free-text messages, source excerpts, filenames and function names are omitted. Error reporting on the websites sets no cookies and stores nothing in your browser.

Sentry stores event reports in its EU data region in Germany and retains these event reports for 30 days on our current Developer plan (section 8). Sentry retains separate organization audit logs indefinitely; the event-report period does not mean that all provider-held data is erased after 30 days. Reports cannot be linked to your account, so deleting your account does not require a separate step at Sentry.

Measurement guide sheets

Measurement guide sheets and their language and theme variants are Bodyper's public reference illustrations, not your progress photos or images of you. They are downloaded through media.bodyper.com from our private Cloudflare R2 EU storage, using short-lived signed download links issued by our catalogue service when needed, checked against a file checksum and kept in a cache on this device for later offline use. An uncached sheet needs a connection to download. The cache is shared by guest mode and accounts on this device; signing out does not remove these public illustrations. You can remove the guide downloads in the app.

Online requests expose technical request data, such as your IP address and the requested asset, to our API hosting provider Vercel and to Cloudflare for media delivery. Guide requests do not send your account authorization credentials. The temporary download link is not saved in the guide cache. Opening a guide does not upload your progress photos or measurement values and does not enable personal photo backup. The private photo access controls described in this policy apply to personal photos, not these public illustrations.

3. Features that work only on your device

These features work on your device. Unless a paragraph says otherwise, we do not receive the data they use, and nothing is sent to a push service.

Timer notifications (Settings → Devices and alerts) are optional and off by default. If you turn them on, the app asks for your device's notification permission where required, and your device can then show a notification when a running rest timer ends while Bodyper is not open on your screen. These are local notifications, scheduled and shown by your device's operating system (Android or iOS); they are not sent from our servers. No push token is created, and no notification data or identifier is sent to us or to any push service, such as Firebase Cloud Messaging or Apple Push Notification service. The notification text is generic (“Rest finished. Time for your next set.”) and does not include exercise names, weights or other training details. The setting and any scheduled notification are kept only on your device, and timer notifications work the same way with or without an account. You can turn them off in the app, or revoke Bodyper's notification permission in your device settings, at any time.

Workout on lock screen (Settings → Devices and alerts) is optional and off by default. If you turn it on, while a workout is open your device shows the rest timer on the lock screen, with buttons to add 15 seconds or skip the rest. On Android it is an ongoing notification, which Android 16 and later can show as a Live Update; on iPhone and iPad it is a Live Activity, which can also appear in the Dynamic Island and, depending on your settings, on a paired Apple Watch. It shows only neutral text, such as “Rest 1:12” or “Workout in progress”. If you also turn on Show exercise and set details, it also shows the exercise and the next set. When that set already has your own values from this workout, it shows them, such as “Bench Press · Set 3 · 80 kg × 8”, and you can log exactly those values from the lock screen; otherwise it shows no values and asks you to enter them in Bodyper, so the workout's planned values are never logged as your own. Values you have typed in Bodyper but not logged also keep the set from being logged there. Anyone who can see your screen can see these details. On Android, a device set to hide sensitive notification content on the lock screen shows only the neutral text. Logging a set from the lock screen needs your phone to be unlocked. On iPhone and iPad, the buttons need iOS or iPadOS 17 or later, and each one first asks you to unlock the device; on Android, adding time and skipping the rest work without unlocking. How to show your workout on the lock screen (Settings → Devices and alerts) checks your device's notification, Live Update, alarm, battery and Live Activity settings and opens the right settings screen; Test now shows a neutral test for 60 seconds. If your device blocks the surface when a rest starts, the workout shows a hint once. These checks run only on your device. The surface is created by the app on your device and shown by your device's operating system; it uses no push service, and its content is not sent to us. A set you log or a rest you change from the lock screen is saved like the same action in the app and, for an account, synchronized like any other change. On Android, while the surface is shown, the app keeps its latest content in its private storage on your device and removes it when the surface ends; on iPhone and iPad, the system holds the Live Activity's content. Apart from that, the app keeps only technical identifiers without workout content, such as which button presses it has already handled. The setting applies to the whole device, including guest use. Android asks for the notification permission when you turn it on; on iPhone, Live Activities can be allowed or blocked in the device settings.

Live heart rate from your watch. During a workout, your phone's workout screen can show the heart rate your paired Apple Watch or Wear OS watch is measuring (section 2). The reading comes directly from the watch over the devices' local link. The phone keeps only the latest value in memory and hides it after 15 seconds; it is not stored, synchronized, exported, included in error reports or sent to us.

Figures calculated on your device. Whenever it shows them, the app calculates figures from your records, such as goal progress, weekly workout counts, weekly body-weight averages and the Muscles tab's analysis of how your training is spread across muscle groups. The app may keep them in its memory while it runs, but it does not save them or send them to us.

Files you import and export. With or without an account, you can export your workouts and your body measurements as CSV files. The app creates a file on your device only when you choose to share it, you decide where it goes, and the app removes its temporary copy afterwards. A workout CSV file contains your completed workouts, including workout and exercise notes. A measurement CSV file contains, for each reading, its date and time with the time zone, the measurement and side, the value in your units and in metric units, the source and the note; deleted readings are not included. You can import workouts from a CSV file exported from Bodyper, Hevy, Strong or FitNotes, or from another CSV file whose columns you match, and body weight, body fat and circumferences from a measurement file exported from Hevy. The app reads only the file you pick and processes it on your device; the file itself is not sent to us. Readings that are already in Bodyper are skipped, and columns the app does not use are ignored. Imported readings are saved with the source “import” and, for an account, synchronized like your other data under your cloud consent. Without an account, imports and exports stay on the device. On Android, the system file picker can create a temporary copy in the app's private cache. Bodyper attempts to remove the returned copy after reading it, including when validation fails or the import is cancelled. A native failure before the path is returned, process termination or a deletion failure can leave a copy until later device cleanup or uninstall. The file you selected at its original location is not deleted.

Settings and drafts. Your device settings (section 2), measurement shortcuts and the goal you last chose for each measurement, the plan and layout of a workout you are doing, values you have typed for its sets but not logged yet, and unsaved drafts of a new workout day or a measurement check-in are stored only on your device. Typed set values are kept so that they survive the app being closed, and removed when the workout ends, when you sign out or when you switch accounts.

Saved workout versions contain the workout on that device for read-only recovery. They are not synchronized, automatically uploaded, or included in the server account export. Handoff notices, late-set recovery copies and queued synchronization payloads also live in the account's device area. Signing out or withdrawing cloud consent does not remove these recovery copies. Saved versions and notices have no automatic age limit or separate pruning control; they remain until that account area is deleted or the app is uninstalled. Dismissing a notice hides it. Late-set copies clear after acknowledged delivery, proof that all sets are present, or the explicit restore/delete resolution; otherwise they remain. Queued changes and synchronization receipts can retain earlier workout values. Protect shared devices.

The offline goal copy is different: it contains only the last complete, server-confirmed list, is read-only and is never a source for re-upload. It is removed when withdrawal starts or is learned from the server, when the cloud generation changes, when the applicable legal release no longer permits it, when the account's local area is deleted or when the app is uninstalled. Signing out alone keeps it separated from other accounts.

4. Where data comes from and who receives it

Personal data comes from you, your device and the changes you record, from files you choose to import, from Apple or Google when you use them to sign in or buy, from Apple's notifications about your Sign in with Apple choices, and from our service providers when they report security, billing or delivery status. We do not request clinical records from hospitals or healthcare providers.

The following table identifies the services used for Bodyper and the data involved. Apple and Google operate their own services; Cloudflare also uses Turnstile signals for the independent purpose described below.

We may disclose information to authorities or professional advisers where a valid legal obligation or a justified legal matter requires it, limited to what is necessary. If our business is transferred, applicable data-protection obligations continue to apply and we will tell you about the change. These possibilities never mean that deleted account data is kept indefinitely.

Commission records are not shared outside Bodyper except with our accountant and authorities when the law requires it. The marketing partner receives monthly totals that do not identify customers.

We do not sell personal data or use it for targeted advertising. We do not send marketing emails or marketing or promotional notifications. We use email only for service-related communications, such as account security, email codes, export notifications, support and required service notices. Your training and health data is never sold or provided to employers, insurers or data brokers.

Cloudflare delivers catalogue videos, thumbnails and guide illustrations through short-lived signed download links (section 2). The storage bucket is private; reference illustrations being available in Bodyper does not make it a public bucket. Media delivery receives technical request data, not your personal images or Health readings. The Supabase private-photo access rule in the table concerns personal photos, which remain separate.

Apple Health and Health Connect are additional sources when you enable them; your paired watch is a source of workout records. Your chosen sharing destination receives the photo you send. Supabase private storage and the backend process opted-in photo backups, not watch sensor samples or the live heart rate shown on your phone. When your phone saves workouts to Apple Health or Health Connect, that platform on your device receives them. Apple and Google operate the health platforms under their own applicable terms and settings; Health Connect data is not described here as automatically uploaded to Google.

When you sync Wear OS workouts to your account (section 2), directly from the watch or through your phone, the existing cloud purpose and recipients apply to those workout records, not raw watch sensor uploads. Using a Wear OS device does not itself mean that your readings are sent to Google.

5. Purposes and legal bases

The table shows our purposes and the legal bases under the EU General Data Protection Regulation (GDPR). Where data can concern your health, we also need one of the conditions in Article 9 GDPR; the table names it.

Where we rely on legitimate interests, we have weighed them against your interests and rights, and we process only the minimum data needed. You can object to such processing (section 10). Device-only records, including guest data, the features in section 3 and device settings, are not sent to Bodyper's servers merely by using those features. Perplatform directs the optional local Health processing described in section 2; staying on your device does not exclude that processing from our accountability. This does not grant cloud processing.

Optional photo backup of images and their health-related details and reading associations has the basis of performance of the requested contract (Article 6(1)(b)) and your separate explicit consent for health-related images (Article 9(2)(a)). Photo consent is not implied by general cloud consent. Photo-choice receipts document the statement version/hash and choice, not photo content.

Calculating, paying and bookkeeping commission on first subscription payments relies on our accounting obligation (Article 6(1)(c), Finnish Accounting Act) and our legitimate interest in paying partners correctly (Article 6(1)(f)). This does not authorize advertising use of health data.

6. Cloud consent and withdrawal

Photo backup. Backup is off by default. The app asks for its separate, explicit consent only when you choose to turn it on; an existing account is not asked automatically. It shows the photo statement and records its version and your choice. General cloud consent must also be in force. After enabling or re-enabling backup, no existing device photo is selected initially: only those you choose are uploaded. New photos saved while backup is on are queued for backup. A Terms or Privacy review, camera permission or Premium purchase does not grant photo backup.

Creating or using an account requires a separate, initially unticked choice that allows cloud processing of your training and body-measurement data. Selecting the sign-in or registration button accepts the Terms and presents this Policy; it does not make the cloud choice. The choice covers one purpose: storing and processing this data in our cloud service to back it up, synchronize it between your devices and calculate the progress, goals and reports you request. It covers no other purpose. A new purpose would need a separate choice, and a new Privacy Policy alone never grants one. If you do not want cloud processing, you can use Bodyper without an account, with the core features working on your device.

You can withdraw your consent at any time in Privacy choices (Settings → Account settings), which shows the statement version, your current choice and what withdrawal means before you confirm. Withdrawal:

• stops uploads from all your devices, and queued work or another device cannot restore the withdrawn data;
• erases the cloud copies of your workouts, programs, workout days, corrections, measurements with their notes and history, private exercises, goals, progress snapshots and reports, with the content-free records of changes to them; goals and the local read-only goal copy are deleted permanently and cannot be re-uploaded;
• keeps other data already stored on your devices, except the offline goal copy; and
• pauses ordinary account use. You can still export your data, delete your account and contact support.

When you turn cloud processing back on, the app asks which data kept on the device you want to upload again, and nothing is uploaded until you choose. A temporary loss of network connection is not withdrawal: after a valid consent, workouts you record offline synchronize later.

Withdrawal does not affect the lawfulness of processing before it, and it does not cancel a subscription.

If the cloud statement changes. If we ever make a material change to the statement that your consent covers, we stop processing your training data in the cloud until you accept the new statement. Nothing is erased. Each of your devices asks once: you can accept, and waiting changes then synchronize, or keep the data on that device only, and nothing is uploaded from it. We do not ask again about the same statement, but Privacy choices keeps showing that synchronization is paused. The copy already in our cloud, made under your earlier consent, is kept until you withdraw your consent or delete your account; it is not used for the changed purpose.

If you register or sign in on a device that holds guest data, the account's Terms agreement, Privacy Policy presentation and cloud choice come first. The app then lists your guest data by category, with every category preselected, and asks you to choose Upload to my account or Keep on this device only. Nothing is uploaded until you choose to upload. Uploaded guest data becomes account data: it is processed under your cloud consent and follows this Policy's rules for account data. If an upload is interrupted, the guest data stays on the device. If you keep it on the device, it stays in the guest area and is available the next time the device is signed out of an account.

Photo-backup withdrawal is a separate choice: it stops photo uploads, invalidates existing cloud exports and queues erasure of cloud photo files, rows and their measurement links. It does not withdraw general cloud consent or erase measurements. Local photos and their links remain unless you remove them. Cloud-consent withdrawal also turns photo backup off and erases its cloud copies; turning cloud processing back on does not silently restart photo backup. Pending or staged imports cannot restore erased cloud data under an old consent generation. Imported Health readings in the cloud follow the same cloud-erasure rules. Existing copies in Apple Health or Health Connect are separate and are not automatically erased by cloud withdrawal or account deletion.

7. Storage on your device and device permissions

The Wear OS sensor choice and permissions are described separately in section 2; phone Health Connect or Apple Watch permissions do not enable it. A Wear OS watch keeps its direct-sync session encrypted in private, no-backup storage using a device-bound key held in Android Keystore.

Camera access is requested only for taking a photo; library selection gives the app only the pictures you pick. Declining these permissions does not prevent recording measurements or using other non-photo features. The microphone description exists because the camera component includes audio code; Bodyper does not request microphone access or record audio for progress photos.

The app keeps a local database separated by account, including a separate guest area when you use Bodyper without an account. It holds your data, pending synchronization work and a log of the changes it has already synchronized, which can include earlier values and notes, as well as settings and a catalogue and media cache. A few settings and the content of the lock-screen surface are kept in the app's private settings storage on your device. When the purchase use described in section 2 starts Google's Play Billing Library on Android, it keeps its technical logs in a database in the app's private storage until it sends them, for at most a week. Sign-in secrets are kept in the platform's secure storage. Do not assume that every local file is encrypted separately from your device's own protection; protect your device with its access controls.

Signing out keeps the data of each account on the device separate, including work that has not yet synchronized; it does not remove the account's data from the device. Deleting your account in the app initiates removal of that account's local area; required cleanup preparation can leave removal pending for retry. The phone's pending Watch erase queue, shared replay-protection records and original-identity binding are separate and can remain as described in section 2. Uninstalling the app is not a request to delete your cloud account or confirmation that platform-secure records, Apple Health copies or another device's records have been erased. An export, CSV file or screenshot that you save or share outside Bodyper is controlled by you and the destination you choose; deleting your account cannot recall a file you sent to someone else.

The app's local database is kept in its private storage on your device. Android app backup and device transfer are disabled for it, and on iOS it is excluded from device backups. You can delete all local guest data in Settings, and uninstalling the app also removes it. We cannot recover deleted guest data, because no server copy exists. Signing out never moves account data into the guest area, and the guest area never shows account data.

If you choose to remove Bodyper-written Apple Health or Health Connect copies when deleting your account, the phone keeps local cleanup records so it can retry those removals. These records can remain after the account's local area is removed. They contain identifiers for Bodyper-written platform records, record types, your removal choice and retry state, not measurement values or workout contents. If the account-deletion result is uncertain, cleanup can wait for a further local keep-or-remove choice; uncertainty does not authorize removal. Cleanup can fail or remain pending, so account deletion is not confirmation that the platform copies have been erased.

The app asks for the notification permission only when you turn on Timer notifications or, on Android, Workout on lock screen (section 3). On Android, you can also allow Alarms & reminders so that a rest-timer notification arrives on time; the app works without it. The camera is used when you take a progress photo; photo-library selection is used for a photo you choose or a support screenshot, and the file picker for an import you choose. Bodyper does not record audio with progress photos. Apple Health and Health Connect permissions apply only to the optional connections described in section 2, with separate read/write choices. Permission to write heart rate and active calories is asked only when a workout to be saved has readings measured by a watch. Watch HealthKit permissions cover workout recording, heart rate and active energy; Wear OS sensor and activity permissions cover heart-rate and energy measurement during workouts. Bodyper does not use your contacts or GPS/location services for these features; manually logged distance is not GPS tracking. Our websites use no advertising or analytics cookies; the security services they rely on process the technical information needed to operate them, and error reporting on the websites sets no cookies (section 2).

8. Retention and deletion

Marketing commission and finance records have the separate treatment below; the general account-deletion description does not promise to erase retained accounting amounts.

We keep account data while your account exists and delete it when you delete your account. Account data includes your identity and profile, synchronized training data and measurements with their notes and change history, private exercises, goals, reports, support history and images, your legal-choice records and content-free records of actions on your account. Corrections, change history and synchronization records are kept while the account exists so that your data can be reconciled and explained accurately.

Cloud copy of your training data. The cloud copy of your workouts, body measurements, goals, progress and reports is kept while your consent is in force. It is erased when you withdraw your consent (section 6) or delete your account. If the cloud statement changes and you do not accept the new one, the copy made under your earlier consent is kept until you withdraw your consent or delete your account (section 6). Withdrawal also erases the content-free records of changes to this data; records of other actions on your account, such as changes to your profile or sign-in methods and privacy requests, are kept until you delete your account.

Guest data stays on your device until you delete it in Settings or uninstall the app. After a successful upload, only the uploaded records become account data; data you leave unselected remains in the guest area on your device. We keep no server copy of guest data you have not uploaded.

Export-ready notification records are deleted with your account. Messages already delivered to your mailbox do not disappear when an export expires. We do not keep a copy of a deleted profile or purchase history for account recovery. Our email host's own backup copies of the support mailbox and Cloudflare's Turnstile data follow those providers' schedules.

Deleting your account. You can delete your account in the app (Settings → Account settings → Account data → Delete account) after confirming your identity within the last 10 minutes with your sign-in method or a short-lived one-time code sent to your account email address. Anyone who has both your unlocked, signed-in phone and access to your mailbox could confirm a deletion, so protect both. An accepted deletion request restricts account access immediately. The app signs you out as deletion proceeds. Local removal can remain pending while required cleanup preparation is retried; a queued Watch erase token can remain until the watch confirms erasure (sections 2 and 7). Erasing the data from our systems can take some processing time. Purchase evidence is erased at once. Deleting your account does not cancel an App Store or Google Play subscription: cancel it in the store.

If you use Sign in with Apple, the deletion screen tells you that you may need to remove Bodyper from your Apple Account settings yourself, and how. If we hold a Sign in with Apple token, we use it to revoke Bodyper's access to your Apple Account. Waiting for Apple can delay the deletion by at most 24 hours from your request: if Apple has not confirmed the revocation by then, we erase the token and continue deletion without waiting for Apple. Other failed cleanup steps can remain pending for retry or our intervention. We may hold no token, for example if Apple told us that you stopped using Sign in with Apple for Bodyper, or if the app could not deliver the code to us after you signed in. Without a token, or if Apple did not confirm the revocation, Bodyper may stay listed in your Apple Account settings until you remove it there. The app does not show the result of the revocation after the deletion, and we never claim that access was revoked when it was not. Deleting your account does not revoke the permission you gave in your Google Account for Google sign-in; you can remove Bodyper in your Google Account settings. A deletion receipt does not mean that every provider or device copy has already been erased. Records controlled by Apple and Google follow their own policies, and files you saved or shared outside Bodyper stay where you put them.

Deletions we carry out. If we delete an account for you, for example after a verified email request or where the law requires it, the same steps run automatically: private files are removed, a stored Apple token is used for revocation and then erased, purchase evidence is erased, and a deletion receipt and restore-protection marker are kept for up to 30 days after the deletion is completed. No message is shown in the app in this case, so if you used Sign in with Apple, check your Apple Account settings and remove Bodyper there if it is still listed.

Removing Apple as a sign-in method. If you remove Apple from your sign-in methods, we use the stored token to revoke Bodyper's access to your Apple Account and then erase it. We retry automatically if Apple does not respond, and a revocation that keeps failing is flagged for our manual follow-up. If you connect the same Apple Account again before the revocation, we keep the token instead.

If you delete your Apple Account. If Apple tells us that you deleted your Apple Account while Sign in with Apple was your only way to sign in to Bodyper, you can no longer sign in to the account. We then delete the account and its data 30 days after the deletion Apple reports, with the same steps as a deletion you make in the app, unless the account has another sign-in method by then. We do not send a separate notice first. Until the deletion starts, you can ask us to stop it by writing to support@bodyper.com; we first check that the request comes from you. If you can also sign in in another way, we only remove Apple from your sign-in methods and erase the stored token; your account and its data stay. Stopping the use of Sign in with Apple for Bodyper without deleting your Apple Account never deletes your Bodyper account.

Additional retention for this version

Photo deletion stops access through the API and queues verified cloud-file cleanup. File removal is not instantaneous: uploads already in progress must finish or their leases expire, and failed cleanup can require our intervention. Other offline devices learn the deletion when they next connect. Unsent local photos and edits remain on the device; turning backup off does not erase them.

• Marketing commission records: the retention period is 10 years as accounting records. Automatic deletion at the end of that period is not yet implemented. On account deletion, the account links and billing identifiers, including first-order matching codes, are erased immediately. Retained accounting records keep the financial amounts, valuation information, store, product and date, not those identifiers.
• Available cloud photos and their retry hashes last until photo deletion, photo-backup withdrawal, cloud withdrawal or account deletion. An individual photo deletion clears content metadata and measurement links and queues file erasure; a content-free tombstone containing only photo/account identifiers, revision and creation/update/deletion timestamps remains without an age expiry to prevent offline resurrection. It is not exported, and is removed by the applicable withdrawal or account erasure.
• Health-origin measurements follow measurement retention: a deleted reading can retain its value, time, provenance and change events, but not its note, until cloud withdrawal or account deletion. Those measurement tombstones are included in export, unlike photo tombstones.
• Incomplete local-data uploads and closed upload receipts are cleaned by bounded workers. General mutation replay receipts are separate. An expiry date does not itself remove stored measurement replay data.
• Photo storage erasure, external sign-in/account-deletion cleanup and export invalidation have background work and retry paths; completion is not instantaneous. Deletion initiated outside the app also queues residual file cleanup. Device-only copies and external shared/Health copies follow the separate rules in sections 2, 3 and 7.

When Wear OS workouts reach the account (section 2), directly or through the phone, these same workout retention, withdrawal and deletion rules apply to those account records. Workouts saved to Apple Health or Health Connect are platform copies and follow the rules in sections 2 and 7.

9. Where data is processed and how it is protected

Bodyper is operated from Finland. Our account database and private account-file storage are hosted by Supabase in the eu-west-1 region (Ireland), and our backend is configured to run on Vercel in its Dublin region. Exercise-catalogue videos and pictures are stored separately in Cloudflare R2 with its EU jurisdiction restriction. This object-storage location does not determine where every network request or technical log is processed. Some of our service providers, or their subprocessors, also process personal data outside the European Economic Area (EEA), mainly in the United States:

• Resend stores email content and delivery records in the United States. Its data processing agreement incorporates the European Commission's Standard Contractual Clauses for non-adequate transfers from the EEA, including the controller-to-processor clauses where it processes data for us.
• Sentry stores reports in its EU data region in Germany; Sentry's US company and its subprocessors can also have access outside the EEA. Under our accepted data processing agreement, transfers to Sentry from Europe to the United States use the Data Privacy Framework; the agreement provides Standard Contractual Clauses if that framework is invalidated or does not apply to the transfer.
• Vercel's and Cloudflare's global networks can handle requests and technical security processing outside the EU object-storage location, including in the United States. Cloudflare's customer data processing addendum provides applicable transfer safeguards, including Standard Contractual Clauses where required; EU storage does not mean EU-only access or network processing.
• Apple and Google are responsible for their own international transfers.

The storage locations described above concern the specified Bodyper cloud records and catalogue objects, not copies on your devices, in Health services or held by people you share them with. Contact support@bodyper.com for information about these transfer safeguards or a copy of the applicable Standard Contractual Clauses.

We protect your data with authenticated, account-scoped access, identity confirmation before exports and deletions, restricted and audited staff access, private storage, encryption for app and backend connections and stored cloud data, encrypted storage of Apple tokens and purchase evidence, minimized logs and error reports, short-lived download access and controls against lost or duplicated changes. Outgoing email delivery uses opportunistic TLS: it attempts an encrypted connection but can fall back to unencrypted delivery if the receiving mail server does not support TLS. Emails are not end-to-end encrypted; protect your mailbox and avoid sending unnecessary health details by email. No service can promise absolute security. If a personal data breach occurs, we handle it and notify the Data Protection Ombudsman and you as the law requires.

10. Your rights

Subject to the conditions of the law, you have the right to access your data, to have it corrected or erased, to restrict its processing and to receive it in a portable format. You also have the right to object to processing based on our legitimate interests. Where processing is based on your consent, you can withdraw it at any time, without affecting processing before the withdrawal. We may check your identity in a proportionate way so that we do not disclose or delete another person's data.

The free account export includes the account data listed below, stored on our servers. Synchronize pending changes first if you want them included. It is a ZIP file with a machine-readable JSON file and a manifest, and it contains your account and profile, sign-in methods, legal-choice records and cloud-consent history, programs, workout days, workouts and corrections, completed history, measurements with their notes and change history, goals, private exercises, stored report snapshots, subscription information, support records and available support images. Reports are included as structured records, not as copies of every PDF or CSV file you created. Sign-in secrets, the Apple token and protected purchase evidence are not included. You can also export your workouts and body measurements as CSV files in the app (section 3).

The export is separate from Premium PDF/CSV performance reports. It is available for 24 hours and is downloaded in the app after you confirm your identity with your sign-in method or a short-lived one-time code sent to your account email address (section 2); the export-ready email is only a notification. A missing or delayed email does not extend the export's availability or prevent you from downloading an available export in the app.

Without an account, we hold no copy of your guest data, so there is no account export or server-side deletion to request for it. You control it on your device: you can export workouts and measurements as CSV files and delete all local guest data in Settings. You can still contact us about privacy, including the technical request data processed by our hosting provider.

Error and crash reports cannot be linked to you by us, so we cannot find or delete them on request unless you give us details that identify a specific report. Event-report retention is described in section 8; the separate provider audit logs do not follow the same period.

Contact support@bodyper.com to use your rights. We respond within one month. If we need more time, as the law allows, we tell you why within that month.

You can lodge a complaint with the data protection supervisory authority where you live or work, or where you think your rights were infringed. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman. In the United Kingdom, you can complain to the Information Commissioner's Office.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. No decision about your health, eligibility, employment or insurance is made from your Bodyper charts.

The account export also contains your records start date, imported Health measurement provenance and change origins, workout handoff records and linked-watch session information. Available progress photos are listed with their current optional title, captured date, view, optional check-in link and the current selected individual-reading identifiers. The readings and their change history are exported separately as measurement data, not as duplicated values in the photo links. Device-only photo links are not in the server archive. Photo files are downloaded in separate numbered ZIP parts, each containing at most 32 MiB of photo content, with its own short-lived download authority. The finished ZIP also contains a manifest and archive overhead, so its file size can exceed that content limit. The parts are assembled for download rather than stored as a second permanent photo archive. Deleted or withdrawn photos are not available through an old download. Internal retry hashes, secret watch grants and local Health record links are not exported. Device-only saved workout versions, comparison files and offline recovery copies are not in the server archive.

The phone's local Watch erase queue and Health cleanup records are not included in the server account export or the workout CSV export.

Where available, a separate private local Watch metadata file contains records for the verified original account or guest scope, its original-identity binding and separately labelled shared device-pair safety state. Reading or sharing it does not synchronize workouts, acknowledge delivery, repeat deletion or reset pairing. An offline or unavailable watch is reported as not captured, not as an empty successful capture. Original-scope proof is required again after restart; missing, corrupt or replaced proof makes access unavailable. This is not a complete account archive or a backup of the device databases. These local records are not exempt from your applicable data-access rights.

The automatic ZIP does not currently include account-linked first-payment commission records. Contact support@bodyper.com about these data and your rights.

These rights also apply to companion data. When Wear OS workouts reach the account, they are within the same workout export and deletion scope; raw watch sensor uploads are excluded (section 2). Live heart rate shown on your phone is not stored, so it cannot be exported.

Workouts still waiting on the watch are not in the server account export. Where available, the workout CSV screen offers a separate export of pending Wear OS workouts through a connected paired phone. Reading them for export does not synchronize, acknowledge or erase them. This is not a complete export of every device record.

11. Children

You must be at least 16 years old to create or use a Bodyper account. Finnish law allows a child aged 13 or older to consent to online services, but we require 16 for accounts in every country, because an account involves consent to processing data that can concern health. We do not knowingly keep account data of anyone under 16. We do not ask for your date of birth or verify ages, but the Terms require account holders to confirm that they are at least 16.

People under 16 can use Bodyper without an account. Their training data then stays on their device. The app includes an exercise catalogue and may request updates and media when connected. Unless crash reporting is turned off, the app is configured to send error and crash reports without training data or Bodyper account details, but delivery reveals the connection's network address to Sentry as described in section 2.

If we learn that an account belongs to someone under 16, we close the account and delete its data. Before deletion, we may give the account holder a short opportunity to export their data, unless the law requires prompt deletion, as it does for children under 13 in the United States. Parents or guardians who believe that their child has created an account can contact support@bodyper.com.

For the consumer-health-data disclosures that follow, the data categories also include health-related progress photos, imported Health readings with provenance and the Watch processing described in section 2. The separate sharing and permission choices remain applicable; we do not sell this information or use it for advertising.

12. Additional information for residents of certain US states

These categories include backed-up progress photos, thumbnails, titles and measurement identifiers and associations: they can reveal information about your body and health. Photo backup requires the separate explicit choice in section 6; general cloud consent does not grant it.

Some US state laws, such as Washington's My Health My Data Act and Nevada's consumer health data law, give residents specific rights over consumer health data. For Bodyper, this means body measurements and training, goal, progress and report data that could indicate your physical health.

• What we collect and why: the data described in section 2, which you enter or import or which the app calculates from your entries, only to provide the features you request, to keep them secure and to meet legal obligations.
• Consent: we collect and process this data in our cloud service only with your separate, explicit cloud consent, with an additional separate choice for photo backup, as described in section 6.
• Sharing: we do not sell consumer health data. We share it only with the service providers that process it on our behalf (section 4), and when the law requires. We do not share it with affiliates.
• Your rights: you can ask us to confirm whether we collect or share your consumer health data, to give you a copy of it and a list of the recipients, and to delete it, including copies held by our service providers. You can withdraw your consent at any time (section 6).

Email support@bodyper.com to make a request. We respond within 45 days; if we need up to 45 more days, we tell you why within the first 45 days. If we deny your request, you can appeal by replying to our decision with “Appeal” in the subject line. We decide on an appeal within 45 days and explain the outcome. If you are not satisfied, you can contact your state Attorney General.

13. Changes to this Policy and language

For this material combined Terms and Privacy update, the app asks you to review both documents once per account before ordinary account use continues. Guests are not interrupted. This review does not turn on photo backup or replace its separate explicit consent.

Each published version has a stable archived copy with its effective date. This version is in English. We publish a new version when our processing or this Policy changes. If the changes are material, for example a new kind of data, a new purpose, a new recipient or a different retention period, the app shows a notice and asks you to acknowledge the new version. A change to this Policy alone never stops you from using the app; if the Terms change materially at the same time, you review both documents in one step. Editorial changes, such as corrections of wording, are published without a notice, and Privacy choices shows that the documents were updated. We ask for new consent where the law requires it, for example if the cloud statement changes (section 6). “Presented” or “acknowledged” does not mean that you read every paragraph or agreed to every processing purpose. Privacy choices shows the version presented to you separately from the newest version. For guest use, the version presented to you is recorded only on your device.

This Policy is published in English, including when you use the app in Finnish. The app, support and separate privacy-choice statements can still use Finnish; that does not change the language of this Policy. Contact support@bodyper.com if you need an accessible copy or help understanding this Policy.