Progress — Privacy Policy

Effective date: 2 October 2026 Data controller: Stijn Smit, Hilversum, the Netherlands Contact: support@stijnsmit.com

1. The short version

• We collect only the data you enter to make the app work for you, plus anonymous crash reports and usage statistics.
• We do not use your data for advertising or profiling, and we never sell it. We do not rent it or share it with advertisers. Ever.
• We collect anonymous, aggregated usage statistics and crash reports that contain no identifier, no health data and no free text, so they cannot be linked to you.
• Your training, health, and photo data is private by default. You decide what (if anything) is shared, and with whom.
• Health-related data is only processed with your explicit consent, which you can withdraw at any time.
• AI features that send data to third-party AI providers run only when you actively use them, under a separate in-app notice and consent.
• You can export or permanently delete all of your data at any time, directly in the app.

2. What we collect and why

We collect data in the following categories. Apart from anonymous technical data, everything is data you create or enter; we do not collect data about you from other sources.

What we deliberately do NOT collect: advertising identifiers, location tracking, contact-list uploads, and no analytics profile of you — usage statistics are anonymous and cannot be joined into a per-person history.

3. What we never do with your data

• No advertising, no ad networks, no ad SDKs.
• No behavioral profiling. Usage statistics are anonymous and aggregated.
• No selling, renting, or trading of personal data.
• No use of your data to train AI models — neither by us nor, per our agreements, by our AI providers.
• No access by our staff to your content except when strictly required to resolve a support issue you raised, or as required by law.

4. AI features (optional)

Some features use a third-party AI provider — for example the in-app AI assistant. Today that is ozeye (the Netherlands), an EU AI gateway running the model (currently DeepSeek) with providers in the EU.

• These features run only when you actively use them (e.g. sending a message to the assistant). Nothing is sent to AI providers in the background.
• Before first use, the app shows a dedicated AI Feature Privacy Notice explaining exactly what is sent, to whom, and under which of that provider's terms. You must consent before the feature activates.
• Only the data needed to answer your request is transmitted, and it is processed only to answer you. ozeye does not store the text of requests or answers.
• AI features may be part of a paid tier. Declining AI consent never affects the rest of the app.
• AI output is general guidance — never medical, nutritional, or professional advice.

5. Sharing and social features

• Nothing you create is visible to anyone else until you accept a friend.
• If you connect with friends, they can see the activity you choose to share. You choose per session: each workout or activity has a Share with friends setting, and you can share or unshare a saved session at any time. Friends see a shared session's name, time, duration, note, rating, intensity, sport, and per-set reps, weight, duration and distance, plus who gave it kudos. Unshared, unfinished and deleted sessions are never shown.
• Sharing is limited to training content. Health data (weight, diet, fasting, supplements, injuries, date of birth, biological sex, body stats, heart rate, routes and location) can never be shared and is never visible to anyone but you — there is no setting that exposes it. Progress photos, workout photos and your bio are not shared either.
• Any signed-in user can find you by your display name and see your name and profile picture, and nothing else about you.
• You can unshare a session, unfriend, or block another user at any time; their access ends immediately. Blocking someone removes any friendship or friend request between you, hides you from their search and stops their friend requests. They are not told. You can unblock them from your Blocked people list; unblocking does not restore the friendship.
• Copies of shared content another user made while it was shared remain their own copies.
• When you delete your account, your friendships, blocks (both directions) and kudos are removed and your activity disappears from friends' views.

6. Storage, security, and encryption

• Data is stored with our hosting processor Supabase in the EU (Ireland) region.
• All data is encrypted in transit (TLS) and at rest (AES-256).
• Access is enforced by row-level security: our systems structurally prevent one user's account from reading another user's private data.
• Passwords are hashed; we never see or store them in plain text.

7. Data retention

• Your data is kept for as long as you have an account — the app's purpose is long-horizon tracking, so nothing is silently expired.
• When you delete your account, your account and all personal data are permanently deleted immediately. Database backups that still contain them roll off within 30 days. Deletion is available directly in the app (see §8).
• We keep one deletion receipt: your account id, a confirmation code, and when the deletion was requested and completed. It links to no other data once your account is gone, and lets support confirm that the deletion happened.
• Legal obligations (e.g. payment records) may require keeping limited billing data for statutory periods.

8. Your rights and controls

You can do all of the following directly in the app, without contacting us:

• Access & export — download a complete copy of your data in a machine-readable format.
• Correct — edit any data you've entered.
• Delete — permanently delete individual records or your entire account and all data.
• Withdraw consent — switch off health-data features or AI features at any time; related data can be deleted on request.

Under the GDPR you additionally have the rights to restriction, objection, portability, and to lodge a complaint with a supervisory authority (in the Netherlands: the Autoriteit Persoonsgegevens). To exercise any right manually, contact support@stijnsmit.com. We respond within one month.

9. Processors (who touches the data on our behalf)

This list is kept current in this policy.

10. Children

Progress is not directed at children under 16 (or the higher/lower age your country sets for information-society services). We do not knowingly process children's data; accounts found to belong to children will be deleted.

11. International transfers

Where a processor is outside the EEA, transfers rely on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. The AI assistant's processing stays inside the EU.

12. Changes

We'll notify you in-app of material changes to this policy before they take effect. Continued use after the effective date constitutes acceptance; for changes affecting consent-based processing, we will re-ask for consent.

Stijn Smit, 2026