Sport Habits.
ENFR
Sign inGet my free cycle

Legal

Privacy Policy

Last updated: September 28, 2026 · Version française

Who we are

Sport Habits is published by BULDEE (contact: legal@sporthabits.app). This policy describes the data processed by the Sport Habits iOS and Android application and its related services.

Data stored on your device

The app works offline: your programs, your sessions, your loads and your weigh-ins are written to your device first, then synchronised with our servers so you get them back after a reinstall or on another device (see below). Only your hydration, your meal check-offs and your settings stay on the device alone, and they are deleted when you uninstall the app.

Data processed by our servers

  • Account: e-mail address, first name and a technical identifier. Your password is never stored in clear text, only its cryptographic hash. Authentication is handled by our own server, not by a third-party identity provider.
  • Program import: the PDF or Excel file you import is sent encrypted (TLS) to our server, held in our database while our processing system reads it, passed to the Claude API (Anthropic) to extract the program structure, thendeleted right after analysis. If the processing fails, the file is retained for up to approximately 48 hours before being deleted. Anthropic does not use it to train its models.
  • Trial and subscription: your trial state, applied coach code and subscription tier, to enforce your access rights.
  • Sync: your finished sessions and measurements are kept on our servers so they can be restored after a reinstall or on a new device.
  • Coach space: if you create a coach space, your display name, referral code and aggregate counters. Never your clients' identities without their knowledge.
  • Purchases: receipt validation goes through Apple or Google; we never see your payment details.
  • Stability: anonymized crash reports via Firebase Crashlytics.

Health (Apple Health / Health Connect)

With your explicit permission, and never before it, the app reads two kinds of data and writes one. The list is the same on Apple Health and on Health Connect, because it is the same list in the code that asks for it.

  • Read: your step count, so the day's activity is counted without you typing it.
  • Read: your body weight, so you do not retype a weigh-in your scale already recorded.
  • Written: your finished strength training sessions, so they appear alongside your other activity.

Nothing else is asked for. The app never reads your workouts, never writes your weight and never touches heart rate, sleep, nutrition or any other type.

Your step count stays on your device and in your health store: it is never sent to our servers, nor backed up to iCloud. A weigh-in is different. Whether you type it or keep the one the app fills in for you from your health store, saving it records it on our servers as a weigh-in, which is what lets your progress read the same number on every device. Your coach only sees it if you decide so, as explained below. It is destroyed with the account, under Body on the deletion page.

You can revoke access at any time, in Health on iOS and in Health Connect on Android.

Sharing your measurements with your coach

Your weight and body measurements (circumferences, body fat, muscle mass, hydration) are health data. Being linked to a coach does not open them to that coach: by default they see none of it, no value, no number of entries, no date. Your sessions go through the link.

  • Legal basis: your explicit consent (GDPR, Art. 9(2)(a)), given in the app for one named coach, after being told what is shared, with whom and how to stop. Nothing is pre-selected; closing the question without answering shares nothing.
  • What is shared: your weight and body measurements, history included, visible to that coach only in their coach workspace, and the weight figures of their cycle reviews.
  • Withdrawal: stop it anytime in Profile, My coach section, as easily as you gave it (GDPR, Art. 7(3)). From the withdrawal on, your coach no longer sees any of your measurements, history included. Cycle reviews they had already validated before your withdrawal stay as they were written; no new review uses your measurements.
  • New coach: a consent is given for one coach. If you change coach, you are asked again and nothing is shared before you answer.
  • Proof and records: every consent and every withdrawal is recorded with its date on our servers, and every time your coach reads your measurements is written in the access register you can ask us for.

What we do not do

  • In the application: no ads, no ad trackers, no data resale. Website audience measurement is described further down and asks for your agreement.
  • No profiling. YouTube videos linked to your exercises open in an embedded player, subject to YouTube's privacy policy, only when you play them.

Website audience measurement

This section covers the sporthabits.app website only, never the application. We measure how this site is found with Metrikia, a tool published by BULDEE, and with Google Analytics, a service of Google Ireland Limited, so we know which pages bring in athletes, coaches and gyms. Both tools set a measurement identifier and report the pages you visit to their publisher. No measurement script is loaded and no data is sent until you accept the question asked at the bottom of the page.

Your choice is kept in your browser's local storage, on your device. You can change it at any time.

Retention and deletion

Server data is kept for as long as your account exists. You can delete your account from inside the app, in your profile, or by writing to the address below. Requests are processed within 30 days. The whole procedure, what is destroyed and what survives it, is on the account deletion page, which is readable without the app installed.

Your rights

Under the GDPR you have the rights of access, rectification, erasure, portability and objection. Contact: privacy@sporthabits.app.

Processors

Railway Corporation (server and database hosting, European Union), Anthropic (analysis of imported programs), Google Firebase (app integrity attestation, notifications, Crashlytics), Apple and Google (in-app purchases). Transfers outside the European Union are covered by standard contractual clauses.