Privacy Policy

1. Overview

This Privacy Policy describes how Routinafy (“Routinafy”, “we”, “us”) collects, uses, stores, and shares information when you use the Routinafy mobile application for iOS and Android, this website, and related services (together, the “Services”). For users in the European Economic Area (EEA), the United Kingdom, and Switzerland, Routinafy is the data controller of your personal data.

The short version:

• We collect only what is needed to log your workouts, calculate your energy needs, and power AI coaching.
• Whiteboard and notes photos are processed by Google Gemini AI strictly to parse your workout. They are never sold and never used for advertising.
• We do not sell your personal information and do not share it for cross-context behavioral advertising.
• Integrations such as Strava are optional and only activated when you connect them.
• You can delete your account and all associated data directly in the app at any time.

2. Information we collect

2.1 Account information

When you create an account we collect your email address and, if you choose Google Sign-In (or Sign in with Apple, where available), the basic profile details the provider shares with us: your name, email address, profile picture, and a unique account identifier. We never receive your Google or Apple password.

2.2 Body & fitness profile

To calculate your Basal Metabolic Rate (BMR) and Total Daily Energy Expenditure (TDEE), and to personalize Coach AI, you may provide your weight, height, age (or date of birth), gender, activity level, and fitness goals (for example, strength, hypertrophy, fat loss, or endurance). Providing this profile is optional, but some features will not work without it.

We refer to this as your “biometric profile” in the app because it describes body measurements. It does not include biometric identifiers such as fingerprints, face geometry, or voiceprints — Routinafy does not perform facial recognition.

2.3 Workout logs

We store the training data you log or import: exercises, sets, reps, weights, rest times, RPE, session duration, notes, dates, and the derived metrics we compute from them (training volume, muscle heatmap values, fatigue and recovery estimates).

2.4 Camera images

When you use the AI Whiteboard & Workout Scanner, you take or select a photo of a gym whiteboard, handwritten notes, or a screenshot. Camera and photo-library access are requested only when you use this feature, and you can revoke them in your device settings at any time. See Section 4 for how these images are handled.

2.5 Purchase & subscription information

If you subscribe to Routinafy Pro or buy Lifetime access, payment is processed entirely by the Apple App Store or Google Play. We never receive your card details. We receive purchase receipts, product identifiers, transaction dates, renewal status, and an anonymous app user ID via RevenueCat to unlock Pro features.

2.6 Integration data

If you connect Strava, we receive an OAuth access token and your Strava athlete ID so we can upload activities on your behalf. We do not read your other Strava activities unless needed to avoid duplicate uploads.

2.7 Technical & diagnostic data

We collect limited technical information needed to operate and secure the Services: device model, operating system version, app version, language, time zone, crash logs, and performance diagnostics. We do not use advertising identifiers (IDFA/AAID) and do not track you across other companies’ apps or websites.

3. How we use your information

We do not use your data for automated decision-making that produces legal or similarly significant effects. Coach AI recommendations are informational suggestions only and you are always free to ignore them.

4. Camera images & Google Gemini AI

Photos you submit to the Workout Scanner are transmitted over an encrypted connection to Google Gemini (Google’s generative AI service) for the sole purpose of extracting the exercises, sets, reps, and weights shown in the image. The structured result is returned to the app so you can review and save it.

• Images are used strictly for parsing your workout. They are never sold, never used for advertising, and never used for facial recognition or identification.
• We use Gemini through paid API terms under which Google does not use submitted content to train its models.
• We do not keep the original photo after parsing unless you explicitly choose to attach it to a workout. Any temporary copies are deleted automatically.
• Please avoid photographing people or unrelated personal information. If people appear incidentally, the image is still only used for text parsing.

Coach AI may also send de-identified summaries of your workout logs and fitness profile (for example, weekly volume per muscle group and your stated goal) to an AI model to generate analysis. Your name and email are not included in these requests.

5. Third-party service providers

We rely on carefully selected providers who process data on our behalf under written agreements and only as necessary to provide their service:

Strava: the integration is entirely optional. Data sent to Strava becomes subject to Strava’s Privacy Policy and your Strava privacy settings. You can disconnect at any time in the app or in your Strava settings, which revokes our access token.

Garmin .FIT export: .FIT files are generated on your device and shared only where you choose to send them (for example, Garmin Connect or your files app). Routinafy does not transmit them to Garmin on your behalf.

6. Sharing and “no sale” commitment

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising as those terms are defined under California law. We do not sell or license your health, fitness, or image data to data brokers, insurers, employers, or advertisers.

We disclose information only:

• to the service providers listed above, to operate the Services;
• to integrations you explicitly connect (such as Strava);
• if required by law, subpoena, or to protect the rights, safety, and security of our users or the public;
• in connection with a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your data and you will be notified.

7. Data retention

• Account, profile, and workout data: kept while your account is active and deleted within 30 days after you delete your account.
• Scanner images: processed transiently and not retained after parsing, unless you attach the photo to a workout.
• Purchase records: retained as long as required for tax, accounting, and legal obligations.
• Backups and logs: encrypted backups are rotated and permanently purged within 90 days.

8. Security

Data is encrypted in transit (TLS 1.2+) and at rest in Supabase’s managed infrastructure. Access is protected by row-level security so each account can only access its own records, and staff access is restricted on a need-to-know basis. No system is perfectly secure, but we continuously work to protect your data and will notify you and the relevant authorities of any breach as required by law.

9. Account deletion & your data rights

Delete your account in the app

You can permanently delete your account and all associated data at any time from Settings → Account → Delete account inside the Routinafy app. Deletion removes your profile, body metrics, workout history, AI analyses, and stored images, and revokes any connected integrations.

Delete by request

If you no longer have the app installed, email support@routinafy.com from the address associated with your account with the subject “Delete my account”. We will verify your request and complete deletion within 30 days.

Deleting the app does not cancel an active subscription. Please cancel in your App Store or Google Play subscription settings to avoid future charges.

Your other rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and receive a copy;
• Correct inaccurate data (most data can be edited directly in the app);
• Delete your data;
• Export your data in a portable, machine-readable format (CSV/JSON);
• Withdraw consent at any time, without affecting prior processing;
• Object to or restrict certain processing;
• Not be discriminated against for exercising your rights.

To exercise any right, contact support@routinafy.com. We respond within 30 days (or 45 days where permitted by law).

10. Additional information for the EEA, UK & Switzerland (GDPR)

We process your personal data on the legal bases described in Section 3. Body measurements and fitness data may be considered health data (a special category under Article 9 GDPR); we process it only with your explicit consent, which you can withdraw at any time by deleting your profile information or account.

You have the right to lodge a complaint with your local data protection supervisory authority. We would appreciate the chance to address your concerns first at support@routinafy.com.

11. California residents (CCPA / CPRA) & other U.S. states

In the preceding 12 months we have collected the following categories of personal information, for the business purposes described in Section 3:

• Identifiers — email, name, account ID;
• Sensitive personal information — health and fitness data (body metrics, workout data), used only to provide the Services you request;
• Commercial information — subscription purchase history;
• Internet/electronic activity — app diagnostics and usage of features;
• Audio/visual information — whiteboard and notes photos you submit.

We do not sell or share personal information, and we do not use sensitive personal information for purposes other than those permitted under the CPRA. You have the right to know, access, correct, delete, and limit the use of sensitive personal information, and to be free from discrimination. Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Washington (including under the My Health My Data Act), and other states with comprehensive privacy laws have similar rights. You or an authorized agent may submit a request to support@routinafy.com.

12. Children’s privacy

Routinafy is not directed to children under 13 (or under 16 in the EEA/UK, or the minimum age required in your country). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact support@routinafy.com and we will delete it.

13. International data transfers

Our providers may process data in the United States and other countries. Where personal data from the EEA, UK, or Switzerland is transferred to countries without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework.

14. App Store & Google Play disclosures; changes to this policy

The data practices described here are reflected in our Apple App Store privacy “nutrition label” and Google Play Data safety section. We may update this policy from time to time. If changes are material, we will notify you in the app or by email before they take effect. The “Last updated” date at the top shows when this policy was last revised.

15. Contact us

For privacy questions, data requests, or account deletion, contact our support and privacy team at support@routinafy.com. Please include the email address associated with your Routinafy account so we can help you quickly.