Privacy Policy – Smart Progression

Effective Date: August 2026
Applicable to: Mobile application Smart Progression (Android & iOS) and associated backend cloud services.
Package / Bundle Identifier: com.saykuro.SmartProgression

1. Data Controller & Contact Information

The data controller responsible for the processing of personal data within the scope of the General Data Protection Regulation (GDPR) and applicable data protection legislation is:

Philipp Mürder (Saykuro Studios)
Mannheimer Str. 38
76131 Karlsruhe
Germany
Email: contact@saykuro.studio
Website & Imprint: /legal/imprint

2. Overview & Privacy Principles

The mobile application Smart Progression is designed for intelligent workout tracking, scientific calculation of muscle fatigue and recovery, and the provision of personalized AI-assisted fitness guidance.

We handle your personal data with utmost care and adhere to strict privacy standards:

No Sale of Data: We never sell, rent, monetize, or trade your personal data with third parties.
No Advertising Trackers: The app contains no third-party ad networks, no remarketing scripts, and no invasive marketing tracking SDKs.
Data Minimization & Transparency: We only collect data necessary to provide, synchronize, and improve your workout experience and app functionality.

3. Categories of Processed Data

Depending on the features you use, Smart Progression processes the following categories of data:

a) Account & Authentication Data

Email Address: Used for account identification, verification, and essential security notices (e.g., password resets).
Password (Hashed): For email/password accounts, passwords are cryptographically hashed using industry-standard one-way hashing algorithms. We never have access to your plaintext password.
Google Sign-In (OAuth): When logging in via Google, we process your Google user ID, email address, display name, and avatar URL provided by Google OAuth.
Guest / Anonymous Sessions: For temporary or unauthenticated use, a randomized session identifier is generated to associate workout data on your device and backend.

b) Profile, Body & Biometric Information

During onboarding and in profile settings, you may provide optional fitness parameters to calibrate calculations:

Body weight and height (to normalize volume tonnage and strength scores),
Age and biological sex (for physiological rest timer and 1RM classifications),
Training experience level (e.g., beginner, intermediate, advanced),
Workout frequency, primary fitness goals, and available gym equipment (e.g., barbells, dumbbells, machines, bodyweight),
Preferred AI coach personality (e.g., analytical, motivating).

c) Workout, Training & Performance Data

Routines & Templates: Custom training splits, routines, and exercise sequences.
Logged Sets & Metrics: Exercise name/ID, weight, repetitions, completion status, set types (Normal, Warm-up, Myo-Reps, Drop sets), RPE/RIR values, and rest interval timestamps.
Cardio Logs: Workout duration, recorded distance, and cardio-specific parameters.
Computed Metrics: Total tonnage, estimated One-Rep Max (1RM via Epley formula), and historical progression charts.

d) Recovery, Wellness & Daily Check-In Data

Sleep Logs: Recorded sleep duration (hours) and subjective sleep quality ratings.
Daily Check-Ins: 5-point rating scales tracking daily energy levels, stress, sleep satisfaction, and muscle soreness.
Readiness & Fatigue Modelling: Computation of a composite Daily Readiness Score (0–100%) and 72-hour muscle fatigue recovery decay across 6 muscle zones (Chest, Back, Legs, Shoulders, Arms, Core).
Recovery Activities: Logged recovery sessions (e.g., sauna, stretching, mobility) with duration and notes.

e) Photos & Media (Progress Photos & Avatar)

You may optionally upload progress photos (linked to timestamp and body weight) or profile pictures.
Access to your photo library occurs solely upon your explicit selection via the native system photo picker. No automated biometric facial recognition or background image scanning is performed.

f) Shared Routines (Workout Sharing)

When sharing a custom routine, a unique 6-character share code is generated. Other users can import the routine (exercises, target sets, and optionally creator name) using this code.

g) Technical & Diagnostic Data

Security Tokens: Authentication session tokens are stored securely in your device's encrypted hardware-backed keystore (iOS Keychain / Android Keystore via SecureStore).
API Server Logs: Technical network metadata (IP address, timestamp, app version, OS platform) collected to ensure backend reliability and prevent service disruption.

4. Legal Bases for Processing (GDPR)

We process your personal data under the following legal bases of the GDPR:

Contractual Performance (Art. 6(1)(b) GDPR): To deliver core workout logging, data synchronization, rest timers, and account management.
Consent (Art. 6(1)(a) in conjunction with Art. 9(2)(a) GDPR): For voluntary tracking of health/wellness metrics, biometric indicators, and progress photo uploads. You may modify or delete this data at any time.
Legitimate Interests (Art. 6(1)(f) GDPR): To maintain technical system security, prevent abusive activity, and resolve software errors.

5. Artificial Intelligence (AI Coach & Exercise Substitution)

Smart Progression integrates AI-powered features (workout generation, on-the-fly exercise substitutions for occupied equipment, and personalized training insights).

Server-Side PII Anonymization (Privacy by Design)

To safeguard user privacy, Smart Progression applies automated server-side filtering (anonymizeCoachPayload):

Complete Removal of PII: Before transmitting prompts to external AI inference endpoints (OpenRouter / Large Language Models), all personal identifiers (name, email address, phone number, user ID, and auth tokens) are completely stripped.
Anonymized Fitness Context Only: Only abstract training parameters are transmitted (target muscle group, exercise name, available equipment, readiness scores).
No Training on User Data: Data sent to AI inference endpoints is not utilized by the infrastructure provider to train public foundational AI models.

6. Third-Party Services & Data Processors

We partner with established, GDPR-compliant service providers:

7. Device Permissions & Hardware Access

Smart Progression requests device permissions only when strictly necessary for specific user-initiated features:

Photos & Media Library (READ_MEDIA_IMAGES / iOS Photo Library): Accessed only when you manually pick a progress photo or avatar. The app never scans or reads your gallery in the background.
Notifications (POST_NOTIFICATIONS): Used to send local notifications when rest timers expire or optional workout reminders. Can be disabled anytime in system settings.
Audio & Haptics: Delivers timer countdown sounds and tactile vibration feedback. Microphone recording is explicitly disabled in the app configuration (microphonePermission: false).
Secure Storage (SecureStore / Keychain): Stores session tokens within the hardware-encrypted keystore on your device.

8. Data Retention & Account Deletion (Google Play Compliance)

We retain personal data only as long as your account remains active or as needed to provide app services.

Complete Account & Data Deletion

You have the absolute right to delete your account and all associated data at any time:

In-App: Navigate to Profile / Settings and select "Delete Account".
Via Email: Send an informal deletion request with the subject line "Delete Account" from your registered email address to contact@saykuro.studio.

Effect of Deletion:
Upon receiving your deletion request, your user account, profile, complete workout history, logged sets, daily check-ins, uploaded progress photos, and shared workout codes are permanently and irreversibly purged from our production databases and cloud storage.

9. Data Security

We implement rigorous technical and organizational security measures:

Encrypted Transmission: All network communication is encrypted using modern TLS/HTTPS and secure WebSocket (WSS) protocols.
Encryption at Rest: All database records and uploaded media are stored with AES-256 server-side encryption at rest.
Hardware Token Protection: Session credentials are kept exclusively in platform keystores (iOS Keychain / Android Keystore).

10. Children's Privacy

Smart Progression is not directed at children under the age of 13 (or under 16 within the European Union). We do not knowingly collect personal data from minors. If we discover that a child has provided personal information without parental consent, we will promptly delete such data.

11. Your Rights Under GDPR

Under the General Data Protection Regulation, you possess the following rights regarding your personal data:

Right of Access (Art. 15 GDPR): Request a copy of the personal data we hold about you.
Right to Rectification (Art. 16 GDPR): Correct inaccurate or incomplete information.
Right to Erasure (Art. 17 GDPR): Request the permanent deletion of your personal data ("Right to be Forgotten").
Right to Restriction of Processing (Art. 18 GDPR): Restrict processing under certain statutory conditions.
Right to Data Portability (Art. 20 GDPR): Receive your personal data in a structured, machine-readable format.
Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests (Art. 6(1)(f) GDPR).
Right to Withdraw Consent (Art. 7(3) GDPR): Withdraw previously granted consent at any time with future effect.
Right to Lodge a Complaint (Art. 77 GDPR): Lodge a complaint with a competent data protection supervisory authority.

To exercise any of these rights, please contact us at contact@saykuro.studio.

12. Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect legal, technical, or functional updates to the app. The latest version is always accessible at https://saykuro-studios.dev/apps/smart-progression/privacy.

Smart Progression: Privacy Policy