Privacy policy
What the Achilles app and this website collect, why, who helps us process it, how long we keep it, and how you stay in control.
Last updated
Who we are
Achilles is a training app that builds strength and mobility plans from sports-science research. It is run by Sospita Yazilim Limited Sirketi, Talaytepe Mah. 4035. Sk. No: 1 H İç Kapı No: 27, 21070 Kayapınar/Diyarbakır, Türkiye ("we", "us"). We are the controller of the personal data described here.
For anything about your data, write to support@trainwithachilles.com. We answer within one month.
The short version
- We collect what we need to build and run your plan: your email, your answers about your body and goals, and the workouts you log.
- Your health answers are stored in the EU (Google Cloud, Frankfurt) and used only with your explicit consent.
- Your plan is written by an AI model. We send it your answers only with a separate consent, and never your name or email.
- We never sell your data, show you ads, or track you across other apps and websites.
- You can withdraw consent, delete your health answers and plans, or delete your whole account at any time.
What we collect
| Data | What it is | Why we need it |
|---|---|---|
| Account | Your email address and the one-time sign-in codes we send to it | To create your account, sign you in and send emails about your plan |
| Health answers | Pain and injuries, health conditions, pregnancy and menopause, the safety screening answers, and anything you write in your own words | To check it is safe to start, and to pick exercises and doses that fit you |
| Training profile | Age, sex, goals, sport, training history, weekly schedule and equipment | To build a plan that fits your goal, your time and your kit |
| Plans and workouts | The plans built for you, the sessions you log, effort and pain ratings, and notes | To show your plan and progress, and to move the plan forward with you |
| App settings | Avatar, theme, sounds, reminder times and the push token your phone gives us once you allow notifications | To run the app the way you set it up and to deliver notifications |
| Usage | The days you used the app and the sessions you started and finished | To count active users and see which parts of the app are used |
| Diagnostics | Crash reports and error logs: device model, OS and app version, the screen you were on, and request paths with ids removed. They carry your account id, never your answers. | To find and fix bugs |
We don't collect your name, phone number, location, contacts, photos, or anything from other apps. This website sets no cookies and loads nothing from third parties.
Apple Health and Health Connect
If you turn it on in Profile, the app saves the workouts you finish to Apple Health (iPhone) or Health Connect (Android). On iPhone it also reads Apple Health, on your phone only, to see which of its own workouts it already saved, so none is saved twice. On Android it reads nothing from Health Connect.
Nothing the app reads from Apple Health or Health Connect leaves your phone. It is never used for advertising or marketing, never sold, and never shared with anyone. You can turn the permission off at any time in the Health or Health Connect app.
Why we may use it (legal bases)
- Your explicit consent (GDPR Art. 6(1)(a) and 9(2)(a)) for your health answers, asked before the intake, and a separate consent for sending your answers to the AI provider, asked when you build a plan.
- Our contract with you (Art. 6(1)(b)) for your account, your plans, logged workouts, settings and the emails and notifications you asked for.
- Our legitimate interests (Art. 6(1)(f)) in keeping the app secure and working, which covers diagnostics and usage counts. These never include your health answers.
- Legal obligations (Art. 6(1)(c)) where a law requires us to keep or hand over data.
How the AI builds your plan
Your plan is written by an AI model, grounded in a library of sports-science research and trusted sources. To do that, we send the model what the plan needs: your answers about your body, goals, schedule and equipment. We never send your name or email address.
The AI providers we use work under a data processing agreement. They process your answers only to write your plan, don't use them to train their models, and delete them within 30 days. Before any plan is built, a fixed set of safety screening questions runs; that check is a rule written in advance, and the AI never decides it.
Who processes your data for us
We use these service providers. Each works under a data processing agreement and may only use your data to provide its service to us.
| Provider | What for | Where |
|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd) | Servers, database, file storage and this website | EU (Frankfurt) |
| Confluent | Messages between our own services | EU (Frankfurt, on Google Cloud) |
| OpenAI | The AI model that writes your plan | United States |
| Firebase Cloud Messaging (Google) and Apple Push Notification service | Delivering notifications to your phone | EU and United States |
| Sentry (Functional Software, Inc.) | Crash reports and error logs | EU (Frankfurt) |
| Twilio SendGrid | Sign-in codes and emails about your plan | United States |
When you play an exercise video, it streams from our video provider (YMove) or plays in YouTube's own player. Both receive your device's IP address, as any video host does; YouTube's own privacy policy applies to videos played there.
We update this list before we add or replace a provider.
Transfers outside the EU
Some providers above process data in the United States. Those transfers rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses in every case. You can ask us for a copy of the safeguards.
How long we keep it
- Your account, plans and workouts: until you delete your account.
- Your health answers: until you delete them (Profile → Consents) or your account. If you withdraw consent, we stop saving new answers.
- Sign-in codes: they expire after 10 minutes.
- Database backups: up to 7 days, after which deleted data is gone from them too.
- Server logs: 30 days. Crash reports: up to 90 days.
- At our providers: the AI provider deletes your answers within 30 days; email delivery records follow SendGrid's own retention.
- After you delete your account: records of AI runs are kept without any link to you, to track cost and quality.
Your rights and choices
You can, at any time:
- Withdraw either consent in Profile → Consents. This doesn't undo what was done before you withdrew.
- Delete your health answers and your plans in Profile → Consents, or your whole account (how).
- Ask us for a copy of your data, or to correct it, restrict it, object to its use, or get it in a portable format.
- Turn notifications and Apple Health or Health Connect access off in your phone's settings.
Write to support@trainwithachilles.com from the email on your account. You can also complain to your data protection authority: in the EU, the one where you live; in the UK, the ICO; in Türkiye, the KVKK Authority (Kişisel Verileri Koruma Kurumu). Users in Türkiye have the rights in Article 11 of Law No. 6698.
US consumer health data
Some US state laws, such as Washington's My Health My Data Act, treat the health answers above as consumer health data. We collect them only with your consent, use them only to build and adjust your plan, share them only with the service providers listed above, and never sell them. You can see, delete or withdraw consent for them as described in this section.
Age
Achilles is for people aged 18 and over. We don't knowingly collect data from anyone younger; if you think a child has signed up, write to us and we'll delete the account.
Security
All traffic is encrypted in transit, data is encrypted at rest, and access is limited to the small team that runs Achilles. The database accepts no direct connections from the internet.
Changes
If we change this policy in a way that matters, we'll tell you in the app or by email before it applies. The date at the top shows the latest version.