Privacy Policy
Last updated: [EFFECTIVE DATE]
We collect only what we need to coach you and run the app. We don’t sell your data and we don’t show ads.
1. Controller
The controller of your personal data is [FULL LEGAL NAME OR BUSINESS NAME], [REGISTERED BUSINESS ADDRESS]. Contact for all privacy matters: kontakt@vlthr.com.
2. What we collect
- Account data — email address, display name, and your profile photo if you sign in with Google.
- Training data — workouts, sets, reps, weights, perceived effort, session notes, mood and energy ratings.
- Health and body data — body weight, measurements, progress photos and check-in answers such as sleep and wellbeing.
- Coaching communication — messages and feedback you send us.
- Payment data — handled by Paddle. We receive which plan you bought, the amount and your country — never your card details.
- Technical data — the session cookie that keeps you logged in, and basic server logs.
Health and body data is a special category of data under the GDPR. We process it only with your explicit consent, and you can withdraw that consent at any time. Withdrawing it means we delete that data; the rest of your account keeps working.
3. Why we use it
| Purpose | Legal basis |
|---|---|
| Running your account, the app and your coaching | Contract — GDPR Art. 6(1)(b) |
| Body weight, measurements, progress photos, wellbeing check-ins | Your explicit consent — GDPR Art. 9(2)(a) |
| Security, fraud prevention, fixing and improving the service | Legitimate interests — GDPR Art. 6(1)(f) |
| Invoices and tax records | Legal obligation — GDPR Art. 6(1)(c) |
| Waitlist and launch emails | Your consent — GDPR Art. 6(1)(a) |
4. Who we share it with
We use a small number of service providers who process data on our behalf:
- Supabase — Database and account authentication
- Vercel — Website and app hosting
- Paddle — Payments and taxes — Paddle acts as Merchant of Record and an independent controller for payment data
- Google — Sign-in, only if you choose “Continue with Google”
Where data leaves the European Economic Area, it is protected by the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.
5. How long we keep it
- Account, training and body data — while your account is active, and deleted within 30 days after you delete your account.
- Invoices and payment records — for as long as tax law requires.
- Waitlist emails — until you unsubscribe or the waitlist closes.
6. Your rights
You can access, correct, delete or export your data, restrict or object to its processing, and withdraw consent at any time. Email us and we’ll respond within one month. You also have the right to complain to the President of the Personal Data Protection Office (UODO) in Poland, or to the data protection authority in your country.
7. Cookies
We use only strictly necessary cookies — the session cookie that keeps you logged in. Your theme choice is stored in your browser’s local storage. We don’t use analytics or advertising cookies; if that ever changes, we’ll ask for your consent first.
8. Security
All traffic is encrypted over HTTPS, and database access rules ensure each user can only read their own data. Your coach can see the training and check-in data of the clients they coach.
9. Children
VLTHR is not intended for anyone under 18, and we don’t knowingly collect their data.
10. Changes
We’ll notify you of material changes to this policy by email or in the app before they take effect.