Chiseld has two types of users:

When a client connects with a trainer, the trainer can view and, where applicable, edit certain client data in order to provide coaching — for example workouts and workout history, body measurements, nutrition logs, and schedule information. We are the controller for the platform and the processing it performs. Trainers independently decide how they use client data in their own coaching practice; for that use they act as separate controllers and are responsible for having their own lawful basis and, where required, providing their own privacy notice to their clients.

a. Information You Provide

• Contact Information: Name, email address.
• Profile Details: Age, gender, fitness goals, and an optional profile picture.
• Account Credentials: Information used to authenticate and secure your account. Authentication is handled through our provider (Firebase Authentication); we do not store plaintext passwords.

b. Fitness and Health Data — Special Category (collected with your explicit consent)

• Workouts and workout history: exercise logs, sets, reps, weights, and related performance data.
• Body stats and measurements: weight, height, and other body measurements.
• Nutrition data: eating patterns and consumed foods.
• Schedule and event information used in the calendar feature.

c. Progress Pictures — Highly Sensitive (collected with your explicit consent)

• Images you choose to upload to track body changes over time. These may reveal sensitive information about your body and health.
• Visible only to you by default. Shared with a trainer solely if you give explicit consent to that specific trainer (see section 1).
• You can delete individual progress pictures, or all of them, at any time from within the app.

d. Payment and Transaction Information

• Clients: In-app subscriptions and purchases are processed by the Apple App Store and Google Play, which handle your payment details directly. We receive transaction and subscription-status information but not your full payment card details.
• Trainers: Payments on our website are processed by Stripe, which handles your card details directly under its own privacy policy. We do not receive or store full card numbers.
• Ledger Information: Trainers may record information about payments received from their own clients within the app.

e. Usage and Device Information (collected automatically)

• Device type, operating system, and mobile network information.
• Session information, including time and length of use.
• Usage patterns and preferences, used to improve the Services.

We use your information for the purposes below. Where the GDPR applies, the legal basis for each purpose is shown.

• Operate the Services — create and manage your account, deliver core app functionality, enable trainer–client coaching, and provide scheduling.Contract
• Process your health and fitness data — workouts and workout history, body stats and measurements, nutrition data, and progress pictures.Explicit consent
• Share progress pictures with a trainer you choose.Explicit consent
• Process payments and manage subscriptions.ContractLegal obligation
• Send service and account messages — security alerts, transactional and account notices, push notifications you enable.ContractLegitimate interests
• Send marketing communications. You can opt out at any time.Consent
• Analytics, troubleshooting, security, and product improvement.Legitimate interests
• Comply with legal obligations and protect rights, property, and safety.Legal obligationLegitimate interests

Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interests, you can object (see section 9).

• Trainers and Clients: As described in section 1, data flows between connected trainers and clients to enable coaching, subject to the progress-picture consent rules.
• Service Providers (Sub-processors): With trusted providers who help us operate the Services and who are contractually required to protect your data and process it only on our instructions:
  • Google / Firebase (Google Cloud) — hosting, database storage, authentication, and analytics (policies.google.com/privacy).
  • Apple App Store and Google Play — in-app purchases (apple.com/legal/privacy, policies.google.com/privacy).
  • Stripe — website payment processing (stripe.com/privacy).
• Authorized Personnel: Our authorized staff and contractors may access personal data where necessary to operate, support, maintain, or secure the Services. Because data is stored in our managed cloud infrastructure (Firebase), authorized personnel are technically able to access stored data, including health data and progress pictures. Such access is limited to legitimate operational and support purposes and is subject to confidentiality obligations.
• Legal Requirements: When required by law, regulation, or legal process, or to protect the rights, property, or safety of our users or the public.
• Business Transfers: In connection with any merger, sale of assets, or acquisition of all or part of our business. We will notify you if your data becomes subject to a different privacy policy.
• With Your Consent: For any other purpose disclosed to you, with your consent.

Our infrastructure providers, including Google/Firebase, may store and process data on servers located outside your country, including in the United States. Where we transfer personal data outside the European Economic Area (EEA) or the United Kingdom, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and our providers’ applicable certifications. Contact us for more information about these safeguards.

Our website uses essential cookies to keep you signed in and remember your preferences, and basic analytics (for example, Google/Firebase Analytics) to understand how the Services are used. Our app uses similar device or SDK identifiers for the same purposes. We do not use cookies or your data for targeted advertising. You can refuse cookies through your browser settings on our website, though some features may not work as a result.

We take reasonable technical and organizational measures appropriate to our size and the nature of the data to protect your information, and we host it on Firebase (Google Cloud) infrastructure. No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify the competent supervisory authority and affected individuals where and as required by law. Please notify us immediately if you suspect any unauthorized use of your account.

We keep your personal information for as long as your account is active or as needed to provide the Services. When you delete your account, we delete or anonymize your personal data — including workouts, body stats, nutrition data, and progress pictures — within a reasonable period, including clearing residual copies from our backups in the ordinary course of our backup cycle, except where a longer period is required or permitted by law. Certain records, such as payment and transaction records, are retained for the periods required by Romanian accounting and tax law. You can request deletion of specific data, such as progress pictures, at any time from within the app or by contacting us.

Depending on your jurisdiction, you have the following rights regarding your personal information:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your personal data, subject to legal and contractual limits.
• Objection and Restriction — object to or request restriction of our processing.
• Data Portability — receive your data in a structured, commonly used, machine-readable format.
• Withdraw Consent — where processing is based on consent (such as health data and progress pictures), withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal.

You can manage much of your data and consent directly in the app. To exercise any right, contact us using the details in the “Contact Us” section; we will respond within the timeframes required by law (under the GDPR, generally within one month, which we may extend by up to two further months for complex or numerous requests, in which case we will let you know). You will not be charged for exercising your rights in most cases.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, and we do not engage in such profiling. Personalized fitness content is informational and does not replace professional advice.

For users in the EU or EEA, we are committed to complying with the General Data Protection Regulation (GDPR). Your data is processed lawfully, fairly, and transparently, on the legal bases set out in section 3, and you have the rights set out in section 9.

You also have the right to lodge a complaint with your local data protection authority. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro). For any privacy question or request, you can contact us at the details below.

Our Services are intended only for adults and are not directed to anyone under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us with personal information, please contact us immediately so we can take appropriate measures.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will post the updated policy with a new “Last Updated” date and, for significant changes, notify you through the Services. Your continued use of the Services after changes take effect constitutes acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at: