Privacy Policy

The data controller for personal data is the owner of the Carvolune app (hereinafter: “we”, “us”). For any questions about personal data you can contact us at: carvolune@wp.pl.

• Account data: first name, last name, email address, phone number.
• Trainer profile data: city, bio, certifications, specializations, profile photo.
• Client data: first name, last name, email, phone, photo — entered by the trainer.
• Training data: sessions, plans, exercises, personal records (PRs), notes.
• Health data (optional): steps, calories, distance, sleep, workouts — synced with Apple Health only with your consent.
• Financial data: income and expenses entered by the trainer in the payments module.
• Technical data: device identifier, error logs.

• Providing the app’s services (Art. 6(1)(b) GDPR — performance of a contract).
• Handling subscriptions and payments (Art. 6(1)(b) GDPR).
• Complying with legal obligations (Art. 6(1)(c) GDPR).
• Legitimate interest — security and stability of the app (Art. 6(1)(f) GDPR).

Health data retrieved from Apple Health (steps, calories, distance, sleep, workouts) is used solely to display progress within the Carvolune app. It is not shared with third parties and is not used for advertising or profiling. Syncing with Apple Health is optional and requires the user’s explicit consent. Access can be revoked at any time in iOS Settings → Health → Access to Data and Devices.

We store data on Supabase servers (AWS infrastructure in the EU region). Health data synced from Apple Health is stored on Supabase servers and is not transferred outside the EEA without your consent.

We do not sell personal data. Data may only be shared with:

• Supabase Inc. — database and authentication hosting.
• RevenueCat Inc. — subscription and in-app purchase handling.
• Google LLC — optional sign-in with Google.
• Apple Inc. — optional sign-in with Apple, App Store purchases.

All subprocessors operate under appropriate data processing agreements.

In-app purchases are handled by the Apple App Store. Payment card data never reaches our systems. Subscriptions are managed through Apple ID account settings.

• Access to your data and a copy of it.
• Rectification of inaccurate data.
• Erasure of data (“right to be forgotten”) — available directly in the app under Profile → Delete account.
• Restriction of processing.
• Data portability.
• Objection to processing.

Requests can be sent to: carvolune@wp.pl

You can delete your account and all associated data at any time in the app: Profile → Settings → Delete account. Data will be permanently removed from our servers. A backup copy may be retained for up to 30 days in line with Supabase’s retention policy.

The carvolune.com website uses cookies necessary for its operation (session, preferences). The mobile app uses localStorage to store session and settings locally on the device. This data is not transmitted to advertising parties.

We will notify you of material changes to this privacy policy via the app or by email. The current version is always available at carvolune.com/privacy.

You have the right to lodge a complaint with the Polish Data Protection Authority (UODO — Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. If you are located in another EEA country, you may also contact your local supervisory authority.