Skip to content

Privacy Policy

Version 2026-09-06

What we collect

  • · Your email address and display name.
  • · The content you create in the app.
  • · Your body metrics, bodyweight and any measurements you record, and your meal and food logs if you use them. These are health information and we treat them as such. They are yours, visible only to you unless you share them, and included in your export.
  • · If you search the gym directory by distance, your device sends us its coordinates for that one search, with your permission and only when you ask for it. We do not store them and we do not keep a history of where you have been.
  • · Whether you have a subscription and when it renews. Payment happens through the App Store or Google Play, not through us. We never see or store card numbers, and we do not receive your billing address. What reaches us is a receipt reference and a status.
  • · If you ask somebody to coach you: what you want out of it, how long you have trained, which days you can train, anything you choose to tell them about injuries, surgery, conditions or medication, and an email address or phone number if you give one. You type all of this yourself and every field is optional. We never pass on the email address you signed up with. Health information here is treated as sensitive, and we ask for it only because a coach who does not know about your knee will write you a programme that hurts it. See Coaches and gyms below for who sees what, and when.
  • · A hashed IP-derived key used solely for rate limiting. It is not linked to your account and is not used for analytics.
  • · If you use progress photos: the images themselves, the date you give each one, and anything you write beside it. These are stored privately and are not visible to anyone else, not to other users, not to gyms or trainers you are connected to, and not to our own admin tools. There is no way to share one from inside Spottr. Every time you view one, the link is created fresh and stops working about a minute later. Deleting a photo removes the image itself rather than hiding it. Closing your account removes them, though the images are cleared by a routine sweep rather than the same instant.
  • · When you sign in: the time, the address your connection came from, your browser and device type, and, where our host resolves it, the city and country. This is linked to your account, on purpose, so that you can check whether a sign-in was you. You can see your own list at any time. We keep it for 90 days and delete it when our pruning runs, that is a manual step today, not a schedule, and we will say so here rather than imply a cadence we do not yet have. It is not used for analytics, advertising, or working out how much you use the app, and it records nothing about what you do once signed in. We do not look your address up against any third-party location service.
  • · If you arrived through an affiliate or referral link, the code you arrived on and the page you landed on.

Cookies

We set cookies that keep you signed in. That is all they do. This build runs no analytics, no advertising pixels and no session recording. If that changes, this page changes with it.

Referral and affiliate codes are stored in your browser's local storage for 30 days so the person who introduced you gets credit. Clearing your browser data removes it.

The phone app

The Spottr app is a separate program from this website. It signs in to the same account and reads the same training, so everything above still applies to what you log. Three things work differently, and all three are on the device.

  • · Progress photos taken in the app never leave your phone. The picture is written to a Spottr album in your normal photo gallery. It is not uploaded, no row is created for it, and we never see it or know it exists. Deleting it is deleting it from your gallery, like any other photo. Only the bodyweight you type beside it is saved to your account, as a weigh-in.
  • · The camerais used only while you are on the camera screen, and only to take the photo you press the button for. The app asks your phone for permission the first time and you can refuse or withdraw it in your phone's settings, which switches that screen off and nothing else.
  • · Your gallery is read when you pick an earlier photo to compare against. The app looks at your recent pictures to show you the picker. Nothing is copied off the device by doing that.
  • · Your sign-inand a couple of settings, such as whether you read weights in kilograms or pounds, are kept in your phone's secure keystore so you are not asked to sign in every time.

The app contains no analytics, no advertising identifier, no crash reporter and no tracking of any kind. It asks for three permissions and no others: internet, camera, and on very old Android versions the storage permission needed to write a photo to your gallery. If any of that changes, this page changes in the same release.

Coaches and gyms

Asking somebody to coach you is the one place Spottr shows your information to another person. It only ever happens because you asked, to the one coach you asked, and you choose what to put in the form.

  • · While they are deciding: they see your name, what you want out of it, how long you have trained, the days you can train, and anything you wrote about injuries or conditions. They need it to answer honestly.
  • · Only once they accept: your email address and phone number, if you gave them. Ask five coaches and you have given your number to none of them until one says yes.
  • · When it ends: your contact details stop being visible to them. What you told them about your training stays, because they coached you and that is a record of real work.
  • · Your training log, weigh-ins, meals and progress photos are not included. A coach sees those only if you separately choose to share them.

You can withdraw at any time by ending the coaching relationship, which removes their access to your contact details, or by asking us to delete the request outright.

Who processes it

  • · Supabase, database, authentication and email delivery.
  • · Apple and Google take the payment for subscriptions bought in the app. They are the seller, not our processor, and they hold your payment details rather than us. Their own privacy terms cover that part.
  • · Our hosting provider, serving the application.

We do not sell your data and we do not share it for advertising.

Your training data is never sent to an AI model and is never used to train one. No processor above is an AI company, and this build contains no AI feature of any kind. If we ever add one it will be opt-in, it will never be the default path through the app, it will tell you what is about to be sent before it sends it, and it will not be your log.

Why we are allowed to hold it

If you are in the UK or the EU, the UK GDPR and GDPR apply to you wherever we are, and these are the grounds we rely on:

  • · To run your account and give you the app you asked for — performance of our contract with you. Your email, your display name, your training log.
  • · To keep the service working and secure — our legitimate interests. Rate-limit keys and the sign-in list, which exists so you can spot a sign-in that was not you.
  • · Health information — your explicit consent, and only that. Your weigh-ins, measurements, food logs, progress photos and anything you tell a coach about injuries or conditions. You give it by choosing to fill the field in; you withdraw it by deleting the entry, ending the coaching relationship, or asking us to. Nothing here is a condition of using Spottr, and refusing costs you only the feature that needed it.
  • · To keep records the law requires us to keep — legal obligation. Tax and billing records.

We do not rely on legitimate interests for anything sensitive, and we do no profiling and no automated decision-making that produces legal or similarly significant effects.

Where it is

Our database and hosting sit outside the UK and the EU. Where personal data of a UK or EU user is transferred out, it is covered by the UK International Data Transfer Addendum and the European Commission’s Standard Contractual Clauses with the providers named above. Ask us at hello@viridiandynamics.com.au and we will tell you exactly which regions your data is in.

How long we keep it

  • · Your account and everything in it: while your account is open.
  • · After you close it: removed, with progress photo files cleared by a routine sweep rather than the same instant.
  • · The sign-in list: 90 days.
  • · Billing records: as long as tax law requires us to keep them, which in Australia is five years. These are records of payments, not your training.
  • · A coaching request you send: until you or the coach delete it, or you close your account.

Your rights

You can ask us to:

  • · Give you a copy of your data, or send it somewhere else in a portable format.
  • · Correct anything that is wrong.
  • · Delete your account and its contents.
  • · Stop using it for a while, without deleting it, while a dispute is sorted out.
  • · Stop a particular use you object to.
  • · Withdraw a consent you gave. That does not undo what was done while it stood, and you can do most of it yourself: delete the entry, or end the coaching relationship.

Email hello@viridiandynamics.com.au and we will action it within 30 days, free. You can also export everything yourself from your account page at any time, on any plan, without asking us.

If you think we have got it wrong you can complain to a regulator: the OAIC in Australia, the ICO in the UK, or your national data protection authority in the EU. You do not have to come to us first, though we would rather you did.

Security

Passwords are hashed by our authentication provider and are never visible to us. Data is encrypted in transit. Access to your rows is enforced at the database level, not merely in the application.

Contact

Viridian Dynamics, hello@viridiandynamics.com.au.