Privacy policy

Summary

Who is responsible

The controller responsible for processing personal data in the Setstack app and on this website within the meaning of the EU General Data Protection Regulation (GDPR) is:

Abd Alrahman El-Hamaoui
Freistädterstraße 8
4040 Linz
Austria
Email: hello@abd-dev.at

Setstack is developed and operated by a single developer. No data protection officer has been appointed because there is no legal obligation to do so. For all privacy questions, write to the email address above.

Data stored on your device

Everything you log in Setstack (workouts, sets, weights, reps, routines, custom exercises, personal records and settings such as units and language) is stored locally in the app's storage on your device. If you use Pro body tracking, your bodyweight, measurements and progress photos are stored on your device as well.

This local data does not reach us. We have no access to it unless you choose to send it to us, for example by attaching a CSV export to a support email.

Home-screen widget and Wear OS watch (Pro): the widget shows data from the app on your home screen. If you use the Setstack watch app, your phone sends the state of your current workout (exercise, next set, rest timer, your next routine and the number of workouts this week) to your own paired watch through Google Play services (the Wearable Data Layer), and the watch sends your taps (for example "Log set") back to the phone. Over Bluetooth this data goes directly between the devices; when phone and watch are not connected by Bluetooth (for example over Wi-Fi or mobile data), Google Play services may relay it through Google's servers, encrypted, as part of Google's own service. It does not reach us, and the watch app stores nothing beyond the last state it received.

AI summaries (Pro): if you use the AI summary of a workout, the text is saved in the same local database. It is never synced.

Android device backup: if you have turned on Android's own backup or device-to-device transfer, Android may include Setstack's local data in your personal Google backup or move it to a new phone. This is controlled by your device settings and by Google, not by us, and we cannot access these backups.

You remove local data by deleting it in the app, by clearing the app's storage in Android settings, or by uninstalling Setstack.

Accounts (optional)

You can use Setstack without signing in. Accounts are provided by Firebase Authentication, a service of Google.

• Continue as guest: Firebase creates an anonymous account with a random user ID. No name, email address or other identifying information is stored.
• Sign in with Google: Firebase stores your user ID together with the email address, display name and profile photo URL that Google provides for your Google account. A guest account can later be linked to Google; the user ID stays the same.

Firebase Authentication also stores technical account information such as when the account was created and last signed in. To provide the service and protect it against abuse, Google processes technical data such as your IP address and device information when the app talks to Firebase.

Purpose and legal basis: providing your account, linking your Pro purchase and cloud data to it, and letting you use it on several devices (Art. 6(1)(b) GDPR, performance of the contract).

Cloud backup and sync (Pro)

Cloud backup and sync is a Setstack Pro feature and is only active if you turn it on. When it is on, your Setstack data (for example workouts, sets, routines, custom exercises and settings) is stored in Cloud Firestore, a Firebase database service of Google, under your Firebase user ID, so it can be restored and kept in sync across your devices.

Data is encrypted in transit and stored encrypted at rest by Google. Only your account can access your data through the app. Progress photos are never uploaded.

Purpose and legal basis: providing the sync feature you purchased (Art. 6(1)(b) GDPR). Turning sync off stops future uploads; to remove data already stored in the cloud, delete your account (see Retention and deletion).

Purchases (Google Play)

Setstack Pro is sold through Google Play Billing. Google processes the payment, your payment details and your billing address under its own terms and privacy policy. Setstack never receives your payment details.

The app only receives the information needed to unlock Pro: a purchase token, the product you bought and the status of your entitlement (for example active, renewed, cancelled or expired). Google keeps its own records of your purchases under its own policies.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract).

Health Connect (Pro, optional)

If you turn on the Health Connect export and grant permission, Setstack writes your finished workouts to Health Connect on your device as exercise sessions (exercise type, title, start and end time, your workout note and one segment per exercise with its repetitions) and, for distance exercises such as running or rowing, the distance. This lets other apps you allow see your workouts. Setstack does not read any data from Health Connect.

When changes reach Health Connect: while the export is on and you have Pro, finishing, editing or deleting a workout in Setstack writes, updates or deletes it in Health Connect shortly afterwards (also for changes that arrive through cloud sync). If Pro ends, Setstack stops writing but still deletes from Health Connect the workouts you delete in Setstack, as long as the export stays connected. After you disconnect (in Setstack or by revoking the permission in Health Connect), nothing is written, updated or deleted any more. If you only allow exercise sessions and not distance, Setstack writes sessions without distances.

Deleting data: you can disconnect at any time in Setstack's settings or revoke the permission in the Health Connect settings on your device. Data already written stays in Health Connect, in your own Health Connect store, until you delete it there. Deleting your Setstack account, also with "delete workouts on this device", does not delete records already written to Health Connect; delete them in Health Connect if you want them gone.

Data from Health Connect is never transferred to third parties, never used for advertising and never sold.

Legal basis: your consent (Art. 6(1)(a) GDPR and, insofar as the data concerns health, Art. 9(2)(a) GDPR). You can withdraw consent at any time by revoking the permission; this does not affect the lawfulness of processing before the withdrawal.

AI features (Pro, optional)

Setstack Pro has optional AI features: an AI summary of a finished workout, Type sets (sets you type in plain words) and a training chat (Ask your coach). They are off until you turn them on, in a consent dialog the first time you use one or under Settings → AI features. Simple input such as "80x8" or "3x8 @ 80" is read on your device and does not use AI.

What is sent. Only when you tap an AI button, the app sends the content of that request to Google's Gemini model:

• Summary: the workout (title, date, duration, exercises, sets with weights, repetitions, times, distances and effort) and, for comparison, your previous session of each of its exercises.
• Type sets: the text you typed, and your weight unit (kg or lb). No workout data is added to it.
• Coach: your question, the earlier messages of the current chat and a short summary computed on your device: working volume per muscle group in the last eight weeks, workout frequency, the best estimated one-rep maxes of your most trained exercises and the name of your running program.

Notes. Notes you wrote on workouts, exercises and sets can contain health information (for example an injury). They are sent only if you turn on "Include my notes", which is off by default and which you can change at any time under Settings → AI features. Anything you type into a question for the coach is sent as well, so please do not write there what you do not want Google to process.

What is not sent. Setstack puts no name, email address, account details, profile photo or progress photo into the content of a request, nothing is sent in the background, and the app limits itself to 30 AI requests per day (a value Setstack can change remotely, between 0 and 100). Like every Firebase request, an AI request also carries technical credentials that belong to Google's Firebase service and are not part of the content: an App Check token (proof that it comes from the genuine app) and, if you are signed in (guest or Google), your Firebase authentication token, which contains your user ID.

Remote settings. While you have Setstack Pro, the app fetches a few settings from Firebase Remote Config, a service of Google: a switch that turns the AI features on or off for everyone, the name of the Gemini model and the daily request limit. This happens in the background, with or without AI features turned on in your app, so that the features can be switched on remotely. The request carries the Firebase installation ID and technical app and device data (such as the app and Android version and the language), but no training data. Users without Pro never contact Remote Config for this.

Who receives it and what Google does with it. Google (Google Ireland Limited and Google LLC) receives the content of the request through Firebase AI Logic and the Gemini Developer API, to generate the answer. Setstack uses the paid services of the Gemini API. Under the paid-services terms of the Gemini API Additional Terms of Service, Google processes the content on our behalf as our processor, under Google's data processing terms, and does not use the prompts and responses to improve its products. Google logs prompts and responses for a limited period only, to detect and prevent violations of its Prohibited Use Policy and to meet legal and regulatory disclosure obligations. Content may be processed or cached transiently in any country where Google or its agents have facilities (see International transfers). Setstack does not use the data for advertising.

Purpose and legal basis. To write the answer you ask for. The legal basis is your consent (Art. 6(1)(a) GDPR and, insofar as the content you send reveals health data, Art. 9(2)(a) GDPR), which you give in the consent dialog. The sentence about notes and health information is shown there, and notes are only included if you choose so.

Retention and your control. Setstack stores AI summaries only in the app's local database on your device; they are not synced and not uploaded by us. The coach chat exists only in memory while the screen is open. You can delete saved summaries under Settings → AI features, and they disappear with the workout they belong to. At Google, the data is handled under Google's terms; we have no access to it and no influence on how long Google keeps its logs. Opt-out: turn the switch under Settings → AI features off at any time; from then on nothing is sent. Withdrawing consent does not affect processing before the withdrawal.

AI answers can be wrong and are not medical advice. No decision with legal or similarly significant effect is made about you.

Progress photos and body data

Bodyweight, measurements and progress photos (Pro body tracking) are stored only on your device. Setstack never uploads progress photos to any server. See Data stored on your device for Android's own device backup.

Notifications and permissions

Setstack only uses local notifications, for example for the rest timer. No push notification service is used, and no notification data is sent to us.

The app asks for permission to show notifications and, optionally, to set exact alarms ("Alarms & reminders") so that rest timers longer than 3 minutes can end on time. These permissions only work on your device.

What we do not do

• No advertising and no advertising ID.
• No analytics, tracking or crash-reporting SDKs.
• No selling, renting or sharing of your data for advertising or marketing.
• No profiling and no automated decision-making within the meaning of Art. 22 GDPR.

Contacting us

If you email us, we process your email address, the content of your message and any attachments to answer your request (Art. 6(1)(b) GDPR where it concerns the app or a purchase, otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering inquiries). We keep this correspondence only as long as needed to handle your request, unless we are legally required to keep it longer. Our email is hosted by IONOS SE in Germany, which stores and delivers these messages for us as our processor.

This website

This website does not use cookies, analytics or tracking.

• Hosting: the site is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit a page, Vercel processes technical data such as your IP address, the requested page, date and time, and browser information (server logs) to deliver the site and keep it secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website).
• Fonts: the "Roboto Flex" font is hosted on this website itself. Your browser does not connect to Google Fonts or any other third-party font service.

Service providers and recipients

We only share data with the following providers, and only as far as needed for the purposes described above:

We may also disclose data where we are legally obliged to, for example to authorities on the basis of a court order.

International transfers

Google and Vercel may process data in the USA and other countries outside the European Economic Area. Such transfers are based on the EU-U.S. Data Privacy Framework, for providers certified under it, and on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), which these providers include in their data processing terms.

Retention and deletion

• Account and cloud data: kept until you delete your account. You can delete it in the app under Settings → Account → Delete account, which deletes your Firebase account and all your cloud data. You can also request deletion by email; see Delete your Setstack account. Deletion is completed within 30 days.
• Local data: stays on your device until you delete it, clear the app's data or uninstall the app.
• AI summaries: kept on your device until you delete them (Settings → AI features), delete the workout, clear the app's data or uninstall the app. Requests to the AI service are handled by Google under its terms (see AI features).
• Health Connect (if you turned it on): workouts written there stay in Health Connect on your device until you delete them there; deleting your account or Setstack's data does not remove them (see Health Connect).
• Purchase records: kept by Google under its own policies.
• Portability: you can export all your workouts at any time as a CSV file under Settings → Export CSV.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data erased (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20),
• object to processing based on legitimate interests (Art. 21),
• withdraw consent at any time with effect for the future (Art. 7(3)).

To exercise your rights, email hello@abd-dev.at. We may ask you to confirm that the account is yours.

You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

Children

Setstack is not directed at children under 16. We do not knowingly process personal data of children under 16. If you believe a child has given us personal data, contact us and we will delete it.

Security

Data sent between the app and Firebase, including AI requests, is encrypted in transit (TLS). Cloud data is protected by Firebase security rules so that only the signed-in account can access its own data.

Changes to this policy

We update this policy when the app or the law changes. The date at the top shows the latest version. If a change significantly affects how your data is used, we will point it out in the app.