**Last updated: 21 August 2026**
This policy explains what Kyklo ("the app") collects, why, who it is shared with, and the choices you have. It applies to the Kyklo mobile app for iOS and Android.
Kyklo is operated by Kyklo, 31 Rue julien sacaze, 31100 Toulouse France. For any question about this policy or your data, contact us at thibault@kyklo.xyz
## What we collect
**Account information.** When you create an account we collect your email address. If you sign up with a password, that password is stored only as a salted hash by our authentication provider and is never visible to us. If you sign in with Apple, we receive your name and email address — where you choose Apple's "Hide My Email", we only ever see Apple's relay address. If you sign in with Google, we receive your email address and basic profile information.
**Your profile.** Your first name, your preferred weight unit (kg or lbs), your exercise library preference, your device's time zone, your notification preferences, and the date you completed onboarding.
**Your training data.** The workout templates you build, the exercises you create along with any tags you give them, and every workout you perform — including sets, repetitions, weights, durations, rest periods, and the times you started and finished.
**Notification token.** If you enable notifications, we store the push token issued to your device so we can send reminders. It identifies the device, not you personally, and it is deleted when you sign out or disable notifications. We also keep a record of which reminders we have already sent you, so that we do not send the same one twice.
**Subscription information.** If you buy Kyklo Pro, our subscription provider records which product you bought, the store you bought it from, the purchase and renewal dates, and whether your subscription is active. Your email address is also shared with that provider so we can help you with billing questions. We never receive or store your card details — payment is handled entirely by Apple or Google.
**Usage analytics.** Which screens you open and which actions you take in the app (for example: a workout started, a workout finished, a setting changed). These events are linked to your account identifier so we can understand how the app is used. Event values are truncated before being sent, and we do not attach your training content to them.
**Diagnostics.** When the app crashes or hits an error, we receive a technical report containing the error, the device model, and the app version, so we can fix it.
## What we do not collect
- **No advertising identifiers.** We do not collect your device's advertising ID (IDFA on iOS, AAID on Android), and the app contains no advertising SDKs. Kyklo does not show ads and does not sell or share your data with advertisers or data brokers.
- **No location data.** The app never requests or records your location. Your time zone is stored so reminders arrive at a sensible hour, and it does not reveal where you are.
- **No health or fitness platform data.** Kyklo does not connect to Apple Health or Google Fit, and reads nothing from them.
- **No contacts, photos, microphone, or camera access.**
## Why we use it
| What we do | Data used | Why we are allowed to |
| --- | --- | --- |
| Create and secure your account | Email, password hash, sign-in identity | To perform our contract with you |
| Store and sync your training data across your devices | Profile, workouts, sessions, exercises | To perform our contract with you |
| Sell and manage Kyklo Pro | Subscription information, email | To perform our contract with you |
| Send reminders you asked for | Push token, time zone, notification preferences | Your consent, which you can withdraw at any time |
| Understand how the app is used and improve it | Usage analytics | Our legitimate interest in improving Kyklo |
| Diagnose crashes and errors | Diagnostics | Our legitimate interest in a working app |
## Who we share it with
We do not sell your data. We use the following providers, who process data only on our instructions:
| Provider | What it handles | Where it is processed |
| --- | --- | --- |
| Supabase | Account authentication and all your training data | use-east-1 |
| RevenueCat | Subscription status and purchase history | United States |
| Google (Firebase Analytics) | Usage analytics | United States |
| Sentry | Crash and error diagnostics | European Union (Germany) |
| Expo | Push notification delivery and app updates | United States |
| Apple, Google | Payment processing for subscriptions | Per their own privacy policies |
Where a provider processes data outside your country, that transfer is covered by the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.
We may also disclose data if we are legally required to, or to protect our rights or the safety of others.
## How long we keep it
We keep your account and training data for as long as your account exists. When you ask us to delete your account, we delete your profile, workouts, exercises, sessions, notification tokens, and subscription records from our database. Diagnostic reports are retained for up to 90 days. Analytics data is retained according to our analytics provider's default retention period.
Purchase records may be retained longer where we are required to keep them for tax or accounting purposes.
## Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to our use of it. You can also withdraw consent for notifications at any time, either in the app's Settings or in your device settings.
To exercise any of these rights, email thibault@kyklo.xyz. We will respond within one month.
If you are in the European Economic Area or the United Kingdom and you believe we have handled your data improperly, you have the right to complain to your local data protection authority.
## Children
Kyklo is not intended for children under 16, and we do not knowingly collect data from them. If you believe a child has given us their data, contact us and we will delete it.
## Security
Your data is held in an access-controlled database where each row is restricted to the account that owns it, and all traffic between the app and our servers is encrypted in transit. No system is perfectly secure, but we take reasonable measures to protect your information.
## Changes to this policy
If we change this policy we will update the date at the top and, where the change is significant, tell you in the app before it takes effect.