Version: 2026-11-05 · Effective: 5 November 2026
This policy explains how your personal data is processed when you use the PilatesGo mobile app (the “App”), and your rights under the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”).
1. Controller
GencS — Semal Genc, Türkiye
Email: genc.sem01@gmail.com
2. In short
We only process data the App needs to work. We do not sell your data.
We process health data such as weight and body measurements only with your explicit consent. If you don’t consent, you can still use the App; only the measurement features stay off.
If you are connected to a trainer, your trainer can see your program, measurements and class records.
Free plans show ads through Google AdMob. Your health, workout and diet data are never shared with ad providers.
You can delete your account and data at any time.
3. Data we process
Account and contact: Name, email, phone (optional), role (trainer / student / individual), app language. Source: you; your trainer if you are a student.
Health and body data (special category): Date of birth, height, weight, body fat, waist / hip / chest / thigh / arm measurements, body mass index. Source: you or your trainer.
Workouts: Program exercises, sets / reps / duration, workout history, completed / partial / skipped exercises, exercise notes. Source: your use of the App.
Nutrition: Diet plans, meals, daily adherence. Source: you or your trainer.
In-person classes and payment records: Attendance days, class requests, fee type, fee and payment amounts, payment method (cash / transfer / card — not card details). Source: your trainer.
Notes: A trainer’s notes about a student (e.g. injury, goals), a student’s notes to their trainer. Source: you or your trainer.
Membership, GO points and store: Subscription plan, plan changes, GO point activity, unlocked packs, rewards. Source: your use of the App, Google Play.
Device and technical: Country / region (for pricing and units), unit preferences, app version, crash logs, notification token. Source: your device.
Advertising (free plans): Advertising ID, approximate location (from IP address), app and ad interactions, diagnostic data. Source: your device, Google AdMob.
Food searches: Food names you search for and barcode numbers you scan. Search texts are stored on our server without being linked to your account; for the search limit, only the search time is kept with your account, for up to 24 hours. Source: you.
We do not process precise (GPS) location, contacts, photos, microphone recordings or payment card details. Subscriptions are paid through Google Play; your card details never reach us.
Camera: Turned on only when you choose to scan a barcode, with your permission. The image is processed on your phone; it is never sent anywhere or stored.
Because notes may contain health information, they are protected as special category data.
4. Purposes and legal bases
Creating your account and providing the App (programs, history, diet, class tracking)
GDPR: contract (Art. 6(1)(b)) · KVKK: contract (Art. 5/2-c)
Recording health and body data, showing progress charts
GDPR: explicit consent (Art. 9(2)(a)) · KVKK: explicit consent (Art. 6/2)
Managing subscriptions, GO points and rewards; preventing abuse
GDPR: contract, legitimate interests (Art. 6(1)(f)) · KVKK: contract, legitimate interest (Art. 5/2-f)
Security, troubleshooting, improving the service
GDPR and KVKK: legitimate interests
Showing ads on free plans
GDPR: consent (Art. 6(1)(a)) · KVKK: legitimate interest; explicit consent for personalized ads
Promotional and news notifications
GDPR: consent · KVKK: explicit consent and commercial message consent
Legal obligations and official requests
GDPR: legal obligation (Art. 6(1)(c)) · KVKK: legal obligation (Art. 5/2-ç)
5. Trainers and students
If you are a student connected to a trainer, your trainer can see: your program and workout history, measurements and progress, diet plans and adherence, class attendance and payment records, active rewards and exercise notes.
Your trainer may enter your details when adding you. Trainers must inform their students and obtain any required consent before entering their data.
Payment records are for the trainer’s own tracking only. PilatesGo does not process payments between trainers and students.
If you disconnect from your trainer, they can no longer see your new data.
6. Who we share data with
We share data only with the service providers below, only as far as needed to provide the service, and under contract:
Supabase Inc.: database, authentication, storage. Location: EU (Frankfurt, Germany).
Google (Google Play): subscription purchases, billing. Location: global.
Google (AdMob): ads on free plans. Location: global.
Google (Firebase Cloud Messaging): notifications. Location: global.
USDA FoodData Central (U.S. Department of Agriculture): food nutrition search. Only the search text is sent, via our server; your identity is not sent. Location: USA.
DeepL SE: translation of food names. Only the search text and food names are sent, via our server; your identity is not sent. Location: EU (Germany).
Open Food Facts (non-profit association): product lookup by barcode. Only the barcode number is sent, directly from your device; your IP address may be visible to them in the process. Location: EU (France).
To show ads on free plans, only your advertising ID, approximate location, app interactions and diagnostic data are shared with Google AdMob. Your name, email, health data, workout, diet and payment records are never shared with ad providers. Paid plans show no banner or full-screen ads. Watching a rewarded ad to earn GO points is entirely optional; no feature is restricted if you choose not to watch.
Learn how Google uses data from apps that use its services: https://policies.google.com/technologies/partner-sites
Otherwise, data may only be disclosed to competent authorities where required by law. We do not sell your data.
7. International transfers
Your data is stored on servers in the EU (Germany). Some Google services may process data in other countries, including the United States. Such transfers rely on adequacy decisions and the EU Standard Contractual Clauses (GDPR) and on standard contracts and, where required, your explicit consent (KVKK Art. 9).
8. Retention
Data is kept while your account is open.
If you delete your account, your data is deleted or anonymised within 30 days, and may remain in backups for up to 35 more days.
If you withdraw consent for health data, your health data is deleted on request within the same periods.
Accounts unused for 24 months are notified and then deleted.
Records subject to a legal retention obligation are kept for the period required by law.
9. Security
Data is encrypted in transit (TLS). Server access is restricted by row-level security rules: each user can only see their own data, and trainers can only see their own students’ data. GO points, rewards and subscriptions are validated on the server.
10. Children
The App is not intended for children under 16. Users aged 16–18 may only use it with the consent of a parent or guardian. Trainers must obtain parental consent before entering the data of students under 18. If we learn that we process data of a child under 16, we will delete it.
11. Your rights
Under GDPR Arts. 15–22 and KVKK Art. 11 you have the right to:
Access your data and receive a copy
Data portability: receive your data in a machine-readable format
Rectification and erasure
Restriction of processing and objection
Know who your data has been shared with
Object to decisions based solely on automated processing
Compensation for damage
Withdraw consent at any time (withdrawal does not affect the lawfulness of earlier processing)
How to apply: Email genc.sem01@gmail.com from the email address registered in the App, stating your name and your request. We respond free of charge within 30 days.
Complaints: You can complain to the data protection authority in your country of residence (in the UK, the ICO; in Türkiye, the KVKK Board at kvkk.gov.tr).
12. Withdrawing consent, ad choices and deleting your account
In the App, go to Profile > Privacy & permissions to withdraw consent for health data and notifications, download your data or delete your account. If you cannot access the App, follow the steps on the account deletion page.
Ad choices: In the EU/EEA, the United Kingdom and Switzerland, you are asked for consent to personalized ads through Google’s consent message; you can change your choice at any time under Profile > Privacy & permissions > Ad privacy options. On any Android device, you can reset or delete your advertising ID in your device settings under Google > Ads.
13. Changes
We may update this policy. For material changes we will inform you when you open the App and ask for your consent again where required. The current version is always on this page.
14. Contact