Privacy notice for the SetAura app
Beta version of 16 October 2026
Beta version. A lawyer reviews this text before public launch. Once the SetAura company is founded it becomes the controller; we will tell you before that happens.
Who is responsible
The data controller for the app is Tolga Atasagun, Avenida D. Teodoro Faria 4, Coopreme, Bloco 1, 1.º Esq., São Martinho, 9000-738 Funchal, Portugal, a private individual who runs SetAura until the company is founded. Contact for anything about your data: [email protected].
Without an account
The app works fully offline without an account. Your workouts, body measurements and activity stay on your phone and nothing is sent to us. If you connect Health Connect, the app reads steps, heart rate and watch sessions on the device, with Android’s permission, and keeps them there.
What reaches the cloud, and only when
Nothing leaves your phone until you create an account and give separate, explicit consent to store data in the cloud. Even then, only the data types you switch on are synced: workouts and sets, body measurements (weight, body fat, circumferences) and daily activity (steps, calories, heart rate). For your account we keep your email address and, if you give it, your name. We also keep a record of each consent: which one, which text version and when. With a cloud account we also record which version of the in-app health notice you accepted and when.
Why, and on what legal basis
Your account is needed to provide the service you ask for (GDPR article 6(1)(b)). Workouts, body measurements and activity can reveal information about your health, so storing them in the cloud and sharing them with a trainer rely on your explicit consent (GDPR article 9(2)(a); in Türkiye, KVKK article 6). You can withdraw consent at any time; this does not affect what happened before. We never sell your data or use it for advertising.
Sharing with a trainer
A trainer sees your data only if you accept their invite code and give a separate consent. You choose each data type with its own switch: workouts, body measurements, daily activity. Seeing every set (weight, reps, set type) needs one more, separate consent. Turning a switch off, or leaving the trainer, ends their access immediately. Trainers may use what you share only to coach you. If your trainer assigns you a plan, you can rate each week (1 to 5, and how hard it felt). In the plan's last week you can also give it one overall score from 1 to 10 with an optional comment. Only that trainer sees these, and you can change them.
Messages, check-ins and the intake form
If you are coached, you can also send your trainer things yourself: messages; a weekly check-in (weight, waist, energy, sleep and stress on 1–5, a note and up to three progress photos); and an intake form (goal, experience, training days and time, place and equipment, height, injuries, a health yes/no question and health notes). Check-ins and the intake form are health data: they are stored only with your consent to share with your trainer, and you can send them only while that consent is in place. Messages are part of the service (GDPR art. 6(1)(b)) and need no extra consent. Only you and your trainer can see any of this; we do not read it, and our admin tools show only anonymous counts. Progress photos are shrunk on your phone, kept in a private storage area in Frankfurt and opened through links that expire after an hour. Your trainer can reply to a check-in; after that it can no longer be changed. Do not put anything in a message or note that you do not want your trainer to see.
Where your data is kept, and who processes it
Cloud data is stored with Supabase in Frankfurt, Germany (EU), which provides our database and sign-in. The website runs on Amazon Web Services in Frankfurt. Account emails are sent through an email provider. These providers act on our instructions under data processing agreements; where a provider’s group is based outside the EU, the EU Standard Contractual Clauses apply.
How long we keep it
As long as you use the cloud features. “Delete my cloud data” in the app erases from the cloud at once your workouts, measurements and activity, your messages, check-ins and their photos, your intake form and your plan ratings, and ends all sharing; deleting your account also removes your email address. Copies in our provider’s backups disappear within 30 days.
Your rights
You can access, correct, export or delete your data, restrict or object to its use, and withdraw any consent, from the app’s settings or by writing to [email protected]. You may also complain to a data protection authority: in Portugal the CNPD, in Türkiye the KVKK Authority, or the authority where you live.
Security
Data is encrypted in transit and at rest. Access rules in the database ensure a trainer can read only what an athlete shared with them. On the phone you can lock the app with your fingerprint or screen lock.
Children
SetAura is not intended for people under 16. When you make a cloud account you confirm that you are at least 16; we store that you confirmed it and when, not your date of birth.
Changes
If we change this notice, the new version appears here with its date. If a change affects what you consented to, the app asks for your consent again.