Privacy notice for the SetAura app
Draft of 1 October 2026
Draft. The operator’s legal name and address will be added, and the text reviewed by a lawyer, before public launch.
Who is responsible
SetAura is the data controller for the app. The operator’s full legal name and address will be published here before public launch. Contact for anything about your data: [email protected].
Without an account
The app works fully offline without an account. Your workouts, body measurements and activity stay on your phone and nothing is sent to us. If you connect Health Connect, the app reads steps, heart rate and watch sessions on the device, with Android’s permission, and keeps them there.
What reaches the cloud, and only when
Nothing leaves your phone until you create an account and give separate, explicit consent to store data in the cloud. Even then, only the data types you switch on are synced: workouts and sets, body measurements (weight, body fat, circumferences) and daily activity (steps, calories, heart rate). For your account we keep your email address and, if you give it, your name. We also keep a record of each consent: which one, which text version and when.
Why, and on what legal basis
Your account is needed to provide the service you ask for (GDPR article 6(1)(b)). Workouts, body measurements and activity can reveal information about your health, so storing them in the cloud and sharing them with a trainer rely on your explicit consent (GDPR article 9(2)(a); in Türkiye, KVKK article 6). You can withdraw consent at any time; this does not affect what happened before. We never sell your data or use it for advertising.
Sharing with a trainer
A trainer sees your data only if you accept their invite code and give a separate consent. You choose each data type with its own switch: workouts, body measurements, daily activity. Seeing every set (weight, reps, set type) needs one more, separate consent. Turning a switch off, or leaving the trainer, ends their access immediately. Trainers may use what you share only to coach you.
Where your data is kept, and who processes it
Cloud data is stored with Supabase in Frankfurt, Germany (EU), which provides our database and sign-in. The website runs on Amazon Web Services in Frankfurt. Account emails are sent through an email provider. These providers act on our instructions under data processing agreements; where a provider’s group is based outside the EU, the EU Standard Contractual Clauses apply.
How long we keep it
As long as you use the cloud features. “Delete my cloud data” in the app erases your workouts, measurements and activity from the cloud at once and ends all sharing; deleting your account also removes your email address. Copies in our provider’s backups disappear within 30 days.
Your rights
You can access, correct, export or delete your data, restrict or object to its use, and withdraw any consent, from the app’s settings or by writing to [email protected]. You may also complain to a data protection authority: in Portugal the CNPD, in Türkiye the KVKK Authority, or the authority where you live.
Security
Data is encrypted in transit and at rest. Access rules in the database ensure a trainer can read only what an athlete shared with them. On the phone you can lock the app with your fingerprint or screen lock.
Children
SetAura is not intended for people under 16.
Changes
If we change this notice, the new version appears here with its date. If a change affects what you consented to, the app asks for your consent again.