Arete

Privacy Policy

For the Android app “Arete”, its server and this website. Last updated: 2026-10-29

Controller

First and last name
Street, postcode, city
kontakt@aretelift.com

Data the app processes

  • Account: email address and password (stored only as a bcrypt hash, never in plain text), plus whether and when you confirmed your email address.
  • Profile (optional): first name, training goal, experience level, gender, age, height, diet phase.
  • Training data: workouts, sets (exercise, reps, weight, RIR, time), training plans, sessions, your own exercises and muscle groups, your own volume targets.
  • Health data: body weight and your answers to the daily questions on sleep, daily load and energy (each a level from 1 to 3).
  • Health Connect (optional): if you allow it, the app reads last night's sleep duration and yesterday's steps to prefill the daily questions. These raw values stay on your device; only the level you save there is sent to the server. The app never writes to Health Connect and never shares this data.
  • Technical data: requests to the server involve your IP address and a timestamp (abuse protection, debugging). There are no ads, no tracking and no analytics SDKs.

This website

This website sets no cookies, uses no tracking or analytics and loads no content (fonts, scripts, images) from third parties. When you visit it, our host Cloudflare processes technically necessary connection data such as IP address, time and requested page to deliver the site and protect it from attacks (Art. 6(1)(f) GDPR).

Purpose and legal basis

We use the app's data only to provide its features: storing and syncing your training, volume and progress analysis, recovery estimates and confirming your email address (Art. 6(1)(b) GDPR). Health data is processed only because and as far as you enter or share it yourself (Art. 9(2)(a) GDPR); you can withdraw this consent at any time by deleting the entries or revoking the Health Connect permission.

Recipients

  • Render Services, Inc. (USA) hosts the app's server and database as a processor.
  • Resend (Plus Five Five, Inc.) (USA) sends the email with your verification code as a processor; for that it receives your email address.
  • Anthropic PBC (USA): only when you import a training plan from a PDF or use plan optimization, the PDF's text or the plan is sent to Anthropic's AI service to analyze it. Without these features nothing is sent to Anthropic.
  • Cloudflare, Inc. (USA) hosts this website and provides the domain's DNS.

Transfers to the US rely on the EU Commission's standard contractual clauses or the EU-US Data Privacy Framework. We do not sell data.

Retention

The app's data is kept until you delete your account. Login sessions expire after 30 days, verification codes after 15 minutes.

Deleting your account and data

In the app under Account → Delete account, or without the app on this page. All data listed above is deleted immediately and permanently.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and to lodge a complaint with a data protection authority. Contact us at the address above.

Security

All connections are encrypted with HTTPS. Passwords, session tokens and verification codes are only stored as hashes.