Privacy policy

Who we are

athlate is a training diary made by Lyskamm Invest AS, a company registered in Norway. Lyskamm Invest AS is the data controller for the information described here. This policy covers the athlate app, the athlate.com website, and the beta we run in TestFlight.

Privacy questions go to hey@athlate.com.

What we collect

Account and sign-in

Email address, display name, username, and the technical identifiers sign-in needs. You can sign in with email, Apple, Google or Vipps. If you sign in with Vipps, we get your name and email address from there. You can turn on Face ID or a fingerprint to unlock the app. That biometric data stays on your phone and never reaches us.

Training data

What you enter: sessions, sets, reps, weights, programs, exercises, your week plan, cardio sessions and body measurements. This is the core of the service, and it is why the app exists.

Health information

If you connect Apple Health or Health Connect, we read body weight and workouts from there, and we can write completed strength sessions back. If you connect Polar, Whoop, Oura or Strava, we fetch your sessions from them through their own sign-ins.

Health information is a special category of personal data under article 9 of the GDPR. We only fetch it when you turn the connection on yourself, and you can turn it off again at any time. The fetching stops when you do.

The social layer

If you use the social features: posts, comments, high fives, challenges, who you follow, who you have blocked, and reports you submit. Pictures you attach to a post or a profile are stored with us.

Camera, photos, microphone and speech

The app asks for access to the camera and photo library when you choose to attach a picture, and for the microphone and speech recognition when you choose to speak to Rytme instead of typing. Speech becomes text in Rytme's own field, and nothing is sent on until you tap to build.

Rytme, the part that uses AI

Rytme asks you before anything is sent. The first time you reach Rytme in the app, you get the question “Rytme uses AI”. If you say yes, the text you write is sent, together with relevant parts of your training history, to Anthropic, who run the language models Claude Sonnet 5 and Claude Haiku 4.5 on our behalf. This also applies when Rytme looks over your log on its own and suggests adjustments. If you say no, nothing is sent, and you use the ready-made programs instead. You can change the choice at any time with the “AI in Rytme” switch under Account.

We log the request and the response so we can debug and check that the quality holds.

Notifications

If you say yes to notifications, we store the device key needed to send them.

Usage analytics

We measure how the app is used, with Google Analytics for Firebase and PostHog. We record events such as a session being completed, a program being created, onboarding being finished, cardio being logged, an export being used, and a service being connected. Events are tied to your user id, not to your name. The measurement says how long a session was and what kind of program you made, not what you lifted.

The numbers are exported to Google BigQuery, where we look at them in aggregate to understand use over time. The analyses we work from are aggregated, that is sums and shares across users, not individual profiles.

We do not show ads in athlate, and we do not track you across other companies’ apps or websites.

You can turn usage analytics off. The “Share usage statistics” switch is in the “Rytme uses AI” question and under Account in the app. It is on, and turning it off stops both Google Analytics for Firebase and PostHog at once. You do not need to restart the app, and the choice is remembered until you change it. The switch does not touch crash reporting or App Check, which are described just below and rest on a different basis.

If you have agreed to help us improve the experience in the app, Microsoft Clarity makes heatmaps and replays of taps and swipes. The recordings are not linked to your name, and what you type is never shown. The question comes after your first completed session, and turning off “Share usage statistics” stops this too.

Crash reports and security

We use Firebase Crashlytics to catch crashes, and Firebase App Check to stop anything other than the app from talking to our services. Technical information about the device and the request comes with that, among other things IP address, device model and operating system version.

The website

athlate.com uses Google Analytics 4 and Microsoft Clarity. Clarity shows us where on the pages people click and how far they read, as heatmaps and recordings of visits. Text you type into forms is masked in the recordings. We have turned off ad storage, ad data and personalisation in both, and we therefore set no marketing cookies.

The waitlist

If you signed up for the waitlist before launch, we have your email address from that. The form is gone from the website, so the list takes no more. You can ask us to delete your address at any time.

If you contact us

Your name, email address and the content of your message.

Why we process the information

• To deliver the service you asked for: keeping your training log, syncing your account and showing it across devices. The basis is our contract with you.
• For health information and connections to other training services: your explicit consent, given when you turn the connection on.
• To answer you when you get in touch.
• To keep the service safe, prevent abuse and fix faults. The basis is our legitimate interest in the service working and not being abused.
• To understand how the app is used and make it better. The basis is our legitimate interest. If you do not want to be counted, turn off “Share usage statistics” under Account in the app.

Who we share it with

We do not sell personal data, and we do not share it with advertisers. We use providers who process information on our behalf, on our instructions and under a data processing agreement:

• Google, through Firebase and Google Cloud: sign-in, database, file storage, server functions, notifications, crash reporting, analytics and BigQuery.
• PostHog: product analytics.
• Anthropic: the language models behind Rytme.
• Vercel: running the athlate.com website.
• Cloudflare Turnstile: the robot check on the contact form.
• Microsoft Clarity: heatmaps and recordings of visits on athlate.com, and in the app for those who have agreed.
• Microsoft and Resend: the email we send and receive.
• Apple and Google: distribution of the app, including TestFlight.

If you connect Apple Health, Health Connect, Polar, Whoop, Oura or Strava, information passes between you and them under their own terms. If you choose to back up to your own cloud storage, the copy goes from your device to your own account with iCloud, Google Drive or Dropbox. We keep no copy of it.

Content you publish yourself in the social layer is visible to those you share it with.

Transfers outside the EEA

Some of the providers above process information in the United States. The transfers rest on the European Commission’s standard contractual clauses or on the EU-US Data Privacy Framework, depending on the provider.

How long we keep it

• Your account and training data: for as long as the account is active. If you delete the account, they are deleted.
• Crash reports and usage statistics: up to 14 months in the analytics tools. Aggregated numbers in BigQuery can stay longer, but they cannot be traced back to you as an individual.
• Support enquiries: for as long as the matter requires, and up to 24 months afterwards.
• Waitlist email addresses: until the launch notifications are done, or until you ask us to delete them.
• Backups: removed within 90 days.

Your rights

You can ask for access to the information we hold about you, ask for it to be corrected, deleted or restricted, ask to have it handed over in a machine-readable format, and object to processing that rests on legitimate interest. If you have given consent, for example to health data, you can withdraw it at any time.

Usage analytics is the processing of ours that rests on legitimate interest, and you object to it by turning off “Share usage statistics” under Account in the app. You do not need to write to us for that.

You can delete your account and training data yourself. How to delete your account. We handle deletion requests without undue delay, and within 30 days at the latest.

Write to hey@athlate.com if you want to use any of your rights. You can also complain to Datatilsynet.

Children

athlate is not made for children under 16, and we do not knowingly collect information about them.

Changes

If we change this policy, we update the date at the top. If the change is material, we say so in the app or by email.

Contact

Lyskamm Invest AS, org. no. 818 925 042, Sofies gate 88B, 0454 Oslo, Norway. hey@athlate.com.