Draft: this document is not in force yet.

Skiplegs Privacy Policy

Last updated: 12 October 2026
Effective: [DATE OF PUBLICATION]

This policy explains what personal data Skiplegs collects, why we use it, who receives it, how long we keep it, and the choices and rights you have. It covers the Skiplegs app for iPhone and Apple Watch, its widgets, Live Activities and Siri shortcuts, and these web pages.

1. Who we are

Skiplegs is provided by Viacheslav Volianiuk, an individual entrepreneur registered in Armenia ("we", "us", "our"). We decide why and how your personal data is used, so we are its controller.

• Registration number: [IE REGISTRATION NUMBER]
• Postal address: [POSTAL ADDRESS]
• Phone: [PHONE]
• Email for support, privacy and legal requests: skiplegssupport@gmail.com

2. Summary

• You can use Skiplegs without an account. Your training log then stays on your device, and we don't receive it.
• With an account, we store your profile, workouts and social activity on servers in London, UK, so you can sync, back up and train with friends.
• Profiles are public by default to other signed-in Skiplegs users. They can see your name, username, photo, bio and training summaries, including your records. Only friends you accept see your full list of sets and when you trained. You can make your profile private at any time.
• Analytics and crash reports go to PostHog and Sentry from every copy of the app, identified by a random ID or your account ID, never your name or email. PostHog also receives your IP address (section 3). There's no setting to turn them off; you can object by email (section 8).
• Apple takes payment for Skiplegs Pro. We never see your card or bank details.
• Skiplegs only writes to Apple Health. Skiplegs doesn't read any other Health data; it only checks the workouts it saved itself. Health data never reaches our servers.
• Strava, only if you connect it. Skiplegs then posts your finished training sessions to your Strava account. It doesn't read your activities or anything else from Strava. You can disconnect at any time.
• No ads, no selling. We don't sell or share your personal information, we don't track you across other companies' apps or websites, and we never use your workout or Health data for advertising or marketing.
• You can delete your account in the app at any time.
• Skiplegs is for people aged 13 and over.

3. What we collect and why

For people in the EU, the EEA and the UK, the "Legal basis" column gives the ground for processing under the GDPR and the UK GDPR:

• Contract: we need the data to provide the app and the features you ask for (Art. 6(1)(b)).
• Legitimate interests: we need the data for our legitimate interests, and we have weighed them against your rights (Art. 6(1)(f)). You can object at any time (section 12).
• Consent: you have agreed, and you can withdraw consent at any time (Art. 6(1)(a), and Art. 9(2)(a) for health data).
• Legal obligation: the law requires it (Art. 6(1)(c)).

We don't collect your date of birth, gender, height, body weight, precise location, contacts or advertising identifier.

Data that stays on your device

• Without an account, your training log, goals, badges and settings stay on your device. We still receive analytics and crash reports, and purchase data if you buy Pro.
• Apple Watch, widgets and Live Activities exchange data with your iPhone directly. Our servers only receive Live Activity data as described above.
• Siri: Apple processes your voice request under Apple's privacy policy. Skiplegs receives only the result, such as the exercise and the number of reps.
• Photos: when you save a card, Skiplegs adds an image to your photo library. It can't see your library. When you choose a profile photo, the app receives only that photo. It uploads a cropped, re-compressed copy that has no location or camera details. When you attach a screenshot to feedback, the app likewise receives only the image you pick and sends a re-compressed copy without location or camera details.
• Feedback waiting to be sent: if a message can't reach our server (for example, you're offline), it stays on your device, with its screenshot, until it goes. A message that still hasn't gone after 30 days is deleted from your device.
• Reminders are scheduled on your device.
• Files you export with Save a copy go wherever you choose.
• When you sign out or delete your account, the training log on your iPhone stays there until you delete the app.

Do you have to give us data?

An email, Apple or Google sign-in is needed only for an account. Without one, the app works on your device but without friends, stories or sync. Every copy of the app sends usage analytics and crash reports (section 8).

4. How we use your data

We use personal data only for the purposes in section 3. We don't use it for advertising, we don't build advertising profiles, and we don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Analytics uses rough ranges rather than exact figures wherever possible. If we want to use your data for a new purpose that isn't compatible with these, we will tell you first and, where the law requires it, ask for your consent.

5. Who receives your data

Service providers

These companies process personal data to provide their services to us:

Supabase, PostHog, Sentry and RevenueCat are each bound by a written agreement to use the data only to provide their service to us, on our instructions, to keep it confidential, and to protect it at least as well as this policy describes. Our support mailbox is a standard Gmail account: Google provides it under its own terms and the Google Privacy Policy, not under a separate agreement with us. We give each provider only the data it needs.

Companies that act under their own privacy policies

• Apple sells and bills Skiplegs Pro through the App Store, and runs Sign in with Apple, Hide My Email (Private Email Relay), Apple Health, Siri and the Apple Push Notification service. Apple handles your Apple Account, payment details and purchase records under the Apple Privacy Policy. If you use Hide My Email, we only get a relay address, and our emails to you pass through Apple.
• Google runs Sign in with Google under the Google Privacy Policy.
• Strava (Strava, Inc., USA) receives the sessions you choose to post if you connect Strava, and shows them in your Strava account and to the people your Strava settings allow, under the Strava Privacy Policy.

Other people

Other Skiplegs users see what section 6 describes.

Legal reasons and business changes

We may disclose personal data if the law requires it, for example in response to a valid order from a court or authority, or where it is necessary to protect someone's life or safety, to prevent fraud or abuse, or to establish or defend legal claims. If Skiplegs is transferred to another owner, your data may be transferred too. The new owner must respect this policy, and we will tell you before the transfer.

What we never do

We don't sell personal information. We don't share it for cross-context behavioural advertising. We don't give it to data brokers or advertisers, and we don't track you across other companies' apps or websites.

6. What other people can see

Nothing in Skiplegs is visible on the open web or to people who aren't signed in to Skiplegs. Search engines can't find your profile.

Every signed-in user can find you by your username or display name, and can see your display name, username and profile photo. This doesn't depend on your privacy setting.

If your profile is public (the default), every signed-in user can also see:

• your bio;
• your training figures: total sets and reps, best set, days trained, current streak and the last day you trained;
• your record for each exercise (most reps, and heaviest added weight, with the variation) and your badges;
• a grid of the last 12 weeks with the number of sets and reps for each day, including days you repaired your streak;
• your sets and reps for each exercise over the last 7 days;
• your stories while they are available, and your highlights.

If your profile is private, people who aren't your friends see only your name, username and photo.

Friends you accept also see your individual sets, including the exercise, reps, added weight and the time you did them, as well as your time zone and your streak repairs. This works both ways: you see theirs too.

Stories. On days you train, Skiplegs shows an automatic story with that day's figures. Stories you post can include a caption. Stories can be seen by anyone who can see your profile, for 24 hours, or for as long as they stay in your highlights. A joint story appears only after your friend accepts it. You can see who viewed and liked your stories, and other people can see that you viewed or liked theirs. You can delete your own stories at any time.

Blocking someone hides each of you from the other everywhere in Skiplegs: search, profiles, photos and stories.

Your choices. Turn Public profile off in Account › Friends & Privacy. Edit or remove your name, bio and photo in Account › Edit profile. People who saw your content before you changed it may remember it or have taken a screenshot. We can't control that.

7. Apple Health

If you turn on Apple Health in the Account tab (this needs an account), Skiplegs asks iOS for permission to write workouts and active energy to Apple Health. It doesn't ask to read anything.

• What we write: your training sessions (sets less than 20 minutes apart form one session) with their start and end times; the number of sets and reps; a set-by-set list with the time, exercise, variation, reps or seconds held and added weight; an estimate of active calories if you allow it; and an ID that links each workout to your Skiplegs account so it isn't saved twice.
• What we read: nothing from your Health data. The app only checks the workouts that Skiplegs itself saved, to avoid duplicates and to remove workouts whose sets you deleted.
• Where it goes: Health data stays in Apple Health on your devices. We don't send it to our servers, to analytics or to anyone else, and we don't store it in iCloud.
• What we never do: we never use Health data for advertising, marketing or data mining, and we never sell or share it. As for the workout data in your log: we never sell it or use it for advertising or marketing. Apart from the service providers in section 5, which process it only for us, and the people you choose to show it to (section 6), we don't share it.
• How to stop: turn off Apple Health in the Account tab, or change Skiplegs' permission in iOS Settings › Privacy & Security › Health. Workouts already saved stay in Health until you delete them in the Health app.

Strava

If you turn on Strava in the Account tab (this needs an account), Strava asks you to let Skiplegs upload activities to your Strava account. Skiplegs asks for that permission only: it doesn't read your activities, profile or anything else from Strava.

• What we post: each training session that ends after you connect, once 20 minutes have passed with no new set and Skiplegs is open on the iPhone you connected it on: for each set, the exercise, reps or seconds held, added weight and time; the session's start time and length; a title naming the exercises and a short text summary. We don't post your earlier training, calories, location or anything else.
• What we keep: on our servers, your Strava athlete ID, your name as Strava gives it (shown only to you, in the Account tab), the permission you granted and the tokens Strava issues, and a record of which sessions were posted, so none is posted twice. The tokens never reach your phone. The app keeps a copy of the connection's status on your iPhone (the athlete ID and name, the permission and when you connected, plus which sessions Strava refused), so the switch shows correctly offline; it is removed when you delete your account, and the connection part when you turn Strava off.
• Who sees it: Strava shows the activities to the people your Strava privacy settings allow, under Strava's privacy policy (section 5).
• How to stop: turn off Strava in the Account tab. We then revoke Skiplegs' access at Strava and delete the tokens and the record. You can also remove Skiplegs in Strava under Settings › My Apps; we then delete them too. Activities already posted stay on Strava until you delete them there: Strava doesn't let apps delete activities.

8. Analytics and crash reports

We use PostHog to understand how people use Skiplegs, and Sentry to find crashes and slow screens. They run in every copy of the app, with or without an account, and the app has no setting to turn them off: we rely on our legitimate interests in fixing problems and deciding what to build (section 3). We keep what they collect small. Neither records your screen, takes screenshots or logs what you type, and neither receives your email or your name. Analytics records which exercise and variation each logged set is, not its reps, and rough ranges for figures such as your number of sets. Both identify you by a random ID, or by your account ID when you're signed in, never by your device's advertising identifier; PostHog also receives your IP address, as section 3 describes.

Objecting. Email us from the address linked to your account and tell us you object to analytics, crash reports or both. Within one month we delete the analytics linked to your account ID at PostHog, and from then on we don't keep new analytics or crash reports under that ID. Crash reports we already received contain only your account ID and are deleted automatically within 90 days. Without an account, what we receive is tied to a random ID rather than to your email, so we can't find it from your request; deleting the app stops all sending. If you later sign in on that copy of the app, PostHog links what it sent before to your account ID, and an objection then covers it too.

Earlier versions of Skiplegs had switches for these in the app's settings. If you turned one off there, analytics and crash reports are on again after you update.

Skiplegs has no ads and no advertising SDKs, and it doesn't use your device's advertising identifier.

9. International transfers

We are based in Armenia. Our main servers are in the United Kingdom. PostHog and RevenueCat store data in the United States, and Sentry stores data in the European Union. These companies and their subprocessors may access data from other countries, and Apple and Google operate worldwide. If you connect Strava, the sessions you post go to Strava, Inc. in the United States. So your data may be processed in countries whose data protection laws differ from yours.

When personal data from the EU, the EEA or the UK goes to a country without an adequacy decision, we rely on an appropriate safeguard: the provider's certification under the EU-US Data Privacy Framework (and its UK Extension), or the European Commission's Standard Contractual Clauses (with the UK Addendum or the UK International Data Transfer Agreement), together with any additional measures needed. The UK has an EU adequacy decision. Wherever your data is processed, we protect it as this policy describes. To get a copy of the safeguards we use, email us.

10. How long we keep data

We keep personal data only as long as we need it for the purposes in section 3. The table in section 3 gives the period for each kind of data. In general:

• your account, profile, workouts and social activity stay until you delete them or your account;
• analytics are kept for up to 12 months, crash reports for 90 days, and server logs for up to 90 days;
• after deletion, data disappears from our hosting provider's backups within 30 days;
• we keep some records for longer only when the law requires it or when we need them to establish or defend a legal claim, and only for as long as that need lasts.

11. Deleting your account

Open the Account tab, tap Delete Account and confirm. You see this option only when you're signed in. If you can't open the app, email us from the email address linked to your account and we will delete it for you. We may ask you to confirm that the account is yours.

Deleting your account doesn't cancel Skiplegs Pro. Apple keeps charging you until you cancel the subscription in your Apple Account settings, so cancel it first.

What we delete:

• your account, email address and sign-in details, and we revoke Skiplegs' access to your Sign in with Apple ID and, if you connected it, to your Strava account;
• your profile: display name, username, bio and profile photo;
• your synced workouts, deleted-set records, goals, badges, streak repairs, time zone and cloud backup;
• your friendships, friend requests and blocks;
• your stories and highlights, and the likes, reactions and views you made;
• Live Activity tokens;
• feedback you sent with your account ID, and its screenshot;
• your analytics profile at PostHog and your customer record at RevenueCat.

Deletion from our live systems happens straight away. It can't be undone.

What stays:

• the training log on your iPhone, until you delete the app (use Account › Backup › Save a copy first if you want a file);
• workouts that Skiplegs saved to Apple Health, until you delete them in the Health app;
• activities that Skiplegs posted to Strava, until you delete them in Strava;
• crash reports in Sentry, which contain only your account ID and are deleted automatically within 90 days;
• feedback you sent without your account ID, which isn't linked to your account (if you want it deleted, tell us roughly when you sent it, and the email address you gave, if any), and emails you sent to our support address;
• copies in our hosting provider's backups, which are overwritten within 30 days;
• records that Apple keeps of your purchases, under Apple's privacy policy;
• records we must keep by law, or need to establish or defend legal claims, such as a record of a privacy request or of a report we acted on.

If we learn that an account belongs to a child under 13, we delete it in the same way.

12. Your rights

What everyone can do in the app

• See and correct your profile in Account › Edit profile, and edit or delete any set in your log.
• Export your training log, goals and badges as a file with Account › Backup › Save a copy.
• Choose who sees your profile in Account › Friends & Privacy, and block people.
• Turn off Apple Health and Strava.
• Delete stories, or your whole account (section 11).

For anything else, email us (see "How to make a request" below). These rights apply to everyone, wherever you live, as far as we can provide them.

EU, EEA and UK

Under the GDPR and the UK GDPR you have the right to:

• access your personal data and get a copy;
• correct inaccurate data;
• erase your data;
• restrict how we use it;
• data portability: receive the data you gave us in a machine-readable format, or have it sent to another company where that is technically possible;
• object at any time to processing based on legitimate interests, including analytics and crash reports (section 8 says how). We will stop unless we have compelling legitimate grounds or need the data for a legal claim;
• withdraw consent at any time, for example for Apple Health. This doesn't affect what we did before you withdrew it;
• complain to a supervisory authority (section 17).

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

California

If the California Consumer Privacy Act, as amended by the CPRA, applies to you, you have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• delete it;
• correct it;
• opt out of the sale or sharing of your personal information. We do not sell or share personal information, as those words are defined in the CCPA, and we haven't in the last 12 months. We don't knowingly sell or share the personal information of anyone under 16;
• limit the use of sensitive personal information. We use it only to provide and improve the app, as the law allows, so there is nothing to limit;
• not be discriminated against for using these rights.

In the last 12 months we have collected these categories of personal information, from the sources and for the purposes in section 3: identifiers (email address, account ID, IP address); customer records (email address); geolocation data (approximate location inferred from your IP address); commercial information (purchase history); internet or other electronic network activity (app usage and crash data); visual information (your profile photo); and information about your workouts, which may be treated as health-related. We disclosed each of these for business purposes only to the service providers in section 5, and to other users as section 6 describes. We keep each category for the period in section 3.

You can use an authorised agent. We will ask the agent for proof of your permission and may ask you to confirm your identity. We don't disclose personal information to third parties for their own direct marketing.

Other US states

Residents of states with similar laws, such as Colorado, Connecticut, Virginia and others, have similar rights to access, correct, delete and port their data and to opt out of targeted advertising, sale and profiling. We don't do any of those three. If we decline your request, you can appeal by replying to our answer. If we reject your appeal, you can contact your state's Attorney General.

Armenia

Under the Law of the Republic of Armenia on Protection of Personal Data, you have the right to get information about how we process your data and to access it, to have inaccurate or unlawfully processed data corrected, blocked or destroyed, and to withdraw your consent. You can also appeal to the Personal Data Protection Agency of the Ministry of Justice or to a court.

How to make a request

Email skiplegssupport@gmail.com, preferably from the email address linked to your account, and tell us what you want. To protect your data, we may ask you to confirm that the account is yours, for example with a code sent to that address. We answer within one month, or within the shorter or longer period your local law sets (for example, 45 days in California). If a request is complex, we may extend this period where the law allows, and we will tell you why. Requests are free, unless they are clearly unfounded or excessive.

13. Children

Skiplegs is for people aged 13 and over. It isn't directed at children under 13, and we don't knowingly collect personal data from them. If you are under the age of majority where you live, you need a parent's or guardian's permission to use Skiplegs where the law requires it.

If we learn that an account belongs to a child under 13, we delete the account and its data. If you think a child under 13 is using Skiplegs, please email us.

14. Security

We protect your data with technical and organisational measures that suit the risk:

• all data travels between the app and our servers over encrypted connections (HTTPS);
• our hosting provider encrypts stored data;
• database rules let each person read and change only their own data, plus what other users choose to show them (section 6);
• sign-in uses one-time codes or Apple or Google, so we store no passwords, and your session is kept in the iOS Keychain;
• secret keys are never stored in the app, and only the people who run Skiplegs can access the servers.

No system is perfectly secure. If a personal data breach puts your rights at risk, we will notify the competent supervisory authority within 72 hours of becoming aware of it where the law requires, and tell you without undue delay if the risk to you is high, or sooner if another law requires it.

15. Do Not Track and these web pages

Some browsers send a "Do Not Track" or Global Privacy Control signal. Skiplegs doesn't track you across other companies' websites or apps, and doesn't sell or share personal information, so these signals don't change anything we do. PostHog and Sentry collect data only about your use of Skiplegs, not about your activity on other companies' apps or websites. These pages have no cookies, analytics or ads. The Skiplegs website keeps one setting in your browser's local storage, the date you last logged a set on it, and it never leaves your device. The pages are hosted by Cloudflare, which may log visitors' IP addresses for security under the Cloudflare Privacy Policy.

This policy took effect on the date shown at the top of the page.

16. Changes to this policy

We may update this policy when the app or the law changes. We will post the new version here and change the "Last updated" date. If a change is significant, for example a new kind of data or a new use of it, we will tell you in the app or by email before it takes effect and, where the law requires it, ask for your consent. You can ask us for earlier versions.

17. Complaints

If you have a concern, please contact us first. We'll try to resolve it. You can also complain to a data protection authority:

• EU and EEA: the supervisory authority in the country where you live or work, or where you think the problem happened. The European Data Protection Board lists them.
• UK: the Information Commissioner's Office.
• Armenia: the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia.
• California: the California Privacy Protection Agency or the California Attorney General.

18. Contact us

Viacheslav Volianiuk, individual entrepreneur
Registration number: [IE REGISTRATION NUMBER]
[POSTAL ADDRESS]
Phone: [PHONE]
Email: skiplegssupport@gmail.com

See also our Terms of Use and Support pages.