Kilopilot Privacy Policy

Effective date: [DATE]

This policy explains what the Kilopilot iPhone app collects about you, why, who helps us run it, how long we keep it and what you can do about it. If anything is unclear, email us at hello.kilopilot@gmail.com.

The short version

Kilopilot builds your plan from your answers, and some of them are about your health. They leave your iPhone only after you tick the health consent box, and we use them only to build and adjust your plan.
Your answers, plans and check-ins are stored on our servers in the EU (Frankfurt, Germany). To write your plan and coach notes, our server sends the parts the AI needs to our AI provider, Anthropic, in the United States.
Your name, your workout and meal logs, your records and your weigh-ins stay on your iPhone.
No ads. No tracking across other companies' apps or websites. We never sell your data.
Anonymous usage analytics only if you say yes, and never your health data. Switch it off any time in Me › Share usage.
Delete your account in the app (Me › Account & data › Delete account) and everything we keep about you goes with it.

1. Who we are

Kilopilot is made by [LEGAL NAME], an individual trading as sunnyApps, [POSTAL ADDRESS], [COUNTRY] ("we", "us"). We decide how your data is used, which makes us the "controller" under data protection laws such as the EU and UK General Data Protection Regulation (GDPR).

Email: hello.kilopilot@gmail.com
Post: [LEGAL NAME], [POSTAL ADDRESS], [COUNTRY]
Our representative in the EU: [EU REPRESENTATIVE]
Our representative in the UK: [UK REPRESENTATIVE]

This policy covers the Kilopilot app, this website (kilopilot.com) and any email you send us. The website sets no cookies and runs no analytics; Cloudflare, which hosts it, sees your IP address to deliver the pages.

2. What we collect, and where it lives

2.1 What stays on your iPhone

These are kept on your iPhone, not on our servers:

Your first name. It's used in the app and on your plan PDF. Plan requests never include it.
Your logs: workouts, meals, personal records and weigh-ins. A weekly check-in sends a summary of them (section 2.3), not the logs themselves.
Your settings: units, appearance, reminders and your analytics choice. Reminders are scheduled on the phone.
What the app reads from Apple Health, day by day. Only weekly averages and counts leave the phone, with a check-in (section 8).
Your plan PDF, which is built on the phone.

Because your logs live only on your iPhone, we have no copy of them. If you lose your phone or delete the app, we can't restore them.

2.2 Your account

When you first open Kilopilot, the app creates an anonymous account on our server. It's a random id with no name or email attached, so you can look around before signing in.

To get a plan, you sign in with Apple. We ask Apple only for your email address, not your name, and you can choose Apple's Hide My Email relay address. We store:

your account id;
the identifier Apple gives us for your Apple ID, so you can sign in again on another phone;
your email address (often Apple's relay address).

2.3 Your plan answers and check-ins

This is health and fitness data. Nothing below leaves your iPhone until you've given the consent in section 3.

When you ask for a plan, the app sends our server:

Your basics from onboarding: sex, date of birth, height, weight, goal, pace and how active you are.
Your plan answers. Which questions you see depends on your plan. They can cover:
- training: days and times, session length, experience, where you train, equipment, focus areas, exercises you dislike, what motivates you, push-ups and pull-ups;
- health and safety: pain or injuries and how they feel, warning signs (such as chest pain or fainting), long-term conditions, some kinds of medicine, pregnancy, a recent birth or breastfeeding, your relationship with food, smoking or snus, alcohol, sleep and stress;
- your body and day: waist and neck measurements, daily steps, the kind of work you do, cardio you enjoy;
- food, for Train + Fuel: how you eat, food rules, allergies and intolerances, cuisines and foods you like or won't eat, meals, cooking, kitchen, household, budget, water and supplements you already take.
Some answers are free text you write yourself.
Your consent record: when you ticked the health consent and which version of its text you saw.

Each weekly check-in sends:

your weekly average weight and your waist;
a summary of your week: sessions and sets done against the plan, whether your lifts went up, new records, how many days you logged food, how much of your plan you ate, and your average daily steps;
how you felt (energy, hunger, sleep and stress, from 1 to 5), any new pain and where, and your own note.

At the end of a block, the app sends a summary of the block (sessions, records, weight and waist change, strength gains) so the coach can write your block-end note.

On our servers we keep your answers, your plans (workouts, and meals for Train + Fuel), your nutrition targets and safety settings, your check-ins and coach notes, and your consent record. If your plan shows no numbers for safety reasons (section 11), we don't keep the weight, waist, step or food figures from your check-ins.

2.4 Subscriptions

When you subscribe, Apple takes the payment. We never see your card or bank details. RevenueCat, our subscription service, tells us what you bought: which subscription, whether it's a free trial, when it started and when it renews or ends. We store this with your account so our server knows what to unlock. RevenueCat knows you by your account id, or by a random id if you bought before signing in.

2.5 Usage counts

To keep costs fair and stop abuse, our server counts your requests to the AI each day: which kind, when, and what each cost to run.

2.6 Crash and performance reports

The app sends crash and performance reports to Sentry, on servers in the EU (Frankfurt, Germany):

crash and hang reports: where in the code it happened, your phone model and iOS version;
launch and request timings;
errors the app reports, with the app's release and build number;
a random install id.

They carry no screenshots, no screen layout, no session recordings, no IP address (we've turned off storing it) and no account id. They aren't linked to you.

2.7 Usage analytics, only if you say yes

During onboarding we ask: "Share anonymous usage: which screens you use and where you get stuck." Nothing is sent unless you tap Share anonymous usage. You can change your mind any time in Me › Share usage.

If you say yes, the app sends PostHog, on servers in the EU (Frankfurt, Germany):

which screens and features you use (for example a tab opened, a workout started, a check-in sent, the paywall seen);
your plan type, the week of your block, and how many days a week you train (the only one of your answers we send);
when you open the app, so we can see whether people come back;
the app version and build, iOS version and phone model;
a random id for this phone.

It never includes your account, name or email, any health values (weight, waist, calories, set weights, steps), your other answers, food or exercise names, or anything that could reveal a safety setting. PostHog doesn't store your IP address or work out your location. When you switch analytics off, sending stops straight away. When you delete your account, the random id on your phone is erased, so the next person to use the phone gets a new one.

2.8 Emails you send us

If you email us, we get your email address and what you write. Send feedback adds the app version, build, iOS version and phone model, so we can reproduce problems. Request a copy of your data adds your account id, so we can find your data. Our inbox is Gmail, run by Google.

2.9 Technical logs

Like any online service, our servers and our providers' servers record technical details of each request, such as the time and the IP address, to keep the service running and secure. Our own code never writes your answers, plans or the AI's replies to these logs.

2.10 What we don't collect

Your location, contacts, photos, browsing or search history.
Advertising ids. Kilopilot has no advertising or tracking software.
Your card or bank details.

3. Your health data and your consent

Before we build a plan, the app shows a screen called "Your health answers". It tells you that, to build a safe plan, we send your answers, including health details, to our servers and our AI provider. You then tick a box that says:

I agree that Kilopilot may process my health information to build my plan.

Nothing is sent until you tick it, and our server refuses a plan request without it. We record when you agreed and which version of the text you saw.

This is your explicit consent to us using your health data (GDPR Article 9(2)(a)). We use this data only to build your plan, keep it safe, adjust it at your check-ins and write your coach notes. We never sell it and never use it for ads.

Some food answers, such as halal or no pork, could hint at your religion. We use them only to choose your recipes, on the same basis as your health answers.

Withdrawing your consent. You can withdraw it at any time by deleting your account (Me › Account & data › Delete account) or by emailing us. We then delete your answers, plans and check-ins. Without this consent we can't build or adjust a plan for you. Withdrawing doesn't affect what we did with your data before.

4. How we use your data

To run your account: create it, sign you in and bring your plan back if you change phones.
To build your plan. Our code works out your calorie and protein targets, your training volume and progression, and checks your answers for safety. The AI chooses exercises from our library, writes recipes from our food database (Train + Fuel) and writes a short explanation of your plan. Our code checks everything the AI returns.
To adjust your plan. At each weekly check-in, our rules decide what changes, and the AI writes a short note explaining it. At the end of a block, the AI writes a summary and your next block is built. The same happens when you Rebuild.
To unlock what you've paid for, checked on our server.
To keep the app working: crash and performance reports help us find and fix problems.
To improve Kilopilot, only if you've said yes to analytics: to see where people get stuck.
To keep things fair and safe: daily limits on AI requests, one free Instant plan per account, and protection against abuse.
To answer you when you email us.
To meet legal duties and to set up, use or defend legal claims.

We don't use your data for advertising. We don't sell it, rent it or give it to data brokers. We don't build marketing profiles of you, and we don't send marketing emails.

5. Our legal bases (GDPR)

What we do	Legal basis
Your account, sign-in, subscriptions and the features you use	Contract: we need it to give you the app (Article 6(1)(b))
Your health answers and check-ins, and food answers that could hint at your religion, used to build and adjust your plan and to send to our AI provider	Your explicit consent (Article 9(2)(a)), together with contract (Article 6(1)(b))
Usage analytics	Your consent (Article 6(1)(a))
Crash and performance reports	Our legitimate interest in a working, stable app (Article 6(1)(f)). They hold nothing that identifies you
Daily AI limits, one Instant plan per account, abuse protection, technical logs	Our legitimate interest in keeping the service fair, affordable and secure (Article 6(1)(f))
Answering your emails	Contract, or our legitimate interest in helping you (Article 6(1)(b) or (f))
Keeping records the law requires, and legal claims	Legal obligation (Article 6(1)(c)) or legitimate interest (Article 6(1)(f))

Where we rely on legitimate interests, you can object (section 10).

6. Who we share it with

We share your data only with the companies that help us run Kilopilot, and only what each needs. They work for us under contracts that limit what they can do with it.

Company	What it does for us	What it gets	Where
Supabase	Database, sign-in and our server functions	Your account, answers, plans, check-ins, consent record, subscription status and usage counts (sections 2.2 to 2.5)	Stored in the EU (Frankfurt, Germany)
Anthropic	The AI that picks exercises and writes recipes and coach notes. Only our server talks to it, never your phone	Only what each task needs, for example your goal and experience, a note to keep your plan cautious, exercises you dislike, your food likes and dislikes, pain you report at a check-in, your weekly averages, how you felt and your own check-in note. Never your name, email address or account id	United States
RevenueCat	Subscriptions	Your account id (or a random id if you bought before signing in) and your purchase history	United States
Sentry	Crash and performance reports	The reports in section 2.6, without personal details	EU (Frankfurt, Germany)
PostHog	Anonymous usage analytics, only if you say yes	The events in section 2.7	EU (Frankfurt, Germany)
Google	Our email inbox (Gmail)	Your emails to us	[GOOGLE DATA LOCATION]

Apple also handles parts of Kilopilot under its own privacy policy: Sign in with Apple, payments and subscriptions, the App Store and Apple Health on your iPhone.

We may also share data:

with authorities or courts, if the law requires it or to protect someone's safety;
with a person or company that takes over Kilopilot, who must keep to this policy. We'll tell you before that happens.

7. Transfers outside the EU

Your answers, plans and check-ins are stored in the EU. Two of our providers are in the United States:

Anthropic. When our server asks the AI to build your plan or write a coach note, the parts of your answers and check-ins it needs, including health details, are sent from our server to Anthropic in the United States. Your health consent (section 3) covers this. We protect the transfer with [ANTHROPIC TRANSFER MECHANISM]. Anthropic uses the data only to send back its answer, keeps it for [ANTHROPIC RETENTION PERIOD] and may not use it to train its AI models [CONFIRM ANTHROPIC TRAINING TERMS].
RevenueCat. Your account id and purchase history go to RevenueCat in the United States, protected by [REVENUECAT TRANSFER MECHANISM].

Supabase, Sentry and PostHog keep your data in the EU. If any of it can be reached from outside the EU or UK, for example by a provider's support staff, and for the emails you send us through Gmail, we rely on [OTHER PROVIDERS TRANSFER MECHANISM]. You can ask us for a copy of these safeguards.

8. Apple Health

Connecting Apple Health is optional, and you can change access at any time in your iPhone's Settings (Privacy & Security › Health › Kilopilot).

What we read: your weight, to fill in your weigh-ins and skip the morning weigh-in reminder, and your steps, for your step goal and your weekly numbers.
What we write: each workout you finish.
What leaves your iPhone: only what goes with a check-in: your weekly average weight and average daily steps. They reach our server and the AI as described above.

We never use Apple Health data for advertising or marketing, never sell it and never give it to data brokers. We don't store it in iCloud. Deleting your Kilopilot account doesn't remove workouts already saved in Apple Health; you can delete those in the Health app.

9. How long we keep it

Data	How long
Your account, answers, plans, check-ins, consent record, subscription status and usage counts	Until you delete your account. Copies in our backups are gone within [BACKUP RETENTION PERIOD]
An anonymous account that never signed in (only a random id)	[ANONYMOUS ACCOUNT RETENTION PERIOD]
Data on your iPhone	Until you delete your account in the app, or delete the app
Your customer record at RevenueCat	Deleted when you delete your account. Apple keeps its own records of your purchases
What our server sends to Anthropic	[ANTHROPIC RETENTION PERIOD]
Crash and performance reports (Sentry)	[SENTRY RETENTION PERIOD]
Analytics events (PostHog)	[POSTHOG RETENTION PERIOD]
Technical server logs	[SERVER LOG RETENTION PERIOD]
Your emails to us	[EMAIL RETENTION PERIOD]

Deleting the app doesn't delete your account. To delete it, use Me › Account & data › Delete account. This:

deletes your answers, plans, check-ins and login from our servers;
deletes your customer record at RevenueCat;
removes Kilopilot's link to your Apple ID;
deletes your logs, records and settings from your iPhone.

It doesn't cancel your subscription; Apple keeps billing until you cancel it in your Apple ID settings. If you sign in with the same Apple ID later, you start a brand-new account.

10. Your rights and choices

You can:

Get a copy of your data (access and portability): Me › Account & data › Request a copy of your data, or email us. We'll send what we keep on our servers in a common, machine-readable format. Your logs are already on your iPhone, and we have no copy of them.
Correct it: change your name in Me › Profile & goals. Your goal, pace and training days change through a Rebuild or your block-end re-check. For anything else, email us.
Delete it: Me › Account & data › Delete account, or email us.
Withdraw your consent at any time: for analytics, switch off Me › Share usage; for health data, see section 3.
Object to what we do on the basis of legitimate interests.
Restrict what we do with your data while a question about it is being sorted out.
Ask a person to review a decision made automatically (section 11).
Complain to a data protection authority, in the country where you live or work or where you think the problem happened. In the UK that's the Information Commissioner's Office (ico.org.uk). Our lead authority is [SUPERVISORY AUTHORITY]. We'd like the chance to help first, so please email us too.

To use any of these rights, email hello.kilopilot@gmail.com. It's free. We'll answer within one month; if a request is complex, we may need up to two more months and will tell you why. We may ask you to confirm the request comes from you, for example from inside the app, before we act on it.

11. Automated decisions and AI

Kilopilot builds and adjusts your plan automatically. Our code, not the AI, sets every number: calories, protein, sets, reps, progression and the weekly changes at check-ins. The AI picks exercises from our library and writes words: recipes, explanations and coach notes.

To keep you safe, some answers change what the app does:

it asks you to see a doctor before you start, and builds a gentler plan;
it shows your plan without calorie or weight numbers ("no numbers");
it keeps your food at maintenance rather than a deficit ("no deficit");
for the most serious answers, it doesn't build a training plan until a doctor has cleared you.

These rules are there to protect your health. If you think one got it wrong, you can go back and change your answers, or email us and a person will look at it.

12. Security

Connections between the app and our servers are encrypted (HTTPS).
Our database only lets each account reach its own data. Plans and check-ins can be read only through our server, which also hides what your safety settings or subscription don't allow.
The key to our AI provider lives only on our server, never in the app, and AI requests go only to Anthropic's official address.
Our code never writes your answers, plans or AI replies to logs.
Crash reports and analytics are set up without screen captures, recordings or IP addresses.

No system is perfectly secure. If a breach puts your data at risk, we'll tell you and the authorities as the law requires.

13. Children

Kilopilot is for adults only. You must be 18 or older to use it. The app asks for your date of birth and won't continue for anyone under 18, and our server refuses plan requests for anyone under 18. If we learn that someone under 18 has an account, we'll delete it.

14. Tracking and cookies

Kilopilot doesn't track you across other companies' apps or websites, has no advertising, and doesn't use Apple's advertising identifier, so it never asks for tracking permission. The app uses no cookies. The random ids described in sections 2.6 and 2.7 are stored on your phone only to make crash reports and, if you said yes, analytics work.

15. If you live in the United States

We don't sell your personal information, and we don't share it for targeted advertising. Everyone, wherever they live, can use the rights in section 10. [US STATE HEALTH-DATA NOTICE]

16. Changes to this policy

When we change this policy, we'll update the effective date at the top. If a change matters, for example a new kind of data or a new provider, we'll tell you in the app before it takes effect and, where the law requires, ask for your consent again. Earlier versions are available on request.

17. Contact

Questions, requests or complaints: hello.kilopilot@gmail.com

[LEGAL NAME], trading as sunnyApps, [POSTAL ADDRESS], [COUNTRY]