KINETIC
Privacy Policy
Last updated: 5 October 2026
The short version.
- Kinetic is run by one person, not a company.
- We store the training data you log so the app can work. We never sell it, and there are no ads.
- Your workouts, body measurements and anything you tell the AI Coach about injuries are treated as health data, and we only process them with your explicit consent.
- When you use the AI Coach, or import a program from a photo, PDF or link, your messages or the imported content are sent to Google's AI to generate a reply or read the program.
- You can delete your account and its data at any time from Profile → Delete account.
The rest of this page is the detail behind those five points.
1. Who we are
The controller of your personal data is Tarek Chamoun, an individual based in the United Kingdom who runs the Kinetic app. You can reach us at [email protected].
Kinetic is not a company — it is built and operated by one individual. We are not required to appoint a Data Protection Officer, so data protection questions go to the address above and are answered by the operator personally.
This policy covers the Kinetic iPhone app and the website kineticai.me (together, the "Service").
2. What we collect
| Category | What it includes | Required? |
|---|---|---|
| Account | Username, email address, and a password stored only as a salted hash. Email verification and password reset tokens. | Yes |
| Sign-in providers | If you use Google or Apple Sign-In, we receive your name and email from that provider. We never see your Google or Apple password. If you use Apple's Hide My Email, we only ever receive the relay address. | Optional |
| Profile | Display name and profile picture, if you add them. | Optional |
| Training | Exercises, sets, reps, weights, effort (RPE), session duration, personal records, the programs you create or follow, skipped sessions, and XP. | Yes |
| Body & nutrition | Body weight and any measurements you log; height, biological sex, date of birth and activity level; nutrition entries and calorie/protein targets. | Partly — see §3 |
| Social | Friend connections, feed posts, photos, cheers, comments, and friends-only leaderboard standings. | Optional |
| AI Coach | Your chat messages, any photos you attach, and coach memory — durable notes the coach saves about your goals, injuries and limitations, preferences, and life context. | Optional |
| Program import | The text, photos, files and web links you import as a program. They are read to build the program you review; the photos and files themselves are not stored. | Optional |
| Technical | Push notification token; crash and error reports (see §7); standard server request logs. | Yes |
We do not collect your precise location, your contacts, any advertising identifier, or data from Apple Health / HealthKit. We show no ads, use no third-party advertising SDKs, and do not sell or share your personal data. We do use one product analytics tool, PostHog (EU cloud), to see which screens and features are used; it receives your account id and username, never your email, and no health data.
3. Health data — and why we ask permission for it
Some of what Kinetic stores is "special category" data concerning health under Article 9 of the UK and EU GDPR. It gets a higher standard of protection than the rest, and we only process it with your explicit consent.
We treat all of the following as health data:
- Your logged workouts and training load.
- Your body weight, body measurements, height, biological sex, date of birth and activity level.
- Your nutrition entries and calorie or protein targets.
- Anything you tell the AI Coach about injuries, pain, limitations, medical conditions or medication — including the injury notes the coach saves to its memory.
- Any photo you attach to an AI Coach conversation.
Biological sex and date of birth are not health data in themselves, but we use them together with your height and weight to estimate your metabolic rate, so we hold them to the same standard rather than a lower one.
Our lawful basis
We rely on your explicit consent under Article 9(2)(a). Because health data is essential to what Kinetic does, if you withdraw that consent we can no longer provide the Service, and your account will be closed and your data deleted.
How you give it
We ask for this consent at the start of onboarding, before you enter any body metrics: the first step says that Kinetic stores your body stats and workouts to track your progress, and you agree by tapping Agree & continue. We record when you agreed. The AI Coach has its own, separate choice (see §6).
How you withdraw it
You can withdraw at whatever level you want, without asking us:
- Delete a single thing the coach remembers — open the coach's memory sheet and remove it. You can also correct one that's wrong.
- Delete individual workouts or body weight entries in the app.
- Delete your whole account: Profile → Delete account.
Withdrawing consent doesn't undo processing that already happened.
4. Why we process your data, and our legal basis
| Purpose | Legal basis |
|---|---|
| Create and operate your account, and sign you in | Performance of a contract — Art. 6(1)(b) |
| Store and show your workouts, programs, analytics, PRs and XP | Performance of a contract — Art. 6(1)(b) |
| Friends, feed, cheers, comments and leaderboards | Performance of a contract — Art. 6(1)(b) |
| Program import, including reading photos, PDFs and links with AI | Performance of a contract — Art. 6(1)(b) |
| AI Coach chat, program generation and coach memory | Contract — Art. 6(1)(b), and explicit consent for the health elements — Art. 9(2)(a) |
| Transactional email (verification, password reset) | Performance of a contract — Art. 6(1)(b) |
| Push notifications you switch on | Consent — Art. 6(1)(a), withdrawable in Settings |
| Crash reporting, debugging, security and abuse prevention | Legitimate interests — Art. 6(1)(f) |
| Product analytics (which screens and features are used) | Legitimate interests — Art. 6(1)(f) |
| Meeting legal obligations and defending legal claims | Legal obligation — Art. 6(1)(c) / legitimate interests — Art. 6(1)(f) |
Where we rely on legitimate interests, we've weighed our interest in keeping a free service working and safe against your rights, and limited what those systems collect accordingly — crash reports carry no email address, no IP address and none of your training or health data. You can object to this processing; see §9.
5. Who we share it with
We share data only with the providers we need to run the Service.
| Provider | What it does | Where |
|---|---|---|
| DigitalOcean | App hosting and the managed database that holds your account | London, United Kingdom |
| Cloudflare R2 | Storage and delivery of photos and profile pictures you upload | European Union |
| Cloudflare | DNS and content delivery for kineticai.me, and routing for our support email | Global edge network |
| Google (Gemini API) | Generates AI Coach replies and programs, and reads imported programs — see §6 | United States |
| Google (Gmail) | The inbox that receives mail sent to [email protected] | United States |
| Google / Apple Sign-In | Optional authentication | — |
| Resend | Delivery of transactional email | United States |
| Expo | Delivery of push notifications | United States |
| Sentry | Crash and error reporting — see §7 | Frankfurt, European Union |
| PostHog | Product analytics: which screens and features are used | Frankfurt, European Union |
Each of these acts as our processor under a written data processing agreement and may use your data only to provide its service to us. We may also disclose data where the law requires it, or where it's necessary to protect the rights and safety of our users.
6. The AI Coach and Google Gemini
When you use the AI Coach, the following leaves your device and is sent to Google's Gemini API: your message, any photo you attach, and the training and body context needed to answer — which can include your recent workouts, your programs, your body weight trend, and the notes the coach has saved about you. Replies are generated by Google's gemini-3.5-flash model.
The AI Coach can also propose changes to your training program and to your calorie and protein targets. Those take effect only when you accept them.
Kinetic uses Google's paid Gemini API. Under those terms Google does not use your prompts or the replies to improve its products, and keeps them only for a limited time to detect abuse. AI coaching is optional: you choose whether to turn it on when you set up Kinetic, and you can switch it off at any time in Settings → Privacy. While it is off, nothing is sent to Google.
AI Coach usage is capped — currently 3 generated programs per calendar month and a daily message limit shown in the app. That keeps the feature free, and it also limits how much of your data is sent to a third party.
Program import. When you import a program from a photo, a PDF or a web link, what you import is sent to Google's Gemini API (gemini-3.5-flash) to read its layout: the text recognised on your phone and, for photos and web pages, the image. Pasted text and spreadsheets are read by Kinetic's own reader and go to Google only when that reader cannot make sense of them or you tap Read with AI. To match exercise names to our exercise library, the names we could not match, with the closest library entries, may also be sent. If a website blocks our server, your phone loads the page itself and sends it to us. Import reads are capped at 10 per day. Imports follow the same AI switch: while it is off, imports are read only by Kinetic's own reader and nothing is sent to Google. You review every imported program before it is saved.
7. Crash and error reports
Crash and error reports go to Sentry, processed in the European Union. They contain your Kinetic user ID and username, your device model, OS version and app version, the screens you moved through before the error, the API request that failed (method, path and status code), whether you were online or offline, and the technical details of the error.
They do not contain your email address, your IP address, your password, your workouts, your body metrics, your nutrition entries or your AI Coach conversations. Crash reporting is switched off entirely in development builds, and we do not use session replay or screen recording.
8. How long we keep it
| Data | Retention |
|---|---|
| Your account and everything in it | For as long as your account is open |
| After you delete your account | Removed from live systems immediately |
| Encrypted database backups | 7 days, then overwritten |
| Photos you uploaded | Deleted when you delete your account |
| Crash reports | 30 days |
| Server access logs | Not stored: our host shows recent logs for troubleshooting but keeps no history, and we don't record IP addresses |
| Data kept to meet a legal duty or defend a claim | Only as long as necessary for that purpose |
Note that content you posted where friends could see it may stay visible in their app until it next refreshes.
9. Your rights
You have all of the following rights over your data. We don't charge for any of them, and we won't ask you to justify the request — we may just ask you to email from the address on your account so we know it's you.
- Access — ask us for a copy of what we hold. We reply within 30 days.
- Rectification — correct your profile, body metrics and coach memories in the app; email us for anything else.
- Erasure — Profile → Delete account, or ask us to do it.
- Portability — ask us and we'll send a machine-readable export of your account and training data. We handle these manually today; an in-app export is planned.
- Restriction — ask us to pause processing while a dispute is resolved.
- Objection — object to processing we base on legitimate interests, such as crash reporting.
- Withdraw consent — for health data see §3; for push notifications, use Settings.
Automated decisions
The AI Coach generates training programs and can propose calorie and protein targets. These are suggestions: they take effect only when you accept them, you can change or reject any of them at any time, and they are not decisions producing legal or similarly significant effects.
Complaints
You have the right to complain to a data protection supervisory authority, particularly in the country where you live or work — in the United Kingdom that is the Information Commissioner's Office (ICO, ico.org.uk). We'd genuinely appreciate the chance to put things right first.
10. International transfers
Your account data is hosted in the United Kingdom (DigitalOcean, London). Crash reports are processed in the European Union (Sentry, Frankfurt), and photos you upload are stored in the European Union (Cloudflare R2). Some providers — Google, Expo, Resend and Cloudflare — process data in the United States or elsewhere outside the UK and EEA.
Where data leaves the UK or EEA we rely on the UK–US Data Bridge and the EU–US Data Privacy Framework where the provider is certified under them, and otherwise on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum. You can ask us which safeguard applies to a specific provider. Today: Google, Apple, Resend, Expo and Cloudflare are certified under the Data Privacy Framework (including the UK Extension). DigitalOcean (London), Sentry (Frankfurt), PostHog (EU) and Cloudflare R2 (EU) keep your data in the UK or the EU.
11. California privacy rights
If you are a California resident, you have the right to know what personal information we collect and why, to delete it, to correct it, to opt out of its sale or sharing, and not to be treated differently for exercising those rights.
We do not sell your personal information and we do not share it for cross-context behavioural advertising, as the CCPA defines those terms. We haven't done so in the previous 12 months, and we don't sell or share the personal information of anyone under 16. Because we don't sell or share, there is no "Do Not Sell or Share My Personal Information" link to offer.
In the CCPA's categories, we collect: identifiers; customer records; protected classifications (age, sex); internet activity (crash and error data); visual information (photos you upload); inferences (training analytics and coaching suggestions); and sensitive personal information in the form of health and fitness data. We use sensitive personal information only to provide the Service you asked for and to keep it secure — never to infer characteristics about you.
To exercise any of these, email [email protected]. You may use an authorised agent. We verify requests by confirming control of the account email, and respond within 45 days.
12. Age requirement
You must be at least 13 to use Kinetic. The Service is not intended for children, and we do not knowingly collect data from anyone under that age. If you believe someone underage has an account, contact us and we'll delete it promptly.
In some countries the age at which you can agree to an online service on your own is higher than 13 (up to 16 in parts of the EU). If that applies where you live, you need a parent or guardian's permission to use Kinetic. We ask for your date of birth during setup and don't accept anyone younger than 13.
13. Security
Data is encrypted in transit with TLS, and encrypted at rest by our hosting and database providers. Passwords are stored as salted hashes and never in plain text. Access to production systems is limited to the operator.
We hold no formal security certification (no SOC 2, no ISO 27001) and don't claim one. If a breach affects your rights we will notify the relevant supervisory authority within 72 hours where required, and tell you without undue delay where the risk to you is high.
Found a security problem? Please tell us at [email protected] before disclosing it publicly.
Photos and media. Photos, videos and profile pictures you upload are held by our storage provider, Cloudflare, in the European Union, and delivered through unique, randomly generated addresses. These addresses are not published, indexed or listed, and are designed to be impractical to guess; a file can be retrieved only by a person who holds its specific address. Because retrieval does not require signing in, we recommend that you do not share the address of any file you wish to keep private. Photos you attach in conversations with the AI Coach are retained solely so that the conversation can display them.
14. The website
kineticai.me is a set of static pages. It sets no cookies of our own, runs no analytics, and contains no tracking pixels, advertising tags or third-party scripts. Fonts are served from our own domain, not a third-party font CDN. There is nothing here to consent to, which is why you won't see a cookie banner.
The two account pages, /verify-email and /reset-password, are the one exception in what they send: to complete the action, they send the token from your email link, and on the reset page your new password, directly to the Kinetic API (the same service the app uses), and nothing else.
The site is served by DigitalOcean through Cloudflare, which process standard web request information — including your IP address — to deliver pages and protect the site from abuse. Cloudflare may set a strictly necessary security cookie as part of that.
15. Changes to this policy
We may update this policy as the Service changes. We'll post the new version here and update the date at the top. Where a change materially affects how we use your health data, we will ask for your consent again rather than relying on notice alone. Previous versions are available on request.
16. Contact
Any question or request about your data: [email protected].