Privacy Policy

Last updated: November 2026

This Privacy Policy describes how Spotter ("we", "us", or "our") collects, uses, and protects information about you when you use the Spotter mobile application ("the App"). Optional product analytics is collected only if you enable it in the App's settings.

1. Information We Collect

We collect the following categories of personal data:

• Account information: email address, first name, last name, date of birth, gender.
• Fitness profile: primary fitness goal, experience level, weekly workout frequency.
• Training data: training programs, workout plans, exercise logs (sets, reps, weight, rest times), workout summaries (duration, volume).
• Body weight data: body weight entries with dates.
• Custom exercises: exercises you create within the App.
• Exercise videos (optional): short videos (up to 30 seconds, including audio) that you choose to submit for AI form analysis, and the resulting analysis reports (see section 5).
• Workout health data: heart rate and calories measured by your Apple Watch or Wear OS watch during a workout (see section 3).
• Optional usage analytics: your Firebase account identifier, app opens, workout starts and completions, whether a weight entry was saved (not its value), workout summary identifiers, and technical event context provided by the device and SDK.

We do not send your email address, name, body weight value, workout name, or exercise details to PostHog.

2. How We Collect Your Information

• Directly from you: when you register, complete the onboarding flow, or enter data in the App.
• Videos you submit: only when you pick or record a video in “Video form analysis”, agree to the AI analysis notice and tap Analyse.
• Automatically via Firebase Authentication: when you sign in with email/password or Google Sign-In, Firebase processes your credentials. We receive only the user identifier and email from Firebase.
• Optional analytics: if you turn on “Share usage analytics” in Settings, the App sends the limited events described above to PostHog. The setting is off by default and is stored separately for each account on each device. You can turn it off at any time in Settings; this stops future analytics collection on that device.

3. Health Data from Your Watch

If you track a workout with Spotter on an Apple Watch or a Wear OS watch, the watch measures it while it runs:

• What we collect: heart rate (average, minimum and maximum) and calories burned during each workout you track with the watch. On Apple Watch these are active calories from HealthKit; on Wear OS they are total calories, resting burn included, from Health Services. They are measured only during a workout you start, and only after you grant the watch's heart rate and activity permissions.
• How we use it: only to show these values in your workout summary and history. They are stored with the workout summary on our backend so you can see them on your devices.
• Apple Health: with your permission, your Apple Watch saves the workout, its heart rate and active calories to Apple Health. Spotter reads only the heart rate and active calories of the workout in progress.
• Health Connect (Android): with your permission, Spotter writes each workout measured by your Wear OS watch to Health Connect as an exercise session and its total calories burned. Spotter does not read any data from Health Connect and does not write heart rate to it. You can change or revoke this access at any time in Health Connect's settings; records already written stay in Health Connect until you delete them there.
• Sharing: we do not sell health data, use it for advertising, or share it with third parties, data brokers or analytics providers. It is never sent to PostHog.
• Retention and deletion: heart rate and calories are deleted with your workout history when you delete your account (see section 7).

4. How We Use Your Information

We use your data exclusively to:

• Provide and operate the App's core features (logging workouts, tracking progress).
• Personalise your experience (e.g., exercise recommendations based on your goal and level).
• Analyse your exercise technique from videos you submit, using Google's Gemini AI service (see section 5).
• Sync your data across devices via our backend service.
• Measure and improve use of the App, only when you choose to share usage analytics.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. Third-Party Services

We use the following third-party services, each with its own privacy policy:

• Firebase Authentication (Google): handles sign-in and identity verification. Firebase Privacy Policy.
• Google Sign-In: optional authentication method via your Google account.
• Google Gemini API (Google LLC): AI service used only for the optional video form analysis described below.
• PostHog: processes optional product analytics using your Firebase account identifier and the limited event data listed above. PostHog Privacy Policy.

We do not use the analytics events for advertising. Session replay is disabled.

AI video form analysis (Google Gemini)

“Video form analysis” is optional. Before your first analysis the App tells you what is sent and to whom, and asks for your permission. If you decline, nothing is sent.

• Who receives it: Google LLC, through the Gemini API, an artificial intelligence service.
• What is sent: the video you pick or record (up to 30 seconds, including audio; it may show your face, body and surroundings), your selected training goal, the video length and the App language. Your name, email address and other profile data are not sent to Google.
• Why: only to generate the technique report shown in the App (score, corrections and suggested exercises).
• Retention: our backend forwards the video to Google without keeping a copy and asks Google to delete it as soon as the analysis finishes. The report is stored with your account and deleted when you delete your account.
• Protection: Google processes the video as our service provider under the paid Gemini API Terms: it does not use the content to train or improve its models, and keeps it only for a limited period to detect abuse. These terms give your data protection equal to that described in this policy. Google Privacy Policy.

6. Data Storage and Security

Our backend and third-party providers process data in the regions configured for their services. Optional PostHog analytics is processed in PostHog Cloud EU. We use security measures including HTTPS/TLS for all data in transit and access controls on our backend infrastructure.

Firebase Authentication uses secure token-based sessions. We store your Firebase ID token locally on your device using encrypted secure storage.

7. Data Retention

We retain core account and training data while your account is active. When in-app account deletion succeeds, we remove the profile, training programs, workout history, exercise logs, body weight entries and video analysis reports from our backend. Email deletion requests are handled by our team.

Optional analytics events are retained for up to one year under our current PostHog Cloud free plan. Turning analytics off stops new events from this device. When you delete your account, we request deletion of the matching PostHog person and past events; PostHog processes this request asynchronously. You may also contact us to request erasure of earlier analytics records and confirmation of processing.

8. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights:

• Right of access: you can request a copy of the personal data we hold about you.
• Right to rectification: you can correct inaccurate data directly in the App's settings.
• Right to erasure: you can permanently delete your account and all associated data from Settings → Delete Account inside the App.
• Right to data portability: you can request an export of your data by contacting us.
• Right to object: you can object to certain types of processing by contacting us.
• Withdraw analytics consent: turn off “Share usage analytics” in Settings at any time.

To exercise any of these rights, contact us at the address below.

9. Children's Privacy

The App is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such data, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by updating the "Last updated" date at the top of this page. Optional analytics remains under your control in Settings.