Privacy Policy — Loki Fitness

Effective date: 2026-05-24 Last updated: 2026-11-08

1. Who we are

Loki Fitness is operated by UnstablePixel SRL (the "Controller").

• Company name: UNSTABLEPIXEL S.R.L.
• CUI: 46015450 · Reg. Com.: J05/1066/2022
• Registered address: Str. Victor Babeș nr. 2, Oradea, Bihor, Romania
• Privacy contact: privacy@unstablepixel.com

For any question about your personal data or to exercise the rights described in Section 9, write to the privacy contact above. We answer within 30 days (one 60-day extension may apply for genuinely complex requests).

2. What this policy covers

The Loki Fitness mobile app (iOS and Android), the web onboarding + payment surfaces at fitness.loki.unstablepixel.com, and the supporting backend API that those clients talk to.

It does not cover:

• AI providers you connect to your account (Claude, ChatGPT, others). When you connect one, data you choose to share with it is processed by that provider under their own privacy policy. We disclose the data at your explicit request, recorded by the consent screen you confirm during connection. See Section 7.
• Apple Health and Health Connect. The health store on your phone belongs to Apple or Google and is governed by their terms, not this policy. What Loki writes into it and reads out of it — and only when you switch that on — is Section 8.

3. Data we collect

We do not collect:

• Body photos, skinfold readings, or any imaging. These are excluded from the product on purpose: the health-data consent in Section 3a covers the numbers in the table above, not pictures of you or a measured body composition, and bringing either in would need its own separate explicit consent. (A body-fat percentage you type in yourself is in the table above, alongside your weight: it is one number you choose to record, we never read it from anywhere, and it is optional — leave it blank and there is nothing to collect.)
• Behavioural tracking for advertising. The app has no ad SDKs.
• Your location.
• Your contacts, calendar, photos, microphone, or camera.

3a. The health-data consent

Some of what Loki Fitness holds is health data — your height and weight, your tape measurements, a body-fat percentage if you record one, the limitations note you can type (injuries, joints to avoid), and anything you tell us hurts. Under GDPR Article 9 that needs your explicit consent, not just a contract, so we ask for it in words:

• Where. Onboarding, on the A bit about you screen — in the app, or in the web sign-up if you start there — as a box you tick yourself: "I agree that Loki Fitness processes my health data." It is never pre-ticked and never bundled with the Terms, and the screen links to this policy before you decide.
• If you don't agree, you can't continue — and nothing has been sent: the consent and your answers leave your phone in the same request, so declining means we never received any of it.
• We record it on our servers: that it was granted, the wording you saw, the platform, and when. That record is how we can show what you agreed to.
• If you had an account before 2026-11-04, we ask you once, on your next launch, and the app waits for your answer. Nothing of yours is deleted while it waits.
• Withdrawing it deletes your data. There is no in-between where we keep it but stop using it — the app runs on this. Settings → Health-data consent → Withdraw… runs the same deletion as Delete my Fitness data (Section 9), and tells you it does not cancel your subscription and where to cancel that.
• It is not the same as the per-type consent for reading from Apple Health or Health Connect (Section 8), or the separate opt-in before imported records reach an AI you connect. Those are still their own switches.

Your strength logs — how much you lifted, for how many reps — are the service itself and run on our contract with you, not on this consent.

4. Why we collect each category

In short: to run the service you signed up for, to keep it working, and to satisfy a few specific obligations.

• Account, onboarding, workout, subscription data — needed to deliver the app's core function. Without them, there is no product.
• Body measurements, your limitations note, and anything you tell us hurts — to draw your charts and shape your training. This is health data, and we hold it on the explicit consent you give during onboarding, not on the contract (Section 3a).
• The health-data consent record — so we can show what you agreed to and when, which Article 7(1) requires of us.
• AI-connector consents — recorded so that when you authorise Claude or ChatGPT to read your workout data, that authorisation is documented and revocable.
• Tool audit log — to detect abuse and to debug AI-tool failures. We store a hash of the arguments, not the arguments themselves. A failed call also keeps the error message the AI was shown, because that message is the whole point of a debugging record.
• AI activity log — so the Activity screen can show you what a connected AI or your coach did on your behalf, including what it tried and failed to do. It exists to be read by you.
• Coaching links — so a coach you paired with can see what you agreed to share, and nothing else, and so either of you can see who has access. See Section 7a.
• Health-store imports and consents — because you asked Loki to read those types from your phone, and because we have to be able to show what you agreed to and when. See Section 8.
• Crash diagnostics + backend telemetry — to know when the app is broken so we can fix it. We don't profile you with this data.

5. Who we share data with (sub-processors)

We use these processors to run the service. Each acts on our documented instructions; each is bound by a Data Processing Agreement.

Apple's App Store sells in-app subscriptions as the seller, under Apple's own terms and privacy policy; Apple is not a processor of ours. We receive only what we need to grant access (the product, the status, the renewal date), never your payment details.

Apple and Google are not processors of ours for the health store. Apple Health and Health Connect run on your phone; Loki exchanges data with them on the device, under the platform's own permission prompt. Nothing about that exchange — which types are switched on, when the last sync ran — leaves your phone. Records you import land in your Loki account and are then held by the processors above, like any other app data. See Section 8.

A coach you pair with is not a processor of ours either: they see your data because you asked us to show it to them (Section 7a).

We do not sell personal data. We do not share it with advertisers.

6. How long we keep it

• Account, workout and measurement data — for as long as your account is active.
• Subscription record: your subscription status, billing cadence and current period end, plus the Stripe customer and subscription ids for a web purchase, or the App Store reference for one made on your phone. This one is kept after you delete your Loki Fitness data. It is the record of a commercial relationship that may still be live, so it is how we know that a payment you are still making entitles you, and it is part of our billing trail. Retained under Art. 6(1)(b), because the contract is still running, and, for the billing trail, Art. 6(1)(c). It is kept for as long as the Loki sign-in it belongs to, and it is removed when your whole Loki account is removed (Section 9): we cancel the subscription first, then delete the record together with the sign-in.
• Health-store imports — until you delete your account or turn that import off, whichever comes first. Turning it off deletes every record already imported for that type immediately, with no grace period.
• Health-store consent records — kept for as long as the account, including withdrawn ones, because they are the evidence of what you agreed to and when. Deleted with the account.
• The health-data consent record — kept for as long as the account, for the same reason, and deleted with it. Because withdrawing that consent is the deletion (Section 3a), the record never outlives the data it covered.
• Tool audit log — 90 days from each entry, then deleted.
• AI activity log — 30 days from each entry, and at most the 1000 most recent entries per account, then deleted.
• Coaching links — for as long as the account. Ending a link stops all access at once but keeps the record that it existed, marked ended (Section 7a).
• Crash diagnostics — Firebase Crashlytics default retention (currently 90 days for crashes, 30 days for non-fatal events).
• Backup snapshots of the Postgres database — 7 days rolling.

When you delete your Loki Fitness data (Section 9), every category above is removed from our systems within 30 days, with three exceptions:

• Your account identity: the Firebase user id, email and display name you sign in with (the first row of Section 3). That sign-in is shared across every Loki app, so deleting it from inside Loki Fitness would lock you out of the other apps' data and of your subscription.
• Your subscription record, for the reason given in its bullet above: the commercial relationship can outlive the data, and dropping our copy of it would leave you paying for a plan this app no longer knows about. Deleting your Loki Fitness data does not cancel your subscription.
• The record of a coaching link you were part of, without your user id: when it started and ended, and the other person's user id. Deleting your data ends every link at once, so the coach (or client) loses all access. The ended record stays so their own history still makes sense, but where your user id was it now says only that the coach (or client) deleted their account. Once you have both deleted your accounts, the record is deleted too. If you were a coach, your user id also stays on your former clients' tool audit log entries that record what you viewed or changed, because that log is our security record of who reached their data, until those entries expire (90 days, above). It is taken off their AI activity log straight away: those entries are theirs and stay, but now read only "Coach".

The first two stay until you remove your whole Loki account: Settings → Privacy & data → Delete my Fitness data → Delete my Loki account, or the same option on your account page at loki.unstablepixel.com/account (Section 9). You can also ask us at the privacy address in Section 1, and we handle that within the same 30 days. Be aware of the knock-on: because the subscription record is keyed to that shared sign-in, signing back in to Loki Fitness with the same account restores your paid access. Your workouts, measurements and programs do not come back; the subscription does. Your own audit-log entries are deleted along with your Loki Fitness data; we do not keep a trail of your past activity.

7. AI connectors (Claude, ChatGPT, others)

This is unusual enough to deserve its own section.

Loki Fitness doesn't send your data to any AI company. Neither the app nor our servers use an AI provider. Your data reaches an AI only if you connect your own assistant, and that is up to you: you can change or disconnect it any time.

The app lets you connect an AI assistant — Claude, ChatGPT, or any other client that supports the Model Context Protocol — to your account. Once connected, that AI can call a defined set of tools against your data (read your workouts, log a new set, fetch your exercise catalog, etc.) only within the scopes you explicitly granted at the OAuth consent screen.

What this means in plain terms:

• The AI provider becomes a recipient of whatever data you ask it to see. Your conversation with the AI is governed by their privacy policy, not ours.
• You can revoke a connector at any time from Settings. We honor the revocation immediately — the next tool call from that AI returns unauthorised.
• We log each tool call (Section 3, "Tool audit log") for security: a hash of the arguments, not the content — plus, when the call failed, the error message the AI was shown.

If you do not connect any AI, no AI provider receives any of your data.

7a. Coaching

Loki Fitness lets a coach — another Loki Fitness user who has switched on Coaching mode — follow your training. Nothing is shared with anyone until you pair.

Starting it. Your coach gives you a 6-character code, valid for 10 minutes. You type it under Settings → Coaches → Add coach, and that screen tells you what the coach will see before you confirm. Typing the code and confirming is your consent; we record when the link started.

What your coach sees. Your workout history and sessions, your saved workouts and program, your body measurements, and the insights computed from your workouts (personal records, volume, progress). Body measurements are health data, so showing them to a coach rests on your explicit consent (Art. 9(2)(a)), given on that screen; the rest rests on your consent (Art. 6(1)(a)). Each of you sees the other by the name on your account (your Google or Apple name), or by the first part of your email address if your account has no name; never by a user id. To show it, we keep a copy of that name with your profile, update it when it changes, and delete it with your data.

What your coach never sees. Your limitations note, anything you told us hurts (Section 3a), records imported from Apple Health or Health Connect (Section 8), your equipment and places, your AI connections, your health consents and your subscription.

Edits are off until you turn them on. A new link is view-only. Under Settings → Coaches you can Allow edits, which lets that coach log sessions, edit your workouts and program and record measurements for you; you can switch it off again whenever you like. The coach can never turn it on themselves. Every change a coach makes shows in your Activity screen, and Activity on the coach's card lists what they viewed and changed, for the last 90 days (the tool audit log's period).

Your coach's own AI. If your coach has connected an AI assistant to their Loki Fitness account, it can act for them on your data within the same limits: what they may see, and edits only if you allowed them. That AI's provider then receives what it reads, under your coach's arrangement with it (Section 7).

Stopping it. Settings → Coaches → Revoke ends the link, and the coach can end it too. Access stops immediately. This is how you withdraw the consent above. We keep the record that the link existed, marked ended, for as long as your account (Section 6).

Deleting your account ends every coaching link you are part of, as a coach or as a client. The other person keeps the record that the link existed, without your user id. If you were their coach, anything you changed in their data shows in their Activity as done by "Coach", without your name. Section 6 lists exactly what stays.

8. Health data from your phone (Apple Health / Health Connect)

Loki Fitness can exchange data with the health store on your own phone — Apple Health on iOS, Health Connect on Android. Both directions are off by default and chosen one data type at a time, from Settings → Apple Health / Health Connect, and you can turn any of it off at any time.

What Loki publishes to your phone. Finished workouts — as a strength-training session with its start, its end and its name — and the body weight you logged. These are values you already entered in Loki; publishing puts a copy in a store you control, on your device, behind the platform's own permission prompt. Loki asks for write-only access to these types, and nothing per set, no volume, no notes and no tape measurements are ever written. Nothing new is collected and nothing about publishing reaches our servers.

What Loki reads from your phone — only for the types you switch on. Two things: workouts other apps and devices recorded (the activity type, when it started and ended, the energy burned and the distance) and body-weight readings from a smart scale or another app. These come from a medical-grade store and count as health data under GDPR Article 9, so before a single sample is read we ask for your explicit consent, for each type separately — a sheet that says what is read, where it goes and who sees it — and we record that consent on our server (the type, the wording you saw, the platform, the date). Reading happens when you open the app, over a window capped at 30 days. It never happens in the background.

Where imported records go. Into your Loki account on our servers, marked with where they came from: the platform, the store's own id for that sample, and the name of the app or device that recorded it. Imported workouts are kept apart from the sessions you logged, and imported weigh-ins never overwrite one you typed yourself. Deleting a record in Apple Health or Health Connect does not delete it in Loki — the app says so, and you can delete the record in Loki directly.

Who sees them. Only you — until you separately switch on Let my assistant see imported data. Until you do, no AI connector (Section 7) can read, count or summarise an imported record; we filter them out on our server, not in the app. If you do switch it on, the AI provider you connected becomes a recipient of that data as well, on the same terms as the rest of your Loki data.

Withdrawing. The same switch that granted it takes it back. Turning an import off deletes every record already imported for that type, in the same operation that records the withdrawal — there is no grace period and nothing is kept back. Turning the assistant switch off stops the assistant seeing imported data from then on. Turning a publish switch off offers to delete everything Loki wrote into your phone's store. Deleting your account (Section 9) removes the imported records and the consent record along with everything else.

What Loki never reads. Nothing beyond the two types above — no heart rate, no routes, no sleep, no reproductive-health data, nothing else the store may hold. Loki also ignores the samples it published itself, so your own entries cannot loop back and be counted twice. Which types you switched on and when the last sync ran is bookkeeping that stays on your phone.

Apple and Google are not processors of ours for any of this: the store is on your device and the exchange is local to it (Section 5).

9. Your rights

Under the GDPR you have eight rights over your personal data. The app implements concrete mechanisms for the ones that need them:

If you believe we have mishandled your data, you have the right to lodge a complaint with your local supervisory authority. In Romania this is the ANSPDCP (https://www.dataprotection.ro/).

10. International data transfers

Our infrastructure is in the EU. The cross-border transfers that happen are documented in Section 5. Each one has a valid Article 46 transfer mechanism (EU–US Data Privacy Framework certification + Standard Contractual Clauses) where the processor is outside the EU.

Connecting an AI provider is a transfer that happens at your explicit instruction under Article 49(1)(a) — we disclose it clearly via the OAuth consent screen and you can refuse.

Exchanging data with the health store on your phone is not a transfer at all: it happens on your device, between Loki and Apple Health or Health Connect (Section 8).

11. Children

Loki Fitness is for people aged 16 and over. Onboarding asks for the year you were born and does not let you continue if that year means you are under 16 — and because a year cannot tell 15 from 16 in the year someone turns 16, we turn that year away too. The app checks it, and so does our server, on every change to that answer.

We do not knowingly collect personal data from children. If you become aware that a child has provided personal data through the service, contact the privacy address in Section 1 and we will delete it.

12. Security

We follow GDPR Article 32 — appropriate technical and organisational measures. In specific terms:

• TLS 1.2 or higher in transit, everywhere.
• AES-256 encryption at rest on the database (Azure default).
• Secrets in Azure Key Vault, never in source control or configuration files.
• The backend's authorisation server scopes every API call to the user it was issued to; one user cannot see another user's data by construction.

No system is breach-proof. If a personal-data breach occurs we will notify the supervisory authority within 72 hours and, where the risk to you is high, notify you directly.

13. Cookies (web surfaces)

The web onboarding and payment pages use only strictly necessary cookies before consent — the session cookie that keeps you signed in, the CSRF token, and the consent record itself. We do not run advertising trackers. If we ever introduce optional analytics on the web surface, you will see a separate opt-in banner before any analytics cookie loads.

14. Changes to this policy

We may update this policy when the service changes or the law requires. The "Last updated" date at the top is the canonical version marker: when it changes, this document has changed, and the copy published at this address is always the current one.

There is one in-app step that asks for a new agreement rather than an acknowledgement: if your account is older than the health-data consent in Section 3a, the app asks for it once, on your next launch, and waits for it — the same box, the same wording, before anything else.

Otherwise there is no in-app step that asks you to re-acknowledge a new version. When a change is material — a new category of data, a new recipient, a longer retention period, or anything that narrows your rights — we announce it in the app's What's new, on the next launch after you update. Where a change needs your consent, we ask for it before it applies to you, per data type, on the screen that switches that feature on (Sections 7 and 8).

15. Contact

For privacy questions, data subject requests, or anything in this document that doesn't read clearly to you, write to:

privacy@unstablepixel.com UNSTABLEPIXEL S.R.L. — Str. Victor Babeș nr. 2, Oradea, Bihor, Romania