Privacy policy

Kilogain is built to know as little about you as possible. You can use the app without an account, and then nothing about your workouts reaches us. This policy explains what is processed when you use an account, buy Premium, send us a message or visit this website. It applies worldwide; sections 15 to 17 add what is specific to the EEA, the United Kingdom and Switzerland, the United States and Canada.

1. Who is responsible

The controller of your data is Björn Billooye, a sole trader established in Belgium and trading as Kwant Software, Nederwijk 242, B-9400 Ninove, company number BE 1041.558.284. Björn Billooye is also the person responsible for the protection of personal information (privacy officer). For any privacy question or request, write to info@kilogain.com or to the postal address above.

We have not appointed a data protection officer, because the law does not require one for us.

2. In short

• Without an account, your data lives only on your device. We don't receive it.
• With an account (through Google), we keep a copy of your training data on our server in the EU (Frankfurt, Germany), so you find it again on another device. Body weight, measurements and goal weight only go along if you gave your separate consent, which you can withdraw in the app at any time.
• Progress photos never leave your device.
• No ads, no selling of data, no profiling. The app contains no analytics and no trackers; the website counts visits with Umami, without cookies and without following you across sites.
• You can delete your account and your data on our server at any time, in the app or through this page.

3. The app without an account

Everything you enter in Kilogain (workouts, plans, own exercises, set targets, body weight, measurements, photos, your name and settings) is stored on your device. As long as you don't sign in, we send none of it to our servers. Rest alerts are scheduled on your device itself; no server is involved. The app contains no analytics, advertising or crash-reporting software of ours or of third parties.

The app asks for these permissions: notifications and exact alarms (the rest timer), and, only when you add a progress photo, access to the photo you pick or take. Photos stay on your device: they never go to our server, and on iPhone and iPad they are excluded from iCloud backup. If you choose to also erase everything on your phone when you delete your account, your photos are erased too.

When you install and update through Google Play or the App Store, Google and Apple process data under their own privacy policies. Crash reports that your phone collects itself also go through them, if you've allowed that on your device.

4. Account and sync

If you sign in with “Continue with Google”, we create a Kilogain account for you. Google gives us your email address, your name and, if you have one, the link to your profile picture, together with a unique Google ID. We never see your password. Google learns that you sign in to Kilogain.

While backup is on, we store on our server:

• your workouts and sets (exercises, weights, repetitions, times), plans, routines and week schedule, own exercises and set targets;
• your settings (such as the units for weight and length, rest times, language and the figure shown on the body map), and the name you entered in the app;
• body weight, body measurements and, if you set one, your goal weight, only if you gave the separate consent described below, together with the time at which you gave it;
• the times at which each item changed, and for items you deleted a mark that they are deleted.

With every request the app also sends its build number, so the server knows which version it's serving. As with any internet connection, the server sees your IP address. Progress photos are never synced.

Why: to keep your data and make it available on your other devices, as you ask when you sign in. The legal basis is the performance of our agreement with you (Article 6(1)(b) GDPR).

Health data: body weight, measurements and your goal weight can be data concerning your health. We only store them on our server if you give your separate, explicit consent for this in the app (Article 9(2)(a) GDPR): with the tick box when you sign in, or later with the switch “Body weight and measurements in backup” under “Settings” → “Backup”. You can also sign in with Google without giving that consent: they then stay on your device, and everything else still syncs. You can withdraw your consent at any time by turning that switch off. The app then stops sending them and erases the body weight, measurements and goal weight that are already on our server; they stay on your device. You can also withdraw your consent by emailing info@kilogain.com or by deleting your account. Signing out stops syncing but doesn't remove anything from the server.

You are not obliged to give us any of this data. Without an account the app works in full on your device; only backup and sync between devices need an account.

5. Premium and payments

As long as Premium isn't on sale, the app doesn't connect to RevenueCat and this section doesn't apply to you yet.

You buy Premium through Google Play or the App Store. The payment and your payment details stay with Google or Apple; we never see them. Google and Apple are themselves responsible for that payment.

To keep track of who has Premium, we use the RevenueCat service as a processor. It receives from the store the proof of purchase and the status of your subscription, together with your Kilogain account ID (or a random ID if you're not signed in) and technical data such as your country, the app version, the type of device and your IP address. RevenueCat gets no training data, no body data, no name and no email address from us.

Legal basis: the performance of the agreement (Article 6(1)(b) GDPR) and our legal bookkeeping obligation (Article 6(1)(c) GDPR).

6. Contact form and deletion requests

If you send us a message through the website, we store the topic, your message, the language of the page, the time and, if you fill it in, your email address. We only use it to handle your question and to improve the app. The legal basis is your consent (Article 6(1)(a) GDPR), which you give with the tick box on the form and can always withdraw. Please don't put health details or other sensitive information in your message.

If you ask us to delete your account through the form, we store your email address, your note, the language and the time, to check that the account is yours and to carry out your request. The legal basis is our legal obligation to handle your request (Article 6(1)(c) GDPR).

Both forms are protected against spam by a hidden field that recognises automated submissions, and by a limit in our database: no more than 3 messages per email address per 24 hours. We store no IP addresses for this and use no third-party captcha.

If you email us directly, your message is processed by our email provider, Combell (Combell NV, Belgium).

7. This website

The website sets no cookies and shows no ads. Your browser remembers your language choice in its local storage; it stays on your device. See also the cookie policy.

Visitor counter: to see which pages are used and which countries visitors come from, the website counts visits with Umami Cloud (Umami Software, Inc.), with storage in the EU. For each page view, Umami records the page address, the site you came from, your country, your browser, your operating system, your device type, your screen size and your language. Your country is derived from your IP address; Umami does not store that IP address. Umami sets no cookies, stores nothing in your browser and doesn't follow you across other sites, and we don't use this data to build a profile of you. The legal basis is our legitimate interest in understanding how the website is used and improving it (Article 6(1)(f) GDPR). If you don't want to be counted, block scripts from cloud.umami.is, for example with a content blocker in your browser.

The website is served by Netlify. Like any web server, it briefly keeps technical logs, such as your IP address, the time, the page requested and your browser type. This serves only security and fixing errors (legitimate interest, Article 6(1)(f) GDPR).

The demo: if you start the demo, it is loaded from this website and runs in your browser. What you do in the demo stays in your browser and isn't sent to us.

8. What we don't do

• We don't sell personal data and don't share it for advertising, including cross-context behavioural or targeted advertising.
• We don't use your data for profiling or for decisions made solely by automated means that have legal or similarly significant effects. The estimates and suggestions in the app are calculated on your device.
• We don't use your data to train artificial intelligence models.
• We don't collect your precise location (for website visitors, only the country), your contacts, your advertising ID or device identifiers.

9. Who receives data

We work with these service providers (processors), who process your data only on our instructions and under a data processing agreement:

Google (sign-in, Google Play) and Apple (App Store, TestFlight) process data as independent controllers, under their own privacy policies.

Beyond that, we only disclose data if the law obliges us to, for example on a binding order of a court or authority, or if Kilogain is transferred to another company, in which case this policy continues to apply to your data and we inform you beforehand.

10. Transfers outside your country

Our database is located in Frankfurt, Germany, the website's visitor statistics in Germany, and our mailbox in Belgium. Supabase, Netlify, Umami and RevenueCat are companies established in the United States, so your data can be processed there or accessed from there, and in other countries where they or their sub-processors operate. Where data leaves the European Economic Area, the United Kingdom or Switzerland, this only happens with appropriate safeguards: an adequacy decision, such as the EU-US Data Privacy Framework with its UK and Swiss extensions for providers certified under it, or the European Commission's standard contractual clauses (with the UK addendum where needed). You can ask us for a copy of these safeguards at info@kilogain.com.

11. How long we keep data

• Account and synced data: for as long as your account exists. If you delete your account, we erase that data from our live database right away. Server backups, where they exist, are kept for no more than 7 days.
• Items you delete in the app while keeping your account: they are marked as deleted on the server, so your other devices remove them too. We permanently erase them from the server 30 days after you deleted them. An own exercise or a routine that you deleted but that still occurs in workouts or plans you keep, stays for as long as those exist.
• Accounts that are no longer used: we erase an account, with all data stored with it on our server, when it hasn't been used for 24 months (no sign-in and no sync). We warn you by email at the address of your account at least 30 days beforehand; if you sign in or sync before that date, your account stays. Data on your device isn't affected.
• Subscription data: for as long as needed for your subscription, and after that for as long as bookkeeping law requires (in Belgium: ten years).
• Messages and deletion requests through the website: until your question is handled, and at most 12 months after you sent them.
• Web server logs: these are kept by our web host Netlify, under its own retention period. We keep no copy of them ourselves.
• Website visitor statistics: at Umami, for as long as we need them for those statistics. We can delete the data there ourselves. Your IP address is not stored.

12. Security

All connections between the app, the website and our servers are encrypted (HTTPS/TLS). The data on the server is encrypted at rest by our provider. On the server, every row of data is walled off per account (row-level security), so other users can't reach it. The app keeps your sign-in session in your device's secure storage, and Android's automatic cloud backup is switched off for the app. Only Björn Billooye has access to the server's administration.

No system is perfectly safe. If a breach occurs that is likely to put you at risk, we inform you and the competent authorities as the law requires.

13. Your rights

Wherever you live, you can ask us to: tell you whether we process data about you and give you a copy; correct data that is wrong; erase your data; and give you your data in a common format. You can do much of this yourself in the app: “Export CSV” takes your data with you, and “Delete account” erases it from our server. For everything else, email info@kilogain.com. We don't charge for this and never treat you differently because you used your rights.

We reply within one month. To protect your data we may ask you to confirm the request from the email address of your account. Someone else may act for you if they show that you authorised them.

If you gave consent, you can always withdraw it. That doesn't change anything that happened lawfully before.

If we refuse a request, we tell you why, and you can ask us to reconsider by replying to that message (appeal). We answer an appeal within 45 days. Further rights and the authority you can complain to depend on where you live; see the sections below.

14. Children

Kilogain is intended for people aged 16 and over, and is not directed at children. You must be at least 16 to create an account. We don't knowingly process data of anyone under 16, and therefore none of children under 13. If you think a child has created an account anyway, let us know at info@kilogain.com and we'll delete it.

15. If you live in the EEA, the United Kingdom or Switzerland

The General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection give you, in addition to section 13, the right to restrict processing and to object to processing that is based on our legitimate interest (the web server logs and the website's visitor counter).

You can lodge a complaint with a supervisory authority, in particular in the country where you live or work:

• Belgium (our lead authority): Data Protection Authority, Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be;
• other EEA countries: your national authority, listed at edpb.europa.eu;
• United Kingdom: Information Commissioner's Office, ico.org.uk;
• Switzerland: Federal Data Protection and Information Commissioner, edoeb.admin.ch.

You can also go to court. We'd appreciate it if you contact us first; we usually solve it together.

16. If you live in the United States

Kilogain is a small business and stays below the thresholds of the California Consumer Privacy Act and of the comprehensive privacy laws of the other states. We nevertheless give everyone the rights in section 13, and this section gives you the information those laws ask for.

Categories we collect (in the past 12 months; from website visitors only the logs and the visitor statistics, everything else only if you use an account, Premium or the contact form): identifiers (email address, name, account ID, IP address); commercial information (subscription status, only once Premium is on sale); internet activity (web server logs, website visitor statistics, app build number); the country you visit the website from, derived from your IP address; health-related and other sensitive information that you enter yourself (body weight, body measurements, goal weight, workouts); the content of messages you send us. The source is always you, or Google when you sign in. The purposes are those in sections 4 to 7, the retention periods those in section 11.

No sale, no sharing: we don't sell personal information and don't share it for cross-context behavioural advertising or targeted advertising, and haven't done so in the past 12 months, also not of people under 16. We disclose it only to the service providers in section 9. We use sensitive information only to provide the service you asked for. Because nothing is sold or shared, there is nothing to opt out of; the website does not respond to Global Privacy Control or “Do Not Track” signals, because it doesn't track you across sites or apps.

Washington and Nevada: see our Consumer Health Data Privacy Policy.

Your rights: access, correction, deletion, a portable copy, and appeal, as described in section 13, by email to info@kilogain.com. If we refuse your appeal, you can contact the attorney general of your state.

17. If you live in Canada

Björn Billooye, reachable at info@kilogain.com, is the person accountable for our compliance with Canadian privacy law and, for Quebec, the person responsible for the protection of personal information.

We collect your information only with your consent, which you give by signing in, by giving your separate consent for body weight, measurements and goal weight, or by sending us a message. You can withdraw it at any time, as described above. You have the right to access and correct your information, to have it erased, and to receive it in a structured, commonly used format.

Your information is stored and processed outside Canada and outside Quebec, in the European Union (Germany and Belgium) and in the United States, by the service providers in section 9. There it is subject to the laws of those countries and can be accessed by courts and authorities there.

We don't use technology to identify or profile you, and take no decisions about you by automated means alone. The website's visitor counter derives from your IP address only the country you are visiting the site from, and doesn't store that IP address.

You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, to the Commission d'accès à l'information (cai.gouv.qc.ca), and in Alberta and British Columbia to the provincial commissioner. This policy is available in French through the language menu.

18. Changes

If anything changes in how we handle data, we update this policy and change the date at the top. For an important change, we'll also let you know in the app before it takes effect, and we ask your consent again where the law requires it. Earlier versions are available on request.