Privacy Policy

This Privacy Policy explains how Mehmet Bahadır GÜNGÖR, operating the Athlor service ("Athlor," "we," "us," or "our"), collects, uses, shares, and protects information when you use the Athlor mobile application and related services (the "App" or "Service"). We are the data controller for the processing described in this Policy unless stated otherwise.

Athlor is a fitness, nutrition, progress tracking, subscription, rewarded-ad, community-contribution, shared-feedback, and AI-assisted coaching app. Because the App can process health, fitness, nutrition, body measurement, photos, chat, feedback, subscription, device, diagnostics, and advertising-related data, please read this Policy carefully.

By using the App, you acknowledge this Privacy Policy. If you do not agree with it, please do not use the App.

1. Information We Collect

We collect information that you provide directly, information generated by your use of the App, and information processed through trusted service providers that help us operate the App.

1.1 Account and Profile Information

• Name or username
• Email address
• Firebase Authentication user ID
• Google Sign-In account identifiers when you choose Google Sign-In
• Apple Sign-In account identifiers and relay email address, if provided, when you choose Apple Sign-In
• Email verification status
• Profile photo URL if you add one
• Birth date or age information
• Language, unit, theme, notification, and app settings
• Account creation and last sign-in timestamps

1.2 Health, Fitness, Nutrition, and Body Measurement Information

Athlor asks for health-related and fitness-related information so it can provide its core features. This may include:

• Height, weight, neck, abdomen, hip, and other body measurements
• Gender, age, daily activity level, experience level, equipment, workout days, and fitness goals
• Weight target and goal progress
• Calculated values such as BMI, BMR, TDEE, body fat percentage, calorie targets, and macronutrient targets
• Workout plans, workout calendar entries, exercise logs, performance history, personal records, custom exercises, and live exercise data
• Nutrition plans, meal logs, food entries, custom foods, barcode or food database search results, and calorie/macronutrient tracking
• Progress analysis inputs and AI-generated progress reports

Athlor is not a medical device and does not provide medical advice, diagnosis, treatment, cure, or prevention of any disease or medical condition.

1.3 AI, Chat, Photos, Feedback, and User Content

When you use AI, feedback, or other content features, we may process:

• Text prompts and chat messages
• Chat history and AI-generated responses
• Context you choose to provide to the AI assistant, such as workout, nutrition, progress, or profile data
• Meal photos or gallery images you submit for AI meal recognition
• Images attached to support or feedback requests
• Feedback titles, issue descriptions, administrative replies, feedback status, support counts, and whether you supported a submission

Depending on the feature, availability, and routing configuration, AI prompts, relevant profile context, and meal photos may be sent through our backend to Alibaba Cloud Model Studio / Qwen, DeepSeek, or Google Cloud Vertex AI / Gemini. Qwen currently supports image-based meal recognition; DeepSeek currently supports text-based tasks; Gemini may remain available as an alternative or fallback provider. Before personal data is shared with a third-party AI provider, the App presents an AI-processing disclosure and requests permission where required. We do not instruct these providers to use your personal prompts or images to train public foundation models, but provider security, abuse-monitoring, and limited retention practices may apply under their service terms.

When you submit food or exercise data requests, proposals, evidence, or support votes, we process the contribution content, your Athlor user ID, and membership tier through Athlor's separate contribution API. Contribution content and status may be visible to other users. If accepted into the shared catalog, factual contribution data may remain in anonymized form after account deletion, while the direct link to your account is removed.

Some feedback submissions may be displayed in an in-app feedback catalog or similar shared feature. Depending on the product version, other Athlor users may be able to search for and view feedback titles, descriptions, status, administrative replies, attachments, and support counts, and may support a submission. Content submitted to a shared feedback feature should not be treated as private. Do not include health records, contact details, account credentials, financial information, or other sensitive personal information in shared feedback.

1.4 Device, Usage, Diagnostics, Video Delivery, and Security Information

• Device model, operating system, app version, package/bundle identifier, and technical app configuration
• Firebase installation identifiers, App Check tokens, authentication tokens, and server logs
• IP address and request metadata processed by Firebase, Google Cloud, Cloudflare, and other infrastructure providers
• Video playback and delivery request data, such as IP address, user agent, request time, playback URL requests, network and performance information, and security logs processed for exercise video delivery
• Firebase Analytics events, app usage information, feature usage, and performance data
• Firebase Crashlytics crash reports and diagnostics
• Firebase Performance Monitoring data
• Firebase Cloud Messaging token for push notifications
• A hashed or derived device fingerprint used for trial eligibility, fraud prevention, and subscription abuse prevention

1.5 Payments, Subscriptions, Trials, and Rewarded Ads

• Subscription product ID, platform, status, expiration date, renewal/cancellation state, and entitlement information
• Google Play purchase token, order ID, real-time developer notification metadata, and obfuscated account identifiers
• Apple App Store purchase and subscription metadata when available through the platform purchase flow
• Trial eligibility information, including hashed device identifiers and normalized email records used to prevent repeated trial abuse
• Rewarded AI ad session IDs, rewarded ad transaction IDs, reward credits, daily rewarded-ad counters, and related fraud-prevention data

We do not collect, process, or store full credit card numbers. Payments are handled by Apple App Store or Google Play.

1.6 Advertising and Consent Data

Athlor uses Google Mobile Ads / AdMob rewarded ads on supported platforms. We request consent or present privacy choices through Google's User Messaging Platform (UMP) before requesting ads where required, including for users in the United Kingdom. Athlor is configured to request non-personalized ads, but Google Mobile Ads may still process device identifiers, IP address, app interaction data, local storage, and other data needed for ad delivery, frequency capping, measurement, fraud prevention, and compliance. You can reopen available ad privacy choices from the App settings.

2. App Permissions

Depending on your device, platform, and feature use, the App may request:

• Internet access: to sync data, authenticate accounts, call Cloud Functions, process AI requests, validate subscriptions, load ads, deliver exercise videos, and use food database services.
• Camera: to take meal photos, scan barcodes, or attach images to feedback.
• Photos / gallery: to select meal photos or feedback screenshots from your device.
• Notifications: to send workout reminders, meal reminders, weekly summaries, AI motivation, subscription notices, and server push notifications.
• Exact alarms / scheduled notifications: to deliver local reminders at the times you choose.
• Store billing: to offer in-app subscriptions through Google Play or Apple App Store.

You can manage operating-system permissions in your device settings. Some features may not work without the relevant permission.

3. How We Use Information

• Create, authenticate, secure, and manage your account
• Provide workout planning, exercise tracking, nutrition tracking, progress tracking, and AI features
• Generate personalized workout, nutrition, chat, meal recognition, and progress outputs
• Save and sync your plans, logs, settings, custom foods, custom exercises, and feedback
• Operate, moderate, attribute, and improve food and exercise contribution requests, proposals, evidence, and support votes
• Display, search, organize, moderate, and respond to shared feedback and calculate support counts
• Calculate health and fitness metrics such as calorie targets, macros, BMR, TDEE, BMI, and body fat estimates
• Process subscriptions, restore purchases, manage trial eligibility, and grant premium or rewarded-ad AI access
• Send local notifications and push notifications you enable or expect from the Service
• Deliver exercise videos and protect video playback from unauthorized use
• Analyze app performance, diagnose crashes, fix bugs, secure the App, prevent abuse, and improve features
• Provide customer support and respond to feedback
• Comply with legal obligations and app store requirements

We do not sell your personal information. We do not use your health, fitness, nutrition, body measurement, meal-photo, or chat data for third-party advertising.

3.1 Legal Bases

Depending on your location and the processing purpose, we rely on performance of our contract with you, compliance with legal obligations, our legitimate interests in securing and improving the Service, and your consent. Where health or other sensitive data requires a separate processing condition, including under Turkish or UK data-protection law, we request explicit consent. You may withdraw consent from the available App settings or by contacting us; withdrawal does not affect processing already performed lawfully.

4. AI and Nutrition Processing

Athlor uses AI to assist with workout planning, nutrition planning, meal recognition, progress analysis, and chat responses. AI outputs can be inaccurate, incomplete, or unsafe if followed without judgment. You are responsible for reviewing AI-generated content before relying on it.

AI providers may change for reliability, quality, safety, or availability. Material changes to the categories of personal data shared or the purposes of AI processing will be disclosed, and renewed permission will be requested where required.

Meal recognition and nutrition results may combine AI estimates with food database information, including data obtained through our nutrition data providers. Nutrition values, portion sizes, and food matches are estimates and should be verified by you.

5. Third-Party Services

We use trusted third-party providers to operate the App. These providers may process data under their own privacy policies and contractual terms.

• Google Firebase: Authentication, Firestore database, Cloud Storage, Cloud Functions, App Check, Cloud Messaging, Analytics, Crashlytics, and Performance Monitoring. Firebase Privacy and Security
• Alibaba Cloud Model Studio / Qwen: AI text and image processing, including meal-photo recognition. Model Studio privacy information
• DeepSeek: AI text processing for supported chat, planning, and analysis tasks. DeepSeek website
• Google Cloud Platform / Vertex AI / Gemini: Alternative or fallback AI processing for supported chat, planning, image, and analysis tasks. Vertex AI documentation
• Google Sign-In: Optional account login and authentication. Google Privacy Policy
• Apple Sign-In: Optional account login and authentication. Apple Privacy Policy
• Google Mobile Ads / AdMob: Rewarded ads, ad delivery, measurement, fraud prevention, and consent-related ad operations. Google technologies and ads
• Cloudflare Stream: Exercise video hosting, signed playback, content delivery, network performance, abuse prevention, and security logging. Cloudflare Privacy Policy
• Google Play: Android in-app purchases, subscriptions, trials, purchase validation, and billing notices.
• Apple App Store: iOS in-app purchases, subscriptions, purchase validation, and billing notices. Apple Privacy Policy
• Nutrition Data Providers: Food search, nutrition database lookup, barcode/food matching, and nutrition data retrieval.
• Athlor Contribution API: Athlor-operated API and database infrastructure used for food and exercise requests, proposals, evidence, moderation, and support votes.

6. Sharing and Disclosure

• With the service providers listed above, including the selected AI provider for the feature you request
• With other Athlor users when you submit content to a feature designed to display or share feedback, status, replies, attachments, or support counts
• With Apple and Google for billing, subscription validation, store compliance, and platform services
• With Google Mobile Ads / AdMob for rewarded ad delivery, measurement, fraud prevention, and legal compliance
• With Cloudflare for exercise video hosting, signed playback, content delivery, performance, and security
• With nutrition data providers for food and nutrition lookup requests
• With law enforcement, regulators, courts, or other parties when required by law or necessary to protect rights, safety, and security
• In connection with a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate confidentiality protections

We do not sell your health, fitness, nutrition, body measurement, meal-photo, or chat data.

7. Data Retention and Deletion

• Account, profile, workout, nutrition, progress, settings, and chat data are generally retained while your account remains active.
• AI meal photos are processed to provide the requested result. We do not intentionally store meal recognition images permanently as standalone server files unless you also submit them as feedback attachments or another feature requires storage.
• Feedback records, attachments, administrative replies, moderation history, and support interactions are stored separately from the main user profile and may be retained to preserve product history, support context, abuse-prevention information, and moderation records.
• Subscription, purchase, entitlement, trial, reward, and anti-fraud records may be retained as needed for billing, legal, accounting, fraud-prevention, chargeback, and store-compliance purposes.
• Hashed device fingerprint and normalized trial email records used to prevent repeated trial abuse are scheduled for cleanup after they are older than one year.
• Rewarded AI sessions are generally retained for 7 days, rewarded AI transaction records for 90 days, and store webhook event records for 30 days.
• Food and exercise contributions may be retained as anonymized factual catalog data after the account link and contributor identifier are removed.
• Accounts that appear inactive for a long period may be deleted under automated retention processes.
• Backups, logs, video-delivery security records, and other technical records may persist for a limited time after deletion before being removed from backup or provider systems.

You can request account deletion through the App, through our account deletion page, or by contacting us. After ownership verification, a deletion request remains pending for 30 days; you may contact support during that period to cancel it. At the end of the grace period, account deletion removes your authentication account, main profile and subcollections, subscription and retention-state records, stored user files, and the account link from contribution records in active Athlor systems. Shared factual contribution data may remain only in anonymized form. Shared feedback and support records are deleted or anonymized unless limited retention is required for legal compliance, security, fraud prevention, billing, dispute resolution, or the integrity of moderation records. Trial identifiers may remain for up to one year and transaction records for the periods stated above.

8. Your Rights and Choices

Depending on where you live, including Türkiye, the United Kingdom, or applicable United States jurisdictions, you may have rights to know or access personal data, receive a copy, correct, delete, object, restrict processing, withdraw consent, or opt out of certain disclosures or targeted advertising. Athlor does not sell personal data or use health data for targeted advertising. You can also manage notification, camera, photos, AI-processing, and ad-related choices through your device or App settings.

To exercise these rights, request removal of identifiable shared feedback, or report inappropriate shared content, contact us using the details below. We may need to verify your identity before completing a request.

UK users may complain to the Information Commissioner's Office. Users in Türkiye may exercise their rights under Article 11 of Law No. 6698 and may complain to the Personal Data Protection Authority after following the applicable application procedure. United States residents may also have state-specific appeal or complaint rights.

9. Children's Privacy

Athlor is not intended for children under 13, and users under 13 must not create an account or use the Service. We do not knowingly collect personal information from children under 13. If we learn that an account belongs to a child under 13, we will take reasonable steps to restrict or close the account and delete the child's personal information, subject to legal, security, and technical retention requirements. Users who are under the age of legal majority where they live should use Athlor only with permission from a parent or legal guardian.

10. International Data Transfers

Your information may be processed outside your country of residence, including in Türkiye, the United States, Singapore, China, and other locations where our providers operate. Depending on the provider and feature, this can include Google/Firebase/Vertex infrastructure, Alibaba Cloud/Qwen, DeepSeek, Apple, Cloudflare, and nutrition providers. Where required, we use an adequacy decision, contractual safeguards, or another lawful transfer mechanism and apply supplementary security measures. You may contact us for information about the applicable safeguard.

11. Data Security

We use technical and organizational safeguards designed to protect information, including HTTPS/TLS in transit, Firebase and Google Cloud security controls, signed video playback, Firebase App Check, access controls, security rules, and provider security practices. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we may notify you through the App, email, store listing, or another appropriate method. The "Last Updated" date shows when this Policy was last revised.

13. Contact Us

If you have questions, requests, reports, or concerns about this Privacy Policy or our data practices, contact us at:

Data Controller: Mehmet Bahadır GÜNGÖR

Address: Kayabaşı Mah. Evliya Çelebi Cad. Park Mavera 1 Sitesi, 34494 Başakşehir/İstanbul, Türkiye

Email: support@athlor.fit