Trenly1. Who we are
The Trenly service (an iPhone app; an Android app is being prepared for release on Google Play; the Telegram bot @trenlybot and the website trenly.org) is provided by FOP Мємєтов Арсен Ділявєрович, a sole proprietor in Ukraine (“we”). Contact for personal data matters: [email protected].
- Trainer data (account, subscription, support requests): we are the controller of personal data.
- Data of the trainer’s clients that the trainer enters into the app: the controller is the trainer. We process it on the trainer’s behalf and only to run the service.
2. What data we process
- Trainer account: email, name, phone, time zone, sign-in method (email and password, Apple or Google). If you sign in with Apple, we store an Apple token so that we can revoke access when you delete your account.
- Trainer’s working data: schedule, sessions and groups, prices, records of clients’ payments and balances, expenses, message templates, settings.
- Client data entered by the trainer: name, phone, Instagram handle, date of birth, gender, goal, notes, including health notes (injuries, contraindications), attendance, balance, body measurements. Before/after progress photos are stored only after the trainer confirms in the app that the client has given consent.
- Telegram data: when a client or a trainer connects the bot, we store the Telegram chat id, name and username, as well as replies to the bot’s buttons (session confirmation, request to reschedule).
- Subscription: subscription status and dates, the App Store or Google Play purchase identifier. We do not receive your bank card data.
- Support requests: the text of requests, category and attachments.
- Technical data: the device push token, platform and app version; server technical logs (request time, error codes).
- Analytics: anonymized app usage events via Firebase Analytics: which screens are opened, key actions (sign-in, trial start, purchase, a session marked done, without amounts), device model, OS version, the app installation identifier. Names, phones and client data do not enter analytics. To turn it off: Settings → Privacy → “Anonymous analytics”.
We do not collect geolocation, phone contacts or the advertising identifier, we do not track you in other apps and on websites, we do not show ads and we do not sell personal data.
3. Why we process data
- to run the service: schedule, records of sessions, payments and balances, measurements and progress, reports;
- to send clients reminders and the trainer’s messages through Telegram, and push notifications to the trainer;
- to verify the subscription and grant access to the app;
- to respond to support requests;
- for security, protection against abuse and troubleshooting;
- to improve the app using anonymized analytics (unless it is turned off).
Legal bases: performance of the contract with the trainer (the terms of use), legitimate interest (security, analytics), consent (progress photos, partner offers in the bot). For client data, the trainer ensures the legal basis themselves.
4. Where data is stored
App data and files (progress photos, support attachments) are stored in Supabase, in a data center in the EU (Frankfurt, region eu-central-1). Files are kept in private storage. Each trainer sees only their own data: this restriction is enforced at the database level.
Some of the data is processed by the services listed in section 5. Some of them may process data outside the EU and Ukraine under their own data protection rules.
5. Who we share data with
- Supabase — database, account sign-in, file storage, server functions.
- Apple — Sign in with Apple, subscription payment in the App Store, delivery of push notifications to iPhone.
- Google — Sign in with Google, subscription payment in Google Play (after the Android app is published), push notifications (Firebase Cloud Messaging), analytics (Firebase Analytics).
- Telegram — delivery of bot messages to clients and the trainer.
- Cloudflare — hosting of the trenly.org website and forwarding of email sent to [email protected].
We verify purchases directly on Apple and Google servers, without intermediaries. There are no other recipients. We may disclose data to public authorities only in cases expressly provided for by law.
6. Partner offers in the Telegram bot
After connecting to the bot @trenlybot, a trainer’s client may agree to receive offers from Trenly partners: sports nutrition, equipment, discounts.
- Consent is optional and off by default. The client taps the “Yes, send them” button themselves.
- No more than two messages per month. This does not apply to session reminders.
- Consent can be withdrawn at any time: in the bot under “🔔 Reminders” or with the /offers command.
- We do not pass personal data to partners, including the client’s Telegram chat id.
- For now we only collect consents. Offers are not being sent yet.
To do this we store the Telegram chat id, the client’s decision, the date of the decision and the version of the consent text. This log proves that consent was given. The /stop command in the bot disconnects the bot from the trainer and erases the consent together with the log.
Legal basis — the client’s consent (Law of Ukraine “On Personal Data Protection”; Article 6(1)(a) GDPR).
7. Demo mode
The “Try without signing up” button creates a temporary anonymous account with no email or password, filled with sample data. The demo lasts 24 hours. After that, the account and all changes in it are deleted automatically, usually within an hour. “Exit demo” deletes the account immediately. The demo sends no Telegram messages and no push notifications. To limit abuse, we store an irreversible hash of the IP address from which the demo was started. Records older than an hour are deleted during subsequent demo launches.
8. Retention period
- While the account is active — all data of the trainer and their clients.
- After the subscription ends the data is kept, the app works in view-only mode and the bot sends no messages to clients. The data stays until you delete the account. We plan to delete data of accounts that have had no access to the app for 12 months, and to warn about it in advance by email to the account address. Until this is introduced, data without access is not deleted.
- After the account is deleted the data and files are deleted immediately (see account deletion).
- Support: request attachments are deleted 30 days after the request is closed, and closed requests themselves after 180 days.
- Subscriptions: records of purchases in the App Store or Google Play (purchase identifier, status and dates) remain after the account is deleted, with no link to it. Such records of ended or refunded subscriptions are deleted 180 days after the last change, and the service log of store notifications after 90 days.
- Demo — up to 24 hours (section 7).
9. Your rights
You have the right to know what data of yours we process, to get a copy of it, to correct it, to delete it, to restrict processing, to withdraw consent, and to complain to the Ukrainian Parliament Commissioner for Human Rights. You can view and change most of your data in the app. For other requests, write to [email protected].
A trainer’s clients should first address requests about their data to their own trainer, because the trainer is the one who enters it. You can disconnect from the bot with the /stop command. You can also write to us, and we will pass the request to the trainer or help ourselves.
10. Account deletion
You can delete your account in the app or by email: how to delete your account.
11. Children
The service is intended for trainers aged 16 and over. If a trainer enters data of a minor client, the trainer is responsible for obtaining the consent of the parents or legal guardians.
12. Changes to this policy
We may update this policy. The current version is always on this page, with the date of the change at the top.