Privacy policy
Last updated: 7 October 2026
Spotwell is a workout planning and tracking app made by me, Saverio Tonon, in London, UK. I’m responsible for the personal data the app collects (the “controller”). This policy explains what that data is, why it’s needed, who helps me process it, and what you can do about it.
These rules sit alongside the terms of service.
The short version: Spotwell collects what it needs to keep your training log and run your account. I never sell your data, there are no ads, and the app doesn’t track you across other apps or websites. You can export everything or delete your account from inside the app at any time.
What Spotwell collects
Your account
- Your email address and a password (stored only as a scrambled hash), or the identifier Apple or Google gives the app when you use Sign in with Apple or Sign in with Google. With Apple’s “Hide My Email”, Spotwell only sees Apple’s relay address.
- That you confirmed you are at least 16. You enter your date of birth to check this, but only the time of the check is stored, never the date itself.
Your profile and settings
- Your name, an optional profile photo, language, time zone, units (kg/lb, cm/in), and what you choose during setup: goals, experience level, equipment and training days.
- Your workout preferences, such as rest times, timer sound, plate sizes and notification choices.
Your training
- Workouts and everything you log in them: exercises, sets, weights, reps, times, distances, rest, RPE, notes and comments, and when each workout started and finished.
- Templates and programs you create, custom exercises, personal records and one-rep-max estimates worked out from your sets, and your schedule.
- Workouts you import from another app (for example a Strong export), which are marked as imported.
Health data (only with your explicit consent) Bodyweight, body measurements and progress photos, and, if you work with a coach, the injuries, limitations and measurements you enter in their intake form, are health data. Spotwell asks for your separate, explicit consent before storing any of it, and records when you gave it. You can use the app without it. You can withdraw consent at any time in Settings → Your Data → Health Data: all of this data is deleted at the same time, including the photo files.
If you work with a coach When you join a coach in Spotwell, they can see your training data and profile so they can coach you, plus what you choose to share with them (for example progress photos you mark as shared). When you join, you choose whether they see your history from the start or only from the day you joined. Messages you exchange are stored so you both can read them. Your coach can never see your password or sign in as you. If you leave the coach, or either of you ends the link, they stop seeing your new data.
Notifications If you allow notifications, Spotwell stores a push token for your device so the server can send you notifications (for example a message from your coach). End-of-rest alerts and workout reminders are scheduled on your phone.
Subscriptions (when available) Payments are handled entirely by Apple (or Google on Android). Spotwell never sees your card or payment details. To know whether your account has PRO, Spotwell and its subscription service receive the purchase status, the product, and its dates, linked to your account.
What Spotwell doesn’t collect: no advertising identifiers, no tracking across apps or websites, no location, no contacts, and no analytics or crash-reporting services.
Why it’s used
- To provide the app (the contract between us when you create an account): keeping your account, syncing your training between your devices, showing your history, charts and records, and sending the notifications you turned on.
- With your explicit consent: storing health data, as described above.
- To keep the service safe (legitimate interest): preventing abuse, handling reports and blocks, and fixing problems.
- When the law requires it: for example keeping the minimum age, or answering a lawful request.
Your data is never sold, never used for advertising, and never used to train AI models.
Where it’s stored, and who helps
Your data is stored on servers in the European Union (Ireland). These services process it on my behalf, only to run the app, under data processing agreements:
- Supabase — the database, sign-in, file storage (profile and progress photos) and, for now, the sign-in emails (for example to confirm your email address), hosted in Ireland.
- Apple — Sign in with Apple, push notifications on iPhone, and App Store purchases.
- Google — Sign in with Google (if you choose it), and push notifications on Android.
- RevenueCat — keeps track of subscriptions once they are available.
- Brevo — will send the app’s emails once it is set up (hosted in the EU).
Some of these companies are based in the United States. Where your data leaves the UK or the EU, it’s protected by the safeguards the law requires, such as the UK and EU standard contractual clauses or the EU-US Data Privacy Framework.
Workouts you log offline are kept on your phone until they sync, protected by iOS’s encryption while the phone is locked after a restart, and erased from the phone when you delete your account.
How long it’s kept
Your data is kept for as long as you have an account. You can delete individual workouts, photos and measurements at any time. When you delete your account, everything is erased, including your photos and other files; copies in the regular database backups disappear as those backups are replaced. Data exports you request are deleted 24 hours after they are created.
Your rights, and how to use them
You can, at any time:
- Get a copy of your data: Settings → Your Data → Download All My Data (a complete export), or Export Workouts (CSV) for your training log.
- Correct it: edit your profile, workouts and settings in the app.
- Delete it: delete workouts in History or with Settings → Your Data → Delete Workouts, or delete your whole account in Settings → Delete Account. If you have a subscription, cancel it in the App Store too, because deleting the account doesn’t cancel it.
- Withdraw consent for health data in Settings → Your Data → Health Data.
- Object to or restrict a use of your data, or ask any question, by emailing me (below).
You also have the right to complain to a data protection authority: in the UK, the Information Commissioner’s Office; in the EU, the authority in your country. I’d appreciate the chance to sort it out with you first.
Security
Connections are encrypted, every record in the database can only be read by the people allowed to see it, and sign-in tokens are kept in the iPhone’s Keychain. No system is perfectly secure, but your data is protected with care, and I will tell you and the authorities if a breach puts it at risk, as the law requires.
Children
Spotwell is for people aged 16 and over. If someone younger signs up, the account and its data are deleted.
Changes
If this policy changes, the date at the top changes with it. Material changes will be noted in the app’s release notes.
Contact
Questions about this policy, or requests about your data: