Privacy Policy
Effective date: November 2, 2026
The short version. Ekvila works without an account, and then your data stays on your iPhone. If you create an account, we keep a copy of your app data on servers in the European Union so it can sync between your devices, and so a coach you choose can see it. We do not show ads, we do not use trackers or analytics SDKs, and we never sell your data. You can delete your account and all cloud data in the app at any time.
1. Who we are
Ekvila (the app, its cloud features and the website ekvila.com, together the "Service") is made and operated by Andrii Sukhostavets, an individual developer based in the United States ("we", "us"). We are the controller of the personal data described in this policy.
Contact for any privacy question or request: support@ekvila.com.
If you live in a US state with consumer health data laws (such as Washington or Nevada), please also read our Consumer Health Data Privacy Policy.
2. Data on your device
If you use Ekvila without an account, your workouts, exercise history, records, notes, body measurements, nutrition goals, food diary, water log, meal plans, reminders, settings and photos you add to your own exercises are stored only on your device. We do not receive this data. It is deleted when you delete the app or use Profile → Delete all data.
3. Data we process when you use online features
3.1 Account
To create an account and sign in, you enter your email address and a one-time code that we send to it. We process your email address, a user ID, sign-in times and technical data needed for sign-in (such as your IP address and device type, which our hosting provider records in security logs).
3.2 Cloud sync
If you have an account, the app stores a copy of your app data in our cloud database so it can sync between your devices and be restored: workouts, exercise history and records, custom exercises and their photos, notes, body data (height, weight, age, sex, activity level, goals), food diary, water log, meal plan preferences (diet type, allergies, foods you avoid), meal plans, reminders, recently scanned products and app settings.
Body data, food diary, allergies and similar information are health data, a special category of personal data. We store them in the cloud only after you give explicit consent when you create an account. You can withdraw consent at any time by deleting your account.
3.3 Coach features
- Your profile. If you use the account features, we create a profile with your display name (if you set one), your role (user or coach) and a personal code (for example EK-7K3Q9X) that you can give to a coach.
- Connection. Coaching is available only to users aged 18 or over. When a coach sends you a request and you accept it, the coach can see the copy of your app data stored in our cloud (everything listed in 3.2 except exercise photos), and can create, change and delete your workouts and replace your meal plan. We show you this before you accept. Before you accept, the coach sees only your display name (and you see theirs). You can disconnect or block the coach at any time; the coach then loses access.
- What we store about connections: who is connected to whom, the status (pending, active, declined, ended or blocked) and the dates. To prevent abuse, we also record the time of each connection request a coach sends; these records are kept for at least 2 days and then deleted (and always when the account is deleted).
- Workouts and plans from a coach are stored separately, with a version number, so your app can apply each change once. They are kept until you delete your account or the coach deletes theirs.
- Chat. Messages between a coach and a client are stored with the sender, time and whether they were read. They are visible only to the two participants. They are not end-to-end encrypted. We do not read them in normal operation, but we may review a reported message and the surrounding conversation (see 3.4).
- Your responsibility as a coach. If you are a coach, you may use a client's data only to coach that client within the Service (see the Terms of Use). If you copy or use it outside the Service, you are responsible for it as an independent controller.
3.4 Reports, blocking and safety
If you report a message or a user, we store the report: who reported, who was reported, the reason, a copy of the reported message or name, and the time. A copy is kept even if the message or an account is later deleted, so that we can investigate. We use an automatic filter that blocks messages and names containing words from a list of prohibited words.
3.5 AI food recognition (optional)
AI food recognition requires an account and your consent before the first use. The photo of your meal, and an optional note you type, are sent through our server function (running in the EU) to our AI provider (Anthropic, USA) to estimate the foods, portion weights and nutrition. We do not store the photo; only the result you choose to save goes to your food diary. Under its commercial terms, Anthropic does not use this data to train its models and keeps it only for a limited time (longer if needed to investigate misuse under its policies). To keep the feature free, we count how many scans each account makes per day.
3.6 Product scanner
When you scan a barcode or search for a product, the app sends the barcode or the search text directly from your device to Open Food Facts, an independent open food database operated by a non-profit association in France. No account data is sent with it, but Open Food Facts receives your IP address, as with any website. Open Food Facts processes these requests as an independent controller under its own privacy policy.
3.7 Apple Health (optional)
If you turn on Apple Health in the app, Ekvila writes your completed workouts (type, start and end time) and estimated calories burned to the Health app. Ekvila does not read any data from Health. Data in Health stays on your device and in your iCloud under Apple's control; we do not receive it. Health data is never used for advertising or marketing, never sold, and never shared with third parties. You can turn off access in the Health app or iOS Settings at any time.
3.8 Camera, photos and notifications
- The camera is used to scan barcodes and, if you choose, to photograph your own exercises or meals. The photo library is used to pick a picture or read a barcode from a photo. Images stay on your device unless you use cloud sync (exercise photos) or AI food recognition (meal photos).
- Reminders are local notifications scheduled on your device; we do not use push notification servers.
3.9 Beta sign-up on the website
If you apply to test the app on ekvila.com, we store your email address, first name (if you give it), preferred language, iPhone model (if you give it), country (if you give it) and the time of your application and consent, so that we can invite you to the beta through Apple's TestFlight and send you messages about the beta. To invite you, we give your email address and name (if provided) to Apple, which then sends you the invitation.
3.10 Support and feedback
If you write to us, we receive your email address, your message and anything you attach. Feedback sent from the app also includes the app version, iOS version and language, to help us fix problems.
3.11 Website
The website ekvila.com does not use cookies (except strictly necessary security cookies that our host may set to block attacks), analytics or trackers, and it loads no fonts or scripts from third parties. It stores only your language choice in your browser (local storage). Our hosting provider processes your IP address and request data in short-lived security logs to deliver the site and protect it from attacks.
4. What we do not do
- No advertising and no advertising identifiers; we do not track you across apps or websites.
- No third-party analytics or tracking SDKs.
- We never sell or rent personal data and do not "share" it for cross-context behavioural advertising.
- We do not use your data for automated decisions that have legal or similarly significant effects on you.
- We do not use your data to train AI models.
5. Purposes and legal bases
If the EU or UK GDPR applies to you, we rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Creating your account and signing you in | Performance of a contract (Art. 6(1)(b) GDPR) |
| Storing and syncing your app data and photos | Performance of a contract (Art. 6(1)(b)) |
| Storing health data in the cloud | Your explicit consent (Art. 9(2)(a)) |
| Sharing your data with a coach you accept | Your explicit consent (Art. 6(1)(a), 9(2)(a)), given when you accept the request |
| Chat between coach and client | Performance of a contract (Art. 6(1)(b)); for health information you choose to write, your explicit consent (Art. 9(2)(a)) |
| AI food recognition | Your consent (Art. 6(1)(a), 9(2)(a)) |
| Writing workouts to Apple Health | Your consent (Art. 6(1)(a)) |
| Reports, word filter, blocking, request limits, security logs | Legitimate interests in keeping users and the Service safe (Art. 6(1)(f)); legal obligations where applicable (Art. 6(1)(c)); where a report contains health data, the establishment or defence of legal claims (Art. 9(2)(f)) |
| Beta sign-ups and beta emails | Your consent (Art. 6(1)(a)) |
| Answering support requests | Legitimate interest in helping you (Art. 6(1)(f)); if you include health information, your explicit consent (Art. 9(2)(a)) |
You can withdraw consent at any time — by deleting your account, disconnecting a coach, turning off a feature, or writing to us — without affecting processing that happened before.
6. Who we share data with
We do not sell data. We share it only as follows:
Service providers (processors) that act on our instructions:
| Provider | What for | Where |
|---|---|---|
| Supabase, Inc. | Account sign-in, database, photo storage, server functions | Data stored in the EU (Frankfurt, Germany) |
| Brevo (Sendinblue SAS) | Sending sign-in codes by email | EU (France) |
| Anthropic, PBC | AI food recognition, only if you use it | USA |
| Cloudflare, Inc. | Website hosting, security and email forwarding for ekvila.com | Global network |
| Apple Inc. | Sending TestFlight beta invitations | Global |
Others, at your request or as needed:
- A coach you accept sees your app data as described in 3.3; the other participant of a chat sees the messages.
- Open Food Facts receives barcode and search requests directly from your device (3.6).
- Apple distributes the app through the App Store and TestFlight as an independent controller and may collect data under its own privacy policy (for example, crash reports and feedback you choose to send).
- Google (Gmail) receives the emails you send to our support address, as the provider of our mailbox, under its own terms.
- Authorities if required by law, or to protect the safety of anyone, for example in a case of threats of violence or child exploitation.
- A successor if the Service is transferred to another operator; we will tell you in advance, and this policy will continue to apply.
7. International transfers
Your app data is stored in the European Union. Some providers (such as Anthropic, Google and Cloudflare) may process data in the United States or other countries, and we, as the operator, are based in the United States. Where data from the EU, the UK or Switzerland is transferred to a country without an adequacy decision, the transfer is protected by the European Commission's Standard Contractual Clauses (and the UK Addendum) or by the EU–US Data Privacy Framework where the provider is certified. You can ask us for a copy of the relevant safeguards.
8. How long we keep data
| Data | How long |
|---|---|
| Data on your device | Until you delete it or the app |
| Account, synced app data, photos, profile | Until you delete your account |
| Coach connections, items from a coach, chat messages | Until you or the other participant deletes their account; a declined or ended connection record is kept until one of you deletes their account |
| Coach request log | 2 days |
| AI scan counters | Until you delete your account |
| Reports | Up to 12 months after we handle the report, longer only if needed for a legal claim or required by law |
| Beta sign-ups | Until the beta ends or you ask us to delete them, at most 24 months |
| Support emails | Up to 24 months after the conversation ends |
| Hosting security logs | Short periods set by our providers (usually days to weeks) |
When you delete your account in the app (Profile → Account → Delete account), we delete your account, synced data, exercise photos, profile, coach connections, items from coaches and the chats you took part in from our database and storage immediately. This also removes those chats for the other participant. Reports about you (3.4), support emails and beta sign-ups are kept as described above unless you ask us to delete them. Copies may remain in our providers' encrypted backups for a short time until they are overwritten.
9. Your rights
Wherever you live, you can ask us to:
- access your data and get a copy of it in a portable format;
- correct inaccurate data;
- delete your data (you can also do it yourself in the app);
- restrict or object to processing based on legitimate interests;
- withdraw consent at any time.
To make a request, write to support@ekvila.com from the email address of your account, so we can confirm it is you. We reply within one month (45 days where US state law allows that). We do not charge for requests and will not treat you differently for using your rights. If we refuse a request, we will explain why and how you can appeal: reply to our decision with the word "Appeal", and we will review it within 45 days.
You can also complain to a data protection authority, for example where you live or work.
10. Additional information for specific regions
European Economic Area, United Kingdom and Switzerland. Your rights and our legal bases are described above. You have the right to lodge a complaint with your supervisory authority — for example the AEPD (Spain), the UODO (Poland), the Office for Personal Data Protection (Slovakia) or the ICO (UK). You can contact us directly at the email above about any privacy matter.
United States. We do not sell personal information or share it for targeted advertising, and we do not use or disclose sensitive personal information for purposes other than providing the Service. We honour the rights described in section 9 for all US residents, including residents of California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with privacy laws. Connecticut residents: we process sensitive data (health data) only with your consent and have assessed the risks of this processing. Our website does not track you, so there is nothing for Global Privacy Control signals to switch off. Residents of Washington, Nevada and other states with consumer health data laws: see our Consumer Health Data Privacy Policy. Children: see section 12.
Japan. Personal data is stored in the EU (which Japan recognises as providing an equivalent level of protection) and may be processed in the United States by the providers listed in section 6. The United States has no comprehensive federal privacy law, but our providers are bound by data processing agreements with confidentiality and security obligations. You may request disclosure, correction, suspension of use or deletion as described in section 9.
Ukraine. We process personal data in line with the Law of Ukraine "On Personal Data Protection". You have the rights listed in Article 8 of that law, including to know where your data is stored, to receive it, to object and to have it deleted; you may complain to the Ukrainian Parliament Commissioner for Human Rights.
Latin America (including Mexico, Argentina, Colombia, Chile and Peru). You can exercise the rights of access, rectification, cancellation and opposition ("ARCO" rights), and withdraw consent, as described in section 9. You may also contact your national data protection authority. Argentina: you may exercise the right of access free of charge at intervals of at least six months, unless you have a legitimate interest in doing so sooner; the Agency for Access to Public Information (AAIP) handles complaints about personal data protection.
Taiwan, Hong Kong, Singapore, Malaysia and other Asia-Pacific countries. You can access and correct your data and withdraw consent as described in section 9. Your data is transferred to and stored in the EU and may be processed in the United States, as described in section 7.
Kazakhstan and other countries with data localisation laws. Our servers are located in the EU, not in your country. If local law requires your personal data to be stored in your country, please do not create an account; you can use the app without one, keeping all data on your device.
11. Security
- All connections are encrypted (HTTPS/TLS), and data at rest in our database is encrypted by our hosting provider.
- Your sign-in token is stored in the iOS Keychain.
- Database rules ensure that each user can read and change only their own data; a coach can read a client's data only while there is an active connection that the client accepted, and can change it only through server functions that check this connection and the format of the data.
- We do not use passwords: you sign in with a one-time email code.
- Access to our administration tools is protected with strong authentication and limited to the developer.
No system is perfectly secure. If a data breach affects you, we will notify you and the competent authorities as required by law.
12. Children
Ekvila is not intended for children. You must be at least 16 years old to use it (or older, if your country requires). We do not knowingly collect personal data from children under 16, or from children under 13 in the United States. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes to this policy
We may update this policy as the Service develops. We will change the effective date above and, for significant changes, notify you in the app or by email before they take effect. Where the law requires your consent to a change, we will ask for it.
14. Contact
Andrii Sukhostavets · Ekvila Email: support@ekvila.com