Nardo ("the App", "we", "us") is a fitness application that generates personalized workout programs and tracks your training. This policy explains what personal data we collect, why, and what your rights are.
The data controller for the processing described here is identified in full in Section 11. For anything concerning your data, write to nardosupport@gmail.com.
Account data
Profile and body data (provided by you during onboarding or in settings)
Training data (created as you use the App)
Coach chat messages
Subscription data
Usage and device data (product analytics)
Support communications
What we do NOT collect
Your body metrics, workout logs, and the exercises you flag as painful are wellness data that may qualify as health data under Article 9 GDPR. We process this data only with your explicit consent, given when you create your account, and only to provide the App's core features (personalized programs, recovery tracking, progress reports). You can withdraw consent at any time by deleting your account (Section 8), which removes this data.
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Create and manage your account | Account data | Contract (Art. 6(1)(b)) |
| Generate and adjust your personalized training program | Profile, body and training data | Explicit consent (Art. 9(2)(a)) |
| Track muscle recovery and progress; produce weekly and monthly reports | Training and body data | Explicit consent (Art. 9(2)(a)) |
| Process your subscription and free trial | Subscription data | Contract (Art. 6(1)(b)) |
| Understand feature usage and improve the App | Usage and device data | Legitimate interest (Art. 6(1)(f)) |
| Secure the service, prevent abuse, fix errors | Technical logs | Legitimate interest (Art. 6(1)(f)) |
| Answer your questions in the coach chat | Your chat messages, profile, body and training data | Explicit consent (Art. 9(2)(a)) |
| Respond to support requests | Support communications | Legitimate interest (Art. 6(1)(f)) |
Our analytics serve only our own product decisions: they are not used for advertising, profiling for marketing, or sharing with advertising networks. If you object to analytics processing, contact us at the address in Section 11.
Parts of the App use automated processing, including a third-party AI service (Anthropic's Claude API), to:
What is shared with the AI service is limited to training-related information: your program structure, recent workout statistics, and profile attributes such as goal, experience level, and available equipment. When you use the coach chat, it also receives the messages you write, your body data, recent sessions and best lifts, and the exercises you flagged to avoid. Your name, email address, and account identifiers are never sent to the AI service. Under our agreement with Anthropic, data submitted through the API is not used to train AI models.
Program adjustments proposed by automated processing are always subject to your approval in the App before they change your program. No decision producing legal or similarly significant effects about you is made solely by automated means.
We use a small number of service providers, bound by data processing agreements:
| Provider | Role | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication, and file storage (project hosted in us-east-1, N. Virginia) | USA |
| Anthropic, PBC | AI processing of training summaries and program adjustments (Section 4) | USA |
| PostHog, Inc. | Product analytics (Section 1), on PostHog's EU Cloud | European Union |
| RevenueCat, Inc. | Subscription status management | USA |
| Google LLC | Optional sign-in with Google; Google Play billing (Android) | USA |
| Apple Inc. | App distribution and billing (iOS) | USA |
Your account, profile, and training data — including the health-related data described in Section 2 — is stored on infrastructure located in the United States (Supabase, us-east-1). Product analytics are the exception and stay within the European Union on PostHog's EU Cloud.
Where providers are outside the EEA, transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
Data is encrypted in transit (TLS) and at rest. Access to production data is restricted by row-level security (each user can only access their own records) and limited administrative credentials.
Under the GDPR you have the right to:
Deleting your account permanently removes your profile, programs, workout history, bodyweight entries, avoided exercises, program adjustments, and progress reports. Deleting your account does not cancel an active subscription — you must cancel that in your Apple App Store or Google Play account settings.
To exercise any right, contact nardosupport@gmail.com. We respond within one month.
The App is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
We may update this policy as the App evolves. Material changes will be announced in the App before they take effect. The current version is always available at this address.
Nardo is operated by Togan Robert-Cristian, Str. Vânătorilor nr. 18A, Sfântu Gheorghe, Covasna, România, who is the data controller for the processing described in this policy.
For questions about this policy, to exercise any of the rights in Section 8, or for any other data protection matter: nardosupport@gmail.com. We respond within one month.