1. Scope of this policy
This policy covers jenera.fit, the Jenera mobile app and enquiries to the project team. The Jenera team is responsible for the website and service development. Privacy contact: [email protected].
Jenera is in development. This edition describes the website and current test version and separately identifies processing associated with planned features. Describing a future feature does not mean it is enabled or its data is already being collected.
This policy provides information about processing and does not replace consent required by law. Simply visiting the website is not consent to publish workouts, access contacts or send marketing emails.
2. When you visit the website
When you open the website, hosting infrastructure may receive your IP address, request time, browser and device information, and the requested page. These technical details are needed to deliver the site and prevent abuse. No advertising pixels are installed. Cloudflare Web Analytics collects anonymised visit statistics without cookies.
The testing form asks for your email and device type: iPhone or Android. We also store the page language, application date and consent version. We use this information to recruit participants and communicate about testing Jenera, not for advertising emails. Submission requires your consent to data processing.
The partnership form stores partner type (gym or trainer), business or personal name, phone or Instagram, city, language, date and consent version. This is needed to discuss participation in Jenera. A repeat application with the same contact and partner type does not create another record or replace the original details.
Cloudflare Turnstile checks that a person submits the form. When it loads, Cloudflare may process IP addresses and browser and device information. The verification token is sent to the server; application fields are not included in the Turnstile verification request. The form confirms submission only after a successful server response.
You can email us instead of using a form. The team and email provider then receive the sender’s address, message and attachments. Do not include unnecessary health information, passwords or sign-in codes.
3. Data in the app
The current local tracker stores exercises, sets, load, repetitions, time, distance, workout dates and duration, notes, templates, history, bookmarks and calculated results on your device. These records let you continue workouts, compare results and build a progress history.
You can fill in a profile with your name, username, date of birth, sex for choosing illustrations, gym and photo. Language, theme, rest and reminder settings are also stored. In the current local version this information stays on your device. Optional fields may be left blank.
Physical activity records may reveal personal information. Do not add medical documents, passwords or other people’s personal data to exercise names, notes or messages unless needed for your chosen action.
Once sign-in and sync are connected, accounts will use a phone number, account identifier and sign-in confirmation information. The chosen code-delivery channel—WhatsApp, Telegram or SMS—requires the number and service data to be sent to that provider. Sync will send account and workout data to a server for recovery and access from other devices. The terms of this processing must be shown when these features are enabled.
5. Device permissions
Access to a selected photo is needed to add a profile image. Notification permission is used for workout reminders. You can change permissions in operating-system settings; refusing a permission limits the relevant feature.
Access to contacts to find acquaintances or location to find gyms is planned functionality and requires a separate action and system permission where necessary. The current tracker does not need continuous location tracking. Before launching these features, we will clarify exactly what is transmitted and how long it is stored.
Apple Health and Health Connect are not connected in the current version. System backup settings are controlled separately by your device and Apple or Google account.
6. Analytics and error diagnostics
Test builds may enable PostHog for product analytics and Sentry for diagnostics. Their activity depends on the specific build configuration. Builds without these services configured do not send data through them.
Product events may describe screen views, workout starts and finishes, duration, total volume and record counts. Technical installation identifiers, app version, device type, operating system and network details may also be processed. This helps find errors and understand how well features work.
Names and phone numbers are deliberately excluded from custom event properties. Automatic click collection through the analytics provider is disabled in the current code. However, technical identifiers and network metadata should not be considered guaranteed anonymous.
Sentry may receive crash information, stack traces, device parameters and performance diagnostics. Sending default personal fields is disabled in SDK settings, but individual errors may also contain contextual data. This setting alone does not guarantee that no personal information can ever be transmitted.
If you do not want to take part in test-version diagnostics, contact us before using it. This policy does not promise a separate analytics switch in the current interface.
7. Who may process data
Team members who need it for support, development and security may access enquiries and technical data. We do not plan to sell personal data or provide workout histories to advertisers.
Cloudflare provides website hosting, exercise media delivery, domain network infrastructure and Turnstile form protection. It may receive IP addresses and other technical metadata when requests are made. The exercise catalog contains prepared materials, not user photos.
PostHog processes analytics events when enabled in a build; the current configuration specifies the European region. Sentry processes diagnostics when enabled. The email provider processes correspondence with the team.
Website applications are saved in separate private Supabase tables. Website visitors and app users cannot access the application lists. The team receives new-application notifications in its Zoho Mail work inbox, containing the relevant form fields, language and date. These are internal notifications, not participant mailings. Supabase is also planned for future accounts, sync and user files; the policy will be clarified when these features are enabled. WhatsApp, Telegram or SMS providers deliver codes through the selected channel, while Expo and Apple and Google services will handle future push notifications.
Data may be disclosed to public authorities where there is a legal basis. Sharing with your chosen trainer, gym or other users is linked to your action in the relevant feature and is described above.
8. Where and how long data is stored
Local tracker records stay on your device. Website applications are currently stored in a Supabase cloud project outside Kazakhstan. External protection, analytics, diagnostics and email services may also process information outside Kazakhstan. This configuration does not confirm that all data is stored in the Republic of Kazakhstan.
The project plans to host its personal-data database in Kazakhstan for public launch. Before the relevant processing is enabled, the actual infrastructure, cross-border transfer conditions and necessary consent must be checked. The policy will then be updated to reflect the actual release configuration.
Applications are used until the relevant testing recruitment or partnership discussion ends, or until you request deletion. Deleting an application also removes its notification queue record and corresponding messages from the team’s work mailboxes. To withdraw consent, stop application-related contact or delete an application, email [email protected] from the address provided in the form; for a partner application, include its contact so we can verify ownership of the request. Local workout history remains until you delete it or the app’s data. Correspondence is used while handling the enquiry and providing necessary support; information required by law or to resolve a dispute may be retained on the relevant basis.
Retention of technical logs, analytics events and backups depends on connected service settings. Specific retention periods and the procedure for clearing server copies must be checked before public launch; this edition does not set an unverified automatic-deletion deadline.
9. Your requests and data deletion
You may request information about processing, access to data relating to you, corrections, deletion or cessation of processing, and withdraw consent as provided by applicable law. You may also approach the competent data-protection authority.
Email [email protected] with the subject “Jenera personal data”. Describe the data or actions involved. Do not send a password, one-time sign-in code or identity document copy without a separately justified need. To protect data, we may ask you to confirm that the request concerns you.
Data that exists only on your phone and has not been sent to the team cannot be viewed or deleted remotely by us. You can delete it through available app features or by deleting local app data. System backups are managed separately.
A deletion feature is planned for server accounts and will be checked when accounts launch. Until available, you can request deletion by email. Uninstalling the app does not itself delete information previously sent to a server, diagnostics service or by email.
Requests are handled within the periods set by applicable law. If some information must be retained on a lawful basis, we will explain that basis and the limitations relevant to your request.
10. Data protection
Network requests to services use secure HTTPS connections. Access to internal systems is restricted according to account purpose; secrets must not be present in public code. Specific server-protection measures are checked as the relevant features launch.
Local information also depends on your device security: screen locks, backup settings and other people’s access to the phone. No storage or transmission method guarantees absolute security. Report suspected leaks or unauthorised access to [email protected].
11. Underage users
We do not target children’s data collection or treat the test version as a service for children to register independently. Where processing a minor’s information requires a legal representative’s involvement, it must be ensured before processing.
If you believe a child provided data without the required involvement of a legal representative, email [email protected]. We will investigate and act according to applicable law. Age conditions and consent checks will be clarified before public launch.
12. Changes and contacting us
The current edition is published at jenera.fit/privacy with its update date. If purposes, data categories or recipients change significantly, we will update the description and request separate consent before new processing where required.
This edition was prepared for the website and product testing. Before public release we will clarify the controller’s identity, actual providers and processing regions, retention periods and mechanisms for exercising rights. This policy does not claim that legal review of the future release is complete.
For any questions about this policy, contact [email protected].
4. Posts, trainers and community
Planned social features will need information you choose to use: your profile, workout posts, follows, reactions, event participation and chosen gym. Visibility should depend on available settings and the audience for each action. Recording a workout locally and publishing it are different actions.
When you contact a trainer or gym, the recipient will see your message, enquiry and the contact details you provide. When a trainer connection is enabled, assigned workouts and results needed for working together will become available to the selected trainer within that feature.
The phone number used for sign-in is not intended to be published automatically in your profile. Before sharing a contact with a trainer or gym, the interface must make the purpose clear.
If you publish a result or share it on another platform, recipients may save copies independently of Jenera. We cannot delete those copies. Processing outside Jenera is governed by the other platform’s rules.