Privacy Policy

Introduction

Nopi Fitness ("we", "our", or "us") operates the Nopi Fitness mobile application. This Privacy Policy explains how we collect, use, and protect your information when you use our app.

Who We Are

Nopi Fitness is operated from the Netherlands by Nopi Studio, the trade name of Stijn Verhaar, a sole trader (eenmanszaak) registered with the Netherlands Chamber of Commerce (KVK) under number 87019159.

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, Nopi Studio is the data controller for the personal data described in this policy.

Information We Collect

Account Information

When you create an account, we collect your email address, display name, and profile photo. Authentication is handled by Clerk, a third-party authentication provider. You may also sign in with Apple or Google, in which case we receive only the information you authorize those providers to share.

Workout & Fitness Data

We collect the workout data you enter, including exercises, sets, reps, weights, cardio sessions, and training plans. This data is used to provide the core functionality of the app, such as tracking your progress and generating performance insights.

Physical Metrics

You may optionally provide physical metrics such as age, weight, height, body fat percentage, and muscle mass percentage. These are used to personalize your experience, including calorie estimates and AI coaching recommendations.

Health Data (Apple Health)

If you grant permission, the app reads and writes data through Apple HealthKit, including body weight, body fat percentage, muscle mass, and heart rate during workouts and cardio sessions. Heart-rate samples recorded during a session are stored on our servers as part of that session's history. Health data is never used for advertising and is only used to power the features described in this policy (progress tracking, calorie estimates, and AI coaching).

Location Data

If you grant permission, the app uses your device's location, including while the app is in the background, to record a GPS route during outdoor cardio sessions (e.g. runs). Route data is stored on our servers as part of that cardio session so you can review it later. Location access is only used for this feature and is never used for advertising.

Training Profile & Goals

You may optionally provide training preferences and goals — such as experience level, available equipment, session frequency, exercise preferences, injuries, and target weights or lifts — to personalize your training plan and AI coaching.

AI Coach Conversations & Voice Notes

When you use the AI coach feature, your messages, any images you attach, and relevant workout and training profile data are sent to our AI provider, OpenAI, to generate personalized responses. Conversations are stored to maintain chat history within the app.

If you dictate a message instead of typing it, the recording is uploaded to Nopi's servers and forwarded from there to OpenAI's transcription service, which returns the text. We do not store your recording. The audio is held in memory only for as long as it takes to transcribe it and is discarded when the request completes; it is never written to our database or to disk. What we do keep is the resulting text — which becomes your message in the conversation — and the length of the recording in whole seconds, which we record so that we can measure what the feature costs and apply your usage allowance.

Previously, dictation audio was sent from your device directly to the transcription provider and did not pass through Nopi's servers. As of this update it passes through our servers, as described above, so that we can measure and limit usage of the feature.

How We Use Your Information

• To provide and maintain the app's core functionality
• To track your workout progress and personal records
• To power the AI coach with personalized recommendations based on your training history
• To enable social features such as sharing workouts with friends
• To improve the app and fix issues

Data Sharing

We do not sell or share your personal information for advertising purposes. Your data is shared only in the following cases:

• Friends: When you share a workout or cardio session, or when your account is set to share activity automatically, an accepted friend can see a summary of that activity — including duration, calories, total volume, personal records, and your profile photo — in their activity feed.
• Service Providers: We use third-party services to operate the app: Clerk (authentication), OpenAI (AI coaching and voice-note transcription), and Railway (server and database hosting). These providers process data only as needed to provide their services. Where a provider processes data outside the European Union, see Where Your Data Is Processed below.
• Legal Requirements: We may disclose information if required by law.

Where Your Data Is Processed

Your account, workout, health, and location data is stored on servers in the European Union. Our application servers and our database are hosted by Railway in Amsterdam, the Netherlands.

Two of the service providers we rely on process personal data outside the EU:

• Clerk (authentication) is a company based in the United States and stores your account and sign-in data there. These transfers are made under the European Commission's Standard Contractual Clauses.
• OpenAI (AI coach and voice-note transcription) provides the service to us through OpenAI Ireland Limited, based in the European Union. OpenAI Ireland may transfer data to OpenAI's affiliates in the United States in order to process your requests, and does so under the European Commission's Standard Contractual Clauses.

Railway, which hosts our servers, is a company based in the United States. It processes data on our instructions and does not use it for its own purposes.

Analytics, Advertising & Tracking

We do not display advertisements in the app, and we do not use your data for advertising or marketing. We do not use third-party analytics, advertising, attribution, or tracking software, and we do not track you across other companies' apps or websites. We do not sell your personal information, and we do not share it with data brokers. The data we collect is used only to provide and personalize the app's features, as described in this policy.

Data Security

We use industry-standard security measures to protect your data, including encrypted connections (HTTPS/TLS), rate limiting, and secure authentication. Access to user data is restricted to authenticated requests and scoped to your own account.

Data Retention & Deletion

Your data is retained as long as your account is active. You can request deletion of your account and all associated data — including workout history, physical metrics, health and location data, and AI coach conversations — by contacting us at stijn@nopi.studio. We will complete deletion requests within 30 days. Some data may persist briefly in backups before being purged on the normal backup rotation schedule.

Voice recordings are not retained and therefore cannot be included in a deletion request; the transcribed text is deleted along with your AI coach conversations.

Your Rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact us at stijn@nopi.studio. If you are located in the European Economic Area, you also have the right to lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection authority, which is our lead supervisory authority — at autoriteitpersoonsgegevens.nl, or by post at Postbus 93374, 2509 AJ Den Haag — or with the supervisory authority in your own country. If you are located in the United Kingdom, you may lodge a complaint with the Information Commissioner's Office at ico.org.uk.

For details of where your data is stored and which providers process it outside the EU, see Where Your Data Is Processed above.

Children's Privacy

Our app is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected data from a child, please contact us so we can delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last updated" date at the top of this page.

Contact Us

If you have any questions about this Privacy Policy, contact us at stijn@nopi.studio.