The short version

Kallen has no accounts, no sign-up and no login, so nothing in the app is tied to your identity. Everything you enter — your profile, your intake answers, your pain notes, your measurements, your photos, your chats — is stored in a local database on your phone. The app also has AI features. Those features do not work on your phone alone: to build your plan, read your posture photos, interpret your camera measurements and answer you in the coach chat, the app sends the data described in section 3 to Google LLC, which processes it with the Google Gemini API on our behalf. That is a real transfer of health-related data to a third party, and it happens only after you have agreed inside the app, by tapping the button of the onboarding screen that names this transfer, Google LLC and the Gemini API (iPhone versions up to 1.1.3 ask on a separate AI consent screen instead). Refusal is a real option: the app stays usable, the plan is then built on your device, and nothing you have paid for is withheld. The consent check is enforced in the app's network layer, not in individual screens, so every AI request — including the coach messages the app prepares in the background — is blocked until you agree, and blocked again the moment you withdraw. Separately, the store versions of the app (App Store and Google Play) send usage statistics to Google Analytics for Firebase — which screens are opened and a fixed list of milestones such as finishing onboarding or a purchase — so we can see where people get stuck and whether our ads bring people who actually use the app. These statistics never contain your health data, your name or anything you type, and the app uses no advertising identifier on either platform (see section 1).

1. What data we collect

Profile basics. Sex, age, height, weight, your dominant side, and how much of your day you spend sitting. Goals and intake answers. What you want to achieve, your training and sports history, and the remaining answers you give in the onboarding questionnaire and in in-app screens. Injury, surgery and diagnosis history — HEALTH DATA. Past and current injuries, operations, and diagnoses you have been given, plus the symptom patterns you select (for example when the pain appears and what makes it worse). Pain map and pain notes — HEALTH DATA. Every body region you mark as painful together with its intensity on a 0–10 scale, and anything you type in your own words about your pain in the intake, in the pain journal and in the coach chat. Measurements, tests and session results. Range-of-motion angles and other values measured with the camera or entered manually, test scores, completed exercises and sessions, and the reports generated from them. Photos and video frames — HEALTH DATA. The posture-scan photos you take or pick from your photo library, single frames captured during camera range-of-motion measurements, and the photos or video frames used by camera-read body tests. These are images of your body, so we treat them as health-related data. Coach chat messages and coach memory. Your messages to the AI coach, the coach's replies, the conversation history, and the short summary of facts about you ("coach memory") that the app stores so the coach does not ask you the same thing twice. This content routinely contains health data. Purchase data. The purchase record of the store you bought in — the App Store purchase receipt on iPhone, the Google Play purchase token on Android — and an anonymous, app-generated identifier used to unlock your subscription. It contains no name, e-mail address or payment card details — Apple or Google handles the payment and we never see your card. If you installed the iPhone app by tapping an Apple Ads advertisement in the App Store, it also includes which of our Apple Ads campaigns and search keywords led to that installation. Technical request data. Standard network metadata (IP address, device and app version, timestamps) that our hosting, update and content-delivery providers necessarily see when your app makes a request. We do not build profiles from it. App usage statistics (Google Analytics for Firebase). Which screens and onboarding steps are opened, and a fixed list of milestones: reaching and completing the posture scan in onboarding, completing or skipping the camera measurements in onboarding (with the number of measurements taken), reaching the onboarding summary, seeing the subscription screen, buying a subscription (the plan, its price and currency, and whether it starts a free trial), entering the app for the first time after onboarding, your first message to the coach, your first training day with every exercise done, each training week with every exercise done (with the number of such weeks so far), and a fourth Mobility Snack in one day. They are tied to a random identifier that Firebase generates for this installation of the app, together with the device model, operating system, app version, language and an approximate location (country and region) that Google derives from the connection. They never include your health data — no body regions, pain, statuses, scores, measured values, photos or chat content — nor your name or anything you type. On iPhone the app does not use Apple's advertising identifier (IDFA) or identifier for vendors (IDFV) and does not ask for permission to track you. On Android it uses neither the advertising ID nor the Android ID: collecting them is switched off, and the permission to read the advertising ID is removed from the app. On Android, Google Play also tells the app which advertisement or link, if any, led to the installation (the Play install referrer); that is recorded with the same random identifier. Development and test builds of the app send none of this. We never ask for your e-mail address, phone number, contacts or location. We do ask for a first name — the coach greets you with it — but it is stored only on this device, substituted into messages locally, and never sent to Google or any other third party.

2. How we collect it

Typed by you. Profile basics, goals, intake answers, injury/surgery/diagnosis history, pain regions and 0–10 intensities, free-text pain notes and manually entered test values are collected as you type or tap them in onboarding and in the app's screens. Captured by the camera or chosen from your photo library. Posture-scan photos, range-of-motion frames and camera-read test frames are captured with the camera, or selected by you through the system photo picker. The app uses the out-of-process picker: it does not request full access to your photo library, and it only ever receives the specific items you pick. One exception: on Android 9 and older, taking a photo also makes the system ask for storage access, which the camera needs there to save the picture; the app reads nothing else through it. Typed into the coach chat. Chat messages are collected as you send them; coach memory is derived from those messages and from your profile. Derived from your use of the app. Session logs, completed exercises, streaks, test scores and generated reports are derived from what you do in the app. Recorded automatically while you use the app. The usage statistics described in section 1 are recorded by the Google Analytics for Firebase SDK built into the App Store and Google Play versions of the app and sent to Google in the background. From Apple, via RevenueCat (iPhone). Your subscription status is derived from the App Store purchase receipt, validated by RevenueCat, Inc. against an anonymous app-generated identifier. The App Store version also passes RevenueCat the attribution token of Apple's AdServices framework; RevenueCat asks Apple whether the installation came from one of our Apple Ads campaigns and, if it did, stores the campaign and search keyword with the same anonymous identifier. This uses no advertising identifier, does not track you across other companies' apps and needs no tracking permission; for any other installation Apple returns no campaign data. From Google Play, via RevenueCat (Android). Your subscription status is derived from the Google Play purchase token, which RevenueCat, Inc. validates with Google Play against an anonymous app-generated identifier. The Android version passes no advertising or attribution data to RevenueCat. On-device pose detection. Live camera guidance uses a MediaPipe pose model that runs entirely on your device. The model file and its runtime library are downloaded once from Google's model CDN (storage.googleapis.com) and from the public jsDelivr CDN; those downloads reveal only ordinary request metadata such as your IP address. Your camera image is not sent to them.

3. What we send to Google, and exactly when

When you have agreed in the app (section 1), the app sends data to the Google Gemini API, operated by Google LLC, over an encrypted (TLS) connection, relayed through our own server. These are all the triggers, and they are the only ones: a) Plan generation, at the end of onboarding. Sent: sex, age, height, weight, how much you sit, your dominant side, your sports history, your injury/surgery/diagnosis history, your symptom patterns, every painful body region with its 0–10 intensity, and your own free-text notes about your pain. Purpose: to generate your personalised corrective training plan. b) Posture scan. Sent: the posture photos you captured or picked, plus your health intake so the reading is interpreted in context. Purpose: to measure your alignment and produce your posture report. c) Camera range-of-motion measurement. Sent: one frame from the measurement together with the measured values. Purpose: to produce the written insight that explains what the measurement means for you. d) Camera-read body test. Sent: the photos or video frames of the test, plus your full health intake. Purpose: to score the test and explain the result. e) Every coach chat message. Sent on each turn: your message, the conversation history, your profile, your pain journal and the stored coach memory. Purpose: to answer you in context. f) Proactive coach messages — sent without you pressing anything. The app also prepares coach messages in the background, and each of those sends the same chat payload (profile, pain journal, coach memory and relevant history) to Google without a gesture from you. There are six of them: the comeback message when you have been away, the education drip, the weekly recap, coach check-ins, plan refreshes, and the follow-up after an analysis. This is stated here, and on the consent screen, so that your agreement covers it; if you would rather this did not happen, withdraw consent as described in section 8. Photos are reduced before they are sent. Every image is downscaled to 560 pixels wide and re-compressed as JPEG at quality 0.55 before it leaves your device — small enough to yield body angles, not a detailed picture of how you look. The full-resolution original stays on your phone and is never transmitted. Your name stays here; no e-mail, no location. The app asks only for a first name, stores it on this device and never includes it in anything it sends; e-mail address and location are never asked for at all. Up to and including version 1.0 (7), a first name entered in onboarding was included in the plan request; that field has been removed from the app and from the plan payload in version 1.0 (9), and no name is sent any more. Nothing is sent before you agree. No personal data goes to Google before you agree on the onboarding screen that describes this transfer (or, in iPhone versions up to 1.1.3, on the separate AI consent screen) — not as a warm-up request, not to fill a loading state, not from a background sender. The check lives in the transport layer that every one of these requests passes through.

4. All uses of the data

We use the data described above only for the following purposes: - to run the app's on-device features: your profile, body map, plan, exercise library, timers, pain journal, tests, measurements and progress history; - to generate your training plan — either by sending your intake to Google Gemini (section 3a) or, if you decline AI processing, by building the plan on your device; - to analyse your posture photos, camera measurements and camera-read tests and to return the resulting reports and scores to your phone (sections 3b–3d); - to answer your questions in the coach chat and to keep the coach's replies consistent with what you have already told it (section 3e); - to prepare the proactive coach messages listed in section 3f and to adapt your plan over time; - to schedule local reminders and desk-break alerts on your device (they are scheduled locally; no data leaves the phone for this); - to validate your App Store or Google Play purchase and unlock premium features; - to understand how the app is used — where people stop during onboarding and which features they come back to — and to measure whether our advertising (Google Ads) brings people who actually use the app, using only the usage statistics described in section 1; - to deliver app updates and to keep the service secure and working (error handling, abuse prevention, operations). We do not use your data for anything else. In particular: we do not sell personal data; your health data, photos, chat content and name are never shared with advertising networks, data brokers or analytics providers; the only data that reaches Google's analytics and advertising systems is the usage statistics in section 1, used to measure our own advertising — ad personalisation is switched off in the app, so they are not used to show you personalised ads; we do not use your health data for marketing or profiling; we do not attempt to identify you or reconstruct a profile of an anonymous user; and no data derived from the camera or from depth/face APIs is used for marketing, advertising or use-based data mining, by us or by anyone else. Data you gave us for one purpose is not repurposed for another without asking you first.

5. Third parties who process data for us

We use a small number of service providers. Unless a paragraph below says otherwise, each one acts on our instructions, for the purposes described above and for nothing else. Google LLC — Gemini API (AI analysis, plan generation, coach chat). Google LLC processes this data solely as our data processor under the Gemini API terms and its Data Processing Addendum, and provides the same or equal protection of user data as stated in this policy and as required by the App Store Review Guidelines. Google does not use this content to train its models. Google LLC — Google Analytics for Firebase and Google Ads (usage statistics and measuring our advertising). Google receives the usage statistics described in section 1, produces our usage reports from them and attributes app installs and in-app milestones to our advertising campaigns. Google provides these services under its own terms and may also use the statistics in line with its own privacy policy — see how Google uses information from apps that use its services: https://policies.google.com/technologies/partner-sites. Advertising personalisation is disabled in the app, and no health data, name or free text is ever part of these statistics. RevenueCat, Inc. — purchase validation and subscription status. RevenueCat receives your App Store receipt (iPhone) or your Google Play purchase token (Android) and an anonymous app-generated identifier — never your name, e-mail or payment details — and, for an iPhone installation that came from Apple Ads, the campaign and search keyword Apple reports for it (section 2). RevenueCat, Inc. processes this data solely as our data processor under its data processing addendum, and provides the same or equal protection of user data as stated in this policy and as required by the App Store Review Guidelines. RevenueCat does not use this data for its own purposes. Vercel Inc. — hosting of our relay server. Our server is a stateless relay: it forwards your request to Google and returns the answer, and stores no copy of your photos, messages, intake or reports. Vercel may keep short-lived operational logs containing request metadata (such as IP address and timestamps) for security and reliability. Vercel Inc. processes this data solely as our data processor under its data processing addendum, and provides the same or equal protection of user data as stated in this policy and as required by the App Store Review Guidelines. Vercel does not use it for its own purposes. Expo, Inc. — EAS Update (app updates). When your app checks for a JavaScript update, Expo's servers see request metadata such as your IP address, device platform and app version. No profile, health data, photos or chat content is involved. Expo, Inc. processes this data solely as our data processor under its terms, and provides the same or equal protection of user data as stated in this policy and as required by the App Store Review Guidelines. Google's model CDN (storage.googleapis.com) and jsDelivr — delivery of the on-device pose model. Downloading the MediaPipe pose model and its runtime reveals only ordinary request metadata (IP address, user agent). No image, measurement or profile data is sent; the pose detection itself runs on your device. These providers provide the same or equal protection of user data as stated in this policy and as required by the App Store Review Guidelines. Apple Inc. — payments and distribution (iPhone). Apple processes your purchase as an independent controller under Apple's own privacy policy. We never receive your payment details. Google — payments and distribution (Android). Purchases in the Android version are processed by Google Play as an independent controller under Google's own privacy policy. We never receive your payment details. International transfers. Google (both the Gemini API and Google Analytics), RevenueCat, Vercel and Expo are established in the United States. Transfers of personal data outside the European Economic Area take place under the European Commission's Standard Contractual Clauses and/or the EU–US Data Privacy Framework, as provided for in each provider's terms.

6. Retention and deletion

On your device. Everything listed in section 1 — profile, intake, health history, pain map and notes, measurements, tests, reports, photos, chat history and coach memory — is stored in a local SQLite database on your phone and stays there until you delete it or delete the app. We set no expiry and we hold no copy. In your phone's own backup or transfer. On iPhone, if you have switched on iCloud Backup, iOS may include the app's data in that backup and bring it back when you restore your phone; the copy is kept in your own Apple account under Apple's terms, and you switch it off or delete it in your iPhone's settings. The Android version is excluded from Google's cloud backup, so nothing is copied to your Google account; moving your data directly from an old Android phone to a new one may still carry the app's data across. These copies are made by your phone's operating system for you; we cannot read them. On our relay. Nothing. The relay is stateless: it does not write your photos, messages, intake or reports to any storage. Only Vercel's short-lived operational request logs (metadata, not content) exist, and they are retained by Vercel under its own terms. At Google. Under the Gemini API terms, content sent through the API is processed to produce your result and may be retained briefly for abuse monitoring before being deleted. It is not used to train Google's models and it is not linked to any identity, because we send no identifier. At RevenueCat, Apple and Google Play. Purchase records are kept for as long as your subscription is active and afterwards as required for accounting, tax and dispute handling, tied to the anonymous app-generated identifier. In Google Analytics. Usage statistics are kept at the level of the random installation identifier for at most 14 months (the data-retention setting of Google Analytics) and then deleted; only aggregated reports without any identifier remain. Because that identifier is random and we cannot link it to you, we cannot look up or delete the statistics of a particular person on request — deleting the app ends the collection immediately. How to delete everything. In the app: Profile → System → Delete all my data. This wipes your profile, intake, health history, pain map and notes, measurements, tests, reports, photos, chat history, coach memory and your consent flags from the device. Deleting the app removes the same data from the phone. Because there is no account and no server-side copy, that deletion is final on our side — apart from the usage statistics in Google Analytics, which carry no health data and expire as described above, there is nothing left for us to delete. On iPhone, a copy in your own iCloud Backup, if you keep one, is outside the app: your phone updates or removes it according to your iCloud settings. If you also want the anonymous purchase record removed, write to kacperloczek3@gmail.com.

7. How to withdraw your consent

Open Profile → System and turn off the AI permission ("Withdraw AI analysis permission"). It takes three taps from the main tab bar and takes effect immediately. What stops. Posture scans, camera range-of-motion insights, camera-read tests, AI plan generation and refreshes, the coach chat, and all six proactive coach messages. The app's network layer refuses these requests outright; the block is not merely a hidden button. What keeps working. Your plan (rebuilt on your device), the exercise library, Mobility Snacks, timers, manually entered tests and measurements, your body map, your pain journal, your history and your reminders. Withdrawing consent never cancels or reduces your subscription. Features that inherently run on the AI — the coach chat and the photo and measurement analyses — pause while AI is off; everything else Pro unlocks (the full exercise library, the adaptive weekly plan, your history and progress) keeps working. You can grant consent again at any time in the same place. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

8. No accounts

Kallen has no sign-up, no login, no password and no server-side user record. We do not know who you are, we cannot link two devices to the same person, and we cannot look up "your" data — because we hold none of it: it is stored on your phone (and, where your phone makes one, in your own phone backup described in section 6, which we cannot access either). This is also why there is no account deletion feature: there is no account to delete.

9. Your rights under the GDPR (EU/EEA, including Poland)

Controller. Kacper Lewandowski, individual developer, Poland — kacperloczek3@gmail.com. There is no obligation to appoint a Data Protection Officer for processing of this scale; privacy requests go to the same address. Special-category data. Your pain scores, injury, surgery and diagnosis history, symptom patterns and body photos are data concerning health within the meaning of Article 9(1) GDPR. Legal bases. - Sending health-related data to Google Gemini: your explicit consent under Article 9(2)(a) GDPR, together with Article 6(1)(a) GDPR — given in the app on the onboarding screen that names the data and the recipient, with a way to continue without AI (iPhone versions up to 1.1.3: a separate consent screen) and withdrawable at any time in Profile → System. - Providing the app itself and your purchased subscription: performance of a contract, Article 6(1)(b) GDPR. - Security, abuse prevention and keeping the service running: our legitimate interest, Article 6(1)(f) GDPR, limited to technical request metadata. - Usage statistics and measuring our advertising: our legitimate interest in improving the app and knowing whether our advertising works, Article 6(1)(f) GDPR, limited to the statistics listed in section 1, which contain no health data. You may object to this processing at any time; because the statistics are tied only to a random installation identifier, the way to stop it completely is to delete the app. Consent is genuinely optional: refusing it keeps the whole app usable — your plan is then generated on the device — and only the features that cannot exist without sending data (the coach chat and the analyses) wait until you agree. Your rights. You have the right of access, rectification, erasure, restriction of processing, objection, and data portability, the right to withdraw consent at any time without affecting the lawfulness of prior processing, and the right to lodge a complaint with a supervisory authority — in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa). How to exercise them in practice. Because there is no account, we hold no data that would let us identify you (Article 11 GDPR), so we cannot answer an access or erasure request from our side — there is nothing there. Your rights are exercised directly in the app: view and edit everything in your profile and journal, and erase everything with Profile → System → Delete all my data. For anything else, including questions about the anonymous purchase record, write to kacperloczek3@gmail.com.

10. Children

Kallen is not directed at children. It is intended for users aged 16 and over in the European Economic Area and 13 and over elsewhere, and we do not knowingly collect data from children below those ages. If you believe a child has used the app, delete the app's data (Profile → System → Delete all my data) and contact us.

11. Security

Everything sent to our relay and on to Google travels over an encrypted TLS connection. On-device data is protected by the operating system's app sandboxing (iOS or Android) and device encryption. Requests carrying personal data are additionally tagged with a consent marker, so the enforcement does not depend on any single screen; server-side verification of that marker is being rolled out as a further backstop.

What changed in this version (3 October 2026)

The agreement to send data to Google Gemini is now given on an onboarding screen that names the data, Google LLC and the Gemini API, by tapping its button; a "Continue without AI" option sits right under it and first explains what works without AI. This applies to the Android version and to iPhone versions from 1.1.4 on; earlier iPhone versions keep the separate AI consent screen. What is sent, when, and how to withdraw (Profile → System) did not change.

What changed on 30 September 2026

This policy now also covers the Android version of Kallen, distributed through Google Play. It works the same way as the iPhone version — the same AI consent screen, the same data sent to Google Gemini, the same usage statistics — and the sections above now state the differences between the two: on Android purchases go through Google Play instead of the App Store (sections 1, 2 and 5), the statistics use neither the Android advertising ID nor the Android ID and include the Play install referrer (section 1), and there is no Apple Ads attribution. Section 6 now also mentions your phone's own backup: on iPhone, iCloud Backup may include the app's data — that is how iPhones have always treated app data, not a change in the app — while the Android version is excluded from Google's cloud backup. Nothing changed in what the iPhone version collects or sends.

What changed on 26 September 2026

If you install the app from an Apple Ads advertisement in the App Store, the App Store version now passes Apple's privacy-preserving attribution token to RevenueCat, so we can see which of our Apple Ads campaigns and search keywords bring subscribers. Sections 1, 2 and 5 describe it. No advertising identifier is used, you are not tracked, and nothing else changed.

What changed on 25 September 2026

The App Store version of the app now sends usage statistics to Google Analytics for Firebase and uses them to measure our Google Ads campaigns. The previous version said that we do not use analytics or advertising SDKs; that sentence has been removed, and sections 1, 2, 4, 5, 6 and 9 now describe exactly what is sent, what never is, and why. Nothing changed in what is sent to Google Gemini.

What changed on 18 August 2026

For transparency, that update corrected three statements in the previous version that no longer matched — or never fully matched — how the app worked: - the previous claim that "nothing leaves your device until you agree" now holds for every AI feature, because consent is enforced in the network layer; previously the end-of-onboarding plan request, coach chat and the proactive coach messages were not covered by that gate; - the previous claim that your name is never included is now precise: in version 1.0 (9) the first name is no longer included in any request — it stays on the device and the coach's greetings substitute it locally; e-mail address and location were never collected and are never sent; - profile, intake, pain journal and chat history were previously described as staying on the device. They are stored on the device, but their content is also sent to Google Gemini for plan generation, the coach chat and the proactive coach messages. Section 3 now says exactly what is sent and when.

Contact

Privacy questions and requests: kacperloczek3@gmail.com. Support page: https://runposture-api.vercel.app/legal/support · Terms of Use: https://runposture-api.vercel.app/legal/terms. If this policy changes, the date at the top is updated and material changes are announced in the app.