Privacy Policy

01Who is responsible

The controller for personal data processed through kinerya.com and app.kinerya.com is GIM Agency Single-Member P.C. (GIM Agency ΜΟΝ.ΙΚΕ), Polykleitou 20, 163 41 Ilioupoli, Attica, Greece — VAT EL801525535, G.E.MI. 158505409000.

Contact for privacy requests and all other enquiries: hello@kinerya.com. We have not appointed a Data Protection Officer.

02Using Kinerya without an account

You can use Kinerya without creating an account. In that mode your data is stored only in your browser’s local storage on your device. It is not sent to our servers, there is no cloud backup, and it is lost if you clear your browser data or lose the device. AI features are not available without an account. You can export a backup file at any time.

03Data we process

• Account data: your email address (used to sign in with a one-time email link — there is no password), display name, account type (for example athlete or coach) and technical account identifiers.
• Training data: programmes, scheduled workouts, logged sets (weight, repetitions, RIR, rest, tempo), workout notes, corrections and history.
• Nutrition data: meal plans, logged foods and portions, favourites, calorie and protein targets and check-ins.
• Health data: the health screening you complete during onboarding (pain or concern areas and their intensity, medical flags such as recent surgery or medication, and optional notes), readiness check-ins (energy, recovery, stress, soreness, motivation, pain), symptom follow-ups after workouts, body weight and height, and nutrition-profile details such as age, sex, allergies, medical conditions, medications, pregnancy or breastfeeding.
• AI Coach data: the questions you ask, the replies you receive and your AI credit balance and usage records.
• Coaching connections: invitations, the consent you give to a coach and the sharing options you choose.
• Push reminder data: if you enable reminders, your browser’s push subscription (endpoint and keys), your timezone, the reminder lead time and delivery records.
• Diagnostics: only if you opt in, technical error codes (for example “sync” or “render”) with the app version, linked to your account.

04Health data (special category)

Health data is a special category of personal data under Article 9 GDPR. We process it only to personalise your training and nutrition guidance and only on the basis of your explicit consent (Article 9(2)(a) GDPR). You can withdraw consent at any time by deleting the relevant data or your account; withdrawal does not affect processing carried out before it.

The app asks for this consent with a separate, unticked checkbox whenever you enter health details. If you do not tick it you can still use Kinerya, but the health details are not stored or synced.

05Purposes and legal bases

• To provide the app, sync your data across devices and keep your account secure — performance of our contract with you (Article 6(1)(b) GDPR).
• To process health data for personalised guidance — your explicit consent (Article 9(2)(a)).
• To run the optional AI Coach — your consent, given in the app before first use (Article 6(1)(a) and 9(2)(a)).
• To send workout reminders — your consent, given when you enable notifications in your browser.
• To collect optional diagnostics — your consent (opt-in in the app).
• To prevent abuse (for example daily AI request limits) and meet legal obligations — our legitimate interests and legal obligations (Article 6(1)(f) and (c)).

06What is sent to the AI Coach

AI features are optional, require an account and your consent, and use AI credits. New accounts receive a limited number of free AI credits. When you use an AI feature, the app sends only the context that feature needs:

• a summary of your recent training (goal, experience, schedule, programme, weekly metrics and your latest workout sets) and nutrition targets and recent check-ins;
• your pain or concern areas and their intensity, the number of health flags you selected (not the flags themselves), readiness answers including pain, and symptom signals from recent workouts;
• the question you asked, in your chosen language;
• when you import workout notes with AI help: the note text you paste (up to 12,000 characters), your clarifications and the draft being reviewed.

Requests are processed by OpenAI through its API with storage disabled (“store: false”). Instead of your identity, a one-way hashed identifier is sent so OpenAI can detect abuse. We keep only credit usage records (request ID, credit change, status, model and token counts), not the prompts. The AI replies you receive are saved to your account so you can read them again.

07Coaches and trainers

If you accept an invitation from a coach, you consent to the connection and choose what to share. Sharing workout history is a separate option. Coaches do not get access to your medical profile, nutrition data or AI conversations. You or your coach can end the connection at any time. Coach invitations expire after 7 days.

08Processors and recipients

• Supabase — authentication and cloud database. Project region: London, United Kingdom (covered by an EU adequacy decision).
• OpenAI — AI Coach responses, only when you use AI features with consent. OpenAI processes requests in the United States; the transfer relies on OpenAI’s Data Processing Addendum, which incorporates the EU Standard Contractual Clauses.
• ROI-MAX — cPanel hosting for kinerya.com and app.kinerya.com, including the reminder service, on servers in Attica, Greece.
• Sign-in emails are sent through Supabase Auth from a kinerya.com sender address.
• Browser push services (for example those operated by your browser vendor) deliver reminders you enabled.
• If you use voice entry, your browser’s speech recognition service may process the audio; this is controlled by your browser, not by Kinerya.

We do not sell your data and we do not use advertising or analytics trackers or cookies. If we add anonymous, cookie-less usage statistics in the future, they will contain no account or device identifier, no health data and no workout content, and we will update this policy before enabling them. The app uses your browser’s local storage to keep your data and sign-in session on your device.

09How long we keep data

• Account and cloud data: for as long as your account exists. Deleting your account permanently removes your cloud data.
• Records you delete inside the app: permanently purged from the cloud database after 30 days.
• Diagnostics error events: 30 days.
• Reminder delivery records: 7 days.
• Coach invitations: expire after 7 days.
• Routine backups kept by our infrastructure providers: for a limited period, after which they are overwritten.
• Data stored only on your device stays there until you delete it or clear your browser data.

10Your controls and rights

• Export: download a full JSON backup or a CSV of your workouts from the app at any time.
• Delete: delete your data from this device only, or permanently delete your account and all cloud data from the app (a recent sign-in and confirmation are required).
• Consent: stop using AI features, turn off reminders or diagnostics, and change or end coach sharing.

Under the GDPR you have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests and to withdraw consent at any time. Contact hello@kinerya.com; we reply within one month. You can also lodge a complaint with a supervisory authority — in Greece, the Hellenic Data Protection Authority (www.dpa.gr).

11Security

Data in transit is encrypted with HTTPS. Cloud data is protected by account-scoped access rules. API keys for the AI service are kept on the server and never shipped to your browser. No system is perfectly secure; please keep access to your email account and devices safe.

12Children

Kinerya is not intended for children. You must be at least 16 years old to use the app. Some nutrition calculations are only available for ages 18–90.

13Changes

We will update this policy when the app changes. Material changes will be announced on this page and, where appropriate, in the app.