Privacy Policy

1. Who is responsible

PanTrainer is run by Idesit AB, Stockholm, Sweden, owned by Pantelis Stylianides. Idesit AB is the controller of your personal data under the GDPR. Questions or requests: pantrainer.app@gmail.com.

2. What we collect

• Account: name, email, profile picture and your Google sign-in ID.
• Training: sessions, exercises, sets, weights, notes, and photos of class boards you choose to upload.
• Health data (a special category under the GDPR): body weight, height, age, injuries and pain you tell us about, resting heart rate, sleep, steps and calories from Apple Health, Health Connect, Garmin or Renpho if you connect them, and food photos and what you eat.
• Food and household: fridge contents, meal plans and shopping lists, and the names of people you invite to your household.
• Technical: a login cookie, error reports from the app (with your user ID), when you last opened the app, and how much AI you used each month (number of requests and tokens per feature, not the content).

3. Why, and on what legal basis

To give you the service you signed up for: plan training and meals, track progress, share the kitchen with your household (Art. 6(1)(b), contract).

Health data only with your explicit consent (Art. 9(2)(a)), which you give with a separate checkbox when you start. You can withdraw it at any time in Settings → About & credits. After that we stop using your health data for planning and automatic analysis, and you can delete your account.

Error reports and login protection to keep the service working and secure (Art. 6(1)(f), legitimate interest).

PanTrainer gives coaching, not medical advice, and is for people aged 18 or older.

4. AI

Plans, meal suggestions, food photo estimates and answers in the app are made by AI. They are marked “Suggested by AI”. Nothing is decided automatically: you choose whether to apply a suggestion.

For AI we send only what the task needs (for example your week, injuries and food), never your name or email. AI requests go to Google’s Gemini models on Google Cloud Vertex AI, processed in the EU, and, when that service is busy, to Scaleway in Paris (EU). Neither uses your data to train models. Scaleway does not store it; Google may keep a request for up to 30 days only to detect abuse of its service, and then deletes it.

If you are inactive for 3 days, automatic AI analysis pauses until you open the app again.

5. Who processes data for us

These companies handle data on our behalf under data processing agreements:

• Google Cloud (Ireland): app hosting in Belgium (europe-west1), stored secrets, workout timer alarms.
• MongoDB Atlas: the database, hosted on Google Cloud in Belgium (EU).
• Vercel Blob (Vercel Inc., USA): photo storage.
• Google Cloud (Ireland): AI processing with Gemini on Vertex AI in the EU.
• Scaleway (France): AI processing in Paris, as a backup.
• Google (Ireland): sign-in with Google, welcome emails (Gmail SMTP), and Gemini AI in Google AI Studio used only for the operator’s own account, never for other users.
• Apple, Google and Mozilla push services: delivering notifications you turn on.

If you connect Garmin or Renpho, we fetch your data from them with your login, which is stored encrypted. Exercise pictures are loaded by exercise name only; no personal data is sent.

6. Transfers outside the EU

MongoDB, Vercel and Google are US companies; your data is stored in the EU, but their staff or support may access it from the USA. Transfers rely on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses.

7. How long we keep data

• Your account and training history: until you delete your account.
• Food photos: 14 days after they are analysed, 30 days if never analysed.
• Error reports: 30 days. Login attempt counters: a few hours.
• Free and trial accounts nobody has opened for 12 months are deleted with all their data.
• Deleted data can remain in database backups for a short period until the backups roll over.

8. Your rights

You can access, correct, export (Settings → Account → Export) and delete (Settings → Account → Delete) your data, withdraw consent, object to or restrict processing, and move your data to another service. Household guests can delete their own sign-in from the Food page. Write to us for anything you can’t do in the app; we answer within a month.

You can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

9. Cookies

We use one essential cookie to keep you logged in. No analytics, advertising or tracking cookies.

10. Changes

If this policy changes in a way that matters, the app asks you to read and accept it again.

11. US users

If you live in Washington or Nevada, our Consumer Health Data Privacy Policy at pantrainer.web.app/privacy/health-data also applies to you.