Effective: 13 October 2026 · Version 2.1
dynaimic ("we", "us", "our") consists of the dynaimic iOS application (the "App") and its backend services (the "Service"). The Service generates personalised, adaptive AI workouts and helps you track strength training over time. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the App.
For the purposes of the GDPR and Turkish KVKK, dynaimic is the Data Controller.
| Data | Purpose | Required |
|---|---|---|
| Apple ID identifier (via Sign in with Apple) | Authentication | Yes |
| Email address (real or Apple Private Relay) | Account contact, support replies | Yes |
| Display name (optional, from Apple ID) | Personalisation | No |
| User ID (UUID) | Internal account key | Auto-generated |
| Data | Purpose | Required |
|---|---|---|
| Gender | Workout personalisation | No |
| Date of birth | Age-appropriate recommendations | No |
| Height | Fitness calculations | No |
| Timezone | Session scheduling, daily reset | No |
We collect the following health-related data to provide personalised fitness recommendations:
This data is classified as Special Category data under GDPR Article 9 and KVKK Article 6. We process it only with your explicit consent, provided during onboarding.
| Data | Purpose |
|---|---|
| Fitness goal (e.g., muscle gain, fat loss, strength, general fitness) | Tailored workout generation |
| Experience level (beginner, intermediate, advanced) | Exercise difficulty matching |
| Preferred session duration (15–180 minutes) | Workout length optimisation |
| Preferred routine type (PPL, Upper/Lower, Full Body, etc.) | Program structure |
| Available equipment (dumbbells, barbell, cables, etc.) | Equipment-appropriate exercises |
| Selected coach personality | Coach voice and programming style |
| Unit preferences (metric / imperial) | Display formatting |
Subscription status, purchase history, renewal dates, and free-trial state. We never see your payment card or banking details — those are handled exclusively by Apple. We receive only a signed receipt from Apple confirming the purchase, which is passed to RevenueCat for cross-device subscription state.
To find and fix bugs, the App sends crash reports and performance traces to Sentry. Before sending, your user identifier is hashed with a salted one-way function so the diagnostic record cannot be re-linked to your account. We do not send your name, email, IP address, or any user-typed content to Sentry.
To understand which parts of the App help people train and to measure our own ad campaigns, the App records a small set of product events and sends them to Meta through the Meta (Facebook) SDK (see Section 4.6). The events cover:
The event parameters are limited to values such as the coach, program, paywall placement or variant, or a yes/no flag. We never add your user ID, email, name or any per-user identifier, and we never include text you type. Meta's SDK adds the technical context it collects for every app event (such as device model, OS version, language and an install-scoped anonymous ID); it does not receive your Advertising Identifier (IDFA), because the App does not ask for App Tracking Transparency permission.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Generate personalised AI workouts | Profile, health data, training history, equipment, goals, body measurements, feedback, personal records | Consent / Contract performance |
| Progressive overload suggestions | Previous weeks' performance data (weights, reps, RPE) | Contract performance |
| Exercise matching via semantic search | Muscle groups trained, equipment, goal, experience level | Contract performance |
| Coach personality & voice | Selected coach, profile, recent session feedback | Contract performance |
| Parse natural-language workout logs | Free-text input, exercise catalogue | Contract performance |
| Track body composition trends | Weight, body fat %, measurement dates | Consent |
| Analytics (muscle heatmap, PRs, streaks, rank) | Workout sessions, exercise logs, XP events | Contract performance |
| Subscription management | User ID, Apple-issued receipts, subscription tier | Contract performance |
| Rate limiting & abuse prevention | User ID, subscription tier, daily generation count | Legitimate interest |
| Authentication & security | Apple ID identifier, JWT tokens, user ID | Legitimate interest |
| Diagnostics & bug fixing | Pseudonymised crash reports and performance traces | Legitimate interest |
| Push notifications (reminders, weekly summaries, coach check-ins), only if you allow them | Account ID, push token, notification settings, the text of each notification | Consent |
| Product analytics & ad measurement | Anonymous product events (Section 2.9), App Store purchase events | Legitimate interest |
| Service health monitoring | Aggregated, non-individually-identifiable metrics | Legitimate interest |
We do not sell your data. Apart from the aggregated, non-identifying ad-measurement signals described in Section 4.6, we do not share your data with advertisers or data brokers. We do not use your data to build cross-app or cross-company profiles.
To run the Service, we rely on a small number of trusted third-party providers. Each receives only the data they need to perform their function and is bound by their own privacy commitments.
Sign in with Apple is the sole authentication mechanism for dynaimic. Apple processes your Apple ID identity token to authenticate you. The App Store handles all subscription billing and payment information. Push notifications (if you opt in) and optional Apple Health integration are also Apple services.
Apple's privacy policy: apple.com/legal/privacy.
Since 7 October 2026, your account, profile, workouts, routines and measurements are stored in a database on our own server, and sign-in runs on our own authentication service, both on a server we rent from DigitalOcean in Frankfurt, Germany. DigitalOcean acts as a Data Processor (hosting provider) and has no access to the content of our database. Cloudflare provides DNS and the encrypted connection to our domains, and stores the App's exercise and card images (Cloudflare R2); it does not store your account data.
DigitalOcean privacy policy: digitalocean.com/legal/privacy-policy. Cloudflare privacy policy: cloudflare.com/privacypolicy.
Supabase (older app versions, temporary). Until 7 October 2026 we used Supabase for sign-in and our database. Versions 1.3.0 and earlier of the App still sign in through Supabase Auth, and those sign-in records are copied to our own server. We will close the Supabase project once those versions are no longer in use. Supabase privacy policy: supabase.com/privacy.
RevenueCat manages your subscription state, free-trial status, and purchase restoration across devices. RevenueCat receives your user identifier and Apple-issued purchase receipts. Payment details never reach RevenueCat or us — only Apple's signed receipts.
RevenueCat privacy policy: revenuecat.com/privacy.
Sentry receives crash reports and performance traces. We send a salted SHA hash of your user identifier — not your email, name, IP address, or any free-text content you have entered. This allows multiple crashes from the same account to be grouped for triage without re-identifying you.
Sentry privacy policy: sentry.io/privacy.
When you request a workout, parts of your fitness profile, training history, and "How did it feel?" feedback are sent through OpenAI's API to generate the session. We use the API tier that does not use your inputs to train OpenAI's public models. OpenAI may retain API inputs and outputs for up to 30 days for abuse monitoring before deletion.
Data sent per generation request includes: your fitness profile, your last 5 body weight / body fat measurements with trend direction, your last 15 workout sessions with set-level detail, your top 5 personal records, recent session feedback, training-frequency metrics, the selected coach personality, the active routine context, and up to 25 candidate exercises from our catalogue. We do not send your name, email, or payment information to OpenAI.
OpenAI's data usage policy: openai.com/policies/api-data-usage-policies.
We use the Meta (Facebook) SDK for two purposes: to measure how well our own Instagram and Facebook ad campaigns perform, and to see, in aggregate, how the App is used through the anonymous product events in Section 2.9. Campaign measurement means attributing app installs and conversions to the ads we run. Attribution is handled entirely through Apple's SKAdNetwork, which reports results to us only in aggregated, non-individually-identifiable form.
Specifically:
In our Apple "App Privacy" label, this corresponds to Purchases and Product Interaction (Usage Data) collected for "Developer's Advertising or Marketing" and "Analytics" purposes, not linked to your identity, with "Data used to track you" answered No.
For EU/UK users, our legal basis for this measurement is our legitimate interest in understanding how effective our marketing is (Article 6(1)(f) GDPR). Because attribution relies on aggregated SKAdNetwork data, and we collect neither the IDFA nor any identifier that links events to your account (the SDK uses only its own install-scoped anonymous ID), the processing is privacy-preserving by design. You can opt out at any time through your device's ad settings.
Meta's data policies: facebook.com/about/privacy.
If you allow notifications, we send them through OneSignal, Inc. (United States). The App asks for this permission when you set a reminder, turn notifications on in Settings, or after you start Premium; you can say no and keep using the App. The notifications are the reminders you set (workouts and your supplement "Stack"), weekly summaries and reviews, and coach check-ins. We do not send advertising notifications.
OneSignal receives: your device's push token and the basic device details its SDK needs to deliver notifications (such as device model, OS version, language and time zone); your dynaimic account ID (a random UUID) as an "external ID", so we can address your device; the title and text of each notification we send you, which can mention your training (for example, a weekly summary); and delivery and open events. We use OneSignal only to deliver notifications (App Functionality), not for analytics or advertising. OneSignal does not receive your email, name or health measurements as such.
You can turn notifications off at any time in the App's Settings or in iPhone Settings → Notifications → dynaimic. When you sign out, the App unlinks your device from your account in OneSignal. When you delete your account, we also ask OneSignal to delete your record there (your account ID, device subscriptions and settings); if that request fails, we are alerted and remove it manually.
OneSignal privacy policy: onesignal.com/privacy_policy.
We may disclose information if required by law, court order, or governmental request, or if necessary to protect the rights, property, or safety of dynaimic, our users, or the public. When permitted, we will notify you before doing so.
Apple Health integration is optional. If you allow it, this is exactly what dynaimic does with Apple Health:
These restrictions are required by Apple's HealthKit rules and we follow them strictly.
Under GDPR and KVKK, we process your personal data on the following legal grounds:
| Data Category | Retention Period |
|---|---|
| Account data | Until account deletion |
| Profile & fitness preferences | Until account deletion |
| Body measurements | Until account deletion or manual removal |
| Workout sessions & exercise logs | Until account deletion |
| Routine data & progress | Until account deletion |
| Session ratings & feedback | Until account deletion |
| Pseudonymised diagnostics | 90 days (Sentry default) |
| Database backups | Up to 5 days (deleted data leaves the backups within that time) |
| Push delivery records (OneSignal) | Until you delete your account; we then ask OneSignal to delete your record |
| Subscription / receipt records | For the duration required by tax law (typically 5–10 years) |
When you delete your account, all personal data associated with your account is permanently removed from our active systems within 30 days, except where we are legally required to retain certain records.
We implement industry-standard technical and organisational measures to protect your data:
No system is perfectly secure, but we take reasonable steps to prevent unauthorised access, alteration, or disclosure. If we ever experience a personal data breach that affects you, we will notify you and the relevant supervisory authorities as required by applicable law.
Under GDPR, KVKK, and other applicable data-protection laws, you have the following rights:
To exercise any of these rights, email [email protected] from the email associated with your account. We will respond within 30 days.
You can delete your account at any time from inside the App:
Deleting your account permanently removes your workout history, custom routines, measurements, profile data, and personal records from our active systems within 30 days. This action cannot be undone.
Deleting your dynaimic account does not automatically cancel any active App Store subscription — you must cancel that separately via iPhone Settings → Apple ID → Subscriptions.
If you cannot access the in-app deletion flow, email [email protected] from your account email and we will process the deletion manually within 7 days.
dynaimic is rated 9+ on the App Store but is designed for use by individuals aged 16 or older (or 13 or older where local law permits, with parental involvement). We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us at [email protected] and we will delete it promptly.
Your data may be transferred to and processed in countries outside your country of residence, including:
For transfers from the EU/EEA or Türkiye, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) and each sub-processor's data-processing commitments. See the Data Processing Agreement for the full sub-processor list and transfer mechanisms.
The dynaimic mobile application does not use cookies, web beacons, or browser-based tracking technologies. The App communicates with our backend via authenticated HTTPS requests. The App includes the Meta SDK only for the aggregated measurement and anonymous product analytics described in Sections 2.9 and 4.6; it does not track you, and dynaimic does not request the App Tracking Transparency (ATT) permission because we do not engage in cross-app or cross-website tracking. We do use Apple's SKAdNetwork to measure our own ad campaigns in aggregate (see Section 4.6), which neither identifies you nor tracks you across apps.
We may update this Privacy Policy from time to time. When we make a material change, we will increment the version number, update the effective date at the top of this page, and notify you inside the App the next time you open it. Continued use of the Service after a change takes effect constitutes acceptance of the updated policy. If you do not agree to an update, you may delete your account.
If you have questions about this Privacy Policy or about how we handle your data, please reach out:
Email: [email protected]
6698 Sayılı Kişisel Verilerin Korunması Kanunu kapsamında, kişisel verileriniz; Burak Özaslan (veri sorumlusu) tarafından dynaimic uygulamasını sunmak amacıyla, hizmet sözleşmesinin ifası ve açık rızanız temelinde işlenmektedir. KVKK'nın 11. maddesi uyarınca; kişisel verilerinizin işlenip işlenmediğini öğrenme, işleme amacı ve buna uygun kullanılıp kullanılmadığını öğrenme, yurt içinde veya yurt dışında aktarıldığı üçüncü kişileri bilme, eksik veya yanlış işlenmiş olması hâlinde düzeltilmesini isteme, silinmesini veya yok edilmesini isteme, işlenen verilerin münhasıran otomatik sistemler vasıtasıyla analiz edilmesi suretiyle aleyhinize bir sonucun ortaya çıkmasına itiraz etme ve kanuna aykırı işleme nedeniyle zarara uğramanız hâlinde tazminat talep etme haklarına sahipsiniz. Taleplerinizi [email protected] adresine yazılı olarak iletebilirsiniz.
dynaimic uygulamasını kullanarak ve ilgili özellikleri etkinleştirerek, aşağıdaki işleme faaliyetlerine 6698 Sayılı Kanun'un 5/1, 6/2 ve 9. maddeleri kapsamında açık rıza verdiğimi beyan ederim:
İşbu açık rızamı dilediğim zaman [email protected] adresine e-posta göndererek veya uygulama içinden hesabımı silerek geri çekebileceğimi; geri çekme işleminin geleceğe yönelik sonuç doğuracağını ve geri çekme sonrasında ilgili özelliklerin (örn. yapay zeka antrenman üretimi, sağlık verisi takibi) çalışmayabileceğini bildiğimi kabul ve beyan ederim.