Legal
Privacy Policy
Last updated: April 2026. This policy applies to the Altor mobile app, web console, and altorstrength.com website.
1. Who we are
Altor is operated by Yves [Surname], [Address], Switzerland ("Altor", "we", "us"). We are the data controller for data collected directly through the Altor app and website. When a gym partners with Altor and its members use the platform, the gym is typically the data controller for membership-related processing and Altor acts as a data processor under a separate Data Processing Agreement.
2. What data we collect
Account data
When you create an account: email address, first and last name, username, and an optional profile photo. If you join a gym through Altor, we may also collect phone number, date of birth, and gender (provided voluntarily during gym onboarding).
Training data
Sets, reps, weight, rest times, session timestamps, plan structure, exercise selections, progression events, and session duration. This is the core of your performance identity — the longitudinal training record that makes Altor useful.
Feedback data
Subjective training feedback: perceived workload (per exercise), muscle pump (per muscle group), and delayed-onset muscle soreness (per muscle group). These ratings are numeric scales (0–2 or 0–3) and are used to drive the progression engine. We treat feedback data with elevated care because it may be considered health-related under certain regulatory frameworks — see Section 5.
Gym interaction data
Check-in and check-out timestamps, QR scan events (which machine, which gym, when), equipment issue reports, and gym membership status. When your gym partners with Altor, this data is shared with authorised gym staff under the gym's data controller role.
Device and technical data
Device type, operating system version, app version, and push notification tokens (Firebase Cloud Messaging). We do not collect device identifiers for advertising purposes.
Website cookies and similar technologies
The Altor marketing website (altorstrength.com) does not use advertising cookies. We store your cookie preference in your browser (localStorage) so the consent banner does not reappear on every visit. Essential third-party requests — such as web fonts and map tiles on gym directory pages — may process your IP address to deliver the page. Optional privacy-friendly analytics (e.g. Plausible or Fathom) load only if you accept them in the cookie banner and only when we have configured a provider; we do not currently run analytics on the website.
3. Why we process your data
| Purpose | Legal basis |
|---|---|
| Provide the training app (logging, plans, progression, analytics) | Contract performance |
| Operate gym features (check-in, equipment mapping, staff console) | Contract performance |
| Send push notifications (session reminders, rest timer, messages) | Consent (opt-in at OS level) |
| Process subjective training feedback (workload, pump, soreness) | Consent (explicit — see Section 5) |
| Improve the product (aggregate, anonymised usage patterns) | Legitimate interest |
| Respond to support requests | Contract performance |
| Comply with legal obligations (tax, law enforcement) | Legal obligation |
4. Where your data is stored
Production data is stored in EU-region PostgreSQL infrastructure (Supabase, AWS eu-central-1, Frankfurt). Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Backups follow the same regional constraints. Profile images are stored in EU-region object storage (Supabase Storage). Push notification tokens are processed through Firebase Cloud Messaging (Google, EU/US infrastructure) — only the device token and message payload transit through Firebase; training data does not.
Training data logged during offline sessions is stored locally on your device (SQLite) until synced to the server. You can use the app fully offline — your data stays on your device until you choose to connect.
5. Health-related data
Subjective feedback (soreness, pump, perceived workload) may be classified as health-related data under GDPR Article 9 or Swiss nFADP. We treat it as such and apply the following safeguards:
- Feedback collection is optional — you can disable it entirely in Settings.
- We process feedback only to drive training adaptation (the progression engine) and personal analytics. It is never sold, shared with advertisers, or used for profiling beyond your own training.
- When a gym partners with Altor, gym staff can see aggregated training signals (e.g. progression rate, session frequency) but not raw feedback responses, unless you explicitly share them.
6. Who we share data with
Your gym
If you are a member of a gym that partners with Altor, authorised gym staff (owner, manager, or staff roles) can see: your membership status, check-in history, equipment issue reports, and aggregated training summaries. They cannot see your raw session logs, feedback responses, or progression details unless you share them or the gym's data processing agreement specifies otherwise.
Your coach
If you grant a trainer access, they can see your session history, progression outputs, and feedback dimensions — scoped by the permission policy you or the gym sets. Coaches cannot access your data without your knowledge.
Sub-processors
| Provider | Purpose | Region |
|---|---|---|
| Supabase (AWS) | Database, auth, storage, edge functions | EU (Frankfurt) |
| Firebase (Google) | Push notifications only | EU/US |
| Stripe (future) | Payment processing (when billing module ships) | EU/US |
We do not sell personal data. We do not use advertising SDKs. There are no ad-tech embeds on any Altor surface — consumer or commercial.
7. Your rights
Under GDPR and Swiss nFADP, you have the right to:
- Access — request a copy of all personal data we hold about you.
- Portability — receive your training history in a structured, machine-readable format. Your performance identity belongs to you.
- Rectification — correct inaccurate personal data.
- Erasure — request deletion of your account and all associated data. Deletion cascades through all tables — training logs, feedback, progression events, gym interactions, and profile data.
- Restriction — request that we limit processing of your data in certain circumstances.
- Withdrawal of consent — withdraw consent for feedback collection or push notifications at any time, without affecting prior processing.
- Objection — object to processing based on legitimate interest.
- Complaint — lodge a complaint with the Swiss FDPIC or your local EU supervisory authority.
To exercise any right, email support@altorstrength.com. We respond within 30 days. Account deletion is also available directly in the app under Settings → Danger Zone.
8. Data retention
Training data is retained for as long as your account is active. This is by design — the performance identity concept depends on longitudinal history. When you delete your account, all personal data is permanently deleted within 30 days. Anonymised, aggregated data (e.g. population-level progression statistics with no individual identifiers) may be retained indefinitely.
9. Security
Multi-tenant row-level security (RLS) on all database tables. Least-privilege service roles. Encrypted connections (TLS) and encrypted storage (AES-256). No shared credentials between tenants. Regular dependency updates. We do not store passwords — authentication is handled by Supabase Auth (bcrypt-hashed, server-side).
10. Children
Altor is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
11. Changes to this policy
We may update this policy to reflect product changes or legal requirements. Material changes will be communicated via email or in-app notice. The "last updated" date at the top reflects the most recent revision.
12. Contact
Privacy questions: support@altorstrength.com
General inquiries: support@altorstrength.com
This privacy policy is a working draft pending formal legal review. Final legal language will be confirmed with Swiss data protection counsel before commercial launch. If you have questions about the current draft, contact us at support@altorstrength.com.