Privacy policy
This policy explains how your personal data is handled when you use the Liftava app for Android, the Liftava watch apps for Wear OS and Garmin devices and the website liftava.com. We collect only what the service needs, we never sell data and we show no ads.
In short
- Your training data is used for one thing: to run Liftava for you.
- Personal details such as your name, email, notes, bodyweight and heart rate are encrypted in our database, which runs on servers in Germany.
- No advertising, no analytics or tracking tools in the app or on this website, no cookies on the website.
- You can delete your account and all its data in the app at any time (how).
Who is responsible
The controller of your personal data is Vojtěch Procházka, a sole trader registered in the Czech trade register, company ID (IČO) 24433896, Švýcarská 2433, 272 01 Kladno, Czech Republic (“we”).
Contact for anything about privacy: support@liftava.com.
What we process and why
Your account
Your name, email address, password, time zone, language and weekly workout goal. We need them to create your account, sign you in and send you service emails (a welcome email with a confirmation link, a code when you forget your password, a notice when you change your email). Your password is never stored, only a one-way hash of it.
Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
Signing in with Google
If you choose “Continue with Google”, Google sends us a signed token with your Google account’s ID, its email address and whether Google has verified it, the name on the account, the address of your profile picture and, for a Google Workspace account, its domain. We keep the ID and the Google account’s email address, encrypted, to recognize you the next time and to know which address Google vouched for, and the name and email address also become your account’s, as when you sign up with your email. The rest we use only to check the token and do not keep. We never receive your Google password or anything else from your Google account. Google learns that you signed in to Liftava, under its own privacy policy.
Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
Your training
Workouts, exercises, sets, weights, repetitions, effort (RPE or RIR), rest times, notes, training plans and custom exercises, and what Liftava calculates from them: XP, levels, personal records, weekly quests and achievements.
Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
Bodyweight (optional)
If you enter your bodyweight, Liftava uses it to count the load of bodyweight exercises such as pull-ups and dips for XP and records. Each bodyweight you enter is kept with the date it applies from, so that a workout counts with the bodyweight that applied when it was done. It is optional, encrypted, never shown to your friends, and you can remove it at any time in your profile, which deletes every bodyweight you entered. Because bodyweight may be considered data concerning health, we process it on the basis of your explicit consent, which you give by entering it and withdraw by removing it.
Legal basis: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).
Heart rate (optional)
If you allow it in the Liftava app on your Wear OS watch, or open the Liftava app on your Garmin watch during a workout, the watch measures your heart rate while a workout runs on your phone and sends it to the phone. When you save the workout, the heart rate is stored with it: the measured values with their times, and the average and maximum that History shows. It is encrypted, never shown to your friends, and deleted together with the workout. Because heart rate is data concerning health, we process it on the basis of your explicit consent, which you give by allowing it on the Wear OS watch, or on the Garmin watch by allowing its sensor access when you install the app and opening the app during a workout. You withdraw it by turning off the heart rate permission in the Wear OS watch’s settings, or by not opening (or by removing) the Garmin watch app: no heart rate is measured from then on. To have heart rate that is already saved deleted, delete the workout or write to us.
Legal basis: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).
Health Connect (optional)
If you turn on “Save workouts” under Health Connect in the app’s settings and allow it in Health Connect, the app writes each workout you finish to Health Connect on your phone: its name, times and notes, the exercises with their sets (the weights, reps and other values you log) and, when a watch measured it and you allow heart rate in Health Connect, the heart rate. Until a workout is written there, the app keeps it, with its heart rate, on the phone. When you edit or delete such a workout in Liftava on that phone while Health Connect is on, it changes or disappears there too. Health Connect is part of Android: the apps you allow in it can read what Liftava wrote, under their own policies. Liftava only writes to Health Connect and reads nothing from it. Turn it off in the app’s settings or take the permission back in Health Connect whenever you like; signing out turns it off too, and the app then forgets which workouts it wrote there. What is already in Health Connect stays there until you delete it in Health Connect. With a Garmin watch you can also choose that your workouts go to Health Connect from Liftava instead of being recorded in Garmin Connect (see below); when the watch recorded only part of a workout, Liftava writes the whole workout as well.
Legal basis: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which you give by turning it on and allowing it in Health Connect.
Importing from Hevy
When you import a Hevy export (a CSV file), the file is uploaded to our server, turned into workouts in your account and then deleted. We keep only the workouts, not the file.
Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
Friends
You can connect with people only through an invite link you share yourself; nobody can search for you. Friends see your name, level, workouts with their exercises, sets and weights, records, your training plans (they can copy them) and your latest workout. They never see your email, bodyweight, workout or exercise notes, your XP, or records and volume of bodyweight exercises. Invite codes expire after one week. You can remove a friend at any time.
Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
Sign-in and security
For each signed-in device we keep a session with a hash of its token, the device’s user agent, its IP address and when it was last used. We use this to keep your account secure and to detect abuse. A session unused for 180 days expires.
If you add a passkey, we keep its public key, its identifier, the type of password manager that holds it and when it was last used. Your fingerprint, face or screen lock never leaves your phone, and we never receive the passkey’s private key.
Legal basis: our legitimate interest in keeping the service and your account secure (Art. 6(1)(f) GDPR).
Liftava Pro
If you buy Liftava Pro, the purchase is made and paid in Google Play. We never receive your payment details. We learn from our subscription provider (RevenueCat) whether and until when you have Pro, linked to your random account ID.
Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
Error reports
When the app or the server fails, an error report is sent to our error tracking service (Sentry, stored in the EU). It contains technical details such as the app version, device model, operating system and what led to the error, and your random account ID. It does not contain your name, email, IP address, screenshots or training content.
Legal basis: our legitimate interest in finding and fixing errors (Art. 6(1)(f) GDPR).
Problem reports
When you send a report with “Report a problem” in the app, we receive your message, your email address (so we can answer you), the app version, your phone’s model and operating system, and a log of what the app did in the last minutes (syncing, the Garmin watch, the workout notification; no training content). The report reaches our support mailbox by email (sent through Resend) and our error tracking service (Sentry) as feedback linked to your random account ID. Only you decide what your message says.
Legal basis: our legitimate interest in answering you and fixing the problem (Art. 6(1)(f) GDPR).
App updates
The app checks our update service (Expo) for small updates to its code. This request contains technical data such as your IP address and the app version, but no account data.
Legal basis: our legitimate interest in delivering fixes quickly (Art. 6(1)(f) GDPR).
Emails to us
If you write to us, we use your email and message to answer you.
Legal basis: our legitimate interest in answering you, or steps before or under a contract (Art. 6(1)(f) or (b) GDPR).
This website
The website uses no cookies, no analytics and no third-party trackers, and loads no resources from other websites. Our hosting provider (Cloudflare) processes technical data such as your IP address and browser in server logs to deliver the website and protect it from attacks.
Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
On your phone and watch
The app keeps some data on your phone so that it works offline: the workout in progress, changes waiting to be synced, a cache of your data and your preferences. Your sign-in token is kept in Android’s encrypted storage. Signing out, deleting your account or uninstalling the app removes this data.
The app asks for these permissions: notifications (the running workout and the end of a rest), alarms and reminders (to buzz exactly when a rest ends), a connected-device service (to keep the connection to your Garmin watch during a workout) and, if you turn it on, Health Connect’s permission to write exercise and heart rate. It does not use your location, camera or contacts, and it reads no health data from other apps or from Health Connect.
The Liftava app for Wear OS shows the workout running on your phone and sends back what you do on the watch (Done with the weight and reps you set, Skip, +30 s). If you allow it, it also measures your heart rate during the workout (see above). It talks only to Liftava on your paired phone, through Google Play services on both devices (over Bluetooth, or over Wi-Fi when the phone is not close), keeps the heart rate only until the phone has received it and sends nothing to us directly. It asks for two permissions: heart rate (body sensors) and notifications, to show the running workout on the watch face. On your phone, the heart rate is kept only until the workout is saved or discarded and, with Health Connect on, written there.
The Liftava watch app for Garmin shows what your phone sends it during a workout (the next set and the rest timer) and sends back your taps (Done, Skip, +30 s). While a workout runs, it also measures your heart rate with the watch’s sensor and sends it to the phone (see above), and it records the workout as a strength activity on the watch, which Garmin Connect receives when the watch syncs, unless you chose Health Connect for it in the app’s settings. The data travels over Bluetooth through Garmin’s Connect app. The watch app has no internet access, keeps the heart rate only until the phone has received it and sends nothing to us directly. Garmin processes data in its own apps, the recorded activity included, under Garmin’s privacy policy.
Who helps us
We use these providers, bound by data processing agreements, to run Liftava:
| Provider | What for | Where |
|---|---|---|
| netcup GmbH, Germany | Servers running the app’s backend and database | Germany |
| Cloudflare, Inc. | Encrypted database backups (R2), DNS, hosting of this website | Backups in the EU; website worldwide |
| Plus Five Five, Inc. (Resend), USA | Sending service emails and problem reports | USA |
| Functional Software, Inc. (Sentry), USA | Error reports | EU (Germany) |
| RevenueCat, Inc., USA | Managing Pro subscriptions | USA |
| 650 Industries, Inc. (Expo), USA | Delivering app updates | USA |
Google (Google Play, Sign in with Google) and Garmin process data about your purchases, sign-ins and devices as independent controllers under their own policies.
Where a provider processes data outside the European Economic Area, the transfer is protected by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.
We do not sell, rent or share your personal data for advertising.
How long we keep it
- Your account and training data: until you delete it or your account. A workout you delete disappears from the app at once and is erased for good when you delete your account.
- Bodyweight: every bodyweight you entered, until you remove it or delete your account.
- Heart rate: with the workout it was measured in, until you delete the workout or your account.
- Health Connect: what Liftava wrote there stays until you delete it in Health Connect, or until you delete the workout in Liftava on that phone while Health Connect is on, with no sign-out in between.
- Backups: encrypted database backups are kept for up to 14 days on our server and up to 90 days in off-site storage, then deleted automatically.
- Sessions: until you sign out, or after 180 days without use.
- Password reset codes: 15 minutes. Email confirmation links: 7 days. Invite codes: 1 week.
- Imported files: deleted as soon as they are processed.
- Error reports: up to 90 days.
- Problem reports: as long as we need them to deal with the problem, at most 12 months.
- Server logs: a few days, rotated automatically.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, to object to processing based on our legitimate interests, and to withdraw your consent at any time (this does not affect processing before the withdrawal).
Much of this you can do yourself in the app: edit your profile, edit or delete workouts and plans, remove your bodyweight, or delete your whole account. For everything else, including a copy of your data, write to support@liftava.com from the email address of your account. We answer within one month.
You also have the right to lodge a complaint with a supervisory authority. In the Czech Republic it is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz).
Security
All connections use HTTPS (TLS). Personal details are encrypted in the database with AES-256-GCM, passwords are stored only as bcrypt hashes and sign-in tokens only as SHA-256 hashes. Servers accept administrative access only with keys, and backups are encrypted before they leave the server.
Children
Liftava is not intended for children under 16, and we do not knowingly process their data. If you believe a child has created an account, let us know and we will delete it.
Changes
We will update this policy when the service or the law changes. We will let you know about important changes in the app or by email before they take effect.