OnlyBody1. Privacy at a glance
This policy covers OnlyBody, OnlyWeights and onlybody.app. I am Illia Khvost, the developer and controller for personal information I receive through this website, support and diagnostics. Contact: support@onlybody.app.
- No account is required. Each app keeps its routines and history separately on your device, without uploading them to me or syncing between apps.
- The apps have no analytics or developer advertising SDKs. Embedded YouTube videos can contact Google and show ads.
- Website hosting processes technical request data. If you email me, I receive the information you send.
2. Data on your device
- Routines: names, exercises, muscle groups, scheduled days, sets, reps, durations and rest intervals, used to plan and generate workouts.
- History: session dates, duration, exercises, reps and any weights you enter, used to show completed training and exercise history.
- Preferences: timer sound, weight units, reminders and record identifiers, used to remember settings and organise local records.
I cannot remotely access this database. The apps do not request Apple Health data or personal details such as your name or email.
Reminders and Apple services
Optional reminders are scheduled locally by iOS with your permission. Change them in the app or turn off notifications in iOS Settings.
Device or iCloud backups may include app data, depending on your settings. This is separate from app cloud sync. Apple handles backups, App Store transactions and diagnostics under its Privacy Policy. Diagnostic reports Apple shares with me according to your choices may be used to investigate faults.
3. YouTube videos
Your choice: YouTube videos are off until you choose “Allow YouTube videos” on an exercise. Before that choice, the apps do not load the embedded player, its scripts or remote thumbnails. You can use exercises and workouts without allowing videos.
The apps save the date and version of your permission locally, separately for each app. Withdraw permission in Settings → YouTube. This stops embedded YouTube connections and removes the saved permission; it does not delete data Google has already received. You can allow videos again from an exercise.
Both apps use YouTube API Services through the official embedded player. Google receives technical data such as your IP address, device/browser information, app identity, requested video and player interactions. It may use cookies or similar identifiers and process data for playback, security, measurement and advertising, including showing ads.
The player uses YouTube’s privacy-enhanced mode (youtube-nocookie.com), which prevents views from being used to personalize your YouTube experience or ads outside the app. Ads within this player are non-personalized. Once you allow videos, opening an exercise with a video can contact Google before you press Play. The player uses temporary website storage. This does not stop network requests, temporary cookies or Google retaining data on its servers. Links opened in your browser use that browser’s settings.
The apps do not send your workout records or support emails to YouTube, or request access to your Google account. See the Google Privacy Policy, cookie information, YouTube Terms of Service, Google privacy controls and account access settings.
4. Website and support
Cloudflare provides website delivery and security, processing data such as IP addresses, requested pages, request times and browser information. The site has no analytics, advertising scripts, embedded videos or signup forms. See Cloudflare’s Privacy Policy.
If you email me, I use your address, message, metadata and attachments to respond, troubleshoot or handle your privacy request. Email providers deliver and store this correspondence. Contacting me is optional; send only what is needed, without passwords or unnecessary health information. I do not sell your information or use support emails for marketing.
5. How information is used
For processing I am responsible for under GDPR, the legal bases are:
- Requested services (Article 6(1)(b)): processing necessary to provide a service you request, where applicable.
- Legitimate interests (Article 6(1)(f)): delivering and securing the website, answering general enquiries and diagnosing faults.
- Legal obligations (Article 6(1)(c)): handling data-protection requests and legally required records or disclosures.
Recipients include hosting and email providers, Apple and Google as described above, and authorities where legally required. Any legally required consent for third-party storage or processing must be obtained separately; this policy is not that consent. Google explains its own purposes and legal bases in its policy. The apps do not make decisions with legal or similarly significant effects on you.
International processing and security
Providers may process data outside the European Economic Area, including in the US. Their policies explain transfer arrangements, which may include adequacy decisions or standard contractual clauses. Contact me for details and copies of safeguards for transfers involving data I control.
iOS storage protections and HTTPS help protect data. Access to support information is limited to handling requests and operating the services. No system guarantees absolute security.
6. Keeping and deleting data
- App data stays until you change or delete it. Deleting a routine preserves completed history. There is currently no individual history-deletion or export tool. To remove all local records, use iOS Delete App; Offload App keeps them. Manage backups separately.
- Support emails are kept for your request and necessary follow-up, then deleted when no longer needed, unless a legal obligation or dispute requires retention.
- Provider records follow the relevant provider’s policies and settings. Deleting an app does not delete those records.
Email me to request deletion of information I hold. I cannot retrieve or delete your on-device database remotely.
7. Your rights
This section concerns personal information I receive, such as support correspondence: your email address, messages and any attachments you send me. You can ask what information I hold about you, request a copy, or ask me to correct or delete it.
Your workout records stay on your device. The apps do not upload your routines, logged weights or training history to me. I cannot access or delete that local database remotely. See Keeping and deleting data for how to remove it yourself. If you choose to send a workout screenshot or details in a support email, the copy you send becomes part of that correspondence.
Where applicable under data-protection law, you may also ask me to limit how I use your information, request a portable copy, or object to processing based on legitimate interests. If processing relies on your consent, you may withdraw it without affecting earlier lawful processing.
To make a request, write to support@onlybody.app. I may need to confirm that the information belongs to you. I normally respond within one month. If I need more time or cannot fulfil part of your request for a legal reason, I will explain why. For data a provider such as Google holds independently, use that provider’s privacy tools or contact process.
You may complain to the Polish Personal Data Protection Office (UODO) or the supervisory authority where you live, work or believe an infringement occurred.
8. Children and policy updates
The apps are not designed specifically for children. Minors should have appropriate parent or guardian involvement and meet third-party age requirements. Contact me if a child sends me personal information so I can review and, where appropriate, delete it.
Policy updates
I will update this page and its date when data practices change, give appropriate notice of material changes and request any legally required consent separately.