Privacy policy and legal notice

Last updated: 23 August 2026

1. Identity of the controller

Owner and controller: Rubén Soro Esteban, independent developer of TrueLift.
Tax identification number: 50750388Z
Business address: Avenida de la carrera 5 Portal 1 2ºA 28223 Pozuelo de Alarcón Madrid
Privacy and support contact: rsoroesteban@gmail.com
Scope: this policy applies to the TrueLift mobile application, the truelift.es website and the TrueLift Coach web tool.

This policy is drafted under Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and Spanish Law 34/2002 (LSSI-CE).

2. Data processed in the TrueLift application

2.1 Data that remains under your control

TrueLift works without a user account. The application does not request your name or email address in order to train. It stores locally the information you enter and the data it generates from it:

• Programme, exercises, available equipment, workouts, loads, repetitions, RIR, RPE, cardio, personal bests and progress.
• Selected sex, date of birth, body weight, nutrition phase and training preferences. The date of birth is optional and is used solely to adjust your strength-level thresholds for age; you may leave it blank.
• Optional wellbeing and health data: sleep, energy or mood, stress, soreness, pain and affected area, illness or fever, HRV and resting heart rate.
• Settings, PRO trial status, drafts and other configuration required for the app to work.

The developer does not receive and cannot view this information. It is used to log and plan your training, calculate progression, adapt recommendations and display your development. The general legal basis is performance of the functionality you request (Article 6(1)(b) GDPR). Wellbeing and health data are optional; when you choose to enter them after receiving this information, their local processing relies on your explicit consent (Article 9(2)(a) GDPR), which you may withdraw by ceasing to use them and deleting the relevant history.

If you turn on the nutrition module, the application additionally stores the data listed in section 2.7, with its own consent and deletion arrangements.

Local data is retained until you delete it in the application, clear the app storage or uninstall it, subject to the backups described below.

2.2 Backups and sharing features

When you export a backup or share a workout, you choose the destination application, folder or service. The terms and privacy policy of that chosen recipient then also apply. The developer does not receive those files.

The operating system may also include TrueLift data in automatic device or account backups if you have enabled that feature. On Android, Auto Backup may store data in your Google Account; on iOS, iCloud Backup may include the app's data. Both systems can support restoration or transfer between devices. These backups are managed by Google or Apple according to your account settings; the developer cannot access them. See Android Auto Backup, iCloud Backup, the Google Privacy Policy and the Apple Privacy Policy.

2.3 TrueLift PRO purchases and subscriptions

Payments are handled through Google Play or the App Store. TrueLift uses RevenueCat, Inc. to display offers and verify, manage and restore purchases. RevenueCat therefore processes a pseudonymous or anonymous installation identifier, basic technical information such as device type and operating system, last usage time and transaction information, which may include the product, subscription status, Apple receipt or Google purchase token.

The developer does not receive bank account or card details, but can view in RevenueCat the purchase status and history associated with the pseudonymous identifier. The purpose and legal basis are to perform the purchase, unlock PRO, prevent errors and restore entitlements (Article 6(1)(b) GDPR). Google and Apple act as controllers for their respective payment processes. RevenueCat processes end-user information on behalf of the developer and may process data in the United States under the safeguards in its data processing agreement and Standard Contractual Clauses.

See the RevenueCat Privacy Policy, its Data Processing Addendum, the Google Privacy Policy and the Apple Privacy Policy. Information is retained for as long as needed to manage the purchase and for the applicable contractual or statutory periods.

2.4 Content and font downloads

When you request the catalogue or a PRO programme, the app connects to GitHub to download public files. GitHub receives the usual technical data of a web connection, such as IP address, date, user agent and requested resource. Your training history and wellbeing data are not sent. This connection is necessary to provide the requested content (Article 6(1)(b) GDPR). See the GitHub Privacy Statement.

The current version may also request its visual fonts from Google Fonts. Google receives the technical data needed to serve them, such as the IP address and request metadata. The purpose is to present the interface and the legal basis is the legitimate interest in providing a consistent visual experience (Article 6(1)(f) GDPR). See the Google Privacy Policy.

2.5 Advertising and product analytics

The application displays no advertising and contains no advertising SDK or third-party commercial tracker. RevenueCat is used solely for purchases and subscriptions, GitHub to download requested content and Google Fonts to present the fonts.

The current version of TrueLift also includes product analytics through Google Analytics for Firebase, provided by Google Ireland Limited. It serves two purposes: understanding which parts of the application are actually used, so as to decide what to improve, and measuring the effectiveness of the advertising campaigns used to make the application known.

Nothing is collected without your permission. The first time you open the application you are asked explicitly and, until you answer, no information is collected or sent. The legal basis is your consent (Article 6(1)(a) GDPR). You may withdraw it at any time in Settings → PRO → Product analytics, with the same effort it took to give it; once withdrawn, collection stops. The application works exactly the same and keeps all of its features, whether you accept or not.

What is sent:

• Usage milestones: that the 16-training-session trial was activated, that a session was logged, that a full training week was completed, and which PRO features were turned on.
• Onboarding milestones: that the welcome screen was seen, that a first routine was confirmed —including the progression system and the number of training days chosen— and that a first session was started.
• Which app tabs are opened for the first time (routine, volume, progress or nutrition), to learn which parts people actually discover.
• When you grant or withdraw this permission: whether it happened on first launch or later from Settings. If you decline, nothing is sent — not even the refusal.
• Aggregated segmentation data: whether the free, trial or paid version is in use, the number of days in the routine, and whether the app was already in use before analytics was enabled or was started with it.
• Standard technical service data: device type, operating system, language, approximate country and application version.

What is never sent: your training history, your loads, sets, repetitions, RPE or personal records; your body weight, body-fat percentage, body measurements, HRV or heart rate; your sex or date of birth; nor any data from the nutrition module. All of that stays on your device, as set out in section 2.1.

This analytics is pseudonymous, not anonymous: it is not linked to your name, your email or any account, but it uses an installation identifier generated by Google that distinguishes one device from another and disappears when you uninstall the application or clear its data.

How long it is kept. Google retains this data for fourteen months from collection, both event data and data tied to the installation, and the period restarts with each new activity from the same installation. After that it is deleted automatically. Aggregated reports, which cannot tell one installation from another, may be kept longer.

Who processes it and where. The provider is Google Ireland Limited, established in the European Union, acting on the developer's behalf under the Google Analytics data processing terms. Google may process the information in the United States: Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection by decision of 10 July 2023, and the standard contractual clauses incorporated into those terms also apply. If you accept, this data may also be used to measure the results of TrueLift advertising across Google services.

How to stop collection and delete what has been collected.

1. Turn analytics off in Settings → PRO → Product analytics. Nothing further is sent from that moment on.
2. Clear the app's storage from your system settings, or uninstall it. The installation identifier disappears and the same one is never generated again, so data already collected can no longer be linked to any device in use.
3. That data is deleted entirely once the fourteen-month period stated above elapses.

Because this analytics is not tied to your name, your email or any account, the developer cannot tell which data is yours and therefore cannot delete it individually on request before that period ends. That is the trade-off of it being pseudonymous and of the app having no user accounts. For any question, or to exercise your rights, write to rsoroesteban@gmail.com.

This concerns only the analytics data described in this section. Your routine, history, loads, body weight, HRV and nutrition data have never left your device and are deleted from within the app, as set out in section 6.

2.6 Health data and medical limitation

Wellbeing and health indicators are processed locally to adjust training recommendations. They are not sent to RevenueCat, GitHub, Google Fonts, Google Play, the App Store or the developer. They are not used for advertising or decisions producing legal effects. TrueLift is a training support tool, not a medical device, and does not diagnose, treat, cure or prevent disease. Seek advice, diagnosis or treatment from a healthcare professional.

2.7 Nutrition module

The nutrition module is an optional TrueLift PRO feature. It estimates your weight trend from the weigh-ins you record and proposes, at most once a week, a possible daily energy (kcal) adjustment together with activity or food examples for applying it. Before it can be turned on, the application displays a safe-use notice that you must read and accept expressly: without that acceptance the module does not start and the app behaves as if it did not exist.

When you turn it on, the application stores locally:

• The weigh-ins you record, with their date, and the weight trend calculated from them.
• Height, sex, goal weight, target weekly rate, the type and dates of each phase, and any baseline intake you declare, which is optional.
• Body-fat estimates, with their date, the method used and the reference weight. The body measurements you enter to calculate them are not stored: only the result is kept.
• Your food list and your protein preferences.
• If you turn on cycle mode, the menstrual cycle start markers you record.
• Carbohydrate refeeds, pauses and resumptions, season plan and the history of recommendations issued.
• Your reminder preferences and the receipt of your acceptance of the safe-use notice: the version accepted and the date and time you accepted it.

Legal basis and consent. This information constitutes health data and, in the case of menstrual cycle markers, particularly sensitive information. Its processing relies on your explicit consent (Article 9(2)(a) GDPR), given by accepting the safe-use notice, together with performance of the functionality you request (Article 6(1)(b) GDPR). The notice is versioned: if its content changes materially, the application requests it again and the module stops issuing recommendations until you accept it anew. You may withdraw consent at any time by turning the module off.

Where it is processed. All calculation takes place on your device. Neither the weigh-ins, nor body composition, nor cycle markers, nor the food list, nor the recommendations are sent to RevenueCat, GitHub, Google Fonts, Google Play, the App Store or the developer. The module's reminders are local notifications scheduled by the device itself: there is no notification server and no data is sent to generate them. As with the rest of the app's information, this data may be included in the automatic operating-system backups described in section 2.2 and in any backups you export yourself.

Automated processing. Weekly recommendations are generated automatically from your data, without human intervention. They do not produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR: they are indicative proposals that take effect only if you decide to apply them, you may ignore any of them and you may turn the module off whenever you wish. No profiling is carried out for advertising purposes and this data is not disclosed to third parties.

Limitations and intended users. The module does not create a diet, does not check whether your food intake is complete, balanced or appropriate, and does not constitute individual nutrition or medical advice. It is intended only for healthy adults. The prior notice expressly excludes its use by anyone under 18, during pregnancy or breastfeeding, and by anyone who has or has had an eating disorder, is underweight, has a disease or medical condition, or takes medication that may affect weight, metabolism or nutritional needs. If you develop discomfort, dizziness, weakness, menstrual changes, concerning weight loss or gain, or any other symptom, you must stop following the recommendations and consult a healthcare professional.

Retention and deletion. The module's data remains on your device until you delete it, clear the app storage or uninstall the app. Turning the loop off deletes nothing: it keeps the information in case you want to resume. To erase it, the application includes a dedicated deletion of nutrition data, with double confirmation, which does not affect your programme or your training history.

3. TrueLift Coach and client data

TrueLift Coach enables a trainer to import backups supplied by a client. It may process a name or alias, sex and date of birth if declared, training history, notes, injuries or discomfort, readiness, HRV and other indicators in the file. If the client was using the nutrition module, the backup may also contain their weigh-ins, estimated body composition, cycle markers and the rest of the information described in section 2.7. The information is read and stored in the trainer's browser local storage; it is not uploaded to a TrueLift server and the developer cannot access it.

The trainer or organisation deciding to import and use this information is the controller of its own processing. Before importing it, they must inform the client, have a valid legal basis and, where health data is involved, satisfy an applicable condition under Article 9 GDPR—commonly explicit consent. They must also restrict access to the device, keep backups secure, avoid retaining unnecessary information and delete it when no longer needed. TrueLift Coach can export the portfolio and delete each client and their data.

Local storage is essential to provide this serverless tool. Information is retained until the trainer deletes the clients or clears the site's browser data. Exported files remain under the control and responsibility of the person who downloads and shares them.

4. Website privacy

The website is static and hosted on GitHub Pages. TrueLift uses no web analytics, advertising or tracking cookies. The language selector stores only the language preference in browser local storage; this technical storage is needed to remember the requested option and is not used to identify you or track your activity.

GitHub may record technical connection data such as IP address, date, requested resource and user agent to host and protect the site under its Privacy Statement. If you use an email link, your address, message and any data you choose to include are processed to respond and provide support (Article 6(1)(b) or 6(1)(f) GDPR). They are retained for as long as needed to resolve the request and may subsequently be restricted for applicable statutory periods.

5. Recipients, transfers and security

Apart from actions you initiate and the providers described above, data is not sold or disclosed. App and website connections use HTTPS. Some providers are established or use infrastructure outside the European Economic Area; their policies and, where they act on behalf of the developer, their data processing agreements set out the applicable transfer mechanisms.

Protect your device with a screen lock, keep the operating system updated and store exported backups securely. No system can guarantee absolute security, but measures proportionate to the local and limited nature of the processing are applied.

6. Your rights

You can view, correct, export and delete in the app the information that exists only on your device. Since the developer does not hold it, they cannot deliver or remotely erase it. You can also clear the application storage or uninstall it, taking operating-system backups into account. The nutrition module data additionally has its own deletion control, described in section 2.7.

To exercise access, rectification, erasure, objection, restriction or portability regarding purchase, support or other information that has been received, email rsoroesteban@gmail.com. Reasonable information may be requested to locate a purchase identifier and verify the request. Data retained by Google Play or the App Store must also be managed with those platforms under their policies.

You may withdraw consent at any time without affecting prior lawful processing. If you believe the processing breaches the law, you may lodge a complaint with the Spanish Data Protection Agency or your local supervisory authority.

7. Children

TrueLift is not directed at children under 14. Children below that age should use it only with the authorisation and supervision of a parent or legal guardian. Purchases are also subject to the family controls and terms of the relevant store. If the developer receives a child's data through support without valid authorisation, reasonable steps will be taken to erase it.

The nutrition module described in section 2.7 is restricted to people aged 18 or over. The notice that must be accepted before turning it on requires confirming that age, and it must not be used on behalf of a minor.

8. Legal notice and TrueLift PRO contracting

Owner: Rubén Soro Esteban · Tax identification number: 50750388Z · Business address: Avenida de la carrera 5 Portal 1 2ºA 28223 Pozuelo de Alarcón Madrid · rsoroesteban@gmail.com

• Intellectual property: the application, trade mark, logo, text, screenshots, manuals and proprietary content belong to the owner or are used under licence. Commercial exploitation is not authorised without permission, except for uses permitted by law.
• Commercial terms: available plans, duration, final price, taxes, renewal and applicable terms are displayed by Google Play or the App Store before purchase confirmation. Subscriptions can be managed or cancelled through the store or the options provided in the app. Cancellation prevents future renewals, without prejudice to paid access and mandatory consumer rights.
• Use of the application: recommendations are indicative and do not replace the judgement of a qualified trainer or healthcare professional. Users are responsible for adapting exercise to their ability, technique, environment and health.
• Liability: the owner is liable as required by applicable law. Nothing in these terms excludes or restricts non-waivable consumer rights or liabilities that cannot legally be excluded.
• External links and services: third-party websites and services are governed by their own terms and policies.

9. Changes and governing law

Changes will be published on this page with the updated date. If they introduce new processing requiring consent, consent will be requested before it applies. This policy and the terms are governed by Spanish and European law. Consumer disputes are subject to the courts designated by mandatory consumer-protection rules, including the consumer's place of residence where applicable.