Privacy policy and legal notice

Last updated: 1 November 2026

1. Identity of the controller

Owner and controller: Rubén Soro Esteban, independent developer of TrueLift.
Tax identification number: 50750388Z
Business address: Avenida de la carrera 5 Portal 1 2ºA 28223 Pozuelo de Alarcón Madrid
Privacy and support contact: rsoroesteban@gmail.com
Scope: this policy applies to the TrueLift mobile application, the truelift.es website and the TrueLift Escritorio web tool.

This policy is drafted under Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and Spanish Law 34/2002 (LSSI-CE).

2. Data processed in the TrueLift application

2.1 Data that remains under your control

TrueLift works without a user account. The application does not request your name or email address in order to train. It stores locally the information you enter and the data it generates from it:

• Programme, exercises, available equipment, workouts, loads, repetitions, RIR, RPE, cardio, personal bests and progress.
• Selected sex, date of birth, body weight, nutrition phase and training preferences. The date of birth is optional and is used solely to adjust your strength-level thresholds for age; you may leave it blank.
• Optional wellbeing and health data: sleep, energy or mood, stress, soreness, pain and affected area, illness or fever, HRV and resting heart rate, and the data TrueLift reads from your watch through Health Connect or Apple Health if you enable that option (see section 2.6).
• Settings, PRO trial status, drafts and other configuration required for the app to work.

The developer does not receive and cannot view this information. It is used to log and plan your training, calculate progression, adapt recommendations and display your development. The general legal basis is performance of the functionality you request (Article 6(1)(b) GDPR). Wellbeing and health data are optional; when you choose to enter them after receiving this information, their local processing relies on your explicit consent (Article 9(2)(a) GDPR), which you may withdraw by ceasing to use them and deleting the relevant history.

If you turn on the nutrition module, the application additionally stores the data listed in section 2.7, with its own consent and deletion arrangements.

Local data is retained until you delete it in the application, clear the app storage or uninstall it, subject to the backups described below.

2.2 Backups and sharing features

When you export a backup or share a workout, you choose the destination application, folder or service. The terms and privacy policy of that chosen recipient then also apply. The developer does not receive those files.

The operating system may also include TrueLift data in automatic device or account backups if you have enabled that feature. On Android, Auto Backup may store data in your Google Account; on iOS, iCloud Backup may include the app's data. Both systems can support restoration or transfer between devices. These backups are managed by Google or Apple according to your account settings; the developer cannot access them. See Android Auto Backup, iCloud Backup, the Google Privacy Policy and the Apple Privacy Policy.

2.3 TrueLift PRO purchases and subscriptions

Payments are handled through Google Play or the App Store. TrueLift uses RevenueCat, Inc. to display offers and verify, manage and restore purchases. RevenueCat therefore processes a pseudonymous or anonymous installation identifier, basic technical information such as device type and operating system, last usage time and transaction information, which may include the product, subscription status, Apple receipt or Google purchase token.

The developer does not receive bank account or card details, but can view in RevenueCat the purchase status and history associated with the pseudonymous identifier. The purpose and legal basis are to perform the purchase, unlock PRO, prevent errors and restore entitlements (Article 6(1)(b) GDPR). Google and Apple act as controllers for their respective payment processes. RevenueCat processes end-user information on behalf of the developer and may process data in the United States under the safeguards in its data processing agreement and Standard Contractual Clauses.

See the RevenueCat Privacy Policy, its Data Processing Addendum, the Google Privacy Policy and the Apple Privacy Policy. Information is retained for as long as needed to manage the purchase and for the applicable contractual or statutory periods.

2.4 Content and font downloads

When you request the catalogue or a PRO programme, the app connects to GitHub to download public files. GitHub receives the usual technical data of a web connection, such as IP address, date, user agent and requested resource. Your training history and wellbeing data are not sent. This connection is necessary to provide the requested content (Article 6(1)(b) GDPR). See the GitHub Privacy Statement.

The current version may also request its visual fonts from Google Fonts. Google receives the technical data needed to serve them, such as the IP address and request metadata. The purpose is to present the interface and the legal basis is the legitimate interest in providing a consistent visual experience (Article 6(1)(f) GDPR). See the Google Privacy Policy.

2.5 Advertising and product analytics

The application displays no advertising. The only third-party measurement components are those of Google (Firebase) and Meta described in the next section and, only if you reached TrueLift from an ad in ChatGPT, OpenAI; all of them are only enabled with your consent. RevenueCat is used solely for purchases and subscriptions, GitHub to download requested content and Google Fonts to present the fonts.

The current version of TrueLift also includes product analytics through Google Analytics for Firebase, provided by Google Ireland Limited, and the Meta SDK (App Events), provided by Meta Platforms Ireland Limited. They serve two purposes: understanding which parts of the application are actually used, so as to decide what to improve, and measuring the effectiveness of the advertising campaigns used to make the application known.

Nothing is collected without your permission. The first time you open the application you are asked explicitly and, until you answer, no information is collected or sent. The legal basis is your consent (Article 6(1)(a) GDPR). You may withdraw it at any time in Settings → PRO → Product analytics, with the same effort it took to give it; once withdrawn, collection stops. The application works exactly the same and keeps all of its features, whether you accept or not.

What is sent:

• Usage milestones: that the 16-training-session trial was activated, that a session was logged, that a full training week was completed, and which PRO features were turned on.
• If you use Strava posting: that a Strava account was connected for the first time and that the first session was posted, with nothing from the session or the account.
• Only if you installed the app on Android from an ad in ChatGPT: the identifier of that click generated by OpenAI (oppref), which Google Play hands to the app on install.
• Onboarding milestones: that the welcome screen was seen, that a first routine was confirmed —including the progression system and the number of training days chosen— and that a first session was started.
• Which app tabs are opened for the first time (routine, volume, progress or nutrition), to learn which parts people actually discover.
• When you grant or withdraw this permission: whether it happened on first launch or later from Settings. If you decline, nothing is sent — not even the refusal.
• Aggregated segmentation data: whether the free, trial or paid version is in use, the number of days in the routine, and whether the app was already in use before analytics was enabled or was started with it.
• Standard technical service data: device type, operating system, language, approximate country and application version.

What is never sent: your training history, your loads, sets, repetitions, RPE or personal records; your body weight, body-fat percentage, body measurements, HRV or heart rate; your sex or date of birth; nor any data from the nutrition module. All of that stays on your device, as set out in section 2.1.

This analytics is pseudonymous, not anonymous: it is not linked to your name, your email or any account, but it uses an installation identifier generated by Google and another generated by Meta, which distinguish one device from another and disappear when you uninstall the application or clear its data. On iOS, the device advertising identifier is shared with Meta only if you also allow tracking when Apple asks you.

How long it is kept. Google retains this data for fourteen months from collection, both event data and data tied to the installation, and the period restarts with each new activity from the same installation. After that it is deleted automatically. Aggregated reports, which cannot tell one installation from another, may be kept longer.

Who processes it and where. The provider is Google Ireland Limited, established in the European Union, acting on the developer's behalf under the Google Analytics data processing terms. Google may process the information in the United States: Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection by decision of 10 July 2023, and the standard contractual clauses incorporated into those terms also apply. If you accept, this data may also be used to measure the results of TrueLift advertising across Google services.

The same milestones are sent to the Meta SDK, provided by Meta Platforms Ireland Limited, established in the European Union, acting on the developer's behalf under the Meta Business Tools Terms. Meta may process the information in the United States: Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework, and the standard contractual clauses also apply. It is used solely to measure the results of TrueLift advertising on Facebook and Instagram (which ads lead to installs, trials and purchases); the app instructs Meta not to use this data to personalise ads. Meta retains it in accordance with its privacy policy.

Ads in ChatGPT (OpenAI). Only if you installed TrueLift on Android from an ad in ChatGPT and you grant this permission, the app sends OpenAI the identifier of that click together with five milestones: that it was installed, that the trial was started, that the first workout was logged, that two full training weeks were completed and, where applicable, the PRO purchase and its amount. Each milestone also carries a random install number that cannot identify you. They are used solely to measure which TrueLift ads in ChatGPT work, during the thirty days after the click; nothing about your training or your body data. Sending goes through the developer's own relay hosted on Cloudflare (Cloudflare, Inc.), which acts on the developer's behalf, only forwards the data to OpenAI and does not store it. OpenAI processes it as the provider of its advertising platform under its advertiser terms and its privacy policy, and may process it in the United States with the safeguards those terms set out. If you did not come from an ad in ChatGPT, or if you use iOS, nothing is sent to OpenAI.

How to stop collection and delete what has been collected.

1. Turn analytics off in Settings → PRO → Product analytics. Nothing further is sent from that moment on.
2. Clear the app's storage from your system settings, or uninstall it. The installation identifier disappears and the same one is never generated again, so data already collected can no longer be linked to any device in use.
3. That data is deleted entirely once the fourteen-month period stated above elapses.

Because this analytics is not tied to your name, your email or any account, the developer cannot tell which data is yours and therefore cannot delete it individually on request before that period ends. That is the trade-off of it being pseudonymous and of the app having no user accounts. For any question, or to exercise your rights, write to rsoroesteban@gmail.com.

This concerns only the analytics data described in this section. Your routine, history, loads, body weight, HRV and nutrition data are never sent to analytics: they stay on your device, except for the sessions you choose to post to Strava (section 2.8), and are deleted from within the app, as set out in section 6.

2.6 Health data and medical limitation

Wellbeing and health indicators are processed locally to adjust training recommendations. They are not sent to RevenueCat, GitHub, Google Fonts, Google Play, the App Store, Google Analytics, Meta, Strava or the developer. They are not used for advertising or decisions producing legal effects. TrueLift is a training support tool, not a medical device, and does not diagnose, treat, cure or prevent disease. Seek advice, diagnosis or treatment from a healthcare professional.

Connected watch (Health Connect on Android · Apple Health on iOS). If you enable this option in Settings, TrueLift reads from Health Connect (Android) or Apple Health / HealthKit (iOS) the data your watch, band or scale stores there: resting heart rate, HRV (only with the HRV module turned on), sleep (duration and stages), steps, active, total and basal calories, body weight and your workouts (activity type, start time and duration) together with the heart rate recorded during each one. On Android, Health Connect also requires the distance permission in order to read workouts; that data is not used. They are used to fill in your daily autoregulation check-in, suggest the sleep answer of the check-in, log the day's weigh-in, add the cardio sessions recorded by your watch to your history with an estimate of their intensity, and refine nutrition recommendations. Access is read-only: TrueLift writes nothing to Health Connect or Apple Health. Reading happens only on your device and only while the app is open. The data read is stored in the app's local storage (and in your backup if you export one) and is not sent to any server, to the developer or to third parties; it is not used for advertising, marketing or decisions producing legal effects. You can revoke access at any time from the Health Connect app (Android), from Settings → Health → Data Access & Devices → TrueLift (iOS) or by turning the option off in TrueLift; data already read is removed when you clear the app's data.

2.7 Nutrition module

The nutrition module is an optional TrueLift PRO feature. It estimates your weight trend from the weigh-ins you record and proposes, at most once a week, a possible daily energy (kcal) adjustment together with activity or food examples for applying it. Before it can be turned on, the application displays a safe-use notice that you must read and accept expressly: without that acceptance the module does not start and the app behaves as if it did not exist.

When you turn it on, the application stores locally:

• The weigh-ins you record, with their date, and the weight trend calculated from them.
• Height, sex, goal weight, target weekly rate, the type and dates of each phase, and any baseline intake you declare, which is optional.
• Body-fat estimates, with their date, the method used and the reference weight. The body measurements you enter to calculate them are not stored: only the result is kept.
• Your food list and your protein preferences.
• If you turn on cycle mode, the menstrual cycle start markers you record.
• Carbohydrate refeeds, pauses and resumptions, season plan and the history of recommendations issued.
• Your reminder preferences and the receipt of your acceptance of the safe-use notice: the version accepted and the date and time you accepted it.

Legal basis and consent. This information constitutes health data and, in the case of menstrual cycle markers, particularly sensitive information. Its processing relies on your explicit consent (Article 9(2)(a) GDPR), given by accepting the safe-use notice, together with performance of the functionality you request (Article 6(1)(b) GDPR). The notice is versioned: if its content changes materially, the application requests it again and the module stops issuing recommendations until you accept it anew. You may withdraw consent at any time by turning the module off.

Where it is processed. All calculation takes place on your device. Neither the weigh-ins, nor body composition, nor cycle markers, nor the food list, nor the recommendations are sent to RevenueCat, GitHub, Google Fonts, Google Play, the App Store, Strava or the developer. The module's reminders are local notifications scheduled by the device itself: there is no notification server and no data is sent to generate them. As with the rest of the app's information, this data may be included in the automatic operating-system backups described in section 2.2 and in any backups you export yourself.

Calories, meal split and AI menu. To estimate your daily energy expenditure and the calories for your phase, the application also uses the type of work you state, which is optional, and the steps and workouts it already records. If you use the meal split, it stores the number of meals, your split preferences and, if you correct it, the calorie figure you choose. The "Create your weekly menu with AI" assistant stores your answers (country, budget, tastes, allergies, intolerances, meal times and other preferences) and prepares on your device a text containing them, your calorie and macro targets, a summary of your recent training and, if you authorise it, your trend weight, height, age and sex. TrueLift does not connect to any artificial intelligence service: that text only leaves your device when you copy it or share it with the application you choose, and from then on its processing is governed by that service's terms and privacy policy. Review it before sending it, as it may include allergies and other personal data. The assistant's answers are stored on your device and in your backups, and are not sent to analytics.

Automated processing. Weekly recommendations are generated automatically from your data, without human intervention. They do not produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR: they are indicative proposals that take effect only if you decide to apply them, you may ignore any of them and you may turn the module off whenever you wish. No profiling is carried out for advertising purposes and this data is not disclosed to third parties.

Limitations and intended users. The module does not create a diet, does not check whether your food intake is complete, balanced or appropriate, and does not constitute individual nutrition or medical advice. It is intended only for healthy adults. The prior notice expressly excludes its use by anyone under 18, during pregnancy or breastfeeding, and by anyone who has or has had an eating disorder, is underweight, has a disease or medical condition, or takes medication that may affect weight, metabolism or nutritional needs. If you develop discomfort, dizziness, weakness, menstrual changes, concerning weight loss or gain, or any other symptom, you must stop following the recommendations and consult a healthcare professional. The meal split is an indicative guide, and TrueLift does not review or verify the recipes, quantities or calculations of any menu suggested by an external artificial intelligence.

Retention and deletion. The module's data remains on your device until you delete it, clear the app storage or uninstall the app. Turning the loop off deletes nothing: it keeps the information in case you want to resume. To erase it, the application includes a dedicated deletion of nutrition data, with double confirmation, which does not affect your programme or your training history.

2.8 Posting to Strava

Posting your sessions to Strava is an optional, free feature. It is only turned on if you connect your Strava account in Settings → Sharing; if you do not, TrueLift does not communicate with Strava. It is not available in demo mode.

Connection. You sign in on Strava's own page and authorise TrueLift: the application never sees your password. Two permissions are requested: uploading activities, which is needed to post, and viewing your activities, which is optional and is used only to avoid duplicating a workout your watch has already uploaded. Strava gives the application temporary access keys, your athlete identifier and your first name, which is shown in Settings. They are kept in the system's secure storage (Keystore on Android, Keychain on iOS), are not included in the app's backups or in operating-system backups, and never reach the developer. To obtain and renew those keys, the request goes through our own service hosted on Deno Deploy (Deno Land Inc.), in its European region, which adds the application's secret key and forwards it to Strava. That service has no database, does not store the keys or write logs containing them, and only returns the data listed above to the app; Deno Land Inc. may process technical connection data, such as the IP address, to provide the service.

What is sent to Strava. Each strength session you post, by hand or with automatic posting turned on, is created in your account as a weight training activity with a title containing the name of your routine day, the start time, the duration and a description with the exercises, the sets with their reps and RIR, the weights and the total volume, and the personal records from that session. Weights and records are only included if you keep their switches on. For bodyweight exercises, the load of a record includes your body weight. Your wellbeing or health data, HRV, heart rate, measurements, photos, sex, date of birth and nutrition module data are not sent. If you edit a session that has already been posted, the description of its activity is updated.

Reading your activities. Only if you grant the permission to view your activities, before posting TrueLift looks up the activities in your account around the time of the session (type, name, start and duration) to check whether your watch has already uploaded that workout. If so, it reads its description and adds the summary underneath, without changing its name, instead of creating another activity. The lookup is made from your device and only the identifier of the chosen activity is kept from it.

What is stored on your device. The identifier of each posted activity, to link to it and avoid posting it twice, your Strava preferences and the record of your consent, which are included in your backups; and, when you are offline, a list of pending posts, which is not included in them.

Legal basis and withdrawal. Your consent (Art. 6(1)(a) GDPR), which you give when you connect your account and, expressly, before the first post or when turning on automatic posting, after seeing what is sent. You can withdraw it at any time: turn off automatic posting or tap Disconnect in Settings → Sharing, which revokes access on Strava and deletes the keys from the device. You can also revoke it from your Strava account settings.

Strava as recipient. Once posted, the activity stays in your Strava account and is processed by Strava, Inc. as controller, under its terms, its privacy policy and your account's privacy settings, which decide who sees it. Strava may process the data in the United States with the safeguards described in its policy. TrueLift cannot delete Strava activities, because Strava does not allow other applications to do so: to remove one, delete it on Strava. Disconnecting your account or deleting the session in TrueLift does not remove it from Strava.

The developer does not receive your sessions, your access keys or your Strava account data. If you accepted the analytics in section 2.5, they only receive two milestones with no content: that an account was connected for the first time and that the first session was posted.

3. TrueLift Escritorio

TrueLift Escritorio is a web tool for viewing your own TrueLift data on a computer. It reads the backup you export from the application and, if you choose, the ZIP file with your progress photos. It may process all the information those files contain, including the health data described in sections 2.6 and 2.7 and your photos.

Files are processed in your browser and stored in its local storage; they are not uploaded to any TrueLift server and the developer cannot access them. The page does not connect to third-party services. So that it can open offline, the browser caches the page's own files, never your data. It is for viewing only: it changes nothing in your app. Reports you print or save as PDF remain under your control.

The data is kept until you delete it from the tool itself or clear the site's data in your browser. It is not a backup: keep your original files. If you import someone else's backup, you are responsible for that processing: you need their permission and a valid legal basis, especially because it contains health data.

TrueLift Coach, the previous tool for trainers, has been retired and its address now leads to TrueLift Escritorio. If you used it, the data you imported remains only in your browser's local storage until you clear the site's data.

4. Website privacy

The website is static and hosted on GitHub Pages. TrueLift uses no web analytics, advertising or tracking cookies. The language selector stores only the language preference in browser local storage; this technical storage is needed to remember the requested option and is not used to identify you or track your activity.

If you reach the site from an ad in ChatGPT, the page address includes a click identifier generated by OpenAI and campaign parameters. The site does not store it in cookies or any storage: it only adds it to the Google Play link (and the campaign, without the identifier, to the App Store link) so that, if you install the app and allow it inside the app, that ad can be measured as described in section 2.5.

GitHub may record technical connection data such as IP address, date, requested resource and user agent to host and protect the site under its Privacy Statement. If you use an email link, your address, message and any data you choose to include are processed to respond and provide support (Article 6(1)(b) or 6(1)(f) GDPR). They are retained for as long as needed to resolve the request and may subsequently be restricted for applicable statutory periods.

5. Recipients, transfers and security

Apart from actions you initiate and the providers described above, data is not sold or disclosed. App and website connections use HTTPS. Some providers are established or use infrastructure outside the European Economic Area; their policies and, where they act on behalf of the developer, their data processing agreements set out the applicable transfer mechanisms.

Protect your device with a screen lock, keep the operating system updated and store exported backups securely. No system can guarantee absolute security, but measures proportionate to the local and limited nature of the processing are applied.

6. Your rights

You can view, correct, export and delete in the app the information that exists only on your device. Since the developer does not hold it, they cannot deliver or remotely erase it. You can also clear the application storage or uninstall it, taking operating-system backups into account. The nutrition module data additionally has its own deletion control, described in section 2.7. The Strava connection is withdrawn from Settings → Sharing, and activities already posted are deleted on Strava, as set out in section 2.8.

To exercise access, rectification, erasure, objection, restriction or portability regarding purchase, support or other information that has been received, email rsoroesteban@gmail.com. Reasonable information may be requested to locate a purchase identifier and verify the request. Data retained by Google Play or the App Store must also be managed with those platforms under their policies.

You may withdraw consent at any time without affecting prior lawful processing. If you believe the processing breaches the law, you may lodge a complaint with the Spanish Data Protection Agency or your local supervisory authority.

7. Children

TrueLift is not directed at children under 14. Children below that age should use it only with the authorisation and supervision of a parent or legal guardian. Purchases are also subject to the family controls and terms of the relevant store. If the developer receives a child's data through support without valid authorisation, reasonable steps will be taken to erase it.

The nutrition module described in section 2.7 is restricted to people aged 18 or over. The notice that must be accepted before turning it on requires confirming that age, and it must not be used on behalf of a minor.

8. Legal notice and TrueLift PRO contracting

Owner: Rubén Soro Esteban · Tax identification number: 50750388Z · Business address: Avenida de la carrera 5 Portal 1 2ºA 28223 Pozuelo de Alarcón Madrid · rsoroesteban@gmail.com

• Intellectual property: the application, trade mark, logo, text, screenshots, manuals and proprietary content belong to the owner or are used under licence. Commercial exploitation is not authorised without permission, except for uses permitted by law.
• Commercial terms: available plans, duration, final price, taxes, renewal and applicable terms are displayed by Google Play or the App Store before purchase confirmation. Subscriptions can be managed or cancelled through the store or the options provided in the app. Cancellation prevents future renewals, without prejudice to paid access and mandatory consumer rights.
• Use of the application: recommendations are indicative and do not replace the judgement of a qualified trainer or healthcare professional. Users are responsible for adapting exercise to their ability, technique, environment and health.
• Liability: the owner is liable as required by applicable law. Nothing in these terms excludes or restricts non-waivable consumer rights or liabilities that cannot legally be excluded.
• External links and services: third-party websites and services are governed by their own terms and policies.

9. Changes and governing law

Changes will be published on this page with the updated date. If they introduce new processing requiring consent, consent will be requested before it applies. This policy and the terms are governed by Spanish and European law. Consumer disputes are subject to the courts designated by mandatory consumer-protection rules, including the consumer's place of residence where applicable.