PumpSheet is made by Vance Solutions, a Dutch sole proprietorship (eenmanszaak), KvK 89223497, Klein Duimpje 7, 5629 LD Eindhoven, the Netherlands. Vance Solutions is the controller of your personal data under the GDPR. This policy covers the PumpSheet app (the App) and www.pumpsheet.app (the Website). Questions: hello@pumpsheet.app.
We collect what the App needs to work, plus analytics and crash reports that you control in the App’s privacy settings:
| Data | Why we use it | Legal basis |
|---|---|---|
| Account and profile: your email address, your name (which you enter, or Apple or Google provides), an optional profile photo, and your settings and units | Run your account and set up the App | Contract (Art. 6(1)(b)) |
| Training and body data: your workouts, what you import, your setup answers (why you train, your goal, experience, weekly goal, muscle groups, gender and birth date), and optionally your height and body weight | Keep your log, calculate statistics, Insights and suggested weights, fit workouts to you, show the matching body figure, confirm you’re 16 or older, and sync your devices | Contract (Art. 6(1)(b)) and explicit consent (Art. 9(2)(a)) |
| What you send to Coach | Answer your questions and generate workouts | Contract (Art. 6(1)(b)) and explicit consent (Art. 9(2)(a)) |
| Purchase data from Apple or Google, never card details | Give you Pro and keep exact revenue figures | Contract (Art. 6(1)(b)); legitimate interest for revenue figures (Art. 6(1)(f)) |
| Where you heard of PumpSheet (optional) | Understand how people find PumpSheet | Legitimate interest (Art. 6(1)(f)) |
| Analytics, only if you say yes: the screens and features you use and device details (device model, operating system, app version and screen size), linked to your account ID, and an approximate location derived from your IP address (country, region, city, approximate postal code and coordinates). Never what you log, your name or your email; the IP address itself isn’t stored | Understand how the App is used and improve it | Consent (Art. 6(1)(a)) |
| Crash reports: the error, recent screens, the App’s requests to our servers and device details (device model, operating system, app version and screen size), linked to your account ID. Never what you log; the IP address isn’t stored | Find and fix bugs | Legitimate interest (Art. 6(1)(f)) |
| Security and support: sign-in logs (the email address, name and IP address of each sign-in), server logs and your messages to us | Keep accounts and the Services secure, and answer you | Legitimate interest (Art. 6(1)(f)) |
You need an account to use the App, and it keeps a copy of your data on your device so it works offline.
A training log can reveal information about your health, so we treat your training and body data as health data under Article 9 GDPR. We process it only with your explicit consent, which the App asks for on its own screen right after you create your account, or after you sign in if there’s none on record; until then, your setup answers stay on your phone. The App can’t keep your log without this consent, so withdrawing it means deleting your account.
Coach asks for its own explicit consent before you use it, because it sends data to OpenAI. Analytics start only if you say yes when you first open the App. You can switch Coach, analytics and crash reports off at any time in the App’s privacy settings, and withdrawing a consent doesn’t affect processing that happened before.
Insights, such as how each lift is going, come from fixed rules applied to your own data. No AI is involved.
Coach, our AI feature, answers your questions and generates workouts using OpenAI. When you use Coach, we send OpenAI your question and the parts of your workouts and body measurements the answer needs. We never send your name, email address or account ID, and your messages pass OpenAI’s moderation check. OpenAI doesn’t train its models on this data. It keeps request data for up to 30 days and stores Coach’s replies until you delete the chat or your account or switch Coach off, when we delete them there too.
Insights, suggested weights, Coach replies and generated workouts are information for you, with no legal or similarly significant effect on you.
We don’t sell your data or share it for advertising. We use service providers for hosting and storage, syncing, Coach’s AI, subscriptions, analytics, crash reporting, email and our website. They process your data only on our instructions, under agreements that require them to protect it at least as well as this policy describes. Our current providers, and where they process data, are listed at https://www.pumpsheet.app/providers.
Some providers process data outside the European Economic Area, mainly in the United States. For those transfers we rely on an adequacy decision, such as the EU-U.S. Data Privacy Framework, or on the European Commission’s standard contractual clauses; ask us for a copy.
Apple and Google distribute the App, take payments and provide sign-in as independent controllers under their own privacy policies; we never receive your card details. We also disclose data when the law requires it. If PumpSheet moves to another company, for example when we incorporate, we’ll tell you in advance, and the new company will ask for your health-data consents again.
| Data | How long we keep it |
|---|---|
| Your account, profile, workouts, body data and Coach chats | Until you delete them or your account |
| Backups | 7 days |
| Coach data at OpenAI | Request data up to 30 days; stored replies until you delete the chat or your account, or switch Coach off |
| Sign-in logs | 1 year, also after you delete your account, to keep accounts secure |
| Purchase records | Up to 7 years, also after you delete your account, under a random account ID without your name or email, so our revenue figures stay exact |
| Analytics | Up to 7 years, also after you switch analytics off or delete your account, under a random account ID without your name or email. We erase them sooner if you ask |
| Crash reports and server logs | As long as needed, at most 2 years |
| Support emails | As long as needed, at most 5 years |
When you delete your account in the App, we email you a code to confirm. We then immediately delete your account, profile, workouts, body data, profile photo, Coach chats and the replies stored at OpenAI; backups expire within 7 days. Deleting your account doesn’t cancel a subscription: cancel Pro in your Apple or Google account settings.
You can ask us to access, correct, erase, restrict or export your data, and withdraw any consent at any time. In the App you can edit your data, export your logged workouts as a CSV file, change your privacy choices and delete your account.
For anything else, email hello@pumpsheet.app: for example, for a copy of your body measurements, profile or Coach chats, to have your analytics erased, or to delete your account without the App, as explained at https://www.pumpsheet.app/delete-account. We’ll confirm the request through your account’s email address and reply within one month.
Right to object. Where we rely on legitimate interest (see the table above), you can object at any time on grounds relating to your situation. We’ll stop unless we have compelling legitimate grounds or need the data for legal claims. You can switch crash reports off yourself in the App’s privacy settings.
You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority where you live.
Our website doesn’t use tracking cookies; we count visits and measure page speed with tools that don’t build a profile of you, based on our legitimate interest. If you join the waitlist, we use your email address only to tell you about the launch, with your consent. Our emails don’t track opens or clicks, and you can unsubscribe at any time.
PumpSheet is for people aged 16 and over. Setup asks for your birth date and stops anyone younger, and if we learn we hold data of someone under 16, we delete it.
We encrypt your data in transit and at rest and limit each account to its own data. If a breach puts you at high risk, we’ll tell you without undue delay.
We’ll tell you about significant changes to this policy in the App or by email before they take effect, and if a change affects something you agreed to, we’ll ask for your consent again. The date at the top shows the current version.
Vance Solutions · Klein Duimpje 7, 5629 LD Eindhoven, the Netherlands · KvK 89223497 · hello@pumpsheet.app