Privacy Policy

Last Updated: August 19, 2026

Introduction

Welcome to Protokl (“we,” “our,” or “us”). We are committed to protecting your privacy and handling your personal data with transparency and care. This Privacy Policy explains how we collect, use, store, and protect your information when you use our fitness tracking application.

By using Protokl, you agree to the collection and use of information in accordance with this policy.

Information We Collect

1. Health and Fitness Data

  • Body Metrics: Weight, body fat percentage, lean body mass, height, BMI, waist circumference
  • Workout Data: Exercise types, sets, reps, weights, duration, calories burned
  • Nutrition Information: Meals logged, nutritional intake (calories, protein, carbohydrates, fat, fiber, sugar, sodium, water, caffeine, cholesterol, iron, calcium, potassium, vitamins A/C/D)
  • Sleep Data: Sleep duration, sleep stages (deep, REM, core, awake), time in bed
  • Progress Photos: Body transformation photos you choose to capture
  • Activity Data: Steps, flights climbed, active energy burned, basal energy burned, exercise time, stand time, walking/running distance, cycling distance, swimming distance
  • Cardiovascular Data: Heart rate, resting heart rate, heart rate variability, walking heart rate average, VO2 max, atrial fibrillation burden
  • Vitals: Blood pressure, respiratory rate, body temperature, blood oxygen saturation, blood glucose, peripheral perfusion index
  • Mobility Data: Walking steadiness, six-minute walk distance, walking speed, step length, walking asymmetry, double support percentage, stair ascent/descent speed
  • Cycling Data: Cadence, power, speed, functional threshold power
  • Audio Exposure: Environmental audio exposure, headphone audio exposure levels
  • Other: UV exposure, time in daylight, mindful minutes

2. Location Data

  • Cardio Tracking: GPS location data when you use location-based workout tracking features
  • Location Services: General location for weather-based workout recommendations (optional)

This location data is only collected when you explicitly enable location tracking for specific features.

3. Device and Usage Information

  • Device Information: Device type, operating system, app version
  • Usage Analytics: Features used, session duration, interaction patterns
  • Technical Data: Error logs, performance metrics, crash reports

4. Account Information

  • Profile Data: Name, age, sex, fitness goals, experience level, preferred pace
  • Preferences: Unit system, notification settings, app customization choices
  • Subscription Status: Whether you have an active subscription, managed by Apple's in-app purchase system

5. Camera and Photo Library

  • Progress Photos: Photos you take or select for tracking body transformation
  • Meal Photos: Photos of meals for nutrition tracking (optional)

Apple HealthKit Data

Protokl integrates with Apple HealthKit to read and write health and fitness data with your explicit permission. The following disclosures apply specifically to data accessed through HealthKit:

HealthKit Data Types We Access

With your permission, we read the following data types from HealthKit: step count, walking/running distance, cycling distance, swimming distance, flights climbed, active energy burned, basal energy burned, exercise time, stand time, heart rate, resting heart rate, heart rate variability, walking heart rate average, VO2 max, body mass, body fat percentage, lean body mass, BMI, height, waist circumference, blood pressure, respiratory rate, body temperature, blood oxygen saturation, blood glucose, sleep analysis, dietary intake, walking steadiness, walking speed, step length, cycling metrics, audio exposure levels, UV exposure, and time in daylight.

We write the following data types to HealthKit: step count, active energy burned, body mass, body fat percentage, lean body mass, and dietary intake (energy, protein, carbohydrates, fat, water).

No Advertising Use

Data obtained through HealthKit is NOT used for advertising or other use-based data mining purposes, either by us or any third party.

No Third-Party Sharing

We do NOT share HealthKit data with third parties. Data accessed through HealthKit is used solely to provide the health and fitness tracking features within Protokl.

No Selling of HealthKit Data

We do NOT sell any information obtained from HealthKit to advertising platforms, data brokers, information resellers, or any other third party.

No iCloud Storage of Health Data

Personal health information obtained from HealthKit is not stored in iCloud or any non-local cloud service. Health data is stored locally on your device using encrypted local storage.

How We Use Your Information

1. Core Fitness Tracking

  • Track your daily health metrics and progress
  • Log workouts, meals, sleep, and other protocol items
  • Display historical data and trends

2. Personalized Recommendations

  • Generate AI-powered meal recommendations based on your nutritional goals
  • Create customized workout plans tailored to your fitness level
  • Provide personalized fitness insights and suggestions

3. Progress Monitoring

  • Calculate body composition forecasts using proprietary algorithms grounded in published physiological research
  • Generate progress charts and analytics
  • Track achievement of your fitness goals

4. Health Data Integration

  • Sync data with Apple HealthKit to provide a unified view of your health information
  • Read and write health metrics to keep your data synchronized

5. App Improvement

  • Analyze usage patterns to improve features
  • Fix bugs and optimize performance
  • Develop new features based on user needs

Data Storage and Security

Local Storage

  • Your health, fitness, and personal data is stored locally on your device
  • This ensures your data remains private and accessible offline
  • Local data is encrypted on your device
  • Optional iCloud backup stores workout and profile data (not HealthKit data) in your personal iCloud account

Security Measures

  • Your data is held on your own device, protected by the operating system app sandbox and by device-level encryption
  • All traffic to our endpoint and to the service providers listed below uses HTTPS/TLS
  • Protokl has no account system, so there are no passwords or login credentials that could be exposed
  • We minimise what leaves the device: diagnostics carry no health or meal data, and analytics use an anonymous identifier

Third-Party Services

We integrate with the following third-party services:

  • Apple HealthKit / Android Health Connect: To read and write health and fitness data with your explicit permission. This data stays on your device and is never transmitted to us or any third party.
  • RevenueCat: To manage subscription status. RevenueCat receives an anonymous app user ID and subscription transaction data. It does not receive your health data.
  • Sentry: For anonymous crash and error diagnostics that help us fix bugs. No personal or health data is sent.
  • PostHog: For anonymous, aggregate product analytics (for example, how far people get through onboarding), tied only to a random per-install identifier. No personal or health data is sent.
  • Google (Gemini AI): When you choose to scan a meal, the photo is sent to Google for nutrition analysis. We do not store these photos.
  • USDA FoodData Central & Open Food Facts: For food and barcode nutrition lookups. Only the food name or barcode you search is sent; no personal data.

No Third-Party Sharing for Marketing

We do NOT sell your personal data to third parties, share your health data with advertisers, use your information for targeted advertising, or provide your data to data brokers.

Subscription Data

Payment processing for subscriptions is handled entirely by Apple through the App Store. We do not collect, store, or have access to your payment method details.

We receive and store only your subscription status (active, expired, trial) via RevenueCat to manage access to premium features. If you cancel your subscription, your data remains on your device and accessible in the free tier of the app.

Your Rights and Choices

  • Access: View all data we have collected about you
  • Correction: Update your profile information at any time
  • Deletion: Delete specific data entries in the app, erase everything stored on your device at any time via Profile > Delete All My Data, or remove all local data by uninstalling the app
  • Consent: Control which permissions the app has and revoke them at any time through your device Settings
  • HealthKit Permissions: Enable or disable individual HealthKit data types at any time via Settings > Health > Data Access & Devices > Protokl

Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the rights described below. As a practical matter we honour these requests regardless of where you live.

We collect the following categories of personal information:

  • Identifiers: an anonymous, randomly generated install identifier. Any name you enter is stored on your device and is never transmitted to us. Protokl has no account sign-up, so we collect no email addresses or credentials.
  • Health and fitness information: the body metrics, workout, nutrition and sleep data described above. Under the CPRA this is sensitive personal information.
  • Commercial information: your subscription status (trial, active, or expired).
  • App activity: which features you use, plus crash and error diagnostics.
  • Visual information: progress photos and meal photos. These stay on your device, apart from meal photos you explicitly submit for AI analysis.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done so. We also do not use or disclose sensitive personal information for any purpose beyond providing the app itself, so the right to limit its use does not restrict anything we currently do.

You have the right to:

  • Know: request the categories and specific pieces of personal information we hold about you
  • Delete: request deletion. You can do this yourself, immediately, via Profile > Delete All My Data
  • Correct: request correction of inaccurate information. Profile data is directly editable in the app
  • Portability: receive your data in a portable format, available as a CSV export in the app
  • Opt out of sale or sharing: not applicable, because we do neither
  • Non-discrimination: we will never deny you service, charge a different price, or give you a lower quality experience for exercising any of these rights

To make a request, email protoklapp@gmail.com. Because we do not hold accounts, we verify requests using information that matches the install in question. An authorised agent may submit a request on your behalf with your written permission.

Your UK and EU Rights (GDPR)

If you are in the United Kingdom, the European Union, or the wider European Economic Area, the rights below apply to you. Ryan Luther is the data controller, as set out under Data Controller.

We rely on these legal bases for processing:

  • Explicit consent (Article 9(2)(a)) for health and fitness data, which is a special category of personal data. You give it by choosing to enter health data or to connect Apple Health or Health Connect, and you can withdraw it at any time by revoking those permissions or deleting your data in the app.
  • Performance of a contract (Article 6(1)(b)) to provide the app and to manage your subscription.
  • Legitimate interests (Article 6(1)(f)) for crash diagnostics, security, and aggregate product analytics that keep the app working and guide improvements. These use anonymous identifiers, and you may object at any time.

You have the right to:

  • access the personal data we hold about you
  • have inaccurate data corrected
  • have your data erased, which you can do yourself via Profile > Delete All My Data
  • restrict or object to processing, including anything based on legitimate interests
  • receive your data in a portable, machine-readable format, available as a CSV export in the app
  • withdraw consent at any time, without affecting processing carried out before you withdrew it

We do not carry out automated decision-making that produces legal effects or similarly significantly affects you. The training and nutrition targets the app generates are recommendations, which you are free to change or ignore.

If you think we have handled your data improperly, you can complain to your local supervisory authority. In the UK that is the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put things right first.

Data Retention

  • Active Use: Data is retained locally on your device as long as the app is installed
  • App Deletion: Deleting the app removes all locally stored data from your device
  • Data Export: You may export your data to a CSV file at any time from Profile > Export Data, without contacting us
  • Subscription Cancellation: Your data is preserved on your device regardless of subscription status

International Data Transfers

Protokl is operated from Canada. Most of your data never leaves your device, but the limited categories described above are handled by service providers located in the United States:

  • Google (Gemini API): meal photos you submit for AI analysis
  • Sentry: crash and error diagnostics
  • PostHog: anonymous product analytics, hosted in the US region
  • RevenueCat: subscription status
  • Vercel: hosting for this website and for the meal-analysis endpoint

If you are in the UK or the EEA, this means data is transferred outside your home jurisdiction. Canada is recognised by the European Commission as providing an adequate level of protection for personal data handled by commercial organisations. For onward transfers to the United States we rely on the safeguards our providers maintain, which include Standard Contractual Clauses and, where applicable, certification under the EU-US Data Privacy Framework.

Cookies and Similar Technologies

The Protokl mobile app does not use cookies. It stores your data on the device and sends analytics events directly, with no browser storage and no cross-site tracking technology.

The protokl.app website does not set cookies either. It uses two analytics tools, both configured so that nothing is stored on your device:

  • PostHog analytics: counts page views and clicks on our App Store links. It runs in memory only, so it writes no cookie and no browser storage, and it cannot recognise you when you return.
  • Vercel Web Analytics: measures site traffic without setting any cookies.

We use no advertising cookies, no cross-site trackers, and no third-party marketing pixels. Because we store nothing on your device, there is no cookie banner to accept and nothing for you to opt out of.

Children's Privacy

Protokl is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

Health Disclaimer

Protokl is a fitness tracking tool and is NOT a medical device or medical service. The app does not provide medical advice, diagnosis, or treatment. Always consult with a qualified healthcare provider before starting any fitness program.

Data Controller

Ryan Luther is the data controller responsible for your personal data collected through Protokl. For any privacy-related inquiries, data access requests, or concerns about how your data is handled, please contact us using the information below.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy in the app and updating the “Last Updated” date.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

By using Protokl, you acknowledge that you have read and understood this Privacy Policy.