Privacy Policy

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is Yannik Muth, Leo-Leistikow-Allee 4, 22081 Hamburg, Germany. Email: [email protected]. More details are in the imprint.

This policy covers the Tarvo app on iPhone and Apple Watch and the website tarvo.app.

2. What the app stores

Tarvo stores your workouts, plans, custom exercises and settings in a database on your iPhone and Apple Watch. There is no account, and Tarvo has no server of its own. We don’t receive this data and can’t see it.

You delete it by deleting Tarvo from your devices. You delete the copy in iCloud in your iPhone’s iCloud settings, under the storage used by Tarvo.

3. iCloud and Apple Watch

If you are signed in to iCloud, Tarvo backs up your data in your private iCloud database (Apple CloudKit) and syncs it between your devices. We have no access to this database. The provider is Apple, and Apple’s Privacy Policy applies. Without iCloud, your data stays on your devices only.

Apple Watch gets its workout directly from your iPhone and reports your sets directly back, without any server of ours.

4. Apple Health

Tarvo uses Apple Health only if you allow it. You can change this permission at any time in the Health app, under your profile, in the apps section.

• Writing: Tarvo saves each finished session as a workout (strength training) in Health. If you train with Apple Watch, the watch also records heart rate and calories.
• Reading: Tarvo reads your heart rate during a session and shows it on Apple Watch. Tarvo doesn’t store it in its own database.
• We never use data from Health for advertising or marketing, never share it with third parties and never transfer it to us. Tarvo doesn’t put any data from Health into iCloud.
• Where health data is processed on your device, your permission is the legal basis (Article 6(1)(a) and Article 9(2)(a) GDPR). You can withdraw it at any time with effect for the future.

5. Subscription and purchases through Apple

You buy the subscription with your Apple Account in the App Store. Apple handles payment and billing; only Apple sees your payment details. Tarvo checks on your device, through Apple, whether a subscription is active. In App Store Connect we only see aggregated sales figures, no names, email addresses or payment details.

Apple’s Privacy Policy applies to purchases.

6. Crash reports from Apple

If you have agreed in iOS to share analytics with app developers, Apple provides us with crash reports and aggregated usage figures for Tarvo. We use them only to find bugs and improve Tarvo. The legal basis is our legitimate interest in an app that works (Article 6(1)(f) GDPR).

You can turn this off at any time in your iPhone’s settings under “Privacy & Security”, in “Analytics & Improvements”.

7. Notifications and Live Activity

Notifications, such as at the end of a rest or two days before the free trial ends, and the Live Activity during a session are created by Tarvo on your iPhone. We don’t run a server for push notifications.

8. Sharing

Tarvo shares only when you start it, and only the image you see.

• Instagram Story: Tarvo puts the image on the clipboard and opens Instagram. In doing so, Tarvo gives Instagram Tarvo’s app ID at Meta. Tarvo itself sends nothing to Meta and contains no Facebook SDK. Inside Instagram, Meta’s Privacy Policy applies.
• Messages and other apps: the image goes to the app you choose. That app’s privacy policy applies there.
• Photos: Tarvo saves the image to your photos if you allow it. Tarvo can’t read your photos.

9. Import and export

Tarvo reads CSV files from Hevy or Strong on your device. Tarvo also creates the CSV or JSON export on your device; you decide where the file goes. We receive nothing.

10. What Tarvo doesn’t do

• No ads and no tracking. That’s why Tarvo doesn’t ask for permission to track you (App Tracking Transparency).
• No analytics SDKs and no services that send data to third parties. The only third-party library is GRDB for the database on your device; it sends nothing.
• No AI, and no selling or sharing of data.

11. This website

The website is fully static and hosted on Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open a page, Cloudflare processes your IP address and request details, such as the address requested, time, and browser and device details, to deliver the pages and protect them against attacks. Cloudflare counts requests only in aggregate, without a script on the page and without a profile.

The legal basis is our legitimate interest in a secure and fast website (Article 6(1)(f) GDPR). We have a data processing agreement with Cloudflare.

The website sets no cookies, doesn’t use your browser’s local storage (localStorage, sessionStorage) and contains no analytics, no tracking and no ads. It serves its font and scripts itself and loads nothing from other servers.

12. Launch notice

If you sign up under “Notify me at launch”, we send you exactly one email when Tarvo comes out. First you confirm your address through a link in an email (double opt-in). There is no newsletter, and we don’t share your address.

We store:

• your email address and the language of the page (German or English),
• when you signed up and confirmed, and when and how often we sent you the confirmation email,
• the version of the text you agreed to,
• a confirmation code, stored only as a hash.

13. Legal basis, storage and deletion for the launch notice

The legal basis is your consent (Article 6(1)(a) GDPR). The times serve as proof of consent (Article 7(1) GDPR). You can withdraw it at any time through the “Delete address now” link in the confirmation email or by emailing [email protected]. Withdrawal applies for the future.

The data is stored in a Cloudflare database (D1) located in the European Union. Cloudflare Email Sending sends the confirmation email and the launch email from [email protected].

When you sign up, Cloudflare briefly processes your IP address to slow down abuse. The counter for this expires after about a minute; we don’t store the IP address in our database. The legal basis is our legitimate interest in protecting the form against abuse (Article 6(1)(f) GDPR).

We delete your address:

• after 7 days if you haven’t confirmed it,
• right after sending the launch email,
• at the latest 12 months after you confirmed it, even if Tarvo hasn’t come out by then.

14. When you email us

If you email us, we process your address, the content, the time and the details we need to reply. The legal basis is Article 6(1)(b) GDPR if it concerns your subscription or your use of Tarvo, otherwise our legitimate interest in answering requests (Article 6(1)(f) GDPR). We delete emails once they are dealt with and no legal retention duty applies.

Our mailbox is hosted by Fastmail Pty Ltd, Australia. Fastmail stores email on servers in the United States or the Netherlands; backups and logs are in the United States. We have a data processing agreement with Fastmail.

15. Transfers outside the EU

Cloudflare and Fastmail may also process data outside the European Union.

• Cloudflare, Inc. is certified under the EU-US Data Privacy Framework. Transfers to the United States rely on the European Commission’s adequacy decision (Article 45 GDPR) and otherwise on the EU Standard Contractual Clauses (Article 46(2)(c) GDPR). More in Cloudflare’s Privacy Policy.
• For Fastmail (Australia and the United States), the EU Standard Contractual Clauses are the basis (Article 46(2)(c) GDPR). More in Fastmail’s Privacy Policy.

16. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You can withdraw consent at any time with effect for the future (Article 7(3)). Write to [email protected].

Where we process data based on our legitimate interest, you can object at any time on grounds relating to your particular situation (Article 21 GDPR).

We don’t have data that is only on your devices and in your iCloud. You export it yourself in Tarvo and delete it as described under “What the app stores”.

You can complain to a data protection authority, for example in your country or the one responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.

17. Obligation to provide data and automated decisions

You don’t have to give us any data. Without an email address, we just can’t notify you at launch. We make no automated decisions within the meaning of Article 22 GDPR.

18. Changes

If Tarvo, this website or the law changes, we update this policy. The version with the date at the top of this page applies.