LEGAL / ATHENOS

Privacy Policy

Last updated: 3 October 2026

This Privacy Notice explains how ATHENOS processes personal information when you use the workout app, create an account, purchase a subscription, view advertisements, or contact support.

Contents

1. Who is responsible for your information?

The data controller is:

Mapp CVR: 45 62 05 81

Email: athenos@athenos.app

You can contact us with questions about this notice or to exercise your privacy rights.

2. Information we process

Account information

When you create or use an account, we process information such as:

  • Your first name, last name, email address, and account identifier.
  • Your birth year and confirmation that you meet the minimum age requirement.
  • Your consent to the processing of health data, the version of the consent text, and when you gave it.
  • Authentication information necessary to sign you in and secure your account.

Passwords are handled by our authentication service. They are not included in support messages or provided to advertising services.

Workout and profile information

Depending on the features you use and the information you enter, the app processes:

  • Height, body weight, and weight history.
  • Workout programs, plans, and preferences.
  • Exercises, sets, repetitions, weights, and workout history.
  • Exercise notes, personal records, and reminder settings.

Body weight and workout information are personal information and, depending on their content and use, may reveal information about your health.

The age check uses your date of birth on your device; only your birth year is saved with your account.

Device calendar

If you turn on calendar reminders, the app lists the calendars on your device so you can choose one, and adds, updates, and removes its own training events in that calendar. It does not read your other calendar events, and calendar information is not sent to ATHENOS servers. If the calendar you choose is synchronised by its provider, such as Google, that provider synchronises the events.

Data exports

If you export your workout data, the app creates the file on your device and saves it where you choose. Temporary copies inside the app are deleted after seven days. ATHENOS does not upload exported files.

Support messages

When you contact us through the app, we process your first name, last name, email address, message, and any information you choose to include. Messages also include technical information such as the app version, operating system, and platform to help us investigate problems.

Subscription information

When you purchase or restore a subscription, the app and RevenueCat process subscription status, purchase identifiers, and information needed to determine whether you have access to paid features.

Payments are processed by the app store through which you purchase. ATHENOS does not receive or store your full payment-card number or security code.

Technical and advertising information

Our hosting and authentication services may process IP addresses, request logs, device identifiers used for account synchronisation, and other information needed to operate and secure the service.

Where advertisements are enabled, Google AdMob and its advertising partners may process:

  • IP addresses, which may indicate approximate location.
  • Advertising and other device identifiers.
  • Interactions with advertisements.
  • Diagnostic and performance information.

The information processed depends on your device, consent choices, and the advertising configuration.

3. Local storage and account synchronisation

An account is required to use ATHENOS. Workout information is stored locally on your device, and supported account data is synchronised with our servers when a connection is available.

When you sign in, account information and supported workout data are stored on our servers and synchronised with your account.

If your device contains workout data created before an account was required, that data may become part of an empty account when you first sign in. If the account already contains data, the earlier local data remains separate.

Signing out does not automatically delete workout data stored on your phone. This allows you to return to the account without losing changes that have not yet synchronised.

If device backup is turned on, Android may include the app’s locally stored data in your device backup with your backup provider, such as Google. Your sign-in session is excluded from that backup.

4. Why we use your information

We use personal information to:

  • Provide workout tracking, calculations, programs, and reminders.
  • Create, authenticate, and secure accounts.
  • Synchronise and restore account data.
  • Check eligibility for our adult-only service.
  • Manage subscription access.
  • Send account-related emails, including password-reset and email-change messages.
  • Respond to support requests.
  • Provide advertisements in the free version, subject to your choices and applicable law.
  • Produce statistics about age groups and account activity using birth year and whether an account has been active during the previous 30 days. We also use information to prevent abuse, investigate errors, and comply with legal obligations.

We do not use your body weight, workout history, exercise notes, or birth year to personalise advertisements, and we do not provide those fields to AdMob.

5. Legal grounds for processing

Where the GDPR or similar laws apply, we rely on the following grounds:

  • Performance of a contract: to provide the account, workout, synchronisation, and subscription features you request.
  • Legitimate interests: to maintain service security, prevent abuse, handle support requests, and understand use of the service through age-group and recent-activity statistics, where these interests do not override your rights.
  • Consent: for processing health data (see below), for personalised advertising, and for access to device storage or identifiers where consent is required.
  • Legal obligations: where we must retain or disclose information to comply with applicable law.

Where information qualifies as health data or another special category of personal data, an additional legal condition is required.

ATHENOS treats your body weight, height, and workout information as health data. We process it on the basis of your explicit consent, which you give when you create your account. An account cannot be created without this consent.

You can withdraw your consent at any time by deleting your account under Profile → My Profile → Delete account. Your account and its data are then deleted.

6. Advertisements and your choices

The free version may display advertisements provided by Google AdMob.

Where required, we ask for your consent before processing information for personalised advertising or using device storage and identifiers for purposes requiring consent.

You can review or change your advertising choices through Profile → Ad choices, where available. You can also manage your advertising identifier through your device settings.

Declining personalised advertising does not prevent you from using the workout features. Depending on your choices and applicable requirements, the app may show non-personalised or limited advertisements, or no advertisement.

Non-personalised advertising may still involve technical data processing; it does not necessarily mean that no information is collected.

For more information, see Google’s Privacy Policy and how Google uses information from apps that use its services.

7. Who receives your information?

We use service providers to operate ATHENOS:

  • Supabase: account authentication, server storage, and synchronisation.
  • SMTP2GO: delivery of account and support emails.
  • RevenueCat: subscription verification and management.
  • Google Play or another applicable app store: purchase and payment processing.
  • Google AdMob and the advertising partners listed in the consent interface: advertising and related technical processing.

Providers receive information necessary for their services. Advertising providers do not receive your workout records or body weight from ATHENOS.

We may also disclose information where required by law or necessary to establish, exercise, or defend legal claims.

Advertising disclosures may be considered “sharing” or similar regulated activity under some privacy laws. Any applicable opt-out choices must be respected.

8. International transfers

Our primary account database is hosted in the EU Central region in Frankfurt, Germany.

Some service providers may process information outside your country, including outside the European Economic Area or the United Kingdom.

More information about how these providers process personal information and protect international transfers is available in the privacy policies of Supabase, SMTP2GO, RevenueCat, Google (including Google AdMob and Google Play) and Apple.

9. How long we keep information

Locally stored workout data remains on your device until you remove it or it is otherwise deleted from the device.

Account information and synchronised workout data are retained while your account is active, unless you delete individual records or request account deletion.

Other retention periods are:

  • Support messages: 12 months.
  • Security and operational logs: 12 months.
  • Server backups after deletion: 12 months.
  • Purchase and legally required records: for the period required by applicable law or necessary to resolve purchase disputes.
  • Copies of a change that was replaced by a later change from another device, kept so the earlier version can be recovered: 30 days.
  • Deletion notices, which contain a one-way fingerprint of a device’s synchronisation key and the time of deletion so that your other devices can learn that the account was deleted: 400 days.

Information retained after account deletion is limited to what is necessary for these purposes.

When a retention period ends, the information is deleted by a daily cleanup on our servers.

10. Deleting your account or local data

You can delete your account in the app under Profile → My Profile → Delete account.

Account deletion removes your account and associated data from the active service. Local account data is removed when a device receives confirmation of the deletion. A device that is offline may retain a local copy until it reconnects or you remove the data manually.

When you are signed out, Accounts on this phone → Remove data from this phone on the welcome screen removes the selected account’s local data without requiring a server connection.

Removing local data does not itself delete the server account. Signing out and uninstalling the app also do not themselves delete the server account.

Account deletion does not necessarily cancel an app-store subscription. Manage or cancel subscriptions through the store where you purchased them.

11. Security

We use technical and organisational measures intended to protect personal information, including encrypted network connections, account access controls, and secure storage of session credentials.

No system can guarantee absolute security. You should protect your device and avoid sharing account credentials.

12. Age requirement

ATHENOS is intended for adults aged 18 and over.

We check your full date of birth on your device to determine whether you meet the minimum age requirement. Only your birth year is saved with your account. The service is not intended for children, and parental permission does not override this requirement.

If you believe a child has provided personal information to ATHENOS, please contact athenos@athenos.app.

13. Your privacy rights

Depending on applicable law, you may have the right to:

  • Access your personal information and obtain a copy.
  • Correct inaccurate information.
  • Request deletion.
  • Restrict certain processing.
  • Object to processing based on legitimate interests.
  • Receive eligible information in a portable format.
  • Withdraw consent at any time.

Withdrawing consent does not affect processing that was lawful before withdrawal.

Contact athenos@athenos.app to exercise your rights. We may need to verify your identity before responding.

You may also complain to your local data protection authority. In Denmark, this is Datatilsynet.

14. Changes to this notice

We may update this notice when our features, providers, or data practices change. The date at the top identifies the latest revision.

Where required, we will notify you of significant changes and request consent for new processing that requires it.

15. Contact

For privacy questions, requests, or concerns:

athenos@athenos.app