Privacy policy

Last updated: October 28, 2026

This is a translation for your convenience. The legally binding version is the German Datenschutzerklärung.

This privacy policy applies to the Frame app (iOS and Android) and to our websites framegym.app and Frame Help (docs.framegym.app). We show no ads and sell no data. Usage analytics in the app are switched on by default and can be switched off at any time in the settings (section 2.14), and so can crash reports (section 2.15). On our websites we use no analytics or tracking tools.

1. Controller

Hamid Reza Mashouf – App-Entwicklung
Tulpenstr. 81
41466 Neuss
Germany

Email: support@framegym.app

We have not appointed a data protection officer because we are not legally required to. For privacy questions, write to the address above.

2. The Frame app

2.1 Sign-up and sign-in

Frame can only be used with an account. You sign in exclusively with Sign in with Apple or Sign in with Google. We do not store a password.

  • Apple: Apple sends us a user ID, your email address (or, if you choose "Hide My Email", a relay address created by Apple) and, the first time you sign in, your name. Provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.
  • Google: Google sends us a user ID, your email address, your name and the address of your Google profile picture. The app shows this picture on the home screen and loads it directly from Google's servers, so Google receives your IP address and device information. We do not store the picture on our servers; only its address is part of the sign-in data in your account. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Users who sign in with Apple do not get a profile picture.

The privacy policies of Apple and Google also apply to the sign-in itself. We store your sign-in session encrypted in your device's protected storage (iOS Keychain or Android Keystore).

Legal basis: Art. 6(1)(b) GDPR (contract for using the app).

2.2 Questions on first launch

On first launch Frame asks, among other things, how you heard about Frame (with free text for "Other"), your preferred units, your training goal, how often you want to train per week, whether you want to connect Apple Health, your gender, your date of birth, your body weight and how you want to create your plan.

You can skip every question. Until you create your account, the answers stay on your device only. After that we store them in your account. We use them to set up the app for you. We also use how you heard about Frame to understand how people find Frame.

Legal basis: Art. 6(1)(b) GDPR. For how you heard about Frame: Art. 6(1)(f) GDPR (our legitimate interest in understanding our reach). For body weight, see section 2.4.

2.3 Training data

For Frame to work, we store the data you create in the app:

  • your training plans, training days, blocks and exercises including targets (sets, reps, rest)
  • your own exercises and your exercise settings
  • your workouts with start, end, exercises, weight, reps, duration, distance and your workout note
  • your app settings, for example units and default rest time

Frame uses this data to calculate your statistics, records and progress, solely to show these to you. There is no automated decision-making within the meaning of Art. 22 GDPR.

You can write freely in workout notes. Please keep in mind that you may include information about your health there, for example about pain. Such information is voluntary.

Legal basis: Art. 6(1)(b) GDPR.

2.4 Body data (health data)

If you enter them, we store body weight, height, body fat percentage and the circumference of waist, chest, upper arm and thigh, each with a date. This is health data and therefore specially protected.

We only process it with your explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR), and only to show and analyse it for you in the app. Only in individual cases, when you ask us for help or there is a suspicion of abuse, we can view this information in our internal admin tool (see section 2.13). This is covered by your consent. Providing it is voluntary, Frame works without it. You can withdraw your consent at any time with effect for the future by deleting the entries in the app or by writing to us. This does not affect the lawfulness of processing before the withdrawal.

2.5 Apple Health (iPhone only)

If you turn on the Apple Health connection and allow access in iOS:

  • Frame saves every finished workout to Apple Health (workout type, start, end and active energy),
  • Frame saves the body weight you enter in Frame to Apple Health,
  • Frame reads your body weight from Apple Health and adds it to your measures in Frame.

We store weights imported from Apple Health with a technical ID so the same value does not appear twice. We use data from Apple Health solely to show it to you in Frame. We do not share it with third parties and do not use it for advertising.

Legal basis: your explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR). You can revoke access at any time in the iPhone Settings app under Apps → Health → Data Access & Devices → Frame, or turn off syncing in Frame's settings.

2.6 Storage on your device

Frame stores some information only locally on your device: your language, your appearance (light/dark), your answers from section 2.2 until your account is created, the state of the Apple Health sync, your sign-in session and, if you signed in with Google, your Google profile picture in the app's cache (until the operating system clears it or you delete the app). This is strictly necessary for the features you request (Section 25(2) no. 2 TDDDG).

2.7 App updates

On launch, Frame checks whether a bug fix or small update is available and downloads it if so. For this we use EAS Update by 650 Industries, Inc. (Expo), USA. Your IP address, operating system, app version and the ID of the installed update are transmitted. No data from your Frame account is transferred.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in fixing bugs quickly and securely). For the transfer to the USA, see section 5.

2.8 Links to YouTube and TikTok

On an exercise page you can search for videos on YouTube or TikTok. Only when you tap one does the respective app or website open, with the exercise name as the search term. From then on the privacy policies of YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or TikTok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland) apply. Frame does not transfer any data from your account.

2.9 App stores

Apple (App Store) and Google (Google Play) handle the download of Frame under their own responsibility, and their privacy policies apply. From the app stores we only receive aggregated statistics that do not identify you personally.

2.10 Subscription

After a free trial, Frame can only be used with a subscription. Apple (App Store) or Google (Google Play) handles purchase and payment. We do not receive your payment details. To manage subscriptions we use RevenueCat (RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA). This processes your Frame user ID, purchase receipts from the app stores, and subscription status, term and price. In our database we store the status of your subscription per account (product, end of term, store, whether it is a trial) to check access to the app. If you have a subscription moved to another Frame account (for example through "Restore purchases"), the status of both accounts changes accordingly.

The legal basis is Art. 6(1)(b) GDPR. For the transfer to the USA see section 5.

2.11 Reminders and notifications

If you allow notifications on iOS or Android, Frame sends you reminders, for example when your weekly streak is at risk, when it has ended, or when you have not trained for a while. For this we store a push token per device, your time zone and your language, and a log of which reminder we sent you and when, so you do not get one twice. You choose whether reminders come and which ones in the Frame settings under Notifications. Delivery is handled by the Expo Push service (650 Industries, Inc., see section 2.7) together with the push service of Apple (APNs) or Google (FCM). The push token and the text of the notification are transmitted.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time in your device settings.

2.12 News in the app

Frame can show you news and notices about the app in a window. We store which messages you have already seen so they do not appear again. The legal basis is Art. 6(1)(b) GDPR.

2.13 Support, suspensions and administration

When you need support, we can look at your account data for it, for example your user ID, email address, the status of your subscription and the settings relevant to your request. This happens through an internal admin tool that only we can access. There we can also grant or end subscription access and suspend accounts for breaches of the terms. For such actions we store who did them, when and why, and for suspensions the reason and duration. You can see the reason for a suspension in the app.

The legal basis is Art. 6(1)(b) GDPR (support, contract) or Art. 6(1)(f) GDPR (our legitimate interest in preventing abuse and keeping actions traceable). We delete these entries with your account, unless legal obligations or the enforcement of claims prevent it.

2.14 Usage analytics (PostHog, can be switched off)

To improve Frame, we want to understand which features are used and where the app has problems. For this we use the analytics service PostHog (PostHog Inc., USA) in its EU cloud, with servers in Frankfurt am Main. The analysis is switched on by default. You can switch it off at any time in the Frame settings under Account → "Usage statistics". After that no analytics data is collected, and Frame works the same.

As long as the analysis is switched on, we process:

  • which screens and features you use, for example "workout started" or "plan created",
  • the app version, operating system, device type and the language you set,
  • after login the random number of your Frame account, so that we can connect your use across several starts and devices; before that a random number that is held in memory only and disappears when the app closes,
  • no location analysis: the IP address with which the data arrives at PostHog is discarded there and not stored,
  • your answers from the first-launch questions, as far as they are not body data: how you heard about Frame (without free text), your training goal, your preferred units, how often per week you want to train and how you wanted to create your plan,
  • at which step of the first-launch questions you left, whether you signed in with Apple or Google, and whether a subscription purchase was started, completed or cancelled (no payment details),
  • how many exercises and sets a workout had (not which weights or repetitions), which settings you change (for example units, language or appearance) and that you entered a body measurement (not which value).

We do not transmit the content of your workouts, your body data, notes, free-text answers, names or your email address. For the analysis Frame stores no identifier of its own on your device; the app only remembers locally if you switch the analysis off. We do not record your screen and do not link the analysis to advertising. The analysis is for us only; we do not pass the data on.

The legal basis is our legitimate interest in improving Frame (Art. 6(1)(f) GDPR). We weighed it against your interests: only counts and screen names are processed, no content and no body data, the analysis is for us only, and on first launch the app points it out on the privacy step, where you can switch the analysis off with a toggle. You can object to the processing at any time by switching the analysis off in the Frame settings (Art. 21 GDPR). We delete analytics data after 12 months at the latest and when you have your account deleted. If you have switched the analysis off and also want the analytics data already collected to be deleted, write to us at support@framegym.app. We will then delete it (Art. 17 GDPR) as far as we can assign it to your account. Data collected before login with only a random number cannot be assigned to a person and therefore cannot be deleted individually. For the transfer to the USA see section 5.

2.15 Crash reports (Sentry, can be switched off)

So that we can fix crashes and errors we cannot reproduce ourselves, we use the service Sentry (Functional Software, Inc., USA) in its EU region, with servers in Germany. Crash reports are switched on by default and use the same switch as the usage analytics: Frame settings under Account → "Usage statistics". When it is off, Sentry does not start and nothing is sent.

If Frame crashes or an error occurs, we process:

  • the technical error message with the path through the program code (stack trace) and the last app events before it, for example which screen was open,
  • the app version, operating system, device type, the language set and the state of the device at the crash (for example free memory, battery level),
  • after you sign in, the random number of your Frame account, so that we can connect several reports from the same device,
  • no IP address, no screen recordings, no names and no email address.

We do not deliberately send the content of your workouts, body data or notes to Sentry; in rare cases they can still end up in an error message or in the events before a crash, for example as part of a request to our server.

The legal basis is our legitimate interest in keeping Frame stable and fixing errors (Art. 6(1)(f) GDPR). We weighed it against your interests: only technical data and a random number are processed, the evaluation serves only us, and you can switch crash reports off at any time (Art. 21 GDPR). We delete reports automatically after 90 days. If you want us to delete the reports of your account earlier, write to us at support@framegym.app (Art. 17 GDPR). For the transfer to the USA see section 5.

3. These websites

3.1 Hosting and server log files

We run two websites: the Frame website at framegym.app and the help pages (Frame Help) at docs.framegym.app. Both are hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Pages). With every visit, the respective server automatically processes your IP address, date and time, the page requested, the page you came from, and details about your browser and operating system. This is necessary to deliver the website and protect it from attacks. Log files are kept only briefly and only as long as needed to operate the sites and protect them from attacks. Cloudflare determines the exact period.

The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in a secure and working website). We have data processing agreements with the providers. For the transfer to the USA see section 5.

3.2 No cookies, no tracking

Our websites set no cookies and use no analytics or tracking services. Fonts and other content are not loaded from third-party servers. Whether you have collapsed the sidebar in Frame Help is remembered only in your browser's local storage. This information never leaves your device (Section 25(2) no. 2 TDDDG). Search in Frame Help runs entirely in your browser; your search terms are not transmitted.

4. Contact by email

When you write to us, for example to support, we process your email address, your name and the content of your message to handle your request. We receive incoming mail to our support address through Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) and send replies through Resend (Resend, Inc., USA). Our mailbox is hosted by Google Ireland Limited (Gmail), Gordon House, Barrow Street, Dublin 4, Ireland. We also store the messages in our database (Supabase) so that we can handle a conversation about one request together.

Legal basis: Art. 6(1)(b) GDPR if your request concerns your account or the use of Frame, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering requests). We delete your messages once your request is resolved, unless statutory retention obligations apply.

5. Recipients and transfers to third countries

We only share your data with service providers who process it on our behalf and according to our instructions (Art. 28 GDPR):

  • Supabase (Supabase, Inc., USA): database, sign-in and server functions of the app. The servers are located in the EU (Ireland).
  • Expo (650 Industries, Inc., USA): delivery of app updates and sending notifications, see sections 2.7 and 2.11.
  • PostHog (PostHog Inc., USA): usage analytics, can be switched off in the settings, with servers in the EU, see section 2.14.
  • Sentry (Functional Software, Inc., USA): crash reports, can be switched off in the settings, with servers in the EU, see section 2.15.
  • RevenueCat (RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA): managing subscriptions, see section 2.10.
  • Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA): hosting of our websites (see section 3.1) and receiving support emails (see section 4).
  • Resend (Resend, Inc., USA): sending support emails, see section 4.
  • Google Ireland Limited (Gmail), Gordon House, Barrow Street, Dublin 4, Ireland: email inbox.

Supabase, Expo, PostHog, Sentry, RevenueCat, Cloudflare and Resend are companies based in the USA. Where data reaches the USA, this is based on an adequacy decision of the EU Commission (EU-U.S. Data Privacy Framework) if the provider is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

We do not share data with any other third parties unless we are legally obliged to.

6. Retention

We store your data as long as your account exists. The subscription payment itself is held by Apple or Google; their retention periods apply to it. When you delete individual entries, such as a workout or a body measure, we remove them immediately. When you have your account deleted, we delete the account and all data linked to it completely. We do not currently keep backup copies. How to have your account deleted is described under Delete your account.

7. Obligation to provide data

You cannot use Frame without signing in with Apple or Google. All other information, in particular the questions on first launch, body data, the Apple Health connection and usage analytics, is voluntary.

8. Minimum age

Frame is intended for people aged 13 and over. If you are under 16, please only use Frame with your parents' consent.

9. Security

All connections between the app, the website and our servers are encrypted (TLS). Access to your data in the database is technically restricted to your own account.

10. Your rights

You have the right to

  • access your stored data (Art. 15 GDPR),
  • rectification of inaccurate data (Art. 16 GDPR),
  • erasure of your data (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • data portability, meaning a copy of your data in a common format (Art. 20 GDPR),
  • withdraw any consent given, with effect for the future (Art. 7(3) GDPR).

Right to object: Where we process data based on Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

To exercise your rights, write to support@framegym.app.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us: The State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

11. Changes

If Frame or the law changes, we will update this privacy policy. The version published here applies.