Tredan Privacy Policy

Last updated: 6 November 2026

Tredan ("the app", "we", "us") is a strength-training coach published by Loki Studios. This policy explains what data the app handles, where it lives, and every case in which any of it leaves your device. It is written to be accurate to how the app actually behaves.

The short version: Tredan is local-first and private by default. Your training history, profile, nutrition logs and health readings are stored on your device. An account is not required for workouts, history, nutrition logging or the on-device coach. Optional Apple, Google or email-code sign-in supports account-linked features. It does not by itself upload your workout history. Data leaves your device only in the cases listed in §3. Remote AI coaching is off until separately enabled and configured. The app contains no advertising or advertising-tracking integration. Imported health readings are excluded from cloud-coach, social and sync payloads. A full backup includes saved health readings; sharing that file sends them to the destination you choose.

1. Data the app stores on your device

All of the following is stored locally in an on-device SQLite database and in your device's secure keystore. If you create an account, account information is also stored by our authentication service, as described in §3.5. Cloud Sync is not offered in the current public build; signing in does not enable it.

• Profile & goals: training goal, experience level, days per week, session-length cap, available equipment, preferred units, and any injury exclusions you enter. Optional profile fields include your name, bodyweight and reference sex for strength standards.
• Training history: workouts, exercises, sets (weight × reps), RPE, estimated and recorded one-rep maxes, personal records, and progression decisions.
• Nutrition logs (optional): foods you log, their macros, and water intake.
• Health readings (optional): if you connect Apple Health or Health Connect, the app reads heart-rate variability, resting heart rate and sleep to compute an on-device recovery/readiness score. Earlier versions could also store steps, active calories and health-provider bodyweight; existing records and restored backups may still contain them. This build no longer requests or reads those three types.
• Settings & secrets: unit, voice-cue, haptics and theme preferences, your consent choices. A previously configured Anthropic credential is held in the platform's secure storage. This build does not offer a credential-entry control.

2. Health and fitness data

Health import requests read-only access to the metrics above. It does not write imported readings back to either provider. Separately, the optional Apple Watch workout export can save a completed workout to Apple Health after you grant write permission, as described in §3.2. The app does not write to Health Connect.

Imported health readings and the derived readiness score are processed on your device. The cloud coach, social and sync projections exclude them. Manual Export my data includes saved health readings, including historical fields. The operating system's share sheet lets you choose a destination; its provider may retain a copy under its own terms.

Turning Health import off in Tredan stops new reads. To revoke the operating system's authorization, use your device's Health / Health Connect settings. The app cannot revoke those system permissions for you. Turning import off does not delete existing readings; local-data deletion is described in §6.

3. When data leaves your device

These are all of them.

3.1 Food lookup — Open Food Facts. When you search for a food or scan a barcode, only the search text or barcode is sent to world.openfoodfacts.org to retrieve nutrition facts. No profile, identity, training or health data is included. This happens only when you actively search or scan; the app is fully usable offline without it.

3.2 Coaching, Watch and local tools.

Online coaching is off in the current release. The following disclosures describe optional capabilities that require separate availability, setup and consent; they are not enabled by signing in. The default coach runs on your device. Eligible subscribers can separately enable Tredan's cloud coach and sign in after accepting the disclosure shown before the first call. When they rebuild or adapt a program, the app sends a minimized request to our coach service on Supabase, which forwards it to the configured Google (Gemini), Anthropic (Claude), or OpenAI provider named in your disclosure. This requires a configured service; failures use the on-device coach. The coach handler does not store the request contents. Account-linked usage counters enforce coaching allowances.

The request contains training goal, experience, days/week, equipment, injury exclusions, allowed exercise identifiers and a recent sets/reps/RPE/progression digest. Adaptations include current prescription identifiers and allowed alternatives. It excludes name, email, bodyweight, nutrition logs, health readings and training loads. Authentication is used by our service to enforce access; the account identifier is not included in the request forwarded to that provider.

An existing separately configured Anthropic credential can still use the legacy direct coach with its own disclosure and consent. That request goes from the device to api.anthropic.com, without passing through our service. Consenting to one provider does not authorize the other. The selected provider processes requests under its own terms and privacy policy. A request already sent cannot be recalled by turning the feature off.

The AI proposes structure only. Every weight, %1RM and 1RM is computed by Tredan's deterministic engine from your own logged performance — an AI model never sets a training load.

Separate assistant, food recognition and meal ideas. When configured and approved, the online assistant sends the message you write, up to eight recent conversation messages for chat, or your meal description/preferences and food photo if you choose one. Excluded catalogue food choices accompany meal ideas. It does not automatically attach your account profile, saved food logs, Health readings or workout records. The screen names the selected recipient before you allow sending; this permission lasts only while that screen is open. Changing recipients requires new permission. These features require an eligible account and consume bounded server allowances. Selected sensitive topics receive a fixed response before a provider call; that routing is not a medical assessment or a guarantee of complete detection. Food identity and portions remain editable estimates. Only an explicit confirmation writes food to your diary; the app calculates nutrients from the selected food source, not model-generated nutrient values.

The app keeps assistant conversation/photo state in memory and clears it when you leave the screen. Temporary camera files are deleted after processing; a cleanup failure is surfaced for retry. The server handler does not persist prompts, images or replies. It records numeric usage, and retains daily account usage counters to enforce limits; those account counters are deleted with the account. These online tools remain unavailable until their provider and release requirements are completed. On-device iPhone speech requires the system's local recognition support; there is no app-controlled cloud speech fallback. Android users may use their chosen keyboard's dictation, governed by that keyboard's settings. Optional read-aloud uses system speech.

Apple Watch and Apple Health workout export. Opting into Watch sharing transfers the active workout and set records to your paired Watch through Apple's device connection. Unsynced records remain on Watch; rejected records retain details for review. They are not part of a phone backup until logged. Stopping and clearing sharing, restoring a backup, or erasing the app revokes that pairing; the Watch copy clears when it next connects. Delayed transfers from a revoked pairing are not reimported. This does not remove workouts already saved in Apple Health. Separately, choosing Save workout to Apple Health requests permission to write that completed workout's type, times and recorded duration, without invented energy or heart-rate values. Health read permissions remain a separate choice.

Local movement review. On supported iPhones, Apple's pose model analyzes temporary camera frames locally for a limited bodyweight-squat movement estimate. No movement frames or joint coordinates are sent to an AI provider. It does not certify technique or safety, and should not be used to decide whether an exercise is safe for you.

3.3 Crash diagnostics. When a release build has crash reporting configured and the diagnostics preference is enabled, errors are reported to Sentry. Reports can contain error messages, stack traces, app/OS information and diagnostic context or breadcrumbs. The app disables the SDK's default personal-information attachment and performance tracing; those settings alone do not prove that every error message or context field is free of personal content. Do not include personal or health information in a support attachment unless it is necessary for your request.

Crash diagnostics is on by default when configured. You can turn it off in Settings → Crash diagnostics to stop reporting. With no reporting service configured, the app sends no Sentry reports.

3.4 Purchases. Where purchasing is available, the Apple App Store or Google Play processes payment under its respective privacy policy. Store notifications are processed by our backend, hosted on Supabase, to associate entitlement status with your account. We never receive or store your payment-card details. Purchase controls remain unavailable until the store products and account integration are configured. The store confirmation screen is the source of the applicable price, trial and renewal terms.

3.5 Optional account. Signing in with Apple or Google shares that provider’s identity token with our authentication service on Supabase to sign in or create your account. The provider may supply your name and email address. The app requests identity access only, not access to your contacts, files or calendars. A saved account session may refresh while you remain signed in, independently of optional sharing features. Signing out removes this device’s saved account session. Email sign-in sends your email address to Supabase and its configured delivery service to send a one-time code. We store the account identifier and the email or name provided for the account. We also store the entitlement information needed to recognize a purchase. This is separate from your local training, nutrition and health records.

3.6 Friends and challenges — optional. Social is enabled in the current build, but participation requires a supported eligibility check, sign-in and your separate sharing consent. Consent shares a display name, friend relationships and training day/timezone with Supabase. The server records when a training day first arrives. Accepted friends can see eligible day counts and shared challenge progress. Discoverability controls whether others can find a profile; it does not replace the sharing switch. Challenge records contain the two account IDs, selected goal, status and timestamps. Reports and blocking choices are stored to enforce moderation. No exercise details, loads, nutrition or health readings are shared for this feature.

Turning social sharing off requires a server confirmation, hides participation and cancels open challenges. Hiding names in your own view does not hide your profile from friends. Account deletion is separate from withdrawing sharing.

3.7 Home Screen, Lock Screen and notifications. Widgets are off until you enable them. They use a reduced snapshot shared locally with the app’s widget extension: your next or active workout, set progress and selected nutrition totals. Live Activities can show workout and rest-timer progress. These surfaces can be visible to someone looking at your screen; choose placements and notification privacy settings accordingly. Turning widgets off clears the shared snapshot. Rest and trial reminders use local notifications and require the relevant permission. Your personal nutrition summary is not sent to the Friends leaderboard.

3.8 Website and support email. Our public information pages are hosted by Cloudflare. It receives the network information needed to deliver and protect the pages, such as an IP address, requested URL and browser information. The pages do not add advertising, analytics scripts, tracking cookies or third-party fonts. Support email and sign-in email delivery use Hostinger. When you contact support, your address and message are processed to handle the request. Do not send passwords, sign-in codes or unnecessary health information.

4. Third parties

The recipients described above include Open Food Facts, Google, Anthropic, OpenAI, Sentry, Apple, Supabase, Hostinger and Cloudflare. A backup destination chosen by you is an additional recipient. Providers process network requests under their own terms and privacy policies. These providers may process data outside your country. Their own privacy notices describe their processing and regional safeguards. We do not claim that an app setting controls a provider’s independent security or legally required records.

Tredan has no advertising integration and does not implement sale of app records to advertisers or data brokers.

5. Your choices and how to withdraw consent

Optional account sign-in, AI coaching and health import are separate choices. A saved account may refresh its session while signed in. Use Settings to manage these choices:

• AI coaching — turn it off with the relevant provider switch. New requests to that provider stop; other providers require their own independent consent.
• Social, where available — turn sharing off while connected and wait for confirmation. This hides participation but does not delete your account.
• Assistant — Turn off online AI or leave the screen to withdraw its session permission. Requests already sent cannot be recalled from the provider. Clear the conversation to remove its local draft/replies.
• Watch sharing — review/sync pending sets before choosing Stop sharing and clear Watch copy. The confirmation explains which unsynced/recovery records will be discarded.
• Health readings — turn off the health toggle to stop new reads. Revoke system authorization separately in your device's Health / Health Connect settings.
• Food lookup — happens only when you search or scan; simply don't, and nothing is sent.

Crash diagnostics (§3.3) is on by default when configured. It has its own switch in Settings. Signing out removes this device's saved account session; it does not delete the server account. Food lookup and backup sharing are initiated by your explicit action.

If we materially change what is shared or who receives it, your previous consent stops applying and the app asks you again rather than assuming it still holds.

6. Your rights — access, export and deletion

You can access and delete local data directly in the app, and delete an optional account separately:

• Access / portability: Settings → Export my data produces a complete file of your profile, programs, sessions, sets, 1RMs, PRs, nutrition and health readings.
• Erasure: Settings → Delete all my data permanently wipes every local table, your consent choices, app settings and app-owned credentials, returning the app to first run when cleanup completes. The app reports incomplete cleanup so you can retry. This does not revoke system Health permissions or delete files already saved or shared outside the app.
• Account deletion: if signed in, Settings → Delete my account requests deletion of your server account and associated records, then clears local data after the server confirms success. Deleting local data alone does not delete a server account or cancel an App Store or Google Play subscription.

If you are in a region with specific privacy rights (e.g. EU/UK GDPR, California CCPA), you may also exercise them by contacting us below; we will not discriminate against you for doing so.

7. Retention

Data on your device is kept until you delete it. Optional account and entitlement records remain until account deletion, subject to any legally required retention. Challenge results are displayed for 30 days after their end; that display window is not automatic deletion of the underlying records. Social records remain until account deletion or an applicable retention policy removes them. Support messages are kept as needed to resolve the request and handle follow-up, security or legal obligations. Deletion of active app records does not immediately erase provider-managed backups or independent security/audit records. Those records expire under the applicable provider’s retention arrangements, or are retained where law requires. Contact us for help with an access or deletion request; we do not promise an unverified backup-purge deadline.

8. Age

Tredan is intended for people aged 16 and over and is not directed to children. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Where the native platform supports it, the app requests a coarse age signal before social participation or a new purchase. It does not request a birth date or persist the raw response. For Friends on supported iPhones, the native app uses Apple's App Attest to send a signed eligibility decision to Supabase. The age range itself stays on the phone. Supabase stores the account-linked device public key and replay counter, a short-lived challenge, and an eligibility decision with an expiry. These records are removed when the account is deleted. App Attest checks the app's integrity; it does not independently verify a person's age. Unknown, under-18, unavailable or restricted results do not enable those features. The free local app and purchase restoration remain available. A device or account that cannot complete verification cannot join Friends; this does not block local workouts or nutrition.

9. Security

Local data is stored in the app's sandboxed database. Saved provider credentials use platform secure storage. All network requests use HTTPS.

10. Changes

We will update this policy as the app evolves and revise the "Last updated" date. Where a change materially affects what is shared or with whom, we will surface it in the app and ask for your consent again.

11. Contact

Loki Studios — support@tredanfitness.com

Account deletion · Terms of Service