Privacy Policy

Dynos is a strength-training app. This policy explains what we collect, why, how long we keep it, and what you can do about it. It covers both the Dynos mobile app and the dynos.fit website, which behave differently — see section 6.

The data controller is Dynos (dynos.fit). For any privacy question or request, contact support@dynos.fit.

Only what the product needs. There is no analytics or tracking SDK in the app and no hidden collection — the categories below are the complete list.

Account information

Health and fitness information

This is sensitive data, and in the UK/EU it is a special category of personal data. We collect it only because you enter it, and only to personalise your training. It is never used for advertising and never sold.

Diagnostics

When something goes wrong, the app records an error entry containing the error type, a stack trace, the app version, and the platform, so we can fix it. These entries are deliberately filtered: the app keeps an allow-list of which fields may be recorded, so your health fields, email, date of birth and profile-photo locations are stripped before an error is stored. Error entries are linked to your account so that deleting your account deletes them too, and are purged automatically after 90 days regardless.

The same filtered error summaries are also sent to Sentry, a crash-reporting service, together with the app version, operating system and device model, so we can see crashes as they happen across the beta. This is configured as narrowly as the tool allows: personal identifiers are switched off, no screenshots or screen contents are captured, no performance tracing runs, and every message is passed through the same redaction filter before it leaves your device. Sentry events are not linked to your account or email.

These are commitments about how the app is actually built:

• No advertising. There are no ads in Dynos and no advertising identifiers are collected or shared.
• No analytics or tracking SDKs in the app. The app ships with no analytics or attribution SDK. The only third-party SDK is the Sentry crash reporter described in section 2, which receives no personal or health data. (The website is different — see section 6.)
• No selling or sharing of personal data. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
• No third-party AI processing. Dynos generates your suggested workouts on your own device. Your training and health data is not sent to any external AI or machine-learning provider to do it.
• No font or asset calls to third parties. Fonts are bundled in the app, so opening Dynos does not reveal your IP address to a font host.
• No push-notification server. Reminders are scheduled locally on your device.

We do not use your data to make decisions with legal or similarly significant effects about you.

Dynos is local-first. Your data is written to a database on your device first, which is why the app keeps working offline, and is then synchronised to our backend so it survives losing or changing phones.

Profile photos are stored in a private bucket that is not publicly readable. Access is scoped to the owning account and served through short-lived signed links.

Data on our backend is protected by row-level security, so one account cannot read another’s rows even if a client misbehaves.

We want to be precise rather than flattering here. The app contains no analytics. The dynos.fit website currently does:

• Google Analytics, to understand how people find and use the site. Advertising storage is disabled, so it is not used to build advertising profiles. If you are visiting from the EEA, the United Kingdom or Switzerland, analytics storage is switched off by default, so no analytics cookie is set and your visit is not measured.
• Vercel Analytics, privacy-focused aggregate traffic measurement provided by our hosting platform.
• If you join the waitlist, we store the email address you submit and send you a confirmation email.

There is no cookie banner because the site sets no analytics cookie where consent would be required. Vercel Analytics is cookieless and does not identify individual visitors.

We do not sell your data. We use a small number of service providers who process it on our instructions:

We may also disclose data where legally required, or to protect the rights and safety of our users.

We keep your account and training data for as long as your account exists, because the product’s value is your history. When you delete your account, deletion is immediate and permanent as described in section 9.

• Diagnostic error entries are deleted automatically after 90 days, or immediately when you delete your account, whichever comes first. Sentry retains crash events for 90 days under its own retention settings.
• Waitlist email addresses are kept until the app is generally available and you have been invited, or until you ask us to remove yours, whichever is sooner.
• Backups. Our database provider may keep encrypted backups for a short rolling period, never longer than 7 days, for disaster recovery. Deleted data can persist in those backups for that period and is then gone.
• Support email you send to support@dynos.fit is kept for as long as needed to resolve your request and for a reasonable period afterwards for reference.

Two of these are built into the app rather than being request-only:

• Export. Profile → Export Data produces a CSV of your workout history on demand.
• Deletion. Profile → Permanently Delete Account erases your training data, your profile, your profile photo, your diagnostic entries, and your login itself. It is not a soft delete or a deactivation, it is not recoverable, and we cannot restore it afterwards. Your local copy on the device is wiped in the same operation.

Depending on where you live, you may also have the right to access, correct, or port your data, to object to or restrict processing, to withdraw consent, and to complain to your local data protection authority. Most correction can be done directly in the app; for anything else, contact us at support@dynos.fit and we will respond within the period required by applicable law.

If you are in California, we do not sell or share your personal information as those terms are defined by the CCPA/CPRA, and we will not discriminate against you for exercising your rights.

Dynos is not directed at children and is not intended for them. You must be 18 or older to create an account, which matches the minimum age in our Terms of Service. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

Our service providers may process data in countries other than yours, including the United States. Where required, transfers rely on appropriate safeguards such as the European Commission’s standard contractual clauses. Our database and file storage are hosted by Supabase in the United States (AWS us-east-1, Northern Virginia), the website is served by Vercel’s global network, and crash reports are processed by Sentry in the United States.

We use encryption in transit, hashed passwords handled by our authentication provider, row-level security so accounts are isolated at the database level, private storage with signed access for photos, and filtering that keeps sensitive fields out of diagnostic logs. No system is perfectly secure, but we would rather tell you exactly what we do than claim more than we can support.

If we change how we handle your data we will update this page and its “last updated” date. For material changes affecting how we use health data, we will seek your consent again rather than relying on a silent update.

Questions, requests, or complaints: support@dynos.fit. We are based in the United States and have not appointed a representative in the EU or UK under Article 27 of the GDPR; you can still reach us at the address above and complain to your local supervisory authority.