Privacy Policy

Last updated: 12 August 2026

This policy explains what personal data the Torvus mobile app and website collect, why we collect it, who it is shared with, and the rights you have over it. We have tried to write it in plain language rather than legal boilerplate.

Who we are

Torvus ("we", "us") is a fitness coaching platform registered in Croatia. For the purposes of the EU General Data Protection Regulation (GDPR) we are the data controller for the personal data described below.

You can reach us about anything in this policy — including any request to access or delete your data — at [email protected].

How Torvus is organised

Torvus is used by trainers and by the clients they coach. Trainers create a space (a gym or coaching practice) and invite clients into it. This structure matters for privacy, because some of your data is deliberately visible to other people in your space — see Who can see your data below.

What we collect

Account and identity: You sign in with Google or Apple. We receive your name, email address and profile picture from that provider. We never see or store your Google or Apple password. We issue our own session tokens once you are signed in.
Profile: Your display name, description and any profile photo you upload.
Training data: Workouts, exercises, templates, sets, and the values you record against them — such as repetitions, weight, duration and distance — along with any ratings or feedback you give on a completed workout.
Scheduling: Events and sessions, their times, and attendance records.
Membership: Which spaces and groups you belong to, your role in them (for example trainer, assistant or client), and the access codes used to join.
Notifications: A device token for each device you enable push notifications on, plus your notification preferences. You can turn notifications off at any time in the app or in your device settings.
Subscriptions: If you subscribe, your purchase is processed by the Apple App Store or Google Play. We receive your subscription status, plan and renewal state — we never receive your card number or payment details.
Usage analytics: Which screens you open and which actions you take, so we can understand what people use and where the app is confusing. Entity identifiers (such as a workout or space id) are hashed on your device before they are sent, so these events do not carry your real record ids. See Analytics and your choices.
Crash diagnostics: If the app crashes we collect a technical report — device model, operating system version and a stack trace — so we can fix the fault.
Correspondence: Messages you send us by email or through the contact form on our website.

Why we use it, and our legal basis

To provide the service — creating your account, storing your training data, showing your programming to you and your trainer, running spaces and events. Legal basis: performance of a contract with you.
To operate subscriptions — granting and revoking access to paid features. Legal basis: performance of a contract.
To send notifications you asked for — session reminders, workout ratings and similar. Legal basis: consent, which you can withdraw at any time.
To keep the app working and improve it — usage analytics and crash reporting. Legal basis: our legitimate interest in maintaining and improving a product you have chosen to use. You can opt out at any time, and doing so costs you no functionality.
To keep accounts secure and prevent abuse. Legal basis: legitimate interest.
To meet legal and accounting obligations. Legal basis: legal obligation.

We do not sell your personal data, we do not share it with advertising networks or data brokers, and we do not use it to target you with advertising anywhere.

Who can see your data

Torvus is a coaching tool, so some of your data is visible to the people coaching you by design:

Your trainer and the staff of your space can see your profile, your assigned programming, the workouts you complete and the values you record against them, and your attendance.
Other members of a group you belong to may see limited profile details and shared sessions.

You control part of this yourself. In Settings → Privacy you can choose whether your photo, name, training history and groups are visible to others. Some information — such as your membership of a space — cannot be hidden, because the space could not function without it.

Health-related information

Torvus records training performance — the load lifted, repetitions, duration, distance, power, calories and effort ratings for an exercise. It does not collect body-composition measurements, health conditions, injuries, medication, date of birth or gender, and it does not connect to Apple Health, Google Fit or Health Connect.

We therefore do not process special categories of personal data under Article 9 of the GDPR. We still treat your training records as private: they are used only to provide the service to you and your trainer, and they are never shared outside your space. Only record what you are comfortable recording.

Service providers we use

We use a small number of established providers to run Torvus. They process data on our instructions under written agreements, and none of them are permitted to use your data for their own purposes.

Google Firebase: Usage analytics, crash reporting and push notification delivery.
Google and Apple: Sign-in, and processing of subscription purchases through their app stores.
RevenueCat: Managing subscription entitlements across both app stores.
Heroku (Salesforce): Application hosting and the PostgreSQL database that stores your data.
Amazon Web Services: Storage of images you upload, such as profile and exercise photos.

International transfers

Some of these providers process data outside the European Economic Area, primarily in the United States. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent approved safeguard.

Analytics and your choices

Analytics is switched on by default so that we can see how the app is actually used. It is limited to your activity inside Torvus — we do not track you across other apps or websites, we do not use advertising identifiers, and the app does not include any advertising SDK.

You can turn analytics and crash reporting off at any time in Settings → Privacy → Usage analytics. Turning it off stops collection on that device and does not restrict any feature of the app.

How long we keep it

Account and training data — for as long as your account is active.
After you ask us to delete your account — removed from our live systems within 30 days, and from backups within a further 90 days.
Analytics events — retained for up to 14 months.
Records we must keep by law, such as invoices — for the period the applicable law requires.

Your rights

Under the GDPR you have the right to:

access the personal data we hold about you, and receive a copy of it;
have inaccurate data corrected;
have your data erased;
restrict or object to how we process it, including our use of legitimate interest;
receive your data in a portable, machine-readable format;
withdraw any consent you have given, at any time, without affecting what came before.

Email [email protected] to exercise any of these. We will respond within one month.

If you believe we have handled your data improperly you can complain to the Croatian Personal Data Protection Agency (AZOP), or to the supervisory authority in the EU country where you live.

Security

Traffic between the app and our servers is encrypted in transit. Access to production systems is restricted to those who need it. No system is perfectly secure, but we take reasonable and current measures to protect your data, and we will notify you and the relevant authority of a breach where the law requires it.

Children

Torvus is not directed at children under 16. If you are under 16, please use Torvus only with the involvement of a parent or guardian. If we learn that we have collected data from a child under 16 without that involvement, we will delete it.

Changes to this policy

If we make a material change we will update the date at the top of this page and, where the change significantly affects you, tell you in the app before it takes effect.

Contact

Questions, requests or complaints: [email protected].