Kilos

Privacy Policy

Kilos (the "App") is made by www Holding AB, org. no. 559515-3668, Anundsgatan 22, 753 34 Uppsala, Sweden ("we"). We are the data controller for the personal data described here. Contact: [email protected].

This policy says what the App stores, why, where, and for how long, in plain words. Last updated 15 October 2026.

What we store and why

Your account. The App creates an anonymous account the first time it opens, tied to a random device identifier stored in your phone's keychain. It creates a new one after you sign out or delete your account on that phone, or if the phone's session stops working, and we store which of these it was, so that we can tell new installs from returning phones. If you sign in with Apple, Google or an emailed code, we store the identifier that provider gives us and, if you share it, your email address. Sign-in exists so your data survives a lost phone and follows you to a new one. Legal basis: performance of our contract with you.

Your training data. Workouts (exercises, sets, weights, reps, distances, times, rests, notes), templates, body measurements you enter, and the gyms you add with their equipment lists. This is synced to our server so it is backed up and available on your other devices. Your weekly goal and streak are computed on your phone from your workouts, not on our server. Legal basis: performance of our contract.

Photos. Photos you take in the App (proof photos after a workout, progress photos) are stored only on your phone, excluded from device backups, and are deleted when you delete the workout, the photo, or the App, and in the iPhone app also when you delete your account. When you sign out in the iPhone app they stay on the phone, hidden from anyone else who signs in on it, and come back when you sign in to the same account again. They are never uploaded. The one photo that does leave your phone is a profile photo, if you choose to add one (see "Profile photo and bio" below).

Where a workout happened. If you allow location access, the App reads your position when a workout starts to pick the gym you are at, and stores that position with the workout. It is visible only to you. When you add a gym and place it, the gym's name, city and position are stored with the gym. A gym you add is visible only to you until our team has reviewed and approved it; after that, its name, city, position and equipment list can be found by other users. We review gyms by hand so that only real gyms are shared. When you tick or report a gym's equipment as present or missing, that is shared with other users only as anonymous counts tied to the gym, never to you. Your own position is never shared with anyone. Legal basis: consent (the iOS location permission), which you can withdraw in iOS Settings.

The AI coach (only if you turn it on). When you use Machine busy suggestions, Plan with AI or the Coach tab, the exercises you log (names, sets, reps, weights), your recent workouts, body measurements you entered, your usual gym's name and its equipment list, what you type into Plan with AI (goal, days, time, anything to consider) and your chat messages are sent to our server and on to an AI provider to produce the answer. If you report an answer, we store the answer, the reason and any note you wrote, so we can review it. Chat threads and answers are stored on our server so you can reopen them and so we can act on abuse. We also keep a log of every request to the AI coach (the question or the plan/substitution request with the workout data sent with it) and the answer it gave, so we can check and improve the coach's answers; it is deleted with your account. The AI coach is off until you turn it on: the App shows what would be sent and to whom, and asks first. Subscribing does not turn it on. Legal basis: consent, which you can withdraw in Settings at any time; stored threads remain until you delete them or your account.

Usage data. To see what is hard to use and fix it, the App records how it is used: which screens you open and for how long, which buttons and menus you tap and where, when sets and rests start and end and how long they take, the exercises you add, swap or remove, how long your notes are (never their text), and how many characters you send to the coach (never the text). Each record carries your account and device identifier. We also keep a log of the requests your phone makes to our server (path, status, timing, your account identifier). Legal basis: our legitimate interest in understanding and improving the App. This data is kept for as long as your account exists and is deleted with it.

Feedback you send. If you write to us from the App (Settings › Send feedback, the "Deleting? Tell us why." action on the home screen, or after answering "Not great" when the App asks how it is working), we store the text you wrote, the email address if you typed one, the App version and your account identifier, so we can read it and, if you asked, reply. Legal basis: our legitimate interest in improving the App. If the message cannot reach our server, the App offers to open it as an email from your own mail app instead.

Working out with friends (only if you use it). The first time you open the feature you choose a username, and optionally a display name, and agree to the community rules in the Terms of Service. Anyone using the App can find you by searching for your username, and sees your username and display name. A username makes you findable for invitations; which of your workouts others can see is set per workout (below). When you work out together in a lobby, its members see each other's username and display name and, for that workout only, the events the lobby carries: who joined or left, the turn order, the sets logged in it (exercise, weight, reps, time), sets someone else logged for you and whether you accepted them, and when someone finished. We store the lobby, its members and these events on our server so every phone in the lobby shows the same thing. If you invite someone, we store the invitation and send them a notification. You can change your username in Edit Profile up to twice in 14 days. When you do, we store your previous username and when you changed it for 14 days, so you can switch back and nobody else can take it in that time; then we delete that record. Usernames and display names can be reported in the App (see "Reports, blocks and suspension" below). Legal basis: performance of our contract with you.

Who can see each workout. Every workout is set either to Everyone or to Only me, and it is Only me until you choose. When you choose a username, the App asks you once who sees your workouts (Everyone or Only me, nothing preselected), and that choice applies to the workouts you already have and to new ones; when you import workouts from Strong or Hevy, the App asks the same for the imported workouts. You can change this later in Settings › Workout Visibility (for all workouts, or for all workouts imported from one app), and change any single workout in its ⋯ menu or on the Finish screen. A workout set to Everyone can be seen by other signed-in users of the App in the Kilos feed (the Feed tab, see below), on your profile (for example when they open it from the feed, a search for your username or a lobby), and in the history of an exercise while you work out together. A workout you imported from Strong or Hevy is never shown in the feed, only on your profile. They see the workout's name, the day of the workout (the date only, not the time of day), how long it took rounded (not the exact start or end time), the exercises and, for each set, the weight, reps, distance, set type and how long the set took, and, for a workout you imported, which app it was imported from. Names you typed yourself (a workout's name, an exercise you created) pass an automatic filter first, and words it flags are hidden. They never see your notes, your workout and progress photos (which never leave your phone), your gyms or your position. A workout set to Only me is seen only by you. There is no Followers setting in the App; a workout that was set to Followers in an earlier version is treated as Only me and seen by nobody but you. Our server enforces this: it does not send a workout to anyone it is not visible to. If you log workouts for a guest profile, you see all of that guest's workouts. Legal basis: performance of our contract with you (showing the workouts you set to Everyone is the feature you choose).

The Kilos feed. The Feed tab shows every signed-in user of the App two kinds of posts, newest first: the workouts users have set to Everyone (each with its owner's username, display name, approved profile photo and Pro ring, and the workout with the same fields and rules as above), and posts we write ourselves about training, which are the same for everyone. Your own workouts set to Everyone appear in the feed too, for you and for others. Imported workouts, workouts set to Only me, and the workouts of anyone you blocked, anyone who blocked you, a suspended account or an account without a username are never in anyone's feed; our server applies these rules every time the feed is loaded. There is no following yet, so the feed is the same set of workouts for every signed-in user, apart from blocks. Each workout in the feed can be reported or its owner blocked from its ⋯ menu. Loading the feed is a request to our server like any other, and which of our posts you open is part of the usage data (both described under Usage data above); the pictures in our own posts are loaded without your account. Legal basis: performance of our contract with you (the feed is how the workouts you set to Everyone are shown).

Profiles, "trained with" and blocking. Signed-in users of the App can open another user's profile (from a search result, a lobby or a post). It shows the username, the display name and the workouts that user has set to Everyone, laid out as posts with the same fields as above. When a workout ends in a lobby, the App stores who was in it (their user ids, usernames or guest names) with your workout, and your post says "with @tim and Ivar". A workout you log for a guest names the others from the lobby the same way, so when the guest takes it over it says "with" you. Others who can see that workout see the names: a friend with the App by their current username (linking to their profile), a guest only as "a friend" (never by the name the guest's owner gave them), and a guest who took over their workouts by their own username. We check on our server that each person named really was in a lobby with you, and we take the names from our own records, not from your phone. You can turn the names off for one workout ("Show who I trained with", on the Finish screen or in the post's ⋯ menu). If someone names you, you decide too: "Let friends show me on their workouts" in Settings › Friends hides your name on everyone's workouts, and "Remove me from this workout" in a post's ⋯ menu hides it on that one, also on the owner's own phone; we store that choice on our server and enforce it. You can block another user from their profile or a post (the ⋯ menu), a search result, a lobby or an invitation. We store the block on our server; from then on neither of you can find the other in search, invite the other, join a lobby the other is in by code or invitation, see the other's profile or workouts, or see the other's name on a post. The blocked person is not told. You can see and undo your blocks in Settings › Friends. Your blocks, the blocks others made of you, "remove me" choices and the setting are deleted with your account. Legal basis: performance of our contract with you, and for blocking also our legitimate interest in keeping the App safe.

Profile photo and bio (only if you add them). In Edit Profile (tap your picture on the Profile tab, or Settings › Account) you can add a profile photo and a short bio of up to 150 characters. Unlike your workout and progress photos, these leave your phone: the App crops the photo you pick to a square, scales it down to 512 × 512 pixels and uploads it as a JPEG, and our server removes the photo's embedded information (such as camera, time and place) before storing it. We store the photo and the bio on our server with your account. A new photo is shown to others only after our team has looked at it and approved it; until then others see your profile without a photo, and we store whether and when it was approved. The photo and the bio are shown wherever your profile is: to other signed-in users of the App who can see your profile, for example when they find you by your username, in a lobby you share, in an invitation from you, and on your profile page. People you blocked, and people who blocked you, don't see them, and nobody sees them if you have no username. You can change or remove the photo and clear the bio at any time; removing them deletes them from our server. Photos and bios can be reported in the App like usernames (see below). The photo and the bio are deleted with your account. Legal basis: performance of our contract with you (showing the profile you chose to fill in), and for the photo review our legitimate interest in keeping the App safe.

Kilos Pro on your picture. If you have Kilos Pro, your picture carries a ring that shows it, and other signed-in users of the App see that ring wherever they see your profile: when they find you by your username, in a lobby you share, in an invitation from you, and on your profile page. It shows only that you have Pro right now, never your plan, price, payment method or how you bought it, and it goes away when your subscription ends. People you blocked, and people who blocked you, don't see it, and nobody does if you have no username. You can turn the ring off in Settings › Account (Show Pro on my profile); then nobody sees it, you included, until you turn it back on. Our server works the ring out from the subscription status it already keeps (see the payment sections below); the only thing stored for it is whether you turned it off, kept with your account and deleted with it. Legal basis: performance of our contract with you (the ring is part of Kilos Pro).

Reports, blocks and suspension. You can report a post or a profile (its username, display name, photo or bio) from its ⋯ menu, and a person in a lobby from their row there. A report stores who made it, who and what it is about (the post, or a copy of the username, display name and bio and an identifier of the photo, not the photo itself, as they were when reported), the reason you gave, and when it was made and reviewed. Our team is alerted by email and reviews every report within 24 hours. The person you report is not told who reported them. If content breaks the community rules in the Terms of Service we remove it, and we may suspend or close the account: a suspended account's profile and posts are hidden from others, and we store when it was suspended for as long as the account exists. Reports about you are deleted with your account; a report you made stays in our moderation records without your account when you delete it. Blocks are described above. Legal basis: our legitimate interest in keeping the App safe and in meeting the App Store's rules for shared content.

Guest profiles and "Get your workout" links. You can log workouts for a friend without the App under a name you give them (a guest profile, for example "Tim"). The guest profile and the workouts logged under it are stored on our server under your account. Only you, and the members of a lobby you add the guest to while you train together, see the name; everyone else, for example on a post that names who you trained with, sees the guest only as "a friend". Please only use a name your friend is comfortable with. When you share a "Get your workout" link, whoever opens it in the App gets the guest's workouts moved into their own account, and the guest profile is no longer yours. The link is stored on our server only in a scrambled (hashed) form. If you delete a guest profile, or your account, the guest profile and its workouts are deleted, unless your friend already took them over. Legal basis: performance of our contract with you (for you), and our legitimate interest in letting you log a shared workout so your friend can receive it (for your friend).

Notifications. If you allow notifications, rest reminders are scheduled on your phone. For the lock-screen Live Activity, the App sends a push token to our server so it can update the countdown; tokens are deleted when the activity ends or the device is revoked. For invitations to work out together, the App sends your phone's notification token to our server, which uses it only to deliver those notifications through Apple; the token is deleted when you sign out on that device, when Apple says it is no longer valid, or with your account.

Crash and error reports. If the App crashes or hits an error, a report goes to our processor, Sentry, Inc. (an EU data residency instance): your device model, OS version, the App version, the stack trace, and your pseudonymous account identifier. Never your email, never the contents of your messages. We use these reports only to find and fix bugs, and they are kept for 90 days.

Payments in the App (only if you subscribe through the App Store or Google Play). Subscriptions are also sold in the App, where Apple or Google is the merchant: they take your payment details, charge you, issue the receipt and handle VAT, and we never see or store them. Receipts are verified and your subscription status is kept by our processor, RevenueCat, Inc. (United States): our account identifier as the app user id, the product you bought, its price and currency, your subscription status, and the platform. No card data reaches RevenueCat or us. Transfers to the United States rely on the EU standard contractual clauses. If you delete your account we delete these records; Apple and Google keep their own accounting records under their terms. Legal basis: performance of our contract with you.

Payments (only if you subscribe on our website). Payment is handled by Stripe, which acts as the merchant of record: Stripe takes your card details, charges you, issues the receipt and handles VAT. We never see or store card numbers. We store the email address you gave at checkout, your subscription status and plan, the currency and amount, and Stripe's identifiers for the customer, subscription and checkout so that we can unlock the App on your account and handle refunds and cancellations. The eight-digit code shown after payment is stored hashed and expires after 7 days. If you delete your account, we cancel the subscription and delete these records; Stripe keeps its own accounting records under its terms. Legal basis: performance of our contract with you.

The website quiz and ads (only if you come through our website). When you start on our website we give your browser a random session identifier for that visit and record which step you are on, which answer you chose (goal, equipment, days per week, previous app, import), how long each step was on screen and whether you went forward, back or left. If you arrived from an ad we also store the campaign parameters in the link and the click identifier the ad network attached (Meta, TikTok or Google), and, only if you accepted marketing cookies, Meta's browser cookies, so the ad network can be told which ads led to a purchase. Nothing you type freely is recorded. When you sign in or pay, the session is joined to your account. Legal basis: our legitimate interest in seeing which steps lose people and which ads pay for themselves; consent for the marketing cookies, which you can decline in the cookie bar with no effect on the site.

Rate limiting and security. Your IP address is used for at most 24 hours to limit abusive request rates and is not stored beyond that.

The iPhone tester list (only if you sign up). We store your first name, email address, where you heard about Kilos and whether you already know the founder, plus when you signed up and the version of the consent you accepted. We use these only to email the TestFlight link, contact you about this test and distinguish new lifters from people who already know the founder when reviewing recruitment. The list is separate from your App account and website quiz, and is not a newsletter. We do not send these form answers to advertising networks. Legal basis: consent, given through the unchecked box on the form. You can withdraw and request removal by emailing [email protected] from the address you signed up with. We delete the signup list after test invitations have been sent, within 90 days of signup even if testing never opens, or earlier if you withdraw. Server backups are overwritten within 30 days.

Who processes data for us

  • Amazon Web Services EMEA SARL (Luxembourg): hosting of our server and database within the EU, in the AWS Stockholm region (Sweden).
  • Cloudflare, Inc. (United States): network delivery and proxy; all traffic to our server passes through Cloudflare on its way to AWS. Transfers outside the EU rely on the EU standard contractual clauses.
  • Apple Inc.: Sign in with Apple and push notifications, under Apple's terms. If you sign in with Apple we keep the token Apple gives us, so that we can revoke the App's access with Apple when you delete your account.
  • Google LLC: Sign in with Google, under Google's terms, only if you use it.
  • OpenRouter, Inc. (United States), which routes the request to AI models from OpenAI and Google: the AI coach, only if you turn it on. Transfers outside the EU rely on the safeguards in the provider's data processing terms (the EU standard contractual clauses).
  • Postmark (ActiveCampaign, LLC), United States: sending the email sign-in code, only if you sign in by email, and alerting our team by email to a new report. Transfers outside the EU rely on the EU standard contractual clauses.
  • RevenueCat, Inc. (United States): verifies App Store and Google Play receipts and keeps subscription status for purchases made in the App, only if you subscribe that way. Transfers outside the EU rely on the EU standard contractual clauses.
  • Sentry, Inc. (EU data residency instance): crash and error reports, so we can find and fix bugs.
  • Stripe Payments Europe, Ltd. (Ireland) as merchant of record for subscriptions bought on our website, under Stripe's terms and privacy policy; Stripe decides what it keeps for its own accounting.
  • Meta Platforms Ireland Ltd. and TikTok Technology Ltd. (Ireland): only if you accepted marketing cookies on our website, they receive that a purchase happened together with the click identifier and a hashed email, so their ad reporting can match it to an ad.

We do not sell data, show ads, or share your data with anyone else.

How long we keep it

Except for the specific retention periods above (including the separate tester list), data is kept for as long as your account exists. Deleting your account in the App (Settings › Account › Delete account) permanently deletes your account, training data, gyms, chat threads, usage data, feedback you sent, request logs, your username, your profile photo and bio, your guest profiles and the workouts logged for them (unless a friend already took them over), your invitations, your sets and membership in lobbies, your blocks, reports about you and any suspension record from our server. A report you made is kept in our moderation records without your account. The one exception is the reason you can optionally type when deleting: that line is kept, with the App version and nothing that links it to you, because reading it is the point of asking. Local data on your phone is deleted when you delete the App, and in the iPhone app also when you sign out or delete your account (signing out first checks that your workouts are backed up, and keeps your photos on the phone for when you sign in again). Server backups are overwritten within 30 days.

Your rights

Under the EU General Data Protection Regulation you can access, correct, export and delete your data, object to processing based on legitimate interest, and withdraw consent. Most of this is built in: export your workouts as CSV in Settings, turn the AI coach off in Settings, and delete your account in Settings › Account. For anything else, email [email protected]. You can also complain to the Swedish Authority for Privacy Protection (IMY, imy.se).

Children

The App is not directed at children under 13, and we do not knowingly collect data from them. If you are under the age at which you can consent to online services where you live (13 in Sweden, up to 16 in some EU countries), a parent or guardian must agree for you; the consent-based features (location, the AI coach) then need their permission. If you believe a child has given us data, email [email protected] and we will delete it.

Changes

If this policy changes in a way that matters, the App will tell you the next time it opens. The current version is always at https://kilosapp.com/privacy.