Privacy Policy
Last updated 9 September 2026
The short version. Your saved workouts, your history and your settings live on your phone, not on our servers. What we send off the device is the sentence you write or speak, so a workout can be generated for it. We do not sell your data, and we do not use it to train AI models. You can delete your account and everything attached to it from inside the app.
1. Who is responsible for your data
Yafa (“the app”) is developed and operated by Annu-Maaria Nivala, Finland, who is the data controller for the purposes of the EU General Data Protection Regulation (GDPR).
Contact for any privacy question or request: yetanotherfitapp@gmail.com.
2. What we collect, and why
| Data | Why it exists | Where it lives |
|---|---|---|
| An anonymous account identifier, created automatically on first launch | So the daily limit on AI generations can be enforced, and so a subscription can be attached to someone without requiring a sign-up first | Firebase Authentication |
| Your email address and name, if you sign in with Apple or Google | To keep your subscription attached to you across reinstalls and devices | Firebase Authentication |
| The workout description you type or speak | It is sent to the AI that writes your workout. This is the request itself — without it there is nothing to generate | Sent to our server and to Anthropic; not stored afterwards |
| A count of how many AI workouts you generated today | To enforce the daily cap that stops automated abuse of the AI | Firestore, keyed to your account identifier |
| Your subscription status and its expiry date | To know whether AI features are unlocked. Decided on our server, not by the app | Firestore + RevenueCat |
| Your saved workouts, workout history, language and guidance settings | They are what the app is for | On your device only — never uploaded |
We do not collect your location, your contacts, your photos, your health records or anything from Apple Health. Yafa does not read or write Apple Health data.
3. Your voice
When you hold the microphone button, the app records audio only for as long as you hold it, and converts it to text using Apple’s speech recognition built into iOS. Depending on your device, your language and your iOS settings, Apple may perform that conversion on the device or on Apple’s servers; that processing is governed by Apple’s privacy policy, and we have no access to it.
Yafa never stores or uploads the audio itself. Only the resulting text is sent onward to build your workout, exactly as if you had typed it. You can avoid speech recognition entirely by using “Type it out” instead, and you can refuse or later revoke microphone and speech permission in iOS Settings without losing any other part of the app.
4. How the AI part works
Your description is sent to our own server function, which forwards it to Anthropic, the provider of the Claude model that writes the workout. The description and the generated workout are processed to answer that single request. We do not keep the text after the workout comes back, and under Anthropic’s commercial terms it is not used to train their models.
Please do not put health details, medical history or anything else sensitive into the description. The app never asks for it and does not need it — “go easy on my knees” is enough.
5. Analytics
There are none. Yafa contains no analytics SDK. Nothing counts which screens you open, how far you get, or what you tap. No app instance identifier is written to your device for measurement, and no behavioural data is sent to Google or to anyone else.
Earlier drafts of this policy described Firebase Analytics, because the app used to include it. It was removed in August 2026, before release, rather than placed behind a consent prompt.
Two things we do see, and they are worth naming so this section is not misleading. Apple gives us anonymous, aggregated App Store statistics such as download counts, which we cannot connect to any individual. And our payment provider tells us the state of subscriptions, because that is what running a subscription requires.
This website counts page views
The app has no analytics. This website has a counter, and it is worth being exact about what that means, because “analytics” usually means something much larger than what happens here.
When you open a page, your browser tells our own server two things: which page it was, and which site you came from, if any. Both are added to a daily total. That is the whole of it.
Nothing identifies you. No cookie is set, nothing is written to your device, no visitor identifier is created, and your IP address and browser details are not stored. Two visits by you and two visits by two strangers are indistinguishable to us. There is no third-party analytics service involved, and nothing here follows you to any other site. This is also why we have no cookie banner: there is nothing stored on your device to ask you about.
6. Payments
Subscriptions are sold and billed by Apple through the App Store. Apple, not Yafa, handles your payment details — we never see your card number or your billing address. We use RevenueCat to receive whether your subscription is active, when it expires, and whether a payment failed, so the app can unlock AI features and so we can tell you if a renewal is about to fail.
7. Legal bases for processing (GDPR Article 6)
- Performance of a contract — your account, your workout description, the AI generation itself and your subscription status. Without these the app cannot deliver what you asked for.
- Legitimate interests — the daily generation cap and basic abuse prevention, so that the service stays affordable and available. Our interest is keeping a small app financially viable; the impact on you is a counter of how many workouts you generated today.
- Consent — notifications. You can withdraw it at any time, in the app or in iOS Settings. Nothing else here rests on consent, because there is no analytics and no advertising to consent to.
8. Who else processes your data
- Google (Firebase) — authentication, database, file storage, serverless functions.
- Anthropic — generates the workout from your description.
- Apple — App Store purchases, and speech recognition as described in section 3.
- RevenueCat — subscription status.
We do not sell personal data, and we do not share it with advertisers or data brokers. There is no advertising in Yafa.
International transfers
Our server functions run in the United States, and the providers above are largely US-based, so your data is transferred outside the European Economic Area. Those transfers rely on the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework, as set out in each provider’s own terms.
9. How long we keep things
- Workout descriptions: not retained after the workout is generated.
- Account identifier, email, subscription status: until you delete your account.
- Daily generation counters: a rolling record per day, removed with your account.
- Everything on your device: deleted when you delete the app.
10. Your rights
Under the GDPR you have the right to access your data, correct it, have it erased, restrict or object to its processing, and receive it in a portable form. To exercise any of them, email yetanotherfitapp@gmail.com — we will answer within one month.
You can delete everything yourself: open Profile in the app and choose to delete your account. That removes your account, your server-side records and the data on your device. It cannot be undone. An active subscription is billed by Apple and must be cancelled separately in your Apple account settings.
If you believe we have handled your data improperly you can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or to the supervisory authority where you live.
11. Children
Yafa is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has provided us data, please contact us and we will delete it.
12. Security
Traffic between the app and our servers is encrypted in transit. The AI provider’s API key is held in Google Secret Manager and never ships inside the app. Access to our Firebase project is protected by two-factor authentication. No system is perfectly secure, but we keep the amount of data we hold deliberately small — the most personal thing in the app, your workout history, never leaves your phone.
13. Changes to this policy
If we change how the app handles data, this page is updated and the date at the top changes with it. Material changes will also be announced in the app.