Stave privacy notice
Who is responsible
The controller of your personal data is Thord Daniel Bjørgård Sørlie, Romolslia 37B, 7029 Trondheim, Norge. Privacy questions go to personvern@stave-gym.site; we answer within 30 days. This notice covers the Stave app and the server it talks to (api.stave-gym.site). It is written to meet Articles 13 and 14 of the GDPR, the Norwegian Personal Data Act, and US state laws such as the CCPA/CPRA.
In short
Your training log lives on your phone. Without an account the app sends us nothing about you beyond anonymous crash and error reports, and what the ads in the free version need (see Advertising). With an account we store what sign-in, friends, challenges and Stave Pro need — and nothing else. Health data (bodyweight, measurements, diet) and the AI coach each require a separate, explicit consent that you can withdraw in the app. We do not sell data about you, and we do not use it to train models.
What we process
Account: email address (or a technical identifier from Google/Apple if you sign in that way), username, display name, when the account was created, sharing choices, and the devices you are signed in from (device name, last used). Passwords, sign-in codes and session keys are stored only as hashes (passwords with salted scrypt), never in clear text.
Training figures: one row per training day for the last 180 days — sessions, sets, reps, volume and personal records — plus the best estimated one-rep max for the five standard lifts on days they were trained. Never individual sets, weights on other exercises, or notes.
Health data (special category, GDPR Art. 9): bodyweight, height, age and sex, when you enter them and have consented. Body measurements and meals (calories, protein, carbohydrate, fat) stay on the phone and are only sent to the AI coach as part of a conversation, never to the database.
AI coach: your questions and a summary of training, body and diet are sent to Anthropic to produce the answer. We store how many tokens the answer cost — not the question, not the answer, unless you report the answer yourself (see Blocking and reports). The chat is stored only on your phone.
Cloud storage: if you turn it on, we store your whole training log as one file, unread by us, until you turn it off or delete the account. The file holds everything the app has: sessions with notes, name, bodyweight, measurements and meals. That is why cloud storage requires the health-data consent, and withdrawing it deletes the file.
Push notifications: the phone's push address (Expo push token), the language the app uses and which features its version has (so a notification uses words your app knows), and, when you start or finish a session, the session name — sent as one line to accepted friends. The session name is not stored.
Cheers: when a friend or a member of a group gives you a cheer for a training day, we store who gave it, to whom and which day, and send a notification. Deleted after 180 days, or with either account.
Leaderboards: each leaderboard is a choice of its own, and you are not on one until you tap «Join». The progress list ranks progress measured against what is usual for your level; the phone then sends your level in each main lift (beginner, intermediate or advanced), which it works out itself. The weight, age and sex the level is based on stay on the phone. The strength list ranks DOTS points, squat, bench and deadlift adjusted for bodyweight; the phone then sends the points, and your bodyweight is shared with your friends. That is health data and needs the health-data consent. If you leave a list, we delete what was sent for it. In older app versions you are on the progress and volume leaderboards if you share lifts.
Gyms and groups: if you choose a gym or join a group, we store that and when. Groups and gyms are public in the app: anyone with an account can find them, see how many members they have and see the leaderboards, where you appear only if you are on the list (see Leaderboards). The name and description you give a group can be seen by everyone. If you report a group, we store the report. You can leave at any time; a group you are alone in is deleted when you leave. A private group is not in search and opens only with the link from someone in it. In a group, members see who is in it (name and username), and the owner and admins can remove members. Challenges in a group are visible to its members; your numbers appear only in those you join yourself. Every group and gym gets a challenge of the month by itself; you are not in it until you tap «Join».
Group feed: in each group you can choose to show your training days to its members. The choice applies to that group only and is off until you turn it on. Members then see the day, number of sets and records for the last 14 days, and can cheer you on. Never weights, exercises or notes. If you turn it off or leave the group, you disappear from the feed at once.
Challenges: some challenge types need a little more from the phone while you are in one that is running: «progress for the level» sends your level in each main lift, and «weeks with the week goal» sends how many sessions a week you aim for. We delete it when no challenge or list you are in uses it any more. A DOTS challenge is only for those on the strength list.
Blocking and reports: if you block someone, we store who blocked whom and when. You then no longer see each other in the app (leaderboards, groups, group feeds, friends, cheers and challenges), and a friendship between you ends. The person you block is not notified, and only you can lift the block. If you report a person, we store whom you reported, the reason you chose, a comment if you write one, and when. If you report an answer from the AI coach, we store the text of the answer as it was shown to you (at most 2000 characters), the reason and when, but not your question. If you report a challenge, we store which one, that you reported it and when. Reports are read only by us, to enforce the terms, and the person reported is not told who reported them. What we do after a report (give someone a neutral name, delete an account, hide or delete a group or challenge) is noted with the time; a note about a name is deleted with the account, and a deleted account is noted without a name.
Invitations: if you use a friend's invitation link, we store who invited you and when, and you become friends. Whoever invited you sees how many of those they invited have joined and how many have bought Pro — numbers, not names, but with one invitee the number can show that you bought. When you first pay for Pro, we mark the reward as given. Deleted with either account.
Payment: that you have Stave Pro, which product, which store, when it expires, and one receipt line per payment (amount, currency, time) from RevenueCat. We never see card numbers or payment details.
Advertising: the free version shows ads from Google AdMob; Stave Pro has none. The first time an ad is due, Google's consent form (TCF) asks whether you want ads tailored to you. If you say yes, Google's ads SDK processes device identifiers and ad data under Google's own privacy policy. If you say no, you get limited ads: Google stores and reads nothing on the phone, uses no device identifier for ads and builds no profile, but sees what any ad request contains (IP address, app and phone model) to deliver the ad, count views and prevent fraud. The device identifier is the phone's advertising ID: the IDFA on iPhone, Google's advertising ID (GAID) on Android. On iPhone the app asks about tracking (Apple's App Tracking Transparency) only when an ad is due. If you say no there, Google does not get the IDFA and you only get non-personalised ads. You change your choice in Google's form under Account → "Privacy options for ads". In older app versions no ads show until you say yes on Stave's own card. You can change the answer at any time in iOS under Settings → Privacy & Security → Tracking. On Android you can delete or reset the advertising ID in the phone's settings.
Exercise animations: the animations are fetched from ExerciseDB's server (static.exercisedb.dev, delivered through Cloudflare) when an animation loads. It then sees the phone's IP address and which animation was fetched, as with any image from the web. We send nothing else there.
Technical: the server keeps a short in-memory log of requests (method, path, status, duration, IP address, app version and which of the hosting provider's data centres took the request) for operations and security; method, path and status are also kept briefly by the hosting provider (Fly.io). IP addresses are used to rate-limit sign-in attempts and are not stored in the database. Without Pro, the app tells the server whether an ad loaded or failed (ad unit, platform, Google's error code and your account id if signed in), so we can debug the ads. If the app crashes, it sends the error message, a short excerpt of where in the code it happened, which screen you were on, the platform and the version number to the server. If the app cannot reach the server, it keeps the same kind of note: which request failed and when, the error text from the phone's network, how long it took, whether the app was open, and what kind of network the phone was on (Wi-Fi, mobile data or VPN, whether it had internet access, and how long since it changed), and sends it once the connection is back. The reports have no account id or device id, and e-mail addresses, IP addresses and long numbers are removed before they are sent. The website stave-gym.site counts visits without cookies: which page, where the visit came from, phone or computer, and language. Unique visitors are counted with a code made from the IP address and browser that is discarded at midnight. We store only daily totals, never the address.
Beta test: if you sign up for the test on stave-gym.site, we keep your e-mail address, chosen platform and the time until the test ends or you ask us to delete it (reply "delete me" to the e-mail). The address is used only to send the test links.
Verified gyms: a gym can ask to be verified on stave-gym.site. We then keep what the person asking enters (name, an e-mail address on the gym's domain, organisation number and the Stave username that will run the gym), and what the Brønnøysund Register Centre says about the business (name, address, website and who holds roles there, such as the managing director). We send a confirmation link to the address. The data is used only to decide the claim, and kept while the gym is verified, or one year after a claim is rejected.
Announcements: a verified gym can post short announcements to its members. We store the text, who wrote it and when, and who cheered it or reported it. Announcements are shown for 60 days.
Import from other apps: if you bring in a training log from Strong, Hevy or another app, the file is read on the phone and stays there. It is not sent to us.
Purposes and legal bases
Providing the service you asked for — account, friends, challenges, leaderboards, group feeds, cheers, announcements, blocking, cloud storage, Stave Pro: contract with you, GDPR Art. 6(1)(b).
Verifying gyms: legitimate interest, Art. 6(1)(f) — that only whoever actually runs a gym can speak for it. The data from the Brønnøysund Register Centre is public.
Health data (bodyweight, height, age, sex, measurements, diet, DOTS points): your explicit consent, Art. 6(1)(a) and Art. 9(2)(a). Without it no health data is stored with us and dietary advice is unavailable.
The AI coach (transfer to Anthropic): consent, Art. 6(1)(a). Without it only the local coach on the phone answers.
Tailored ads: consent, Art. 6(1)(a), through Google's consent form (TCF). Limited ads, without consent: legitimate interest, Art. 6(1)(f). Our interest is funding the free version; yours is protected in that nothing is stored on the phone, no profile is built, and Pro has no ads at all.
Bookkeeping and receipts for Pro: legal obligation, Art. 6(1)(c) (Norwegian Bookkeeping Act).
Security, abuse prevention and debugging (short-lived logs, crash reports, sign-in rate limits): legitimate interest, Art. 6(1)(f). Our interest is keeping the service up and your account safe; the data is minimal and short-lived.
Reports of people and coach answers: legitimate interest, Art. 6(1)(f) — keeping the app free of harassment and harmful answers.
Exercise animations: legitimate interest, Art. 6(1)(f). The phone has to fetch an animation to show it.
Counting new users: legitimate interest, Art. 6(1)(f) — to see where new people give up, so the app can be easier to get started with. The app sends only the name of a step (for example "first workout saved") when you pass it the first time. No id, no account and nothing about your training goes with it, and nothing is stored on the phone for it. We keep only the number per day and platform.
Who we share with
We use processors that handle data on our behalf and under our instructions:
Fly.io, Inc. (USA) — hosting of the server and database. The server and storage are located in Stockholm, Sweden (EEA).
Cloudflare, Inc. (USA) — stores an encrypted backup of the database in the EU (R2). Cloudflare does not have the key and cannot read the content.
Resend, Inc. (USA) — sends the sign-in code and the deletion confirmation to your email.
Anthropic, PBC (USA) — the AI coach. Receives the question and the summary when you use the coach. Anthropic does not use API data to train models.
RevenueCat, Inc. (USA) — subscription status and receipts from the App Store and Google Play.
Apple Inc. and Google LLC (USA) — purchase of Stave Pro, and sign-in if you choose "Sign in with Apple/Google". They are independent controllers for the payment under their own terms.
Expo (650 Industries, Inc., USA) — delivers push notifications to the phone, and fixes to the app (sees the phone's IP address when the app asks for a new version).
Google AdMob (Google LLC, USA / Google Ireland Ltd.) — advertising in the free version, tailored only with consent. For advertising Google is an independent controller.
In addition, ExerciseDB (static.exercisedb.dev, delivered through Cloudflare) receives the phone's IP address when an exercise animation loads. They are not our processor and handle the address under their own terms, and the server may be outside the EEA.
Friends you have accepted see what you chose to share: username, display name, training figures, estimated maxes and — only if you turn it on — bodyweight. The server enforces your choices on the way out. The leaderboards (everyone, per gym and per group) show your name and the number the list measures, for those on it: progress for the level (for example «2.5×») with your level (beginner, intermediate or advanced) and your average progress in per cent, or DOTS points, and in older app versions percentage progress and volume for those who share lifts. If you join a challenge, everyone in it sees the number it measures for you over its period — sessions, volume, records, progress, weeks with the week goal or DOTS — regardless of your sharing choices; joining is the choice. A shared goal also shows how many sessions everyone has together. The group feed shows what you chose to show in that group. If you have Stave Pro, people who see your name in the app — friends, members of the same group, feeds, leaderboards and challenges — see a «Pro» mark by it. They only see that you have Pro, never which product, the price or when it expires. We never sell, rent or share personal data with others for their own purposes. We disclose data to authorities only when the law requires it.
Transfers outside the EEA
Data is stored in Sweden. Some of our processors are US companies, and the AI coach, sign-in email, push and payment status are processed in the USA. Transfers rely on the European Commission's Standard Contractual Clauses (GDPR Art. 46(2)(c)) in our agreements with the providers and, for providers that are certified, on the EU–US Data Privacy Framework (Art. 45). You may request a copy of the clauses at personvern@stave-gym.site. The AI coach additionally requires your consent (Art. 49(1)(a)) because the content may reveal something about your health. Exercise animations may be fetched from servers outside the EEA, which then see the IP address (see Who we share with).
How long we keep it
Sign-in codes: ten minutes. Session keys: until you sign out, sign a device out from Account, or delete the account. Account, training figures, health data, friends and challenges: until you delete the account. Level per lift, week goal and DOTS points: until you leave what uses them. Cheers: 180 days. Announcements: 60 days. Gym verification claims: while the gym is verified, or one year after a rejection. Training figures older than 180 days are deleted on a rolling basis. Cloud storage: until you turn it off or delete the account. Coach usage: per month, deleted with the account. Blocks: until you lift them or either account is deleted. A report of a person: until the reported account is deleted; if you delete your own account, the report stays without your name on it. A report of a coach answer: until you delete the account. Push address: until you delete the account or the address stops working. Pro receipts: five years after the financial year (Bookkeeping Act), with no link to name or email once the account is deleted. Database backups: seven days on the server and 30 days in the encrypted copy at Cloudflare. Crash reports: 90 days. Technical logs: in memory only, gone on restart.
Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability, and to object to processing based on legitimate interest. Consents can be withdrawn at any time without affecting the lawfulness of what happened before.
In the app: "Download my data" under Account gives you everything the server holds about you as one file (access and portability). "Delete account" erases everything at once and sends an email confirmation. Consents and sharing choices are changed under Account and Social. Username and display name you correct yourself.
Otherwise: write to personvern@stave-gym.site. We answer within 30 days. If you disagree with how we handle your data, you can complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no, P.O. Box 458 Sentrum, 0105 Oslo, Norway) or to the supervisory authority in the country where you live.
For users in California and other US states
Categories we collect (CCPA/CPRA): identifiers (email, username, device identifier for push), commercial information (Pro purchases), health information you enter yourself, and in-app activity data. Purposes and recipients are listed above. We do not sell personal information and have not done so in the preceding twelve months. "Sharing" for cross-context behavioral advertising happens only if you consent to tailored ads.
Do Not Sell or Share My Personal Information: choose no under Account → "Privacy options for ads". You then get limited ads only, and no data is shared for targeted advertising. We treat a withdrawn consent as an opt-out from targeted advertising under the laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with similar rules.
You have the right to know, delete, correct and port your information, and not to be discriminated against for exercising these rights. Use the buttons under Account or write to personvern@stave-gym.site. An authorized agent may submit a request on your behalf with written permission. Health information is processed only with your consent, consistent with the Washington My Health My Data Act and similar laws, and is never used for geolocation or advertising.
Children
Stave is not made for children. You must be at least 16 to create an account in the EU/EEA and at least 13 in the USA (COPPA). If we learn that we hold data about someone below the limit, we delete it. Parents and guardians can write to personvern@stave-gym.site.
Automated advice
The AI coach and the local calculations give training suggestions and dietary advice based on your numbers. They are advice, not decisions: nothing in Stave produces legal effects for you or similarly significant effects (GDPR Art. 22). The calorie budget is computed by a fixed formula on the server, and the app refuses to suggest calorie levels below a health-safe minimum.
Security
All traffic is encrypted (TLS). Sign-in codes and session keys are stored as hashes. Sharing choices are enforced on the server, not in the app. The key to the AI provider lives only on the server, never in the app. The database is backed up daily on the same encrypted storage volume, and a copy is encrypted on the server (AES-256) before it is sent to Cloudflare R2 in the EU, so Cloudflare holds only encrypted content. If we discover a breach that poses a high risk to you, we notify you and the supervisory authority within 72 hours.
Changes
If we change this notice it gets a new version number, and the app asks you to read and accept it again the next time you open it. The version is shown at the top of the document.
Contact
Thord Daniel Bjørgård Sørlie, Romolslia 37B, 7029 Trondheim, Norge. Email: personvern@stave-gym.site.