Privacy Policy

1. Who is responsible

Plain Gainz is a strength training app for iPhone and Android. It includes Online Coach, where you can ask a strength coach a question and receive a written answer.

Plain Gainz is run by Tim Enersen through his sole proprietorship TIM ENERSEN (organisation number 922660476). On Google Play, the app is published under the developer name Nordic Gainz. The data controller is:

TIM ENERSEN (org. no. 922660476), developer name on Google Play: Nordic Gainz Heliveien 2, 1820 Spydeberg, Norway plaingainz.norge@gmail.com

If Plain Gainz is later transferred to another company, we will update this policy.

2. Summary

• Your training data, body measurements and photos are stored only on your device. We do not receive them.
• You do not need an account to use the training features.
• Online Coach requires Sign in with Apple (iPhone) or Sign in with Google (Android) and is for users aged 18 or older. We do not ask Apple for your name or email address. Google gives us your email address and, if available, your name and profile picture (section 4.2).
• Online Coach gives advice only on strength training, muscle growth, training programs, exercise technique, load and progression. It does not give medical advice, and you should not include health information in your questions.
• If you use Online Coach, your questions and the answers are stored on our server in the EU (Ireland) so the coach can answer and you can read the answer. Questions are currently answered only by Tim Enersen.
• Payments are handled by Apple on iPhone and by Google Play on Android. We never receive your payment card details.
• We do not sell your personal information and do not use it for advertising. The app contains no advertising or tracking and no analytics tools of its own. RevenueCat, which manages purchases, shows us statistics about purchases and subscriptions (section 5).

3. Information stored only on your device

You can choose to enter the following in the app. It is stored locally in the app's private storage on your device and is not sent to us:

• Workouts: exercises, sets, weights, repetitions, set types, workout times, and your optional rating and comment for a workout
• Workout history, progression and personal records
• Your training program and any custom program or workout
• Profile details: name (optional), profile photo (optional), body weight and weight history, height, year of birth, sex, training goal, experience level and earned badges
• Body measurements
• Progress photos you take with the camera or choose from your photo library
• Daily activity level and calorie estimates calculated from the details above
• Settings such as language and appearance
• Drafts of Online Coach questions you have not yet sent

The app asks for access to the camera and photo library only so you can add progress photos and a profile photo. Photos stay on your device.

This information is used only inside the app, for example to show your history and progress, to suggest weights and repetitions (Smart Coach, which runs on your device), and to estimate calories. It stays on your device until you delete it in the app or delete the app. We cannot access or restore it. Coaches never have access to it.

4. Online Coach

4.1 Age limit and consent

Online Coach is only for users aged 18 or older. Before you can send your first question, you tick two separate boxes in the app. Nothing is ticked in advance:

• One where you confirm that you are 18 or older.
• One where you confirm that you will not include health information and, if your question still contains such information, give your explicit consent to the coach reading it only to assess and, if needed, reject the question (section 4.3).

A link to this policy is shown next to the boxes. Our server stores when you confirmed and consented, and which version of the consent text you accepted, and it refuses new questions and new question purchases without them. If we change the consent text, you will be asked again. The age confirmation is a self-declaration; we do not verify your age.

You can withdraw your consent at any time in the app, just as easily as you gave it, without deleting your account (section 10a). Withdrawing does not affect what was done before you withdrew.

4.2 Signing in

To use Online Coach you sign in with Apple on iPhone or with Google on Android.

With Sign in with Apple, we do not request your name or email address from Apple, so we do not receive them. Apple gives us a unique identifier for your Apple account in this app, which we use to recognise your Online Coach account.

With Sign in with Google, Google gives us a unique identifier for your Google account, your email address and, if your Google account has them, your name and profile picture. We use the identifier to recognise your Online Coach account. The email address, name and profile picture are stored in our sign-in system only because Google provides them; we do not use them to contact you, and they are not shown in the coach view.

Our server stores an account identifier, the Apple or Google identifier linked to it (and, for Google, the email address, name and profile picture), and when the account was created and last signed in. A sign-in session is stored on your device so you stay signed in.

Our hosting providers record technical information such as IP address, time and type of request in server logs and sign-in audit records, for security and to operate the service (see section 9 for how long).

4.3 Questions, answers and health information

Online Coach gives advice only on strength training, muscle growth, training programs, exercise technique, load and progression. It does not give medical advice, diagnoses, injury treatment or advice about illness or other health problems. The app shows this next to the question field and asks you not to include information about illnesses, injuries or other health information.

When you send a question, we store:

• The text of your question and the coach you chose
• The status of the question (for example awaiting payment, paid, answered, rejected or expired) and the dates it was created, paid, answered, rejected or expired
• The coach's answer

If a question still contains health information (special category data under the GDPR), the coach reads it only to assess it, based on your explicit consent (section 4.1). A question that is about health, injuries or illness is rejected: its text is deleted immediately, the question is closed without an answer, and you receive one credit for a new question. You can see in the app that the question was rejected and why. If you would rather have your money back, you can ask Apple or Google Play, wherever you bought it, for a refund.

If a paid question is not answered in time, it expires and you receive one credit for a new question. The app shows how many credits you have, and which questions were paid with a credit. If a purchase is refunded by Apple or Google Play, the credit linked to it is cancelled.

You can delete a question that has not been paid for at any time in the app under My questions. Unpaid questions are deleted automatically 30 days after they were created. Paid questions, purchases and credits are never deleted this way.

Each purchase attempt gets its own number. We store when the attempt started, whether it was cancelled, what your phone reports about the purchase and, if relevant, a one-way hash of the transaction number. If a question is stuck on an unclear purchase, support can check the purchase with RevenueCat and release the question. We then store the number of purchases the check found, who assessed the case, the reason and the time. The question text is not included, and a release never records anything as paid.

4.4 Who answers your question and who can see it

All questions in Online Coach are currently answered by Tim Enersen himself, under the coach name STERKETIM. He is also the data controller and the only person who runs Online Coach and answers questions. He reads your question to answer it; if it contains health information, he reads that only to assess and reject the question. No other coaches or other people at Plain Gainz have access; our service providers process the data only as described in section 6. If other coaches are added later, we will update this policy before they get access.

In the coach view, only paid questions are shown: the question text, its status and dates, whether the payment was a real purchase or a test purchase (Apple or Google Play), and the answer. The coach view does not show your name, email address, Apple ID, Google account, purchase details or any information stored on your device, including your training history. The question is linked only to a pseudonymous account number that does not reveal who you are.

In the administration panel, the data controller can also see unpaid questions and payment status. This is used only to run Online Coach, handle support and payments, and meet legal obligations. The coach panel is protected by password and two-step sign-in.

4.5 Purchases of questions and Premium check

Online Coach requires an active Plain Gainz Premium subscription, and each question is a separate one-time in-app purchase through Apple or Google Play. To confirm a payment, our server checks the purchase with RevenueCat and stores the transaction identifier, product, purchase date, whether it was a real or test (sandbox) purchase, and any refund. To confirm Premium, our server checks with RevenueCat whether your subscription is active and stores the result and expiry date.

4.6 Notifications

You can choose to get a notification on your phone when the coach has answered, and if the coach cannot answer your question because it is outside what Online Coach advises on. The app only asks for permission when you tap "Turn on notifications", and Online Coach works the same without notifications: the answer is always shown under My questions.

If you turn notifications on, we store a notification address for your phone (an Expo push token) and the app language, linked to your Online Coach account. The notification only says that the answer is ready, or that the question could not be answered and that you have received one credit, and contains the question's internal number so the app can open it. It never contains your question, the answer, the reason for rejecting it, your name or any health information. A notification about a rejected question is only sent while the credit is valid. The notification is sent through Expo's push service and, on iPhone, Apple Push Notification service or, on Android, Firebase Cloud Messaging from Google.

The notification address is deleted from our server when you sign out of Online Coach, delete your Online Coach account or withdraw your consent, when the push service reports that it no longer works, and in any case after 180 days without use. You can also turn notifications off at any time in the iPhone Settings app or in the notification settings on your Android device.

5. Subscriptions, free trial and purchases

Premium subscriptions and question purchases are bought through the Apple App Store on iPhone, where Apple processes the payment, and through Google Play on Android, where Google processes the payment. We do not receive or store payment card details.

Any free trial is offered and managed by Apple through the App Store or by Google through Google Play, and the app shows it only when the store offers it to you. Subscriptions renew automatically until cancelled. You can manage or cancel your subscription in your Apple Account settings or, on Android, in Google Play under Payments and subscriptions.

We use RevenueCat to manage subscriptions and purchases. When the app contacts RevenueCat, its software in the app sends purchase and subscription information (such as which products you have bought and whether your subscription is active), an anonymous app user ID, and technical information about your device and the app. This includes the device model, operating system version, language settings, App Store country, app version, whether tracking is allowed on your device (the app never asks for this permission), and Apple's identifier for vendor (IDFV), an identifier for your device that is shared by apps from the same developer. Like any server, RevenueCat also sees the IP address of the connection. We do not use the advertising identifier (IDFA).

On Android, RevenueCat's software sends your purchase history and subscription status, an anonymous app user ID and technical information about the app and your device. The Apple identifiers above are not used on Android. We do not use Google's advertising ID, and we do not use RevenueCat integrations that collect advertising identifiers.

RevenueCat also shows us statistics about purchases and subscriptions, such as a customer's purchase history and overall figures. We use this to run and understand the subscription service, not for advertising.

When you use Online Coach, your Online Coach account identifier is also stored with RevenueCat so our server can confirm that the purchases belong to your account. It is removed when you delete your Online Coach account.

6. Service providers

• Supabase – hosting of the Online Coach database, server functions and sign-in. Data is stored in the EU (Ireland).
• RevenueCat, Inc. (USA) – subscription and purchase management, and statistics about them. See section 5 for what it receives.
• Apple – Sign in with Apple and payments. Apple processes this information as an independent controller under its own privacy policy. Apple Push Notification service delivers notifications to your iPhone if you turn them on.
• Google – Sign in with Google and payments through Google Play on Android. Google processes this information as an independent controller under its own privacy policy. When you delete your Online Coach account, our server sends the confirmation from your new Google sign-in to Google to check it (section 10).
• Google Firebase Cloud Messaging – delivers notifications to your Android device if you turn them on. It uses a Firebase installation ID for your phone to know where to deliver them. For this, Google acts as our data processor under the Firebase Data Processing and Security Terms.
• Expo (650 Industries, Inc., USA) – sends notifications about your questions, if you turn notifications on. When the notification address is created, Expo receives an installation ID for the app, the app's identifier and the push token from Apple (APNs) or Google (Firebase Cloud Messaging) for your phone, and it stores the notification address so notifications can be sent. For each notification, Expo receives the notification address, the fixed notification text and the question's internal number. Like any server, Expo also sees the IP address of the connection. According to Expo, the content of notifications is not stored longer than needed to deliver them.
• Scaleway SAS (France) – runs the web panel where the coach reads and answers questions. The panel runs in Paris and does not store questions or answers; they stay in the Online Coach database.

Supabase, RevenueCat, Expo, Scaleway and Google (for Firebase Cloud Messaging) process personal information on our behalf, as data processors, and only to provide their services. Their data processing agreements are part of their terms of service. We do not send your questions, answers or health information to RevenueCat or Expo.

7. Transfers outside the EEA

Online Coach data is stored in the EU (Ireland), and the coach panel runs in the EU (Paris). Supabase and its subprocessors may access the data from outside the EEA to operate the service; these transfers are covered by the EU Standard Contractual Clauses in Supabase's data processing agreement. RevenueCat and its subprocessors process information in the United States; these transfers are covered by the EU Standard Contractual Clauses in RevenueCat's data processing agreement. Expo processes notification addresses and the related identifiers in the United States; Expo is certified under the EU-U.S. Data Privacy Framework and also uses the EU Standard Contractual Clauses where needed. Google processes information for Sign in with Google and Google Play under its own privacy policy. For Firebase Cloud Messaging, Google may process data in any country where it has facilities; Google LLC is certified under the EU-U.S. Data Privacy Framework, and the EU Standard Contractual Clauses in the Firebase Data Processing and Security Terms apply where needed.

8. Legal basis

• Providing the app and Online Coach, answering your questions and confirming payments: performance of our agreement with you (GDPR Article 6(1)(b)).
• Health information that a question contains despite our request: your explicit consent (GDPR Article 9(2)(a)), limited to assessing and rejecting the question. You can withdraw it at any time (section 10a).
• Keeping accounting records of purchases: legal obligation under the Norwegian Bookkeeping Act (GDPR Article 6(1)(c)).
• Keeping a record of your age confirmation and consent: our legal obligation to be able to demonstrate consent (GDPR Articles 7(1) and 6(1)(c)), and our legitimate interest in being able to establish, exercise or defend legal claims (GDPR Article 6(1)(f)).
• Notifications about your questions: part of the service you choose to turn on (GDPR Article 6(1)(b)). You can turn them off at any time.
• Statistics about purchases and subscriptions in RevenueCat: our legitimate interest in running and understanding the subscription service (GDPR Article 6(1)(f)).
• Resolving purchases that are stuck, and documenting the assessment: our legitimate interest in correcting errors and being able to defend legal claims (GDPR Article 6(1)(f)).
• Security, server logs, two-step sign-in for the coach panel and preventing misuse, such as limiting test purchases: our legitimate interest in a secure and reliable service (GDPR Article 6(1)(f)).

9. How long we keep information

• Information on your device: until you delete it or delete the app.
• Sign-in information (the Apple or Google identifier, and for Google your email address, name and profile picture): as long as you have your Online Coach account, then deleted as described in section 10.
• Online Coach questions and answers: as long as you have your Online Coach account. When you delete the account or withdraw your consent, their text is deleted as described in sections 10 and 10a.
• Unpaid questions: until you delete them, or at most 30 days after they were created, then deleted automatically.
• Premium check results: 90 days, then deleted.
• Purchase records required for bookkeeping: five years after the end of the financial year (calendar year, Norwegian time), then deleted. Only a one-way checksum of the transaction number is kept, so a deleted purchase cannot be registered again.
• Technical records of purchase notifications from RevenueCat: 12 months, then deleted.
• Notification address for your phone, on our server: until you sign out, delete your account or withdraw your consent, and at most 180 days without use. Expo keeps the address it stores for as long as reasonably necessary, according to its privacy policy.
• Information at RevenueCat: while we use RevenueCat, under our data processing agreement with it.
• Purchase attempts, reports about them and checks that did not lead to a release: 90 days, then deleted, but not while the question is awaiting payment.
• Releases made by support, with the check behind them: 3 years, as documentation in case of legal claims, then deleted, but not while the question is awaiting payment.
• Record that a notification was sent (contains no text): 30 days, then deleted.
• Sign-in audit records in our database: 90 days, then deleted.
• Record of your age confirmation and consent (when you confirmed, consented and withdrew, and the version of the consent text): kept while your consent is active, and for 3 years after you withdraw your consent or delete your account, whichever happens first, as documentation of your consent and in case of legal claims (3 years is the general limitation period under Norwegian law). It contains no questions, answers or health information. It is then deleted automatically. If you still have your account, you will be asked for consent again before your next question.

Deletion runs automatically every night.

• Server logs at our hosting providers (Supabase and Scaleway): at most 7 days.
• Backups: our hosting provider may keep backups of the database for up to 7 days, so deleted information may remain in a backup for up to 7 days.
• Before larger updates to Online Coach, we may take an extra copy of the Online Coach data. It is stored encrypted on the data controller's computer, is used only to restore the service if something goes wrong, and is deleted within 30 days.

10. Deleting your Online Coach account

You can delete your Online Coach account in the app: Online Coach → Online Coach account → Delete Online Coach account. You confirm by signing in again with Apple or Google, and we then:

• If you use Sign in with Apple: revoke the Sign in with Apple authorization for Plain Gainz
• If you use Sign in with Google: check with Google that the new sign-in belongs to the same Google account, and delete nothing if it does not. We do not remove Plain Gainz from your Google account; you can do that yourself in your Google Account settings
• Delete unpaid questions
• Delete the text of your other questions and the answers (it is replaced with "[Slettet]", Norwegian for "deleted")
• Close paid questions that have not been answered (they will not be answered)
• Delete stored Premium checks and cancel unused credits
• Delete purchase attempts, reports and checks, and the reason in releases (the release is kept for the period in section 9)
• Delete the notification address for your phone
• Remove the link between your account and RevenueCat in our records, and the app removes the Online Coach account identifier stored with RevenueCat (if your device is offline, this is completed the next time you open Online Coach)
• Remove your Apple or Google identifier, and for Google your email address, name and profile picture, from our sign-in system

Purchase records needed for bookkeeping and the record of your consent are kept, without the link to RevenueCat, for the periods in section 9. Deleting the Online Coach account does not delete training data on your device and does not cancel your Premium subscription, which you manage with Apple or Google Play.

You can also ask us to delete your Online Coach account without using the app, by emailing plaingainz.norge@gmail.com (section 11).

10a. Withdrawing your consent without deleting your account

You can withdraw your consent at any time in the app: Online Coach → Withdraw consent. You confirm once, and we then:

• Stop new questions and new question purchases until you consent again
• Delete unpaid questions
• Delete paid questions that have not been answered. The payment can be used for a new question after you have consented again. If the question was paid with a credit, you can use the same credit again. You do not receive a new credit
• Delete the text of your other questions and the answers (it is replaced with "[Slettet]", Norwegian for "deleted"). Answered questions do not give a new payment
• Delete the notification address for your phone

Your account, purchases, credits and Premium subscription are kept, and a record that you gave and withdrew consent (times and version) is kept as documentation (section 9). You can consent again the next time you ask a question.

11. Your rights

You have the right to access, correct and delete your personal information, to receive a copy of it, to object to or restrict our use of it, and to withdraw consent at any time. To make a request, email plaingainz.norge@gmail.com. If you use Sign in with Apple, we do not know your name or email address, so we may ask you to confirm the request from the app or with information that links you to your account. If you use Sign in with Google, we may ask you to write from the email address of that Google account. We answer within one month.

You can complain to the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no) or to the data protection authority where you live.

12. Not medical advice

Online Coach answers, weight suggestions and calorie estimates are general training guidance. They are not medical advice, diagnosis or treatment and do not replace advice from a doctor, physiotherapist or other health professional. Online Coach does not give medical advice, diagnoses, injury treatment, advice about illness or dietary advice; questions about these are rejected (section 4.3). Stop training and seek medical help if you feel pain or are unwell.

13. Children

The training features of Plain Gainz are not directed at children, and Online Coach is only for users aged 18 or older. We do not knowingly collect personal information from children.

14. Changes to this policy

We may update this policy when the app or the way it handles information changes. The date at the top shows when it was last updated. If a change affects what you consented to, the app asks for your consent again.

15. Contact

Tim Enersen (Plain Gainz)
Heliveien 2, 1820 Spydeberg, Norway
plaingainz.norge@gmail.com