Kachalochka Privacy Policy
Summary
Kachalochka keeps a log of your gym workouts and body measures. When you sign in, we store them so they sync between your devices, and show your workouts, never your measures, to the members of groups you join and to a parent you link as your guardian. We use your data only to provide that service.
There are no ads, no analytics and no crash reporting, and we never sell your data or share it for marketing.
What we collect
- From Google sign-in: your e-mail address, your name, your profile picture link and your Google account identifier. The e-mail address tells your accounts apart in the app’s account menu; the name is shown to members of your groups until you set a nickname. The authentication service also records when you sign in and from which IP address.
- Your profile: your nickname, which friends see instead of your Google name; your sex, year of birth and height, if you enter them for the body-fat calculator; and the colours you pick for friends.
- What you record: your machines (name, setup note, weight settings and unit), the photos you add to them, and their links to friends’ machines, your visits (the day of each and when it was recorded) and your sets (weight, repetitions and the time each was recorded) and your workout plans. Photos are shrunk before they are stored.
- Body measures: your weight, girths, body fat and any measures you add, with the day of each value.
- Groups: the groups you create or join, their names and invite codes, who belongs to each, and the name its members see: your nickname, or your Google name if you set none.
- Guardian links: whom you link as a guardian, or who links you, and when, and the one-time codes that make a link until they are used or expire a day later.
- Technical data: the sign-in tokens that keep you signed in, and the request logs, including IP addresses, that our hosting providers keep to run and secure their services.
Where it is stored
- Android: on your device. Without an account nothing is sent to our backend. When you first sign in, what you recorded without an account is added to that account; from then on, what you record is synced to our backend. When several accounts are signed in on one device, each keeps its own data. Android’s own backup may copy the app’s data, including your sign-in, to your Google account and to a new phone you transfer to.
- Web: in our backend only. Your browser keeps just your sign-in session and your theme choice.
Who can see it
You see your own data. When you join a group, its members see your nickname, your visits, your machines with their photos and how your machines are linked to theirs, read-only; they never see your body measures or your profile details, and nobody but you, or a guardian you link, can change your data. Leaving a group, or its owner deleting it, stops the sharing. There is no public profile, and nothing is shared outside the groups you join and a guardian you link.
If you enter a parent’s code in “Родители” (Parents), that person becomes your guardian in the app: they can see and record your visits, sets, machines with their photos and links, and plans, as your own account does. They see your nickname and picture, as group members do, but never your body measures, the rest of your profile or your groups. A code works once, within a day, and links only the account that enters it. You or the guardian can end the link at any time, in “Родители” or “Дети” (Children). What the guardian recorded stays in your account, and your account’s rows are removed from the guardian’s devices.
When you share a visit as text, the app hands it, headed by your nickname, to the app or clipboard you choose; where it goes from there is up to you.
Service providers
We rely on these providers. Each processes data under its own privacy policy and may do so in countries other than yours.
- Supabase hosts the database and the photos, and handles authentication.
- Google provides sign-in.
- GitHub hosts the web app and the Android app’s downloads.
Kachalochka’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Retention and deletion
- We keep your data for as long as your account exists.
- When you delete a visit, a set, a measure or a day’s values in the app, it disappears from the app, but the record stays on our servers, marked deleted, until your account is deleted. The same goes for groups you delete or leave. A photo you remove is deleted from storage.
- Signing out removes the account from that device’s account list. Its data stays on our servers, so signing back in finds it again. On Android its records also stay on the device, hidden from the other accounts, until the app’s data is cleared or the app is uninstalled.
- To delete your account and all the data tied to it, choose “Удалить аккаунт” (Delete account) in the app’s settings, on Android or on the web. Your photos, your account and everything recorded under it are deleted from our servers at once, and on Android from that device too. Deleting an account also ends its guardian links, and its rows leave the guardian’s devices on their next sync. If you can no longer sign in, open an issue asking for deletion. Do not put your e-mail address or any other personal data in the issue: we reply there and confirm the account with you privately before deleting it. Deletion is completed within 30 days of the request. A machine a group member copied from you belongs to their account and stays with it.
- On Android, data recorded without an account is removed by uninstalling the app or clearing its data.
Security
Every request between the app and our backend is encrypted with HTTPS. Row-level security in the database lets an account read only its own data, that of the groups it belongs to and that of the accounts it is the guardian of.
Permissions
The Android app asks for no runtime permissions. Its manifest declares network access, and the permissions its libraries need for background sync and Google sign-in. Photos come from the phone’s own camera app or photo picker, which hand over only the picture you take or choose; the web app reads only the file you pick.
Children
Kachalochka is for people aged 13 and over. A teenager signs in with their own Google account on their own device; where Google’s Family Link supervises that account, their parent may need to allow the app once. A parent who trains with them can then be linked as their guardian, as described under “Who can see it”.
Changes
We publish any change to this policy on this page with a new effective date. Its full history is public in the repository.
Contact
Questions and requests go to the repository’s issues.