Genova Privacy Policy

PRIVACY POLICY

Last updated September 20, 2026

This Privacy Notice for Kirill Hundoryn (doing business as Genova) ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

Visit our website at https://genovasport.app or any website of ours that links to this Privacy Notice

Download and use our mobile application (Genova - AI Workout Tracker), or any other application of ours that links to this Privacy Notice

Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at support@genovasport.app.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? Some of the information may be considered "special" or "sensitive" in certain jurisdictions, including health data and account login credentials. We may process sensitive personal information when necessary with your consent or as otherwise permitted by applicable law. Learn more about sensitive information we process.

Do we obtain personal information from other sources? We do not obtain personal information from data brokers, purchased lists, public records, scraping tools, or similar indirect sources. We may receive limited information through user-authorized services and from service providers that help deliver the Services, as described in this Privacy Notice.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your personal information.

How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.

How do you exercise your rights? The easiest way to exercise your rights is by visiting https://genovasport.app/support, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?

2. HOW DO WE PROCESS YOUR INFORMATION?

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

6. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

8. HOW LONG DO WE KEEP YOUR INFORMATION?

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

10. WHAT ARE YOUR PRIVACY RIGHTS?

11. CONTROLS FOR DO-NOT-TRACK FEATURES

12. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

13. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?

14. APPLE HEALTHKIT INTEGRATION

15. LOCAL DEVICE STORAGE AND ACCOUNT DELETION

16. PUSH NOTIFICATION DEVICE TOKENS

17. AI DATA PROCESSING DETAILS

18. SOCIAL FEATURES AND USER INTERACTIONS

19. CHILDREN’S PRIVACY

20. WEBSITE-SPECIFIC DATA PRACTICES

21. AGE ASSURANCE

22. APP PRODUCT ANALYTICS

23. DO WE MAKE UPDATES TO THIS NOTICE?

24. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

25. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?
Personal information you disclose to us
In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

email addresses

usernames

passwords

contact or authentication data

birthdate

height

weight

fitness level

fitness goals

body measurements

avatar images

names

contact preferences

workout, exercise and cardio records

training plans and schedules

ai chat messages and prompts

recovery and wellness check-ins

profile biography and social comments

feedback, bug reports and support messages

website quiz and onboarding responses

app settings and preferences

parental or guardian consent records

health and performance reference

social connections and interactions

Sensitive Information. When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information:

health data

account login credentials (email address and password)

Payment Data. Purchases and subscriptions are processed through Apple’s in-app purchase system. Genova does not receive or store card numbers, security codes, or billing details. Apple processes payment information under its privacy notice. RevenueCat receives purchase and subscription information needed to validate purchases and manage access, but it does not receive payment-card details.

Application Data. If you use our application(s), we also may collect the following information if you choose to provide us with access or permission:

Mobile Device Access. We may request access or permission to certain features from your mobile device, including your mobile device's apple healthkit, microphone, speech recognition, photo library, sensors, and other features. If you wish to change our access or permissions, you may do so in your device's settings.

Mobile Device Data. Depending on the feature you use, limited technical information may be processed to operate, secure, and troubleshoot the app. A device token is processed for push-notification delivery. RevenueCat processes device type and operating-system information for subscription management. Ordinary service requests temporarily process information such as an IP address. If you enable Error Reporting, Sentry may receive limited technical crash information, such as app version, operating system, and device model. Genova does not request precise geolocation, and these data categories are not all processed in every situation.

Push Notifications. We may request to send you push notifications regarding your account or certain features of the application(s). If you wish to opt out from receiving these types of communications, you may turn them off in your device's settings.

This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for our internal analytics and reporting purposes.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected
In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies. You can find out more about this in our Cookie Notice: https://genovasport.app/cookies.

The information we collect includes:

Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called "crash dumps"), and hardware settings).

Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.

2. HOW DO WE PROCESS YOUR INFORMATION?
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We process the personal information for the following purposes listed below. We may also process your information for other purposes only with your prior explicit consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order. (Retention period: For the life of the account and until account deletion is completed. Limited backups, deletion records, security logs, and legally required records may remain temporarily.)

To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service. (Retention period: While the account is active or until the user deletes the relevant data. Limited backups and provider records may remain temporarily under their retention schedules.)

To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service. (Retention period: Until the inquiry and reasonable follow-up are completed, and longer only when needed for security, disputes, or legal obligations.)

To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information. (Retention period: While the account is active and as needed to send service, security, policy, subscription, or account notices. Related records follow account-deletion or provider-retention schedules.)

To fulfill and manage your orders. We may process your information to fulfill and manage your orders, payments, returns, and exchanges made through the Services. (Retention period: While needed to manage the subscription and account. RevenueCat customer data is deleted through account deletion; Apple retains App Store transaction records under its own rules.)

To enable user-to-user communications. We may process your information if you choose to use any of our offerings that allow for communication with another user. (Retention period: Until the user deletes the content, the account is deleted, or the record is no longer needed for moderation, safety, or legal purposes.)

To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services. (Retention period: Until the feedback is deleted or anonymized. Account-linked feedback is also deleted through account deletion.)

To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention. (Retention period: Genova website rate-limit records become eligible for deletion after 48 hours and are normally deleted during the next daily cleanup. Other security and service logs follow provider schedules and may be kept longer when required for security or law.)

To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them. (Retention period: Until the analysis is no longer needed, after which the data is deleted or anonymized. Provider records follow the applicable provider retention schedules.)

To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.

Cloud sync. Supported account and app data, including account information, settings and preferences, workout records, cardio summaries, training plans, consent records, social data, and derived training or recovery values, may be synchronized with Supabase to provide the Services, restore supported data, and make it available across devices. Current app versions keep raw Apple Health samples, body-measurement history, exact birthdate, height, the health and performance reference, goal measurement baselines, per-set bodyweight values, and pre-workout freshness snapshots only on the device. These categories are not included in Genova cloud backup or cross-device restoration. Earlier app versions may have synchronized some of this information. Historical cloud copies may remain until deleted under the retention and account-deletion practices described in this Policy.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. You can withdraw your consent at any time. Learn more about withdrawing your consent.

Health data and explicit consent. Where the GDPR or UK GDPR applies, Genova relies on your explicit consent under Article 9(2)(a), together with consent under Article 6(1)(a), to process the health and fitness information described in this Privacy Notice and the Health & Fitness Data Privacy Notice for personal training, plans, workouts, progress, recovery, and account synchronization. Apple Health and AI features require their own additional permissions or consent. You may refuse or withdraw Genova's health-data consent at any time. Without it, Genova's private app features are paused until you consent again. Withdrawal does not automatically delete information already collected; account deletion is a separate action.

Performance of a Contract. We may process your personal information when we believe it is necessary to fulfill our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.

Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, we may process your personal information for some of the purposes described in order to:

Analyze how our Services are used so we can improve them to engage and retain users

Diagnose problems and/or prevent fraudulent activities

Understand how our users use our products and services so we can improve user experience

Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.

Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way

For investigations and fraud detection and prevention

For business transactions provided certain conditions are met

If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim

For identifying injured, ill, or deceased persons and communicating with next of kin

If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse

If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province

If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records

If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced

If the collection is solely for journalistic, artistic, or literary purposes

If the information is publicly available and is specified by the regulations

We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
In Short: We may share information in specific situations described in this section and/or with the following third parties.

Vendors, Consultants, and Other Third-Party Service Providers. We use third parties to provide and support the Services. Their legal roles differ. Some process personal information on our behalf under our instructions and applicable agreements. Others, including certain platform providers, may process information independently under their own terms. They may use authorized subprocessors or disclose information when permitted or required by law. We limit the information we provide to what is reasonably necessary for each purpose and require appropriate protections where applicable.

The third parties we may share personal information with are as follows:

AI Service Providers

OpenAI

Functionality and Infrastructure Optimization

Termly.io

Invoice and Billing

Apple App Store

Website Hosting

Vercel

Authentication

Apple Inc. — Sign in with Apple

Authentication, backend, database, file storage, and first-party analytics processing

Supabase

Subscription management and purchase validation

RevenueCat

Push notification delivery

Apple Push Notification service (APNs)

Internet connectivity checking

Google LLC

Importing and exporting health, workout, and body-measurement data at the user’s request

Apple Health / HealthKit

Mobile app crash and error monitoring, only after user consent

Sentry

Beta app distribution and testing

TestFlight

Transactional authentication email delivery

Resend

We also may need to share your personal information in the following situations:

Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Other Users. Information you choose to make visible through Genova’s optional social features may be seen by other authenticated users according to the feature and your settings. Search results may show limited profile information; accepted friends may see the profile and statistics described in Section 18; and workouts you explicitly share may be shown to the intended social audience. Account deletion begins removal of account-linked social data, subject to asynchronous cleanup and limited safety or legal retention. Copies made by other users or third parties may remain outside Genova’s control.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
In Short: We may use cookies and other tracking technologies to collect and store your information.

We use cookies and similar technologies for essential functions, service protection, preferences, and consent-based analytics. We do not use them for advertising, retargeting, or advertisements tailored to your interests. More information and consent choices are available in our Cookie Notice: https://genovasport.app/cookies.

6. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?
In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.

As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). These tools are designed to enhance your experience and provide you with innovative solutions. The terms in this Privacy Notice govern your use of the AI Products within our Services.

Use of AI Technologies

We provide the AI Products through third-party service providers ("AI Service Providers"), including OpenAI. As outlined in this Privacy Notice, your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products for purposes outlined in "WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?" You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.

Our AI Products

Our AI Products are designed for the following functions:

AI bots

AI insights

AI predictive analytics

How We Process Your Data Using AI

Personal information used by our AI features is handled as described in this Privacy Notice, including Section 17. We use technical and organizational safeguards designed to protect it, but no transmission or storage method can be guaranteed completely secure.

How to Opt Out

We believe in giving you the power to decide how your data is used. To opt out, you can:

Decline the AI consent prompt when first accessing the AI Coach feature

Go to Settings → Privacy, Terms & Permissions → Manage AI Data → Revoke AI consent

7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: We may transfer, store, and process your information in countries other than your own.

Genova is based in Poland. We use service providers in the European Economic Area and in other countries. The location of processing depends on the service, feature, and provider or subprocessor involved. This means personal information may be transferred to and processed in a country other than the country where you live.

Where applicable law requires safeguards for an international transfer, we rely on the transfer mechanism that applies to the relevant provider and transfer. Depending on the transfer, this may include an adequacy decision, the European Commission’s Standard Contractual Clauses, or another mechanism permitted by law. You may contact us using the details in this Privacy Notice to request more information about safeguards that apply to a particular transfer.

8. HOW LONG DO WE KEEP YOUR INFORMATION?
In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). If you are located in the EU or UK, see section "HOW DO WE PROCESS YOUR INFORMATION?" for our retention periods by purpose.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?
In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

10. WHAT ARE YOUR PRIVACY RIGHTS?
In Short: Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. If a decision that produces legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.

We will consider and act upon any request in accordance with applicable data protection laws.

If you are located in the UK and are unhappy with how we have handled your personal information, you can make a complaint directly to us. This is in addition to the rights you have under the UK General Data Protection Regulation and the Data Protection Act 2018.

How to contact us:

Email: support@genovasport.app

Post: See "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?"

What happens after you complain

We will acknowledge your complaint within 30 days of receiving it.
We will investigate without unjustifiable or excessive delay.
We will keep you informed of progress and explain the outcome.

If you are not happy with our final response, you can refer your complaint to the Information Commissioner's Office, the UK supervisory authority.

Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.

If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below or updating your preferences.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.
Account Information
If you would at any time like to review or change the information in your account or terminate your account, you can:

To update your profile, open Profile and tap Edit Profile. To delete your account and all associated data, go to Settings → Data & Privacy → Manage data → Delete account & all data.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services. For further information, please see our Cookie Notice: https://genovasport.app/cookies.

If you have questions or comments about your privacy rights, you may email us at support@genovasport.app.

11. CONTROLS FOR DO-NOT-TRACK FEATURES
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard specifically for DNT has been finalized, so we do not currently respond to DNT browser signals. This statement concerns DNT only and does not limit any obligation to recognize a legally required opt-out preference signal. Genova does not currently sell personal information or share it for cross-context behavioral advertising. If our practices or applicable requirements change, we will update this Privacy Notice.

California and other applicable laws may require recognition of certain opt-out preference signals when a business sells or shares personal information or uses it for targeted advertising. Genova does not currently engage in those practices.

12. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.
Categories of Personal Information We Collect
The table below shows the categories of personal information we have collected in the past twelve (12) months. The table includes illustrative examples of each category and does not reflect the personal information we collect from you. For a comprehensive inventory of all personal information we process, please refer to the section "WHAT INFORMATION DO WE COLLECT?"

Category	Examples	Collected
A. Identifiers	Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name	YES
B. Personal information as defined in the California Customer Records statute	Name and other account information within this statutory category. Genova does not collect billing addresses, payment-card numbers, or bank-account details	YES
C. Protected classification characteristics under state or federal law	Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data	YES
D. Commercial information	Purchase history, subscription status, and entitlement information. Payment-card details are processed by Apple and are not received by Genova	YES
E. Biometric information	Fingerprints and voiceprints	NO
F. Internet or other similar network activity	Browsing history, search history, online behavior, interest data, and interactions with our and other websites, applications, systems, and advertisements	YES
G. Geolocation data	Approximate location inferred from an IP address; Genova does not collect precise GPS location	YES
H. Audio, electronic, sensory, or similar information	Images and audio, video or call recordings created in connection with our business activities	YES
I. Professional or employment-related information	Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us	NO
J. Education Information	Student records and directory information	NO
K. Inferences drawn from collected personal information	Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics	YES
L. Sensitive personal Information	Account login information and health data	YES

We only collect sensitive personal information, as defined by applicable privacy laws or the purposes allowed by law or with your consent. Sensitive personal information may be used, or disclosed to a service provider or contractor, for additional, specified purposes. You may have the right to limit the use or disclosure of your sensitive personal information.

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

Receiving help through our customer support channels;

Participation in customer surveys or contests; and

Facilitation in the delivery of our Services and to respond to your inquiries.

We will use and retain the collected personal information as needed to provide the Services or for:

Category A - Account identifiers are kept while the account is active and deleted through the account-deletion process. Browser-level identifiers associated with feedback, consent, security, or service records are kept until the related record is deleted or anonymized, or according to the applicable provider retention schedule.

Category B - Account-linked information is kept while the account is active and deleted through the account-deletion process. Limited backups, deletion records, consent records, security and service logs, and legally required records may remain temporarily under applicable retention schedules.

Category C - Account-linked characteristics are kept while the account is active and deleted through the account-deletion process. Limited backups, service logs, and provider records may remain temporarily under their applicable retention schedules.

Category D - Subscription and entitlement information is kept while needed to manage the subscription and account. RevenueCat customer data is deleted through the account-deletion process. Apple retains App Store transaction records under its own retention and legal requirements.

Category F - Internet-activity information is kept only while needed for analytics, security, and service operation, then deleted or anonymized. Genova website rate-limit records become eligible for deletion after 48 hours and are normally deleted during the next daily cleanup, while provider records follow their applicable retention schedules.

Category G - Approximate location may be inferred from IP addresses. We do not collect precise GPS location. This information is retained only as long as necessary for security, consent management, and service delivery, then deleted or anonymized.

Category H - Avatar images are stored locally and in Supabase until replaced or the account-deletion process is completed. Limited backups may remain temporarily under Supabase’s retention schedule. Photos selected as share-card backgrounds are not uploaded to Genova’s servers. Generated share-card images are written to temporary device storage and may remain until iOS removes them; they are shared only with destinations chosen by the user. Voice audio is processed on-device for transcription and is not uploaded or stored by Genova; only the transcript is used if the user chooses to send it.

Category K - Account-linked training scores, recovery assessments, recommendations, and AI insights are kept while the account is active or until the related data is deleted. They are deleted through the account-deletion process. Limited backups and provider records may remain temporarily under Supabase’s and OpenAI’s applicable retention schedules.

Category L - Account login information and account-linked health or age data are kept while the account is active or until the relevant data is deleted. Historical data relating to users known to be under 16 follows the same rule. Data is deleted through the account-deletion process. Limited backups, security logs, and provider records may remain temporarily under applicable retention schedules.

Sources of Personal Information
Learn more about the sources of personal information we collect in "WHAT INFORMATION DO WE COLLECT?"How We Use and Share Personal Information
Learn more about how we use your personal information in the section, "HOW DO WE PROCESS YOUR INFORMATION?"

Will your information be shared with anyone else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information to in the section, "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.

We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed the following categories of personal information to third parties for a business or commercial purpose in the preceding twelve (12) months:

Category A. Identifiers

Category B. Personal information as defined in the California Customer Records law

Category C. Characteristics of protected classifications under state or federal law

Category D. Commercial information

Category F. Internet or other electronic network activity information

Category G. Geolocation data

Category H. Audio, electronic, visual, and similar information

Category K. Inferences drawn from collected personal information

Category L. Sensitive personal information

The categories of third parties to whom we disclosed personal information for a business or commercial purpose can be found under "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"

Your Rights
You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

Right to know whether or not we are processing your personal data

Right to access your personal data

Right to correct inaccuracies in your personal data

Right to request the deletion of your personal data

Right to obtain a copy of the personal data you previously shared with us

Right to non-discrimination for exercising your rights

Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California’s privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")

Depending upon the state where you live, you may also have the following rights:

Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)

Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware, and Maryland)

Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon)

Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)

Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Connecticut and Minnesota)

Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)

Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida)

How to Exercise Your Rights
To exercise these rights, you can contact us by visiting https://genovasport.app/support, by emailing us at support@genovasport.app, or by referring to the contact details at the bottom of this document.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.
Request Verification
Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.
Appeals
Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at support@genovasport.app. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.

13. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?
In Short: You may have additional rights based on the country you reside in.

Australia and New Zealand

We collect and process your personal information under the obligations and conditions set by Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020 (Privacy Act).

This Privacy Notice satisfies the notice requirements defined in both Privacy Acts, in particular: what personal information we collect from you, from which sources, for which purposes, and other recipients of your personal information.

If you do not wish to provide the personal information necessary to fulfill their applicable purpose, it may affect our ability to provide our services, in particular:

offer you the products or services that you want

respond to or help with your requests

manage your account with us

confirm your identity and protect your account

At any time, you have the right to request access to or correction of your personal information. You can make such a request by contacting us by using the contact details provided in the section "HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?"

If you believe we are unlawfully processing your personal information, you have the right to submit a complaint about a breach of the Australian Privacy Principles to the Office of the Australian Information Commissioner and a breach of New Zealand's Privacy Principles to the Office of New Zealand Privacy Commissioner.
Republic of South Africa
At any time, you have the right to request access to or correction of your personal information. You can make such a request by contacting us by using the contact details provided in the section "HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?"

If you are unsatisfied with the manner in which we address any complaint with regard to our processing of personal information, you can contact the office of the regulator, the details of which are:

The Information Regulator (South Africa)

General enquiries: enquiries@inforegulator.org.za

Complaints (complete POPIA/PAIA form 5): PAIAComplaints@inforegulator.org.za & POPIAComplaints@inforegulator.org.za

14. APPLE HEALTHKIT INTEGRATION
Genova integrates with Apple HealthKit only after you grant permission through Apple’s authorization screen. Depending on the permissions you choose, Genova may read sleep, heart-rate variability, resting heart rate, heart rate, cardio fitness (VO2 max), body mass, body-fat percentage, waist circumference, workouts, active energy, cardio distance, and workout-effort data. Genova may write workouts, active energy, body mass, body-fat percentage, waist circumference, cardio distance, and workout-effort data to Apple Health. HealthKit data is used to provide workout, recovery, progress, and personalization features. Some HealthKit-derived data may be stored locally or synchronized with Genova’s backend and, if you consent to AI features, included in AI requests as described below. Genova does not sell HealthKit data or use it for advertising. You may change or revoke Health permissions in Apple Health settings. Revoking access stops future access but does not automatically remove data already stored by Genova. Removing data that Genova wrote to Apple Health is a separate action available in the app’s data-management settings.

15. LOCAL DEVICE STORAGE AND ACCOUNT DELETION
Genova uses an offline-first architecture. Account-scoped data, such as workouts, exercise history, body measurements, settings, and preferences, is stored on your device and may also be synchronized with Genova’s backend. When an account-deletion request is accepted, Genova clears account-scoped local data and begins deleting account-linked backend data. Some remote cleanup may continue asynchronously. Limited records may be retained where required or permitted by law, for security, dispute prevention, or financial and accounting obligations. Uninstalling the app does not by itself delete your Genova account or backend data.

16. PUSH NOTIFICATION DEVICE TOKENS
Genova collects an Apple Push Notification service (APNs) device token and associates it with your account solely to deliver notifications. Apple receives the token and notification information required to deliver the notification. When you log out, the app attempts to mark the current token inactive. Account deletion includes the token in account cleanup. Inactive tokens are subject to Genova’s backend retention cleanup. You can disable notifications at any time in iOS Settings.

17. AI DATA PROCESSING DETAILS
To provide AI-generated workout programs, post-workout insights, and coaching, Genova may send OpenAI data relevant to your request, such as chat messages, workout and training history, body measurements, fitness goals, experience level, and recovery or health metrics. The exact data depends on the feature you use. Genova sends OpenAI Responses API requests with provider response storage disabled (store: false), so the generated response is not kept as ordinary Responses API application state. This is not Zero Data Retention. Under OpenAI’s default data controls, abuse-monitoring logs may contain API inputs and outputs for up to 30 days, or longer when required by law or reasonably necessary to protect OpenAI’s services or a third party from harm. OpenAI may also temporarily retain encrypted prompt-cache data for up to 24 hours. OpenAI does not use API data to train its models by default unless the customer opts in. Genova may separately store chat messages and AI memory in its backend until you delete them or delete your account, subject to the deletion and retention practices described in this Policy. AI features require consent. You may decline the initial AI consent prompt, revoke consent under Settings → Data & Privacy → Privacy, Terms & Permissions → Manage AI Data, and delete AI memory entries. AI output may be inaccurate and is not medical advice.

18. SOCIAL FEATURES AND USER INTERACTIONS
Genova offers optional social features. To use them, you set a username. Authenticated users may search for you by username; search results may show your username, display name, and avatar. Accepted friends may see your display name, username, avatar, biography, fitness level, account creation date, and eligible social or training statistics. Statistics protected by the Hide Profile Statistics setting are not shown to other users. If you explicitly share a workout or session to the social feed, the selected content is visible to the intended social audience, and other users may react or comment. Blocking limits certain visibility and interactions. Reports may be reviewed for safety and moderation. Do not include sensitive information in your username, biography, comments, or shared content. Account deletion begins removal of account-linked social data, subject to asynchronous cleanup and any limited safety or legal retention.

19. CHILDREN’S PRIVACY
Our Services are not intended for children under 16 years of age, and users under 16 may not create an account or use the Services. We do not knowingly collect personal information from children under 16. Genova may retain historical parental or guardian approval confirmations collected through earlier app registration flows for some users aged 16 or 17. These historical records are handled according to the retention and account-deletion practices described in this Policy. If you are a parent or guardian and believe that a child under 16 has provided us with personal information, please contact us at support@genovasport.app. We will investigate and take appropriate steps to delete the information.

20. WEBSITE-SPECIFIC DATA PRACTICES
Our website uses essential browser storage and optional analytics. It stores your theme preference locally in your browser. If you consent to analytics, the website records aggregate funnel information: screens reached, the A/B variant shown, completion and call-to-action events, a broad traffic-source category derived from utm_source, and, only in the main quiz, the satisfaction answer. Other quiz answers and UTM campaign values are not retained. Genova does not attach a persistent browser, device, account, advertising, installation, or session identifier to this analytics information. Session storage contains only already-counted event keys so the same event is not counted twice in the current browser tab. Withdrawing analytics consent stops future analytics collection and clears browser-side analytics storage and experiment assignments. Aggregate counts already recorded on the server remain for up to 13 months. They are not linked to a person or browser and therefore cannot be individually identified. The website infrastructure temporarily processes ordinary request information, including an IP address, to deliver and protect the service. For quiz and feedback rate limiting, Genova converts the IP address into a rotating one-way rate-limit key. The raw IP address is not stored by the quiz analytics code. Rate-limit keys become eligible for deletion after 48 hours and are normally deleted during the next daily cleanup. The public feedback board collects the category, title, and description you submit. These fields are publicly visible. It does not collect a display name. For each feedback item you vote on, your browser stores a separate random token so duplicate votes can be prevented and you can remove your vote. The token is not used for analytics or reused between feedback items. The server stores only a hash derived from the feedback item and token. Do not submit sensitive personal information in feedback or bug reports. More information about browser storage, cookies, and consent choices is available at https://genovasport.app/cookies.

21. AGE ASSURANCE
Genova is intended for users aged 16 or older. Where Apple reports that age assurance is required, the app asks Apple to share an age range. Genova does not receive an exact date of birth through this process and stores only a device-local access result.

22. APP PRODUCT ANALYTICS
Genova automatically collects aggregate statistics about onboarding, app experiments, and subscription-screen interactions to understand how features perform and improve the app. The app stores the assigned experiment variant and flags showing which events have already been counted locally on your device. Events sent to Genova include the experiment and variant, interaction type, onboarding step, the week the relevant flow began, and fixed categories such as registration method, acquisition source, assessment mode, or subscription plan category. These events do not include persistent account, user, device, advertising, installation, or session identifiers, workout data, free text, or exact event times. The analytics database stores grouped counters in Supabase. Counters older than 13 months are scheduled for deletion monthly. Because the database contains grouped counters rather than individual user records, Genova cannot retrieve or delete a separate analytics record for a particular user. Ordinary network metadata, such as an IP address, may be processed separately to deliver and protect requests and apply rotating rate limits, but it is not stored with the analytics counters. This automatic product analytics is separate from optional Error Reporting, which users can control in the app.

23. DO WE MAKE UPDATES TO THIS NOTICE?
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

24. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
If you have questions or comments about this notice, you may email us at support@genovasport.app or contact us by post at:

Kirill Hundoryn

Solec 61A/25

Warsaw, Mazovian 00-424

Poland

25. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please visit: https://genovasport.app/support.