Privacy policy

1. Information we collect

We process information you provide when you use Voltra or contact us. This includes:

• Email address (used for authentication and communication)
• If you sign in with Google: the name, email address, profile picture link, and account identifier Google shares, stored with your sign-in record
• Display name, date of birth, app preferences, and optional gender selection used to choose the Progress body-map illustration
• Body weight logs, workout dates and times, logged weights, repetitions, durations, distances, exercise notes, exercise records, and training programs and targets you create in the app
• Billing and payment information (processed by Stripe — we do not store card details)
• Reply email addresses, request types, and messages submitted through our privacy contact form
• Feedback you send from Settings: the category and message you write, plus your display name, account email, account identifier, plan, app version, and device type (installed app or browser, and your browser's user-agent)

Technical requests include information such as IP addresses and browser request headers. This information is processed to deliver the website, protect the service from abuse, and investigate operational problems. Our public forms use IP-based rate limiting.

Free-text notes can reveal information about your health. Please include only information needed for your training records, and avoid entering information about other people.

An email address is required for an account and for a reply to a privacy request. Display name and date of birth are required by onboarding; without them you cannot complete onboarding. Gender selection is optional. You choose which training information to log; omitting information may limit the corresponding training or statistics feature.

2. How we use your information

We use personal information for the following purposes and rely on the following GDPR legal bases where applicable:

• Provide your account, training records, synchronization, statistics, and subscription services — performance of our contract with you (Article 6(1)(b))
• Authenticate your account and provide service emails such as password resets — performance of our contract with you (Article 6(1)(b))
• Process payments and manage your subscription via Stripe — performance of our contract with you (Article 6(1)(b)); retain records required by applicable accounting or tax law — compliance with legal obligations (Article 6(1)(c))
• Protect accounts, prevent abuse, and investigate technical failures — our legitimate interests in operating a secure and reliable service (Article 6(1)(f))
• Respond to ordinary support and privacy questions — our legitimate interest in answering your request (Article 6(1)(f)); handle GDPR rights requests — compliance with legal obligations (Article 6(1)(c))
• Read and reply to feedback you send and use it to improve Voltra — our legitimate interest in improving the service and answering you (Article 6(1)(f))

3. Data sharing

We do not sell your personal data. The following providers process information needed to operate the service:

• Supabase — database and authentication hosting (your data is stored on Supabase-managed PostgreSQL)
• Google — sign-in, only if you choose Continue with Google (Google learns that you signed in to Voltra)
• Stripe — payment processing (subject to Stripe's Privacy Policy)
• Vercel — application hosting and content delivery
• Resend — delivery of authentication emails, privacy contact messages, and feedback
• Redis service provider — IP-based rate limiting to protect public forms from abuse, and per-account limits on feedback
• Microsoft Outlook/Hotmail — receipt and storage of privacy contact messages and feedback in our inbox

Privacy contact messages include your reply address, request type, and message. Feedback messages include the details listed in section 1. The recipient inbox addresses are kept private. Stripe processes payment details; Voltra stores subscription status and Stripe identifiers rather than card details. We may also disclose information when required by applicable law.

4. Data retention

Account and training records are held while your account exists. Account deletion removes application records and your authentication account after subscription cancellation. If a stage fails, deletion remains incomplete until the issue is resolved. Limited deletion-recovery records can remain after account deletion.

Other retention depends on the purpose of the records: privacy correspondence supports responding to and documenting your request; operational and abuse-prevention records support troubleshooting and security; and billing records may be needed for legal or accounting obligations. Backups and provider-held records follow separate retention and deletion arrangements. Deleting an account does not automatically remove separately submitted privacy correspondence or feedback emails.

5. Security

We take reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), Row-Level Security policies in the database, and cookie-based session authentication. Authentication cookies are browser-readable to support sign-in and token refresh. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Object to or restrict certain processing activities
• Receive a portable copy of data where the right to data portability applies
• Withdraw consent at any time for processing based on consent, without affecting earlier lawful processing
• Lodge a complaint with your local data protection authority

To exercise any of these rights, use the privacy contact form below.

We may need to confirm your identity before providing or changing account data. Under GDPR, we normally respond to rights requests within one month of receipt. If complexity or the number of requests requires a permitted extension, we will explain it within that first month. You can complain to your competent supervisory authority, including Denmark's Datatilsynet.

7. Cookies and storage on your device

Voltra uses strictly necessary cookies for authentication session management. We do not use tracking cookies or third-party advertising cookies.

Voltra also stores user-scoped data in your browser's local database (IndexedDB) so workout logging can work offline. This includes cached exercises and programs, workout records and notes, and pending changes awaiting synchronization. When you reconnect, pending changes are synchronized with your account. Unsynchronized changes exist only on that device until they are successfully synchronized.

Sign-out and account-change flows clear private local data after handling pending changes. Deletion of server records cannot immediately erase copies on another device that is offline. On a shared device, sign out when finished. Clearing browser data can remove unsynchronized workout changes. The service worker caches public resources for the app; private pages and API responses are not stored in its response cache. Unsubmitted privacy contact drafts stay in page memory and are not saved for offline delivery.

8. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We will communicate material changes through an appropriate notice in the app or by email. If a new use of information requires consent, we will obtain it separately; continued use of the app does not itself provide that consent.

9. Contact us

If you have any questions about this Privacy Policy or how we handle your data, use this form. It is also available if you don’t have an account or have deleted your account. Your request is sent through Resend to our private Outlook/Hotmail inbox. We use IP-based rate limiting through our Redis service provider to protect the form from abuse.