Evershape Privacy Policy

Effective: 2026-11-10

Evershape is a gym app that builds a training plan and logs your workouts. This policy explains what data the app and this website collect, why, who else handles it, how long we keep it, and what you can do about it. We wrote it to be short and plain.

Who we are

Evershape is made by Idan Refaeli, an individual developer in Israel, who decides how your data is used (the "controller" or "database controller"). Contact: alphabornapps@gmail.com. For anything in this policy, write to that address.

What we collect

When you sign in (Sign in with Apple on iPhone, or Google on iPhone and Android): a user ID, your name and your email address, as Apple or Google share them. With Apple you can hide your email; we then get a relay address from Apple.

What you tell us in the questionnaire and settings: gender, date of birth, body weight, fitness goal, experience level, where and on which days you train, the body type and focus areas you pick, your reasons and obstacles for training (one option is "Injuries or pain"), how you heard about Evershape, and your language. In the EU, the EEA and the UK, the body weight and "Injuries or pain" are asked only if you allow health data (see "Your data, your choice").

Your training: the plan we build for you and every workout you log: date, duration, exercises, sets, reps, weights, your body weight at the time (if you gave it), and your totals and streaks.

Your subscription: whether you have an active subscription, and your purchase and renewal history. Payment itself is handled by Apple (App Store) or Google (Google Play), depending on where you subscribed; we never see your card details.

Your consent choices (EU, EEA and UK only): your yes or no to health data and to usage analytics, each with the time you gave it. They're kept on your phone and with your account, so they follow you to a new phone.

How you use the app (usage analytics): events such as which onboarding screens you saw, when you opened the paywall or picked a plan, when you started, finished or left a workout, and when you changed a setting. Some events carry details: your answers to the single-choice questions (gender, goal, experience level, where you train, how many days a week, how you heard about Evershape) and your language; workout numbers (duration, number of exercises and sets, how often you used the suggested weight); why an exercise was swapped (missing equipment, a crowded gym, a swap you made yourself, or "other"; a swap for pain is sent only as "other", never as pain or which body part); and the plan, price and currency of a purchase. With them go the app version, device model, operating system, a random ID for the app install, and an approximate location (city and country) worked out from your IP address. Your name, email, date of birth, body weight and your reasons and obstacles for training are not sent to analytics. We use this only to understand and improve the app. In the EU, the EEA and the UK none of it is sent unless you say yes, and everywhere you can turn it off in Profile.

Technical data that Apple's and Google's tools need to run: for example the device's country, language, time zone and OS version when the app fetches its settings. On iPhone, when the app shows its App Store rating, your phone asks Apple's public App Store lookup service for it, sending the app's ID and your phone's region; no account data is sent.

A count of accounts: we keep one number, how many accounts exist, with nothing about who they are. The app may show it, together with its App Store rating, on an onboarding screen.

If you join the waitlist on this website (/waitlist, before the app is out): your email address, the language of the page, the link you came from (for example our Instagram or TikTok bio), the time you joined and that you ticked the consent box. We use it only to email you once, when Evershape launches. The website sets no cookies and has no analytics or trackers. Firebase Hosting, which serves it, processes your IP address and browser details to deliver the page, as any web server does.

What we don't collect: no photos or camera access, no precise location, no contacts, no health records from Apple Health or Health Connect, no advertising ID. The quick check-in before a workout (energy, time, sore spots, missing or taken equipment, a crowded gym, a missed last workout) is used on your phone to adjust that workout. In the EU, the EEA and the UK it asks about sore spots only if you allowed health data. The answers themselves aren't saved, only the adjusted workout you then log (for example lighter weights or a swapped exercise) and, in the usage analytics, the reason for a swap described above.

Do you have to give it?

No law requires you to give us any of this. The sign-in and the questionnaire answers are needed for the app to work (an account to keep your plan and history, and the answers to build the plan). If you don't want to give them, you can't use the app. In the EU, the EEA and the UK your body weight and your pain and injury answers are optional (see "Your data, your choice"). Usage analytics are not needed for the app to work (see "Your choices and rights").

Your data, your choice (EU, EEA and UK)

If you're in the European Union, the European Economic Area or the UK, the app asks for your consent before the weight question, on a screen called "Your data, your choice". We go by your App Store or Google Play country, or, when that isn't known, by your phone's region settings (on Android, also the country of your SIM card and mobile network); if none of them is known, we ask. The screen has two choices, and both stay off unless you turn them on:

• Health data: your body weight and any pain or injuries, used to build and adjust your plan. If you leave it off, the app skips the weight question, doesn't offer "Injuries or pain" among the obstacles and doesn't ask where it hurts before a workout. Your plan starts from standard weights.
• Usage analytics: the usage events described above, sent to Mixpanel. Until you say yes, Mixpanel isn't started at all, so nothing is sent to it.

You can change both at any time in Profile (see "Your choices and rights"). Everywhere else this screen isn't shown: the health questions are part of the questionnaire, and usage analytics are on until you turn them off in Profile.

Why we use it

• To run the app: create your account, build and adjust your plan, save and sync your workouts across your devices, check your subscription, show the workout reminders you turned on and, if you start a free trial, a reminder the day before it ends (both are scheduled on your phone, not sent from a server), and answer your support emails.
• To email you once, at launch, if you joined the waitlist. No newsletter and no other emails.
• To improve the app: understand which screens and features work, using the usage events above.
• To keep the service secure and comply with the law.

We don't sell your data, we don't show ads, and we don't use your data to track you across other companies' apps or websites. We don't use your fitness data for advertising or marketing.

The plan is calculated by rules in the app (sets, reps, weights and rest from your answers and your logged workouts). It doesn't make decisions about you beyond suggesting your training.

Who else handles your data

We use a few service providers who process data for us, under their own terms and security commitments, and only to provide their service:

We require each of them to protect your data at least as well as this policy does. We may also disclose data if the law requires it, or to protect our rights, and if the app is ever sold, to the new owner under this same policy (we'll tell you first).

Data outside Israel: our providers store data on servers outside Israel. Your profile, plan, workouts, consent choices and waitlist sign-up are kept in Cloud Firestore in the European Union (Google's eur3 location). Sign-in (Firebase Authentication), usage analytics (Mixpanel) and subscriptions (RevenueCat) are handled mainly in the United States. We transfer data only under the legal mechanisms that apply. For users in the EU: the European Commission recognizes Israel as giving adequate protection, Google and Mixpanel are certified under the EU-U.S. Data Privacy Framework, and other providers rely on the Commission's standard contractual clauses.

How long we keep it

• Account, profile, plan, workouts and consent choices: as long as you have an account. When you delete your account in the app, your sign-in account, profile, plan, workouts and consent choices are deleted from our database right away, and their copies on your phone with them.
• Usage analytics: no longer than 24 months. Deleting your account deletes your analytics profile, but not the events already sent: they stay linked only to a random account ID, which no longer leads to your name or email. Write to us and we'll delete them within 30 days.
• Purchase records: the store you bought in (Apple or Google) and RevenueCat keep transaction records as long as tax and accounting law requires, even after you delete your account.
• Support emails: up to 24 months after the conversation ends.
• Waitlist: until we send the launch email; we delete the list within 30 days after that. If you ask us to delete yours sooner, we do.

Your choices and rights

• Delete your account: Profile, Delete account (also from the person icon on the paywall). Deleting the account does not cancel your subscription: cancel it first where you bought it, or Apple or Google keeps billing. On iPhone: Settings, your name, Subscriptions. On Android: the Google Play Store app, your profile picture, Payments & subscriptions, Subscriptions.
• Access, correction and deletion: you can ask to see the data we hold about you, to get a copy, and to have it corrected or deleted. Under Israel's Privacy Protection Law you have the right to see your data (section 13) and to ask to correct or delete it (section 14). Most of it you can also change yourself in Profile.
• Usage analytics: Profile, Share usage analytics. When it's off, nothing more is sent to Mixpanel. It starts on, except in the EU, the EEA and the UK, where it starts off until you say yes. Turning it off doesn't delete what was already sent: write to us and we'll delete the usage data linked to your account.
• Health data (EU, EEA and UK): Profile, Health data. Turning it off deletes your body weight (also the one saved with each workout) and your "Injuries or pain" answer, on your phone and in our database (if you're offline, the app finishes it the next time it can). Your plan goes on with standard weights. You can turn it on again later and add your weight.
• Reminders: turn workout reminders off in the app (Profile, Reminders), or turn off all of Evershape's notifications, the trial reminder included, in iPhone Settings, Notifications, Evershape (on Android: Settings, Notifications, App notifications, Evershape; the names can differ by phone).
• Leave the waitlist: email us from the address you signed up with, and we delete it. That also withdraws your consent to the launch email.
• Withdraw consent at any time, with the switches above; it doesn't affect what was done before.

To use a right, email alphabornapps@gmail.com from the address of your account. We answer within 30 days.

If you're in the European Union, the EEA or the UK, you also have the rights to restrict or object to processing and to data portability, and the right to complain to your data protection authority in your country (in the UK, the Information Commissioner's Office). Our legal bases: performing our contract with you (account, plan, workouts, subscription); your explicit consent, given on the "Your data, your choice" screen, for data that may count as health data (body weight, the "Injuries or pain" answer and the pain check before a workout) and for usage analytics; your consent, given with the waitlist's box, for the waitlist and its launch email; and our legitimate interest in keeping the service secure.

In Israel you can complain to the Privacy Protection Authority (הרשות להגנת הפרטיות).

Children

Evershape is for people aged 16 and over. We don't knowingly collect data from younger children. If you think a child under 16 gave us data, write to us and we'll delete it.

Security

Data is sent encrypted and stored with Google Firebase, whose security rules let each account read and change only its own data. Nobody can read the waitlist from the website; only we see it, in the Firebase console. No system is perfectly secure; if a breach affects you, we'll tell you and the authorities as the law requires.

Changes

If we change this policy, we'll update the date at the top, and for important changes we'll tell you in the app before they apply.

Contact

Idan Refaeli, Israel · alphabornapps@gmail.com · https://evershape.app