Privacy policy
This page explains which data CYBL FiT and this website process, why, and for how long. In short: we only process what the app needs to work. There is no advertising and there are no ad trackers. Usage statistics are only collected if you agree (see section 12).
1. Controller
CYBL Group LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA, represented by Alexander Hein. Email: info@cybl.app
EU representative under Art. 27 GDPR: [Name and address of the EU representative]
2. Account and sign-in
For an account, we store your email address and a password (only as an encrypted hash). If you sign in with Google, Google gives us your name, email address and profile picture. During setup, we add your username, display name, weight unit and training experience, as well as the time you accepted the terms of use.
Legal basis: performance of the contract of use (Art. 6(1)(b) GDPR).
3. Training data
The app stores your workouts: exercises, sets, weights, reps, duration, rest times, notes, routines, training plans, and the personal records and statistics calculated from them. This also includes endurance entries you make yourself: activity (for example running, cycling, walking), date, duration, distance, steps, elevation gain, effort and note. The app uses this to suggest your next weight and to show your progress.
You can save your own notes on exercises. They are visible only to you, are included in the data export and are deleted with your account. Please do not enter anything you do not want stored. Notes may contain health information if you enter it.
Legal basis: performance of the contract of use (Art. 6(1)(b) GDPR).
Feedback in the app
If you write to us via “Feedback and wishes”, we store your message, the type you chose (bug, wish, praise), your account, the app version and the device (iPhone or Android). We use this to fix bugs and improve the app. The legal basis is our legitimate interest. We only see your email address with the message if you agree to a reply. The message is deleted with your account. Please do not include any health information.
4. Body data
If you choose to, you can enter your body weight, body fat percentage and body measurements (waist, neck, hip, upper arm, thigh), and for the calculators also your height, year of birth, sex, how active you are in everyday life, and a calorie goal, and for endurance entries also your heart rate (average and maximum). The app only uses this information to calculate results for you, such as your calorie needs, your body fat percentage or your heart rate zones. This information is health data. We only process it because and for as long as you enter it yourself; we do not show it to anyone else and do not pass it on. For the calculators, the app also uses the duration of your workouts.
Before you save body data for the first time, the app asks for your consent. The legal basis is your explicit consent (Art. 9(2)(a) GDPR). You can withdraw it at any time: in the app under Body data you delete height, year of birth, sex, everyday activity and calorie goal with one tap; you delete measurements under Measurements.
5. Apple Health
On iPhone you can connect CYBL FiT to Apple Health. This is optional. Without your permission the app reads nothing from and writes nothing to Apple Health. When connecting, and at any time afterwards in your iPhone settings (Health › Data Access & Devices), you decide which data the app may read and write.
What the app reads from Apple Health: your steps as a daily total, for your daily goal; runs, rides, walks, hikes, swims, rowing and similar cardio workouts with type, date, duration and distance, which appear in your Cardio overview; your heart rate during these workouts and during your strength workouts in CYBL FiT (only average and maximum per workout), your resting heart rate (one value per day) and your body weight, all three only if you have agreed to the processing of your body data (section 4). We do not store individual readings. The app only fetches entries from the last 14 days and new entries after that.
What the app writes to Apple Health: your finished strength workouts with start, end and an estimated amount of active calories, so they count toward your Apple Watch rings. The app does not write sets, weights or exercises to Apple Health.
How we use the data: Imported entries are stored in your account like entries you add yourself and are shown to you in the app, marked "Health". They do not appear in the feed for others. If you have given a coach access, they see imported entries like your own, within the scope of what you share. We do not use Apple Health data for advertising, do not sell it, do not pass it on to advertisers or data brokers, and do not use it in usage analytics.
Disconnecting and deleting: Under Settings › Apple Health you can disconnect at any time or turn off individual data types. Entries already imported stay in your account until you delete them. They are permanently deleted together with your account.
Data from Apple Health is health data. The legal basis is your explicit consent (Art. 9(2)(a) GDPR), which you give when connecting and can withdraw at any time.
6. Training buddy (voice)
With the training buddy you can use the app by voice or text, for example to log sets, ask about your training or open pages. The buddy is optional and only active when you turn it on or tap the microphone button.
What is processed: your spoken sentences (audio) or typed text, plus what the buddy needs to answer: your current workout, your plan and routines, and, if you ask about them, your past workouts and cardio entries. The buddy only uses your body weight if you have agreed to the processing of your body data (section 4). Your iPhone recognises the wake word ("Hey Saibel") itself; no audio leaves the device for that.
Who processes the data: OpenAI turns audio into text, Anthropic (Claude) understands the content, and OpenAI creates the spoken answer. The providers only process the data to create the answer and, under their terms, do not use it to train their models. We do not store your sentences or answers ourselves. We only store technical details about each request (time, duration, whether it worked, size) to find errors.
What the buddy may do: It only logs what you say and changes your plan or routines only after you agree. It cannot delete anything, buy anything, send messages or change a coach's access.
The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR) and, for body data, your consent (Art. 9(2)(a) GDPR). You can turn the buddy off at any time in Settings.
7. Coaching with CYBL HQ
If you work with a coach who uses CYBL HQ, you can connect using their code. The connection only exists once you explicitly tap "Share" in the app. Before that, the app shows you exactly what your coach will see.
What your coach sees once connected: your username and display name, your workouts with all sets, weights, notes and effort, your plan and how often you train.
Only with a separate, additional permission: nutrition and body data (for example weight, cardio and heart rate), progress photos, blood test results and health details from the questionnaire (complaints, medication, allergies). The app asks for each of these separately, and you can withdraw any of them at any time. Only your coach sees your check-in answers.
What your coach can create: plans for you, notes about you and the package and payment details of your coaching. They cannot change your own entries. Every time a coach accesses your data it is logged, and coaches sign in to CYBL HQ with a second step.
Ending it: You can end the connection in the app at any time. Your coach then no longer sees anything of yours.
The legal basis is your consent (Art. 6(1)(a) GDPR) and, for health data, your explicit consent (Art. 9(2)(a) GDPR). Your coach is responsible for their own work with your data.
8. CYBL Pro and purchases
You buy CYBL Pro and Elite through the App Store. Apple handles the payment. We do not receive payment details such as card numbers.
To link your subscription to your account and unlock it on all your devices, we use RevenueCat. For this, RevenueCat receives your account ID with us and Apple's purchase details (which subscription, purchase date, term, renewal or cancellation). We do not pass on your name or email address for this.
You can cancel at any time in your iPhone settings under your name › Subscriptions. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).
9. Profile and social features
Your username, display name, profile picture and bio are visible to other signed-in users. You decide who sees your workouts: everyone, followers only, or only you. This also applies to endurance entries; others only see the activity, day, distance, duration, elevation gain and note, never your heart rate, your effort or the time of day. With a private profile, others only see your workouts once you accept their request. When you follow others, give a “Strong” or comment, the people concerned see this.
If you report a post, a comment or a person, we store the report with its reason so we can review it. If you block someone, we store this so that you no longer see each other.
Legal basis: performance of the contract of use (Art. 6(1)(b) GDPR) and our legitimate interest in a safe community (Art. 6(1)(f) GDPR).
10. Invitations
When you invite friends, the app opens WhatsApp or your phone’s share menu, or copies a text. We do not see whom you invite.
11. Notifications on your phone
The sound at the end of a rest is scheduled by the app directly on your phone; no data is transferred for this. If you allow notifications, we store a device identifier for push messages (push token) together with the device type and time zone. We use it to send you alerts when others react to you, workout reminders, the weekly review and important service notices. You only receive news from CYBL if you turn on “News & tips”, and at most once a week. You choose which kinds you receive in the app under Settings › Notifications. The messages are sent through Expo’s push service and from there via Apple or Google to your phone. The legal basis is performance of the contract of use (Art. 6(1)(b) GDPR); for news, your consent (Art. 6(1)(a) GDPR).
12. Usage statistics (PostHog)
If you agree in the app, we send anonymous usage data to PostHog Inc. The data is stored on servers in the EU (Frankfurt am Main). We record: which screens and features you use, plans and workouts you start (without their content), crashes and errors, and device model, operating system and app version. We do not record training content, body data, photos, messages, names or email addresses, and no advertising ID. A random identifier is used to link the data.
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) of the German Telecommunications Digital Services Data Protection Act, TDDDG). You can withdraw it at any time in the app under Settings › Privacy; after that, no more data is sent. The data is deleted after 12 months. We have a data processing agreement with PostHog.
13. Waitlist and pilot
If you join the waitlist on the website, we store your email address, the language of the page and the time you signed up and confirmed. We first send you an email to confirm. Only once you tap the button in it are you on the list. We only use the address to tell you that the app is available, and we do not pass it on. The emails are sent via Resend (see section 14). The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email or by writing to info@cybl.app; we then delete your address. Unconfirmed sign-ups are deleted after 7 days, and the whole list at the latest 3 months after the app launches.
If you take part in our pilot (test phase before launch), we also store that you are a tester and since when, and your answers to the voluntary questions in the app. We also see how often and when you last trained, but not the content of your workouts. We only use this to improve the app and do not pass it on. The legal basis is your consent (Art. 6(1)(a) GDPR). You can leave the pilot and have your answers deleted at any time: write to info@cybl.app. Deleting your account also deletes your answers.
14. Service providers and storage location
- Supabase (Supabase Inc., USA): the app’s database, sign-in and file storage. The data is stored on servers in Ireland (EU).
- PostHog (PostHog Inc., USA): usage statistics, only with your consent. The data is stored on servers in Frankfurt am Main (EU).
- Google (Google Ireland Ltd. / Google LLC): only if you use Sign in with Google.
- Cloudflare (Cloudflare Inc., USA): delivery of this website and of the operator area. This involves technically necessary server logs (for example IP address and time of access).
- Expo (650 Industries Inc., USA): forwarding push notifications to Apple and Google. The device identifier and the text of the message are transmitted.
- Resend (Resend Inc., USA): sending the sign-in emails (confirmation, sign-in link, password) and the waitlist emails. Your email address and the content of the email are transmitted.
- OpenAI (OpenAI, L.L.C., USA): speech recognition and voice output of the training buddy.
- Anthropic (Anthropic PBC, USA): understands requests to the training buddy and creates the answer.
- RevenueCat (RevenueCat Inc., USA): linking and unlocking subscriptions.
- Apple (Apple Distribution International Ltd., Ireland): App Store, subscription payments, Apple Health on your iPhone.
We have data processing agreements with all service providers. For transfers to the USA, we rely on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses. Because we ourselves operate as a US company, data is also transferred to the USA by the fact that we run the app. The basis for this is performance of the contract of use (Art. 49(1)(b) GDPR) or the safeguards mentioned.
15. Storage period
We store your data for as long as your account exists. If you delete your account (in the app under Settings → Delete account), your profile, workouts, routines, body data and photos are permanently deleted. Statutory retention obligations remain unaffected.
16. Your rights
You have the right to access, rectification, erasure and restriction of processing, to data portability, and to object to processing based on legitimate interests. You can withdraw consent at any time with effect for the future. To do so, write to us at info@cybl.app.
You can also lodge a complaint with a data protection supervisory authority, for example the authority where you live.
17. Minimum age
The app is intended for people aged 16 and over.
Last updated: November 2026