Privacy policy

Last updated: 23 October 2026

This is a translation provided for convenience. If it differs from the Italian version, the Italian version prevails.

Who processes the data

Data controller: Ludovico Allega, contact: allegaludovico@gmail.com.

What data

Sign-in email and password (the password is stored encrypted by the authentication provider).
Workouts: exercises, sets, reps, loads, dates, notes and plan.
Body measurements you choose to enter: weight, body fat, circumferences. These are health-related data.
Progress photos you choose to take (front, back, sides). Before saving them, the app makes them smaller and removes the data hidden in the file, such as location and phone model. They are kept in a private store and only open through temporary links.
Plan files you upload (PDF or photos).
The personal trainer you choose to link to, what you choose to share with them and the plans they send you.
The feedback you give at the end of a workout: perceived effort and any discomfort or pain.

Why, and on what legal basis

Only to make the app work: logging workouts, showing your progress and syncing it across your devices. Processing of body measurements and photos is based on your explicit consent, which you give the first time you sign in and can withdraw by deleting your account. We do not use the data for advertising, we do not sell it and we do not do profiling.

Who sees it

You. If you link to a personal trainer, they see only what you choose, and you can change or revoke it anytime from You: your workouts (dates, exercises, loads, reps, feedback on effort and discomfort), and only if you also turn them on, weight and measurements and, with a separate choice, progress photos. They also see the name you enter and your email. The trainer can send you plans, which you find in the app.

To run the service, the controller sees usage data: your email, when you signed up and last signed in, how many workouts you have logged and when, whether you are linked to a trainer and which version of the app you use. To understand which parts of the app are really useful, we also count which sections you open (for example Progress or Leaderboard) and how many times a day: the controller only sees totals across all users, and the data is deleted after 90 days. From the app, the controller does not see the content of your workouts, your weight and measurements, or your photos.

Only if you turn on Friends (Progress, Friends), you choose a name and get a code. Whoever uses it becomes your friend and you only see each other's consistency: how many workouts you do each week, for how many weeks you have hit your goal and when you last trained. Never weights, reps, measurements, photos or email. Cheers (💪) and challenge invitations arrive as an in-app notice and, if you turned on notifications, on your phone, never between 10 pm and 8 am. If you accept a challenge, the other participants see your name and how many days you train during the challenge. You can remove a friend or leave a challenge anytime.

Only if you choose to join the leaderboards (Progress, Leaderboard), other users see the public name you choose and how many days you trained in the week or month: never weights, reps, measurements, photos or your email. The region or country and the gym you enter are used to build the leaderboards; others also see the gym name, as a suggestion when they type theirs. The server does the counting, so your workouts are never sent to others. You can leave anytime: your name disappears right away. The controller can remove offensive names or clearly fake workouts from the leaderboards.

You can delete progress photos anytime, one date at a time (You, Weight, measurements and photos, Photos). Deleting your account erases them together with all other data. If you unlink or change trainer, photo sharing is turned off.

Technical providers: Supabase (database, authentication and file storage, servers in the European Union, Frankfurt) and Vercel (website hosting). To notify the controller of a new invite request from the website we use Resend (email delivery), which receives the name, email and message of the request. Data is transmitted over an encrypted connection.

Only if you use Import from PDF or photo, the files you choose are sent to Google (Gemini API service) to read the plan and turn it into exercises. Only those files are sent, only at that moment, without your workouts or measurements, and we ask Google not to keep them. For services offered in the European Economic Area, Google's terms state that this content is not used to improve its products or train its models.

When you create an account with a code, to block repeated attempts we keep for two days a non-reversible fingerprint of the network address you sign up from (not the address itself). If you use a personal trainer's code, during setup we ask what they can see before linking you.

If an imported plan was not read correctly and you tap Tell us, giving consent in the checkbox, the controller sees those files, what the app read, the plan as you corrected it up to that moment and the note you write, only to improve the reading. You can ask for it to be deleted at any time; deleting your account deletes the report.

Only if you turn on notifications, we store the delivery address your browser creates for this phone, together with the days, time, time zone and app language you choose. Notifications go through the push service of the browser or phone maker (for example Google, Apple, Microsoft or Mozilla), which delivers them encrypted without being able to read the text. They contain a reminder with the number of workouts for the week and, if you use Friends, notices from your friends (💪, challenges, new friends). You can turn them off anytime from You; signing out stops this phone from receiving them.

Access requests from the website

If you fill in the "Request an invite" form on the Ferrea website, we store your name, email, whether you train or are a personal trainer, the language of the page and, if you write them, gym or city and message. We use them only to reply and create your account. Only the controller reads them. Legal basis: your request. Handled requests are deleted after 12 months, the others after 24. You can ask for deletion at any time by writing to the contact above.

Website statistics

On the Ferrea presentation website we count visits anonymously: which page or button (visit, demo opened, access request), when, the domain of the site you come from and whether you use a phone or a computer. We do not use cookies, we do not store anything on your device and we do not record your IP address or other data that identifies you. The counts are deleted after 13 months.

How long

As long as you have the account. If you delete it, the data is deleted immediately from the database and the file store.

Your rights

You can access your data, download it (You, Your data and privacy, Download my data), correct it, delete it (You, Your data and privacy, Delete account) and withdraw your consent. For any request write to the contact above. You can also lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali) or the authority of the EU country where you live.

Data on your phone

The app keeps a copy of your data in the browser storage, to work without a network too. It is deleted when you sign out. Only your display preferences stay (language, theme and color), which say nothing about you. Ferrea does not use profiling cookies, advertising or analytics tools: it only stores what it needs to work, which is why you don't see a cookie banner.