Legal

Privacy Policy

For the VFrame app (iPhone) and the website vframe.fit · Last updated: 22 October 2026

In short: your training data is yours and lives on servers in the EU. Your scan photos are analysed by an AI only after you explicitly agree to it in the app. The website sets no cookies and does not track you. You can delete your account with everything in it at any time in the app. The details follow.

1. Controller

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Scope

This policy covers the website vframe.fit and the iPhone app "VFrame". It explains which data we process, for what, on which legal basis, how long we keep it and which rights you have.

3. The website

3.1 Hosting and server logs

The website is hosted by Netlify, Inc. (San Francisco, USA) and delivered through its global network. When you open it, Netlify processes technically necessary data: IP address, date and time, page requested, browser and operating system. This data serves to deliver the site and to fend off attacks (Art. 6 (1) (f) GDPR, legitimate interest in secure operation). Netlify keeps server logs for a short time (about 30 days according to Netlify). The transfer to the USA is safeguarded by EU standard contractual clauses.

3.2 No cookies, no tracking

The website sets no cookies, uses no analytics or advertising services and loads no fonts or scripts from Google. The animation libraries (GSAP, Lenis) are loaded from content delivery networks (cdnjs by Cloudflare, jsDelivr), which receive your IP address for that request (Art. 6 (1) (f) GDPR).

3.3 Contact

If you email us, we process your details to answer your request (Art. 6 (1) (b) or (f) GDPR). We delete the message once the matter is settled and no retention duties apply.

4. The VFrame app

4.1 Account and sign-in

On first launch the app creates an anonymous account with a random identifier, so your plan and your onboarding answers can be saved. After subscribing you link this account to a sign-in method, so you can find it again on other devices:

• Sign in with Apple: Apple gives us a user identifier and, if you share them, your name and email address (which may be an Apple relay address).
• Continue with Google: Google gives us your Google account identifier, your name and your email address.
• Email with a code: We store your email address and send you a sign-in code.

The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR). Account data is stored with Supabase on servers in the EU.

4.2 Profile, plan and training

In the app you enter details about your training (goal, training days, place, experience, sex for the body-fat scale, bodyweight for the muscle ranks) and log your workouts (exercises, sets, weights, reps, duration, bodyweight history). This data is the core of the app: it produces your plan, the weight suggestions, records, ranks and the calendar. Legal basis: Art. 6 (1) (b) GDPR. The data is stored on your device and synced with your account at Supabase (EU), so it is available on a new device.

4.3 Body scan and AI analysis

The body scan is optional. You take three photos (front, side, back). The photos are stored encrypted in your private storage area at Supabase (EU); only you can access them through your account.

For the analysis (physique score, body-fat range, body type, muscle group ratings, posture note) the photos are sent to our AI provider Anthropic, PBC (San Francisco, USA) and analysed there with the Claude model. We store the results in your account. Anthropic processes the photos solely for this analysis and does not use them to train its models. The transfer to the USA is safeguarded by EU standard contractual clauses.

Photos of your body and a body-fat estimate can reveal information about your health. We therefore process them only with your explicit consent (Art. 6 (1) (a) and Art. 9 (2) (a) GDPR), which you give in the app before your first scan. You can withdraw it at any time under Settings → Privacy & data; after that, new photos are no longer analysed. Withdrawing consent does not affect the lawfulness of processing carried out before. There you can also delete all scan photos with one tap; results stay until you delete them or your account.

Results are estimates from photos, not medical measurements.

4.4 Subscriptions and purchases

Subscriptions are bought through Apple's in-app purchase. Apple handles the payment; we receive no payment details (no card numbers, no bank data). To check your subscription status we use RevenueCat, Inc. (San Francisco, USA): RevenueCat receives the App Store receipt and your anonymous account identifier and tells us whether a subscription is active (Art. 6 (1) (b) GDPR; EU standard contractual clauses).

4.5 Product analytics (only with consent)

To understand which features are used and where people drop off, we use PostHog (PostHog, Inc.; servers in the EU, Frankfurt). This happens only if you tap "Allow" on first launch (Art. 6 (1) (a) GDPR). We record events such as screens opened, onboarding steps and whether a subscription was bought, linked to your account identifier, as well as recordings of how the app is used (session replay) with every image and text input masked. We do not record scan photos, bodyweight, name or email. You can switch analytics off at any time under Settings → Privacy & data.

4.6 Notifications, widgets and data on the device

Reminders and the rest timer are local notifications on your iPhone; no content leaves your device for them. Widgets and the Lock Screen read the app's data on the device. The app also stores your data locally so it works offline.

4.7 Apple diagnostics

If you have allowed Apple to share diagnostics with developers, we receive anonymised crash reports and usage statistics from Apple, with no link to your VFrame account.

4.8 Deleting your account and data

Under Settings → Delete account you permanently delete your account with your plan, workouts, bodyweight, scan photos and results. The link to Apple or Google is removed. A running subscription must be cancelled separately in your Apple ID settings.

5. Recipients and transfers outside the EU

We pass data only to the following providers and only as far as needed for the purpose. For providers based in the USA we rely on the EU standard contractual clauses (Art. 46 (2) (c) GDPR) and, where the provider is certified, on the EU-US Data Privacy Framework.

6. Retention

• Account, profile and training data: for as long as your account exists; deleted immediately when you delete the account, backups within 30 days at the latest.
• Scan photos: until you delete them or your account.
• Anonymous accounts without a subscription: deleted after 90 days without activity.
• Analytics data: 12 months.
• Website server logs: about 30 days.
• Emails: until your request is settled.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time with effect for the future. Write to support@vframe.fit. You can export your training data as CSV in the app under Settings → Privacy & data.

You can also complain to a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

8. Children

VFrame is intended for people aged 16 and over. We do not knowingly process data of younger users.

9. Changes

We update this policy when the app or the law changes. The current version is always at vframe.fit/privacy and in the app.