Privacy policy

Last updated: October 8, 2026

This is a translation for your convenience. The legally binding version is the German Datenschutzerklärung.

This privacy policy applies to the Frame app (iOS and Android) and to this website (Frame Help). We show no ads, sell no data and use no analytics or tracking tools.

1. Controller

Max Mustermann
Musterstraße 1
12345 Musterstadt
Germany

Email: DEINE-EMAIL

We have not appointed a data protection officer because we are not legally required to. For privacy questions, write to the address above.

2. The Frame app

Frame can only be used with an account. You sign in exclusively with Sign in with Apple or Sign in with Google. We do not store a password.

Apple: Apple sends us a user ID, your email address (or, if you choose “Hide My Email”, a relay address created by Apple) and, the first time you sign in, your name. Provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.
Google: Google sends us a user ID, your email address, your name and the address of your Google profile picture. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The privacy policies of Apple and Google also apply to the sign-in itself. We store your sign-in session encrypted in your device’s protected storage (iOS Keychain or Android Keystore).

Legal basis: Art. 6(1)(b) GDPR (contract for using the app).

2.2 Questions on first launch

On first launch Frame asks, among other things, how you heard about Frame (with free text for “Other”), your preferred units, your training goal, how often you want to train per week, whether you want to connect Apple Health, your gender, your date of birth, your height, your body weight, your training experience and how you want to create your plan.

You can skip every question. Until you create your account, the answers stay on your device only. After that we store them in your account. We use them to set up the app for you. We also use how you heard about Frame to understand how people find Frame.

Legal basis: Art. 6(1)(b) GDPR. For how you heard about Frame: Art. 6(1)(f) GDPR (our legitimate interest in understanding our reach). For height and body weight, see section 2.4.

2.3 Training data

For Frame to work, we store the data you create in the app:

your training plans, training days, blocks and exercises including targets (sets, reps, rest)
your own exercises and your exercise settings
your workouts with start, end, exercises, weight, reps, duration, distance and your workout note
your app settings, for example units and default rest time

Frame uses this data to calculate your statistics, records and progress, solely to show these to you. There is no automated decision-making within the meaning of Art. 22 GDPR.

You can write freely in workout notes. Please keep in mind that you may include information about your health there, for example about pain. Such information is voluntary.

Legal basis: Art. 6(1)(b) GDPR.

2.4 Body data (health data)

If you enter them, we store body weight, height, body fat percentage and the circumference of waist, chest, upper arm and thigh, each with a date. This is health data and therefore specially protected.

We only process it with your explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR), and only to show and analyse it for you in the app. Providing it is voluntary, Frame works without it. You can withdraw your consent at any time with effect for the future by deleting the entries in the app or by writing to us. This does not affect the lawfulness of processing before the withdrawal.

2.5 Apple Health (iPhone only)

If you turn on the Apple Health connection and allow access in iOS:

Frame saves every finished workout to Apple Health (workout type, start, end and active energy),
Frame saves the body weight you enter in Frame to Apple Health,
Frame reads your body weight from Apple Health and adds it to your measures in Frame.

We store weights imported from Apple Health with a technical ID so the same value does not appear twice. We use data from Apple Health solely to show it to you in Frame. We do not share it with third parties and do not use it for advertising.

Legal basis: your explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR). You can revoke access at any time in the iPhone Settings app under Apps → Health → Data Access & Devices → Frame, or turn off syncing in Frame’s settings.

2.6 Storage on your device

Frame stores some information only locally on your device: your language, your appearance (light/dark), your answers from section 2.2 until your account is created, the state of the Apple Health sync and your sign-in session. This is strictly necessary for the features you request (Section 25(2) no. 2 TDDDG).

2.7 App updates

On launch, Frame checks whether a bug fix or small update is available and downloads it if so. For this we use EAS Update by 650 Industries, Inc. (Expo), [ADRESSE EXPO], USA. Your IP address, operating system, app version and the ID of the installed update are transmitted. No data from your Frame account is transferred.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in fixing bugs quickly and securely). For the transfer to the USA, see section 5.

2.8 Links to YouTube and TikTok

On an exercise page you can search for videos on YouTube or TikTok. Only when you tap one does the respective app or website open, with the exercise name as the search term. From then on the privacy policies of YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or TikTok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland) apply. Frame does not transfer any data from your account.

2.9 App stores

Apple (App Store) and Google (Google Play) handle the download of Frame under their own responsibility, and their privacy policies apply. From the app stores we only receive aggregated statistics that do not identify you personally.

3. This website

3.1 Hosting and server log files

This website is hosted by [HOSTING-ANBIETER, ADRESSE]. With every request the server automatically processes your IP address, date and time, the page requested, the previously visited page and information about your browser and operating system. This is necessary to deliver the website and protect it from attacks. Log files are deleted after [ANZAHL] days.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and working website). We have concluded a data processing agreement with the provider.

3.2 No cookies, no tracking

This website sets no cookies and uses no analytics or tracking services. Fonts and other content are not loaded from third-party servers. Whether you collapsed the sidebar is remembered only in your browser’s local storage and never leaves your device (Section 25(2) no. 2 TDDDG). Search runs entirely in your browser, your search terms are not transmitted.

4. Contact by email

When you write to us, for example to support, we process your email address, your name and the content of your message to handle your request. Our email provider is [E-MAIL-ANBIETER, ADRESSE].

Legal basis: Art. 6(1)(b) GDPR if your request concerns your account or the use of Frame, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering requests). We delete your messages once your request is resolved, unless statutory retention obligations apply.

5. Recipients and transfers to third countries

We only share your data with service providers who process it on our behalf and according to our instructions (Art. 28 GDPR):

Supabase (Supabase, Inc., [ADRESSE SUPABASE]): database, sign-in and server functions of the app. The servers are located in the EU (Ireland).
Expo (650 Industries, Inc., [ADRESSE EXPO], USA): delivery of app updates, see section 2.7.
[HOSTING-ANBIETER]: hosting of this website.
[E-MAIL-ANBIETER]: email inbox.

Supabase and Expo are companies based in the USA. Where data reaches the USA, this is based on an adequacy decision of the EU Commission (EU-U.S. Data Privacy Framework) if the provider is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). [PRÜFEN: Zertifizierung von Supabase und Expo unter dataprivacyframework.gov]

We do not share data with any other third parties unless we are legally obliged to.

6. Retention

We store your data as long as your account exists. When you delete individual entries, such as a workout or a body measure, we remove them immediately. When you have your account deleted, we delete the account and all data linked to it completely. The data disappears from backups after [ANZAHL] days at the latest. How to have your account deleted is described under Delete your account.

7. Obligation to provide data

You cannot use Frame without signing in with Apple or Google. All other information, in particular the questions on first launch, body data and the Apple Health connection, is voluntary.

8. Minimum age

Frame is intended for people aged 16 and over. If you are younger, please only use Frame with your parents’ consent.

9. Security

All connections between the app, the website and our servers are encrypted (TLS). Access to your data in the database is technically restricted to your own account.

10. Your rights

You have the right to

access your stored data (Art. 15 GDPR),
rectification of inaccurate data (Art. 16 GDPR),
erasure of your data (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability, meaning a copy of your data in a common format (Art. 20 GDPR),
withdraw any consent given, with effect for the future (Art. 7(3) GDPR).

Right to object: Where we process data based on Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

To exercise your rights, write to DEINE-EMAIL.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us: [ZUSTÄNDIGE AUFSICHTSBEHÖRDE, ADRESSE].

11. Changes

If Frame or the law changes, we will update this privacy policy. The version published here applies.