Updated 16 Oct 2026

Privacy
Policy

Your privacy matters to us. In this policy we explain how we collect, use and protect your personal data in the Tsemp service.

1. Data controller

The controller responsible for processing your personal data is:

Tsemppi Fitness Oy

  • Business ID: 3377898-6
  • Address: Kolmas Linja 30 B, Helsinki, Finland
  • Email: info@tsemppiapp.fi

2. What data we collect

We collect the following data in order to provide the service:

Basic details

Name, email, date of birth, gender

Account details

Username, password (encrypted), profile picture

Training data

Training history, performances, weights, repetitions, progress data

Body data

Height, weight, limitations (optional)

Health and fitness data

Workouts you import from Apple Health or Health Connect: type, duration, distance, energy burned, heart rate and elevation gain (optional)

Location data

The GPS route of outdoor workouts, and your location for gym search (optional, see section 5)

Usage data

How the app is used, device information, IP address

Feedback and questions

Your answers to the occasional questions the app asks, such as where you heard about Tsemp, and the reason you may give when deleting your account. Answering is always optional (see sections 6 and 10)

Note: Your heart rate and any injuries or limitations you tell us about are health data. We process them only with your explicit consent (Article 9(2)(a) GDPR), which you give by switching on the feature in question. We store heart rate only if you connect Apple Health or Health Connect and import workouts from there. You can delete imported workouts and the limitations you have entered at any time, and the processing then ends. Training, body and health data are voluntary, and you decide what you store.

3. Artificial intelligence and data processing

Tsemp uses artificial intelligence to create personalised training programs. Here we explain in detail how the AI works:

What data the AI uses

  • •Goal: Muscle growth, strength, fat loss or performance
  • •Level: Beginner, intermediate or advanced
  • •Training frequency: How many times per week you want to train
  • •Session length: Target time per workout
  • •Equipment: Gym, basic equipment or home training
  • •Limitations: Any injuries or restrictions (knee, shoulder, back, hip)

Third-party AI service

We use an OpenAI language model to generate training programmes. When you create a new training programme:

  • •We send OpenAI only the onboarding details mentioned above (goal, level, frequency, length, equipment, limitations)
  • •We do not send personal identifiers such as your name, email or username
  • •OpenAI does not use the data to train its models when accessed via the API
  • •The data is processed in accordance with the EU General Data Protection Regulation

Data storage

  • •Your account data, training data and other data created in the service are stored in data centres located in the EU
  • •Generated training programmes are stored in your account, not at OpenAI
  • •Some of the service providers we use also process data outside the EU and the EEA, including in the United States. For those transfers we rely on the European Commission’s standard contractual clauses or on other safeguards required by EU law. The list of service providers is in section 8.

Limitations of the AI: The AI creates a training program based on the information you provide and our existing exercise library. The AI does not replace advice from a professional, and we recommend consulting a doctor before starting a new training program, especially if you have any health-related limitations.

4. Strength level and muscle points

Tsemp calculates metrics that describe your progress based on your training data:

Strength level metric

The strength level is based on standardised powerlifting formulas and takes into account:

  • •Lifted weights: Maximum performances in different exercises
  • •Body weight: Relative strength in proportion to body weight
  • •Gender: Comparison with gender-specific averages

Muscle map and progress

The muscle map visualises the load of your workouts:

  • •Intensity: Calculated from sets, repetitions and weight
  • •Target muscles: Each exercise targets specific muscle groups as defined in our exercise library
  • •PR tracking: Personal records are saved automatically

Note: These metrics are indicative and intended to motivate and track progress. They are not medical assessments.

5. App permissions

Tsemp may request the following permissions on your device. Each permission is optional and you can manage them in your device settings:

Camera
Optional

We use the camera to take a profile picture and to save training videos and progress photos to your profile.

Notifications
Optional

We use notifications to remind you about workouts, inform you about community activity (likes, comments, followers) and replies to support messages.

HealthKit (iOS)
Optional

The HealthKit integration lets you sync training data with Apple Health, so you can follow all your activity in one place.

Health Connect (Android)
Optional

The Health Connect integration brings workouts from your watch and other fitness apps into your training history (type, duration, distance, energy burned, heart rate and elevation gain), and saves the workouts you finish in Tsemp and your weight to Health Connect. We read only the data types you allow, and we never use them for advertising. We do not read workout routes from Health Connect.

Location
Optional

When you start an outdoor workout, Tsemp records the GPS route, distance and pace, including while the screen is locked, and stops as soon as you finish. The route coordinates stay on your phone: our server stores only the distance, splits and the shape of the route, without coordinates. In gym search, your location is sent to Google’s place search to find gyms near you, and it is not stored.

Note: The app works fully without these permissions. We only ask for permission when you use the relevant feature for the first time.

6. What we use your data for

We use your data for the following purposes:

  • ✓Creating personalised training programmes with AI — performance of the contract
  • ✓Tracking your progress and visualising it as a muscle map — performance of the contract
  • ✓Managing your user account and signing you in — performance of the contract
  • ✓Providing community features (if you share your workouts) — performance of the contract
  • ✓Processing health data in your training programme — explicit consent
  • ✓Customer communication and support — performance of the contract
  • ✓Developing and improving the service — legitimate interest
  • ✓Developing the service on the basis of your voluntary feedback answers — legitimate interest
  • ✓Ad measurement in the app (section 10) — consent

7. Data security

We protect your data carefully:

🔐
Encryption

All data is encrypted both in transit (TLS) and at rest. Passwords are hashed with the bcrypt algorithm.

🛡️
Secure infrastructure

The database and files are located in data centres in the EU. Our servers are in Germany. Some service providers also process data outside the EU, see sections 3 and 8.

🔑
Access control

Authentication based on JWT tokens, 90-day session validity

📋
Regular audits

We review our security practices regularly

8. Sharing of data

We do not sell your data

Your personal data is never sold to third parties for marketing purposes.

We share data only with:

  • •OpenAI: Generating your training programme. Only onboarding data, no personal data
  • •MongoDB Atlas: The main database, where your account data and training data are stored
  • •Google Cloud Storage: Storage of profile pictures, workout pictures and community post images, and storage of employee benefit receipts in a protected folder
  • •RevenueCat: Managing subscriptions and trial periods. Receives the subscription identifier and the subscription status
  • •Resend: Emails sent by the service, such as the welcome message and password reset. Receives your email address and name
  • •Expo Push Notification Service and Firebase Cloud Messaging: Delivery of push notifications. Receive your device’s notification token
  • •Sentry: Error and crash monitoring. Contains no training or health data
  • •PostHog (EU region): Usage analytics. You can refuse analytics: Settings → About → Analytics
  • •Google Places: Gym search. Your location is sent for the search and is not stored
  • •Apple and Google sign-in: Alternative sign-in method. We only receive your email address and name
  • •Ad measurement (Meta and TikTok): Only with your consent, and only in the app. See section 10
  • •Website analytics and ad measurement: Only with your consent, and only on the website. See section 9
  • •Community features: To other users only if you choose to share your workouts
  • •Legal obligations: To the authorities only where required by law

9. Cookies and tracking on the website

Running the website

Necessary cookies keep the website working: signing in, the session and the language choice. These cannot be switched off and they do not require consent.

Required
Visitor counts without cookies

We measure which pages are read and which pages lead to the app stores. This measurement stores nothing on your device and reads nothing from it. The identifier is random and disappears when you close or reload the page. Events pass through our own server to PostHog (EU region), and your IP address is not passed on. We do not build user profiles. The basis is our legitimate interest in improving the website.

No cookie

Analytics and ad measurement, only with consent

With your consent we also use the following tools. They set cookies or use browser storage, and some of them transfer data outside the EU.

Google Analytics 4 (Google Ireland Ltd)

Visitor numbers and behaviour on the website.

Consent only
Microsoft Clarity (Microsoft Ireland)

Session recordings and heatmaps that show us where on a page visitors stop.

Consent only
Meta Pixel (Meta Platforms Ireland Ltd)

Measuring and targeting advertising.

Consent only
TikTok Pixel (TikTok Technology Limited)

Measuring and targeting advertising.

Consent only

The legal basis is your consent (Article 6(1)(a) GDPR). Before you consent, these tools are not loaded at all. You can give or withdraw your consent at any time:

Transfers outside the EU

The parent companies of these services are in the United States and data may be processed there. For those transfers we rely on the European Commission’s standard contractual clauses or on other safeguards required by EU law.

Ad measurement in the app is a separate matter from website tracking. It is described in section 10.

10. Ad measurement in the app (Meta and TikTok)

The app includes ad measurement by Meta (Facebook and Instagram) and TikTok. It lets us see which advert a download or a subscription came from. We use the Meta SDK (react-native-fbsdk-next) and the TikTok Business SDK.

Nothing is sent before you consent. We ask for your consent once, before you create an account, in a separate view. If you do not consent, ad measurement stays switched off entirely and nothing is sent from your device to the advertising platforms.

What is sent for ad measurement:

  • •Device identifiers: the advertising identifier and technical details of the device
  • •App events: installing the app, opening it and registering
  • •Purchase events: taking out a subscription and the value of the subscription

Purpose and legal basis

We use this data to measure and target advertising: we can see which adverts lead to downloads and subscriptions, and the advertising platforms can target advertising. The legal basis is your consent (Article 6(1)(a) GDPR).

Differences between operating systems

iOS

The app does NOT use App Tracking Transparency or the IDFA advertising identifier. Measurement is based on Apple’s SKAdNetwork and on aggregated data that cannot be linked to an individual user.

Android

The app uses the Google Advertising ID (GAID). You can reset or delete the advertising ID in your Android device settings.

Recipients and transfers outside the EU

Meta Platforms Ireland Ltd

Advertising platform. Also processes the data for its own purposes, such as targeting advertising.

Meta Privacy Policy
TikTok Technology Limited

Advertising platform. Also processes the data for its own purposes, such as targeting advertising.

TikTok Privacy Policy

Both companies are established in the EU (Ireland), but the data may also be transferred for processing outside the EU and the EEA, including to the United States. The safeguards required by EU law are used for these transfers, such as the European Commission’s standard contractual clauses. Further details of the transfers and the grounds for them can be found in those companies’ own privacy policies.

Withdrawing your consent. You can withdraw your consent at any time in the app: Settings → About → Ad measurement. After withdrawal the app sends no new events. You can ask Meta and TikTok to delete data already sent through their own channels.

11. Data retention period

  • 👤User data: We keep it for as long as your account is active
  • 💪Training data: We keep it for the lifetime of the account, so you can follow your progress
  • 🗑️After account deletion: Data is deleted within 30 days
  • 📊Anonymised statistics: We may keep anonymised data to develop the service
  • 💬Feedback answers: Kept on our own server for as long as your account is active. When you delete your account, your answers are anonymised: they are detached from the account and any text you wrote is deleted, so your choices remain only in anonymous statistics. The reason you give when deleting your account is stored without your name, email address, username or the exact time, so it cannot be linked to you.
  • ⏰Session expiry: After 90 days of inactivity you need to log in again

12. Your rights (GDPR)

You have the following rights regarding your personal data:

Right to access your data

You can request a copy of all data collected about you

Right to rectification

You can correct inaccurate or incomplete data

Right to erasure

You can delete your account in the app settings ("right to be forgotten")

Right to restrict processing

You can restrict the processing of your data in certain situations

Right to data portability

You can receive your data in a machine-readable format

Right to object

You can object to your data being processed for marketing

Right to withdraw consent

You can withdraw a consent you have given at any time. Withdrawal does not affect the lawfulness of processing carried out before it

Exercise your rights by sending an email to info@tsemppiapp.fi. We respond to your request within 30 days.

13. Underage users

Tsemp is intended for people aged 15 and over.

  • •We do not knowingly collect personal data from anyone under 15
  • •If we learn that a person under 15 has created an account, we delete the account and the data associated with it
  • •If you are under 18, you need your guardian’s consent to take out a paid subscription
  • •A guardian has the right to review and delete a minor’s data by contacting info@tsemppiapp.fi

14. Changes to this privacy policy

We may update this privacy policy from time to time. We will notify you of significant changes:

  • 📱In the app with a notification
  • 📧By email
  • 🌐On our website

We recommend reviewing this policy regularly. By continuing to use the service after changes, you accept the updated privacy policy.

15. Right to lodge a complaint

If you believe that our processing of your personal data infringes data protection law, you have the right to lodge a complaint with a supervisory authority. As the data controller is established in Finland, the lead supervisory authority is the Office of the Data Protection Ombudsman (Finland). Under the GDPR you may also lodge a complaint with the supervisory authority in your country of residence; if you are in Denmark, this is the Danish Data Protection Agency (Datatilsynet):

Office of the Data Protection Ombudsman (Finland)

  • Visiting address: Lintulahdenkuja 4, 00530 Helsinki, Finland
  • Postal address: P.O. Box 800, 00531 Helsinki, Finland
  • Email: tietosuoja(at)om.fi
  • Switchboard: +358 29 566 6700
  • Denmark: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby – dt@datatilsynet.dk

16. Contact us

If you have questions about privacy or want to exercise your rights:

📧
📍Kolmas Linja 30 B, Helsinki, Finland
🏢Tsemppi Fitness Oy (Business ID: 3377898-6)

This version replaces the version dated 14 October 2026. The previous version is available: 14 October 2026

Privacy Policy