Privacy Policy

Last updated: August 12, 2026

Training Buddy ("the App") is provided by Mochi ("we", "us"). This policy describes what data we collect, how we use it, the legal basis on which we process it, how long we keep it, and the choices you have.

Data controller

For the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the data controller of the personal data processed by the App is Mochi (Sweden). You can reach the controller at info@mochi.is for any privacy-related question or to exercise the rights described below.

Data we collect

• Account data: email address and display name you provide when signing in.
• Workout data: exercises, sets, reps, weights, durations, GPS traces, heart rate, and other training metrics you enter or that are recorded during workouts.
• Social data: friends, feed posts, cheers, and reactions.
• Device data: crash reports, performance metrics, and diagnostic logs (via Firebase Crashlytics and Analytics).
• HealthKit / Health Connect (reading): if you grant permission, we read heart rate, steps, active energy, and workout records. Heart-rate samples and live-workout signals recorded during an active session are uploaded to our servers as the session runs — to sync your workout and, if you share it, to show live progress to friends — not only when you save it; the remaining Health data we read stays on your device unless it forms part of a workout you record.
• HealthKit / Health Connect (writing): if you opt in, when you finish a workout the App writes it back into Apple Health (iOS) or Health Connect (Android) on your device — the workout type and duration, heart-rate samples, active energy, and, for cardio sessions, the GPS route. This export is off by default; on iOS you enable it with the "Sync to Apple Health" toggle in Settings, and on Android it happens only after you grant Health Connect write permission (including the separate route-write permission for GPS routes). Once written, this data lives in your device's Health store, where other apps you have authorized may be able to read it; that sharing is governed by Apple's or Google's health-data policies and your device permission settings, not by us. You can turn the export off at any time, and revoking the permission stops all future writes.
• Location: if you grant permission, we record GPS traces during cardio workouts you start. Location is not tracked in the background outside of an active session.

How we use it

• To sync your workouts across your devices and provide the core features of the App.
• To show you statistics, progress, and social feed content.
• To diagnose crashes and improve stability.

Legal basis (EEA / UK users)

Where the GDPR applies, we process your data on the following grounds:

• Performance of a contract (Article 6(1)(b)): account creation, sync, social features, and other functionality you sign up for.
• Legitimate interests (Article 6(1)(f)): crash diagnostics and performance monitoring to keep the App stable.
• Consent (Article 6(1)(a) / Article 9(2)(a) for health data): location tracking during cardio workouts, and reading data from — and writing finished workouts back into — HealthKit / Health Connect. You can withdraw consent at any time in the App's settings (for the Apple Health export) or your device's permission settings.

Data storage and processors

Data is stored on Google Firebase (Firestore, Cloud Storage, Authentication, Cloud Functions, Crashlytics, Analytics). Google processes this data on our behalf under their data-processing terms. Firebase services may transfer data outside the EEA (primarily to the United States); Google relies on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses to provide an adequate level of protection.

Third-party SDKs and services we use:

• Firebase (Google) — authentication, database, storage, hosting, crash reporting, analytics, cloud functions.
• Google Maps — to render workout routes on the web.
• Apple HealthKit / Google Health Connect — only when you grant permission; used both to read health metrics and, if you opt in, to write your finished workouts (including cardio GPS routes) into your device's Health store.

Retention

We keep your account data for as long as your account exists. When you delete your account from within the App, your account record and associated training data are removed from our live systems immediately. Backups are rotated on a rolling basis and deleted entries are purged from backups within 30 days. Crash and diagnostic data is retained for up to 90 days.

Sharing

We do not sell your data. Workout and profile content you post to the social feed is visible to your friends or to all users according to the privacy setting you choose on each post.

Cookies and analytics

Analytics is off by default and only runs if you accept it — no analytics cookies are set until then. You can change your mind at any time:

Your rights

• Access / export: use the Export Data option in the App's Settings, or the Export Data page on the web, to download your workouts. Choosing the Complete format in the App's Export Data screen downloads a full copy of everything we hold about you (profile, body measurements, achievements, posts, and full GPS and heart-rate data). You can also request one from info@mochi.is.
• Rectification: edit your profile and workout data directly in the App.
• Deletion: use the Delete Account option in the App's Settings, or the Delete Account page on the web. This removes your account and associated training data.
• Objection / restriction: contact us at the address below.
• Complaint: if you are in the EEA or UK, you have the right to lodge a complaint with your local data protection supervisory authority.

Children

The App is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact us so we can remove it.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be highlighted in-app or via email.

Contact

Questions about this policy or to exercise your rights: info@mochi.is