Privacy Policy

Last updated: July 18, 2026

This Privacy Policy describes how Povver collects, uses, stores, and shares your personal data when you use the Povver mobile application and website (together, the "Service"). The Service is operated by BVA Technologies Oy (trading as Povver), a limited liability company registered in Finland (Business ID: 3629043-3).

By creating an account or using the Service, you consent to the practices described in this policy, including the processing of health-related data as described in Section 3.

1. Data Controller

Povver is the data controller for the personal data processed through the Service. This means we determine the purposes and means of processing your data.

BVA Technologies Oy
Business ID: 3629043-3
Lupajantie 1 F 16, 00970 Helsinki, Finland
Email: info@povver.ai

2. What We Collect

2.1 Account Information

When you create an account, we collect your email address, display name (if provided), and authentication credentials. Authentication is handled by Firebase Authentication or Apple Sign-In — we do not store passwords directly.

2.2 Workout and Training Data

The core of the Service involves recording your training. This includes exercises performed, sets, repetitions, weights, RPE (Rate of Perceived Exertion), workout dates, durations, personal notes, templates, routines, and training programs. This data may reveal information about your physical capabilities and health status, and we treat it accordingly (see Section 3).

2.3 AI Coaching and Analysis Data

When you interact with the AI coach, we process the messages you send, the responses generated, and the workout context used to produce those responses. Your workout history and performance trends are provided to the AI model so it can generate personalized coaching. See Section 5 for details on how AI processing works.

After each workout, we run a background analysis that computes training metrics from your session — such as estimated strength levels, training load, and volume trends across muscle groups. These computed metrics are stored alongside your workout data and used to generate coaching recommendations. See Section 5 for details.

The AI coach may also store notes about your preferences, equipment, and training context (such as injuries you've mentioned or exercises you prefer) so it can provide continuity across conversations. You can view and delete these notes at any time through the app.

2.4 Device and Usage Data

We automatically collect device type, operating system version, app version, feature usage patterns, interaction events, crash reports, and performance diagnostics. We collect country-level location (not precise GPS coordinates).

2.5 Payment Data

All subscription payments are processed by Apple through the App Store. We do not collect or store your payment card details, billing address, or financial information. We receive only a transaction confirmation and subscription status from Apple.

2.6 Analytics and Diagnostics

In the app: We use Google Firebase Analytics to understand how features are used (for example, which screens you visit and which actions you take) and Google Firebase Crashlytics to detect and diagnose crashes and errors. These tools collect your account identifier, device type, operating system version, app version, interaction events, and diagnostic data, and process it on Google's infrastructure to help us keep the app stable and improve it. You can opt out of app analytics at any time in the app's settings, and doing so does not affect any other functionality.

On our website: povver.ai uses Google Analytics 4 to collect anonymized usage data such as page views, referral sources, and device information. Until you accept the cookie banner, and if you decline it, the analytics tag runs in consent mode: it sets no cookies and stores no identifier, and sends only cookieless pings (for example that a page was viewed) that carry no persistent identifier, cannot be linked to you across visits, and are used only in aggregate. If you accept, Google Analytics sets its cookies so that visits can be counted per visitor. You can withdraw consent at any time by clearing this site's data in your browser, after which the banner is shown again.

2.7 Data We Do Not Collect

We do not collect biometric identifiers or biometric information (such as fingerprints, facial geometry, voiceprints, or retina scans). We do not collect precise geolocation data. We do not access your device camera, microphone, contacts, or photo library.

3. Legal Basis for Processing

We process your data under the following legal bases, as required by the GDPR and other applicable privacy laws:

  • Contractual necessity (GDPR Art. 6(1)(b)) — processing that is necessary to provide the Service you signed up for, including storing your workouts, generating AI coaching, computing training metrics, and delivering personalized recommendations.
  • Explicit consent for health-related data (GDPR Art. 9(2)(a)) — workout data may reveal information about your physical health, fitness level, and physical capabilities. We treat your training data as sensitive personal data and process it only with your explicit consent, which you provide when you create an account and begin logging workouts. The App Store also discloses our Health & Fitness data collection before you download the app.
  • Consent for advertising measurement (GDPR Art. 6(1)(a)) — where we share limited data to measure advertising or offer relevant promotions (see Section 4), we do so on the basis of your consent, which you can decline or withdraw at any time.
  • Legitimate interest (GDPR Art. 6(1)(f)) — service improvement based on aggregated usage patterns, security monitoring, and fraud prevention. We balance these interests against your privacy rights and only process what is necessary.
  • Legal obligation (GDPR Art. 6(1)(c)) — where required by applicable law, such as responding to lawful requests from authorities.

Withdrawing Consent

You can withdraw your consent at any time:

  • Advertising consent — where advertising measurement relies on your consent, you can decline or withdraw it at any time, and the Service continues to function identically.
  • Health-related data consent — you can stop AI processing of your data by cancelling your premium subscription, which disables coaching and analysis features while preserving your workout history. To withdraw consent for all data processing, you can delete your account, which triggers deletion of your personal data within 30 days (see Section 8).

Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.

4. How We Use Your Data

  • Providing the Service — storing your workouts, generating AI coaching recommendations, tracking your training progress, and building personalized programs.
  • AI Coaching and Analysis — your workout history and messages to the AI coach are sent to our AI model provider (Google Vertex AI) to generate responses. After each workout, we also run a background analysis to compute training metrics (such as estimated strength, muscle-specific volume, and fatigue trends) and generate personalized recommendations. If you enable Auto-Pilot, low-impact recommendations (such as small weight increases) may be applied to your training templates automatically. You can disable Auto-Pilot at any time. See Section 5 for details.
  • Service Improvement — analyzing anonymized usage patterns, identifying bugs, and developing new features. We do not use your individual workout data for this purpose without anonymization.
  • Communication — sending service-related notifications and responding to support requests. We will only send marketing communications with your explicit opt-in consent.
  • Security and Fraud Prevention — detecting and preventing unauthorized access, abuse, or other harmful activity.
  • Legal Compliance — meeting our obligations under applicable law, including responding to lawful requests from authorities.

We do not sell your personal data. We do not share your personal data with third parties for their own independent marketing purposes.

Advertising and measurement: We promote Povver through advertising platforms such as Apple Search Ads and Reddit. Today, our advertising relies on aggregate, platform-level measurement and does not involve sharing your personal data with these platforms. In the future, we may introduce privacy-preserving measurement or offer relevant promotions — for example, by sharing hashed identifiers that cannot be read as your real name or email. If we do, it will be only with your consent where required, we will update this policy beforehand, and we will never share your name, email address, workout data, conversation history, or any health-related information with advertising partners.

5. How AI Processing Works

Povver uses AI to provide coaching, post-workout analysis, and program generation. The AI coach is an automated system, not a human. When you send messages to the AI coach, those messages are transmitted to a third-party AI infrastructure provider for processing. By using the AI coaching features, you acknowledge and consent to this transmission.

5.1 Real-Time Coaching

When you chat with the AI coach, your message and relevant training context (such as a summary of recent workouts, your current program, and active workout state) are sent to Google Vertex AI to generate a response. We do not routinely review individual conversations; access is limited to authorized personnel and only for security, debugging, abuse prevention, or legal compliance.

5.2 Post-Workout Analysis

After you complete a workout, Povver runs a background analysis. This process works in two stages:

  • Deterministic computation: We calculate training metrics directly from your workout data — such as estimated strength levels per exercise, training load ratios, and volume per muscle group. This stage does not involve AI and runs entirely on our infrastructure.
  • AI-powered assessment: If the analysis detects meaningful signals (such as a strength plateau, elevated fatigue, or a progression opportunity), summary statistics are sent to Google Vertex AI to generate specific recommendations. Only pre-aggregated metrics are sent — not your raw workout data.

5.3 Automatic Recommendations (Auto-Pilot)

Premium users can enable Auto-Pilot, which allows the system to automatically apply low-impact recommendations to training templates — such as small weight increases when you've consistently hit your targets. Higher-impact changes (such as exercise swaps or deload weeks) are always presented for your review. You can disable Auto-Pilot at any time, and all automatic changes are logged and visible in the app.

Auto-Pilot recommendations are based on your logged training data and general exercise science principles. They do not account for injuries, pain, illness, or day-to-day physical condition that you have not reported to the coach. You are responsible for evaluating whether any recommendation — automatic or otherwise — is appropriate for your current condition.

5.4 Data Derived from Your Workouts

We compute and store the following data from your workouts to power coaching and analysis:

  • Estimated one-rep maximum (e1RM) per exercise
  • Weekly training volume and intensity per muscle group
  • Fatigue and recovery status (based on workload ratios)
  • Progression and plateau detection
  • A training profile that reflects your learned preferences (such as how aggressively you prefer to increase weight)

This derived data is stored alongside your workout data, is subject to the same protections, and is deleted when you delete your account.

5.5 External AI Integrations (MCP)

Premium users can optionally connect external AI tools — such as Claude — to their Povver data through the Model Context Protocol (MCP). When you connect an external tool, it can read your profile, workout history, training programs, and analysis data to provide additional coaching or insights, and — acting on your behalf — make changes to your training.

  • You control which tools are connected and can revoke access at any time through the app.
  • In addition to reading your data, connected tools can make changes on your behalf: create, edit, and delete routines and workout templates; set or pause a periodization plan; record injury notes; and delete a logged workout. Tools that delete or overwrite data are marked as such so the assistant asks before making destructive changes.
  • All changes made by external tools are recorded in a change log attributed to the tool, so you can see what was done.
  • We are not responsible for how external AI tools process your data once it leaves our servers. Review the privacy policy of any tool you connect.

5.6 AI Provider and Data Use

  • AI Model Provider: We use Google Vertex AI (operated by Google LLC) to run large language models that power the coaching and analysis features.
  • Data retention by the AI provider: Under our agreement with Google, data sent to Vertex AI for inference is not used by Google to train or improve their models. Google's data processing terms apply to this processing.
  • No third-party model training: Your personal workout data is never used to train AI models — not by us, and not by our AI provider.

6. Third-Party Data Processors

We use the following third-party services to operate the Service. Each processes data on our behalf, under data processing agreements, and subject to their own privacy policies:

  • Google LLC (United States / global infrastructure)
    • Firebase Authentication — account creation and sign-in
    • Cloud Firestore — secure storage of workout data and account information
    • Google Vertex AI — AI model inference for coaching features
    • Firebase Analytics — in-app usage analytics
    • Firebase Crashlytics — crash and error diagnostics
    • Google BigQuery — internal, access-restricted analytics data warehouse
    • Google Analytics 4 — anonymized website usage analytics
  • Apple Inc. (United States)
    • Sign in with Apple — authentication
    • App Store — payment processing and subscription management
  • Advertising Platforms (various jurisdictions)
    • We promote Povver through advertising platforms such as Apple Search Ads and Reddit. Our current acquisition advertising uses aggregate, platform-level measurement and does not share your personal data. If we later introduce privacy-preserving measurement or retargeting, any data shared would be limited to hashed identifiers, subject to your consent where required, and would never include your workout data, conversation history, or health-related information.

We may integrate additional service providers in the future. When we do, we will update this policy and notify you of material changes. Any new provider will be bound by a data processing agreement before receiving access to personal data.

For details on how these providers handle data:

7. International Data Transfers

Povver is based in Finland (EU). Your data may be transferred to and processed in countries outside the European Economic Area, including the United States, where our third-party service providers maintain infrastructure.

These transfers are protected by:

  • The EU-U.S. Data Privacy Framework (for transfers to certified U.S. organizations)
  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • The UK International Data Transfer Agreement (UK IDTA) for transfers from the United Kingdom

We ensure that any international transfer of your data is accompanied by appropriate safeguards that provide a level of protection equivalent to that available within the EEA.

8. Data Retention and Deletion

We retain your data for as long as your account is active and as needed to provide the Service. Specific retention periods:

  • Workouts, templates, and routines — retained for the lifetime of your account. Your training history is what makes coaching and progression tracking work.
  • AI conversations and coach memory — retained for the lifetime of your account to provide continuity across coaching sessions.
  • Training recommendations — stop being offered after 7 days, and are retained while your account is active so we can learn which suggestions helped you. Deleted when you delete your account.
  • Post-workout insights and weekly training reviews — retained while your account is active to power your progress trends, training history, and coaching. Deleted when you delete your account.
  • Subscription event records — retained for 180 days for billing audit purposes, then deleted.
  • Derived training metrics (muscle state, training profile, periodization plan) — retained for the lifetime of your account, deleted on account deletion.
  • Internal analytics warehouse — we export certain data, which may include personal data, to an internal analytics data warehouse (Google BigQuery) that we use to operate, monitor, and improve the Service. This data is not shared externally, and access is restricted to authorized personnel.

When you delete your account, we will delete all personal data associated with your account within 30 days. Encrypted backup copies may persist in access-restricted disaster recovery storage for up to 30 additional days, after which they are automatically purged. If you request deletion of specific data (such as a conversation or workout) without deleting your account, we will process that request within 30 days. Data that we are required by law to retain will be kept for the minimum period required and then deleted.

You can request account deletion at any time through the app or by contacting us at info@povver.ai.

9. Your Rights

Regardless of where you are located, you have the following rights regarding your personal data:

  • Access — request a copy of the personal data we hold about you.
  • Correction — request correction of inaccurate or incomplete data.
  • Deletion — request deletion of your personal data.
  • Restriction — request that we limit how we process your data.
  • Portability — receive your data in a structured, commonly used, machine-readable format.
  • Objection — object to processing of your data based on our legitimate interests.
  • Withdraw consent — where processing is based on your consent, you may withdraw it at any time. For health-related data, you can withdraw by cancelling your premium subscription (which stops AI processing) or by deleting your account. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
  • Control over advertising data — where we offer advertising measurement that relies on your consent, you can decline or withdraw it at any time without affecting any other functionality of the Service.
  • Human review of automated decisions — where automated processing (such as Auto-Pilot recommendations) may significantly affect your training, you have the right to request human review. Contact us at info@povver.ai.

To exercise any of these rights, contact us at info@povver.ai. We will respond within 30 days. If a request is complex or we receive a large number of requests, we may extend this by an additional 60 days — we will notify you if this is the case.

If you are unsatisfied with our response, you have the right to lodge a complaint with a supervisory authority. For users in Finland, this is the Office of the Data Protection Ombudsman (tietosuoja.fi). Users in other jurisdictions may contact their local data protection authority.

10. Data Security

We implement technical and organizational measures to protect your personal data, including:

  • Encryption in transit (TLS 1.2+) and at rest
  • Authentication-gated access to all personal data
  • Principle of least privilege for system access
  • Regular security reviews of our infrastructure and code

No method of electronic transmission or storage is completely secure. While we implement industry-standard protections, we cannot guarantee absolute security.

11. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

  • Notify the relevant supervisory authority within 72 hours of becoming aware of the breach.
  • Notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms.
  • Document the breach, its effects, and the remedial actions taken.

12. Age Restriction

The Service is intended for users who are at least 18 years old. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected data from a person under 18, we will delete it promptly. If you believe someone under 18 has provided us with personal data, please contact us at info@povver.ai.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes — such as new categories of data collection, new third-party processors, or changes to how AI processing works — we will notify you through the app and/or by email before the changes take effect.

The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of the Service after changes take effect constitutes acceptance of the updated policy. If you disagree with the changes, you should stop using the Service and delete your account.

14. Regulatory Compliance

Povver is designed and operated to comply with the following data protection and privacy frameworks:

  • GDPR — EU General Data Protection Regulation (Regulation (EU) 2016/679)
  • UK GDPR — United Kingdom General Data Protection Regulation and Data Protection Act 2018
  • Finnish Data Protection Act (Tietosuojalaki 1050/2018)
  • CCPA / CPRA — California Consumer Privacy Act and California Privacy Rights Act
  • PIPEDA — Canada's Personal Information Protection and Electronic Documents Act
  • Australian Privacy Act 1988 and Australian Privacy Principles (APPs)
  • EU AI Act — Regulation (EU) 2024/1689, as applicable to limited-risk AI systems

Where local law provides additional rights beyond those described in this policy, those rights apply to users in the relevant jurisdictions. If you have questions about your specific rights under local law, contact us at info@povver.ai.

15. Contact

For questions about this Privacy Policy, data protection requests, or concerns about how your data is handled:

BVA Technologies Oy
Business ID: 3629043-3
Lupajantie 1 F 16, 00970 Helsinki, Finland
Email: info@povver.ai

We aim to resolve all data protection queries promptly. If you are not satisfied with our response, you have the right to escalate your concern to the relevant supervisory authority in your jurisdiction.