Privacy Policy

Last updated: October 15, 2026 · Version française (autoritative)

Courtesy translation. This English version is provided for convenience only. The French version is the legally authoritative text and prevails in case of any discrepancy.

1. Introduction and legal framework

This privacy policy describes how the Project Alpha application (the "Application", "we") collects, uses, stores, shares and protects your personal data. Project Alpha is published from Switzerland. It applies to all users and is written to comply with both:

the Swiss revised Federal Act on Data Protection (FADP/nLPD), in force since September 1, 2023;
the European Union's General Data Protection Regulation (GDPR), for users residing in the EU/EEA.

The data controller is identified in our legal notice (French). You can reach us at any time at support.projectalpha@gmail.com for any question about your data.

2. Data we collect

2.1 Account and sign-in

Email and password (classic sign-up): to create, secure and authenticate your account. The password is managed by Firebase Authentication (Google) and is never accessible in clear text, including by us.
Google or Apple sign-in: we only receive your email address, display name and an account identifier provided by Google/Apple; never your Google/Apple password.
Phone sign-in: your phone number is sent to Google / Firebase Authentication to send you a verification code by SMS and for abuse prevention (limiting fake account creation or automated SMS sending). It is stored by Firebase and linked to your account as long as you use phone sign-in. This is disclosed in the Application before the SMS is sent.
Your username (visible to other users), while your email/phone number remain private from other users (see 3.4).

2.2 Fitness profile and activity

Age, sex, weight, height, goal, fitness level, training frequency, available equipment.
Workout sessions (exercises, sets, loads, reps, duration), statistics (XP, rank, level, streak).
Meals and nutrition data you log (calories, macronutrients).
Generated programs (12-week program, meal plans).
Weight and body measurements you enter (arm, chest, waist, hips, thigh, calf, with their date): visible to you only. Your weight, height and age are kept in a private area of your account, never readable by other users; your weight is used to compute your calorie needs.
Personal records (max load, estimated 1RM, best volume, best reps, best distance, pace and duration), computed by our servers from your workouts, and monthly recaps (workouts, time, total load, records, most trained muscle, streak, rank, pack) generated on the 1st of each month. Visible to you only, unless you choose to share them.
Offline mode: a workout finished without a connection is kept temporarily on your phone, then sent to our servers as soon as the network is back and deleted from the phone.

2.3 Photos

Profile picture: visible to other users (friends, pack, leaderboard).
"Before/after" progress photos: stored in Firebase Storage, visible only to you, never shared publicly or with other users.

2.4 Social features (friends, activity feed, packs)

Some of the data you post is, by nature, visible to other users:

Activity feed posts and comments: visible to any signed-in user.
Friend requests and friend lists: visible to the people concerned.
Weekly XP leaderboard: your username, profile picture and XP are visible to other signed-in users.
Packs: if you join or create a pack, your username, profile picture, the messages you send in the pack chat, and your workouts appearing in the pack's activity feed are visible to the other members of that pack (never to other users).
Profile sex: it is visible to other signed-in users who see your profile, your posts, your leaderboard position or your activity in a pack (friends, activity feed, leaderboard, pack). It is used only to display your rank with the right grammatical agreement (for example « Louve Solitaire » or « Guerrière » in French).

2.5 AI Coach and generated content (Anthropic / Claude)

The AI Coach, 12-week program generation, meal plan generation, meal photo analysis and monthly recap analysis (a numeric summary of the month: workouts, time, total load, records, most trained muscle, streak, rank, and the previous month for comparison) features rely on Anthropic's API (Claude models). When you use these features, we send to Anthropic, through our servers:

the messages you send to the Coach (and previous replies, for conversation context);
a summary of your profile: first name, age, sex, weight, height, goal, fitness level, in-app rank, training frequency, available equipment, total number of sessions, current streak;
a summary of your recent workouts (date, program, duration, sets, exercise names);
for meal plans: your calorie/macronutrient targets and any dietary preferences or allergies you enter;
for meal photo analysis: the photo you take with the camera or choose from your gallery, sent to Anthropic solely to detect the foods and estimate portions/calories/ macronutrients. This photo is never stored on our servers: it is held in memory only for the duration of the analysis and then immediately discarded; only the foods, portions and nutritional values you subsequently confirm (and can edit before saving) are kept in your food log.

Anthropic acts as a data processor and only processes this data to generate the requested reply, program, plan or analysis. Under Anthropic's public commercial terms, data submitted through its API is not used to train its models by default, and is retained for a limited time for safety/abuse-prevention purposes before deletion. We recommend not sharing sensitive health data with the AI Coach beyond what is necessary for a relevant answer (e.g. pain, injury); the AI Coach never replaces professional medical advice (see our Terms of Use).

Explicit consent required. Before the very first use of the AI Coach, the 12-week program, the meal plan, or meal photo analysis, the Application shows a dedicated screen detailing the data transmitted and its recipient (Anthropic, United States) and asks for your explicit agreement ("I agree" / "Decline"). Without this agreement, these four features remain unavailable: no data (including no photo) is sent to Anthropic. This consent, with its date, is recorded on your account and re-verified by our servers on every use. You can withdraw it at any time from Settings → AI privacy; the features then immediately become unavailable again until you agree once more.

Meal photo analysis is limited to Premium members and capped at 15 analyses per day per account. Results are estimates that you must review and can correct before anything is saved to your log.

2.6 Payments and Premium subscription

Premium subscription purchases are processed by Google Play (and, on iOS, Apple's App Store) and synchronized through RevenueCat, our subscription management platform. Project Alpha never sees, processes or stores your payment/card details. RevenueCat only provides us with your subscription status (active, expired, plan type) so we can unlock Premium features on your account.

2.7 Push notifications

If you enable them, a device token (provided by Firebase Cloud Messaging) is linked to your account to send you notifications (workout reminders, messages, reactions, streak-at-risk alerts). This token is automatically removed if it becomes invalid (uninstall, expiry) and when your account is deleted.

2.8 Technical data

Technical execution logs from our server functions (Firebase Cloud Functions), used only for diagnostics and security purposes, retained according to Google Cloud Logging's standard retention periods.

Crash reports (Firebase Crashlytics) and usage statistics (Firebase Analytics): collected only if you accept in the consent banner shown on first launch. A crash report contains the technical trace of the error, the device model, the system and app versions and an installation identifier; it contains none of your workouts, messages or photos. You can withdraw this consent at any time in Settings → Privacy; collection then stops immediately. Reports are kept for 90 days.

These statistics are anonymous: they are not linked to your account (no account identifier, name or email address is sent to Firebase Analytics or Crashlytics). They are used only to measure how the Application is used and to fix errors. They are never used for advertising or for tracking across third-party apps or websites, and are not shared with any data broker. The Application collects no advertising identifier (IDFA on iPhone, Android advertising ID) and shows no ads. A native mobile app does not use cookies: the Application stores no cookies on your device.

We only collect the data strictly necessary for the Application to function.

3. Data processors and recipients

Your data is processed by the following providers, each acting as a data processor:

Provider	Role	Data involved
Google LLC (Firebase: Authentication, Firestore, Storage, Cloud Functions, Cloud Messaging, Hosting, Analytics and Crashlytics with your consent)	Hosting, authentication, database, photo storage, push notification delivery	All data described in section 2
Anthropic PBC	Generating AI Coach replies, 12-week programs, meal plans, meal photo analyses and monthly recap analyses	Coach messages, profile and workout history summary, nutrition targets, preferences/allergies, meal photo (never stored, see 2.5)
RevenueCat, Inc.	Premium subscription management and synchronization	Account identifier, subscription status and history (never payment/card details)
Google Play / Apple App Store	Payment processing	Payment details (handled entirely by the platform, never sent to Project Alpha)

These providers are established or operate servers outside Switzerland and the EU/EEA, notably in the United States. The corresponding transfers rely on the safeguards provided by their respective contractual commitments (notably the European Commission's Standard Contractual Clauses for Google and Anthropic).

4. No sale of data

Project Alpha never sells, rents or monetizes your personal data for advertising or commercial purposes. The only data sharing is the one described in section 3 (processors necessary for the service to run) and section 2.4 (social features you voluntarily use).

5. Security

Your data is encrypted in transit (TLS) and at rest by our hosting providers. Access to data is restricted by strict security rules (Firestore Security Rules): for instance, your email and phone number are only readable by you, your progress photos are only accessible to you, and sensitive fields (subscription, XP, pack data) can only be modified by our servers, never directly by a client.

6. Retention period and account deletion

Your data is kept for as long as your account remains active. You can delete your account at any time from Settings → Delete account, after re-authentication. Deletion is immediate and permanent and erases:

your authentication account (Firebase Authentication);
your profile, workouts, nutrition data, generated programs, progress photos and profile picture (Firestore and Storage);
your personal records, weight and body measurements, monthly recaps and notifications;
your weekly leaderboard entries, referral code, username (freed up for another user);
your published posts and comments, your private conversations;
your pack membership (with leadership transfer if needed) and your entry in each of your friends' friend lists.

Some data may be retained beyond account deletion where required by law (for example accounting obligations related to payments), for the period strictly necessary for that obligation.

For the detailed steps (in-app or without the app), the full list of data deleted, and the processing time, see our dedicated page: Delete account.

7. Minors

The Application is not directed at children under 16 and we do not knowingly collect data about them. If you believe a child has provided us with personal data, please contact us so we can delete it.

8. Your rights

Under the GDPR (EU/EEA residents) and the FADP/nLPD (Swiss residents), you have the following rights over your data:

Right of access: obtain a copy of the data we hold about you;
Right of rectification: correct inaccurate or incomplete data (directly editable in the Application for most fields);
Right to erasure ("right to be forgotten"), available in self-service from the Application;
Right to data portability: receive your data in a structured format (GDPR). Exercise it on your own from Settings → Privacy → Export my data: you get CSV files (workouts, sets, records, nutrition, weight and measurements) and a readable PDF summary, shared through your phone's share menu;
Right to object and to restriction of the processing of your data;
Right to withdraw consent at any time where processing relies on it (e.g. phone sign-in, push notifications).

To exercise these rights, contact us at the address below. Swiss residents also have a right of appeal to the Federal Data Protection and Information Commissioner (FDPIC), and EU/EEA residents to the data protection authority of their country of residence.

9. Contact

For any question about this policy or to exercise your rights (access, rectification, deletion), contact us at:

support.projectalpha@gmail.com

10. Changes to this policy

We may update this policy to reflect changes to the Application or to applicable law. Any material change will be notified to you within the Application. The last-updated date appears at the top of this page.