Privacy Policy
Overview
Overa records the training you log and keeps it available across your devices. This policy describes what leaves your device, where it goes, who processes it for us, and how to get rid of it. It covers both the app and the Overa website. Overa collects no advertising identifier, shows no App Tracking Transparency prompt, and does not ask Apple which advertisement led to an install. We do not share your data with other companies to build profiles of you or to target advertising, and we do not sell it.
Who is responsible for your data
Overa is provided by M. Anas Ali, Küçükçekmece, İstanbul, Türkiye. We are the controller of the personal data described in this policy, which means we decide what is collected and why. If you have a question about your data, or want to exercise any of the rights described below, write to us at support@overaios.com.
Account information
When you create an account we store your email address and, if you provide them, your first and last name, display name, username, and profile photo. We also store your time zone and the time of your most recent sign-in. If you sign in with Apple or with Google, we receive the account identifier and email address that service returns to us, and never your password. The app asks for your photo library only when you pick a profile photo, and to save an image only when you export a session card; it does not read your library at any other time.
Training data
We store the training content you create: programs, workout definitions, planned exercises, scheduled sessions, completed workouts, and the individual sets you log — weight, repetitions, and whether a set was a warm-up. We also store figures derived from that content: your personal records, weekly summaries, and per-exercise statistics. Names you write yourself, such as programme titles and custom exercise names, are stored as you entered them.
Optional measurements
If you choose to enter your height or your body weight, we store them to show your profile and to present measurements in the units you prefer. These fields are optional, nothing in the app requires them, and you can clear them at any time from Edit Profile.
Where your data is stored
Your data is written to your device first, so the core of the app keeps working offline and a session recorded without signal is not lost. When you are signed in and connected, it is synchronised to our hosted database provider, Supabase, and stored on servers they operate in Sydney, Australia. Profile photos you upload are held in storage restricted to your own account. If you are in the European Economic Area or the United Kingdom, your data is therefore transferred outside that area to a country without an adequacy decision; that transfer is covered by the standard contractual clauses in our data processing agreement with that provider, and you may request a copy using the address above.
Product analytics
If you are signed in and have not turned analytics off, the app sends events about how the app is used — that a workout was started or completed, that a sync succeeded or failed, which screen was opened — to our analytics provider, Mixpanel, on servers in the European Union. These events are linked to your account identifier, so they are not anonymous. The app does not send your training content, your measurements, or any text you have written yourself to Mixpanel; this is enforced in the app's code. We process these events with your consent, nothing is sent before you are signed in, and you can withdraw consent at any time in Profile. Turning analytics off stops events being sent and clears anything still held on your device. Mixpanel is not given your IP address for location lookup.
Notifications
Workout reminders, rest-timer alerts, and weekly tips are scheduled on your device, and your notification inbox is stored on your device. If you use Spotters, the app asks permission to send push notifications and registers a notification token with Apple's Push Notification service. We store that token against your account so we can tell you when a spotter request you started has been confirmed. The token is removed when your account is deleted. Spotters works without push notifications; the token exists only so you do not have to watch a screen and wait.
Sharing a program
If you choose to share a programme, we store a copy of it — its structure, its title, and its summary — and make that copy readable to anyone holding the share link. We record how many times a shared programme has been viewed. You can revoke a share, and a share may expire. Nothing is shared unless you choose to share it, and your training history is never part of a shared programme.
What a Spotter can see
Spotters is the one feature that shows your information to another person, and it happens only after you have both agreed to it. While someone is your spotter, they can see your display name, your profile photo, the days you trained, how many sessions you recorded on each of those days, and the names of those sessions. They cannot see your weights, your repetitions, your volume, your personal records, the time of day you train, or anything from before you added each other as spotters. You can see exactly the same about them and nothing more. Before a spotter is confirmed, the person entering your code sees your display name and photo, so you can each check you are adding the person you meant to. Either of you can end it at any time and without giving a reason: from that moment their app shows neither your name nor your photo, and the shared view stops.
Keeping accounts secure
Adding a spotter stores the connection itself and a hashed form of the code used to set it up — the codes are never held in readable form — together with short-lived records of failed code attempts and of how often sign-in method lookups are requested. These records exist to detect and slow down abuse, we keep them only as long as they serve that purpose, and we rely on our legitimate interest in running a service that is not trivially attacked.
Exporting your data
Profile, then Export Data, produces a CSV or PDF of your training history on your device and hands it to the iOS share sheet, so you can send it wherever you like. The file is generated on your device and is not uploaded to us.
How long we keep your data
We keep your account and your training data for as long as your account exists. We do not delete accounts for inactivity: if you stop using Overa, your data stays where it is until you ask us to remove it. When you delete your account, your data is removed from our systems immediately, and it is not kept in a backup copy afterwards.
Your rights and your choices
You can correct your profile at any time from Edit Profile, and export your training history as described above. You can withdraw consent to analytics in Profile. You can delete your account and its data from within the app, in Profile: deletion asks you to confirm who you are and to type the word DELETE, then removes your profile, your training data, your profile photo, your notification token and anything you have shared, and if you signed in with Apple it also revokes Overa's access to your Apple ID. Records of failed code attempts are kept without any link to you, so they no longer identify you. Deletion cannot be undone, so export first if you want a copy. If you are in the European Economic Area or the United Kingdom you also have the right to object to or restrict processing, to receive your data in a portable form, and to complain to your local supervisory authority.
Why we are allowed to process your data
We create your account, store your training data, and synchronise it between your devices in order to perform our agreement with you — without them there is no product to provide. We process product analytics, and send waitlist confirmation emails, with your consent, and only until you withdraw it. We keep the short security records described above on the basis of our legitimate interest in preventing abuse of accounts. We do not process your data for any purpose that is not named in this policy.
Who processes data for us
Supabase provides our database, file storage, and authentication. Mixpanel, on its European servers, provides product analytics when you have enabled them. Apple provides Sign in with Apple and delivers push notifications. Google provides Google Sign-In. Resend sends and receives our email, including waitlist confirmations. Each of them processes data only on our instructions and for the purposes described here.
Children
Overa is not directed at children and we do not knowingly collect information from them. If you believe a child has created an account, contact us at support@overaios.com and we will delete it.
The Overa website
This policy covers the Overa website as well as the app. If you join the waitlist we store the email address you give us and a confirmation token, and we send you a confirmation email. We also record which page you arrived on, the site that referred you, and any campaign parameters in the link you followed. We do not store your IP address or your browser's user-agent string alongside those records.
Changes to this policy
If this policy changes in a way that materially affects you, we will update the effective date shown at the top, and the copy shown inside the Overa app and the copy published at https://www.overaios.com/privacy will be updated at the same time. The two are always the same text.