karvd Privacy Policy
Who we are. karvd is run by Hugo Tabosa Torres, trading as karvd, a sole trader, Unit 124819, PO Box 6945, London, W1A 6US, United Kingdom (“we”, “us”). We are the controller of your personal data.
Contact. For anything in this policy, including data-protection requests, write to support@karvd.app. To use your rights, see “Your rights” below.
1. What karvd collects, and why
karvd is a fitness app. You need an account to use it. You make one, or sign in, with Apple, with Google, or with your email address and a password. There is no guest mode. Below, “optional” means the feature works without it.
| What | Why | Where it lives |
|---|---|---|
| Your email address and password (if you sign up with email) | To make and recognise your account; to send you sign-in codes, a link to confirm your address and links to reset your password. karvd cannot read your password: our sign-in system keeps only a salted hash of it | Our cloud database and hosting provider; the emails are sent by our email delivery service |
| Sign in with Apple (if you use it): the email address Apple gives karvd, which is your own or an Apple private-relay address if you choose “Hide My Email”, and an Apple user id. karvd does not ask Apple for your name | To make and recognise your account. karvd also keeps a token from Apple, only on its own server in a private store: never on your phone, and it is not part of the export of your data. It is kept only so that karvd can tell Apple to revoke it when you delete your account (once karvd’s Apple key is set up on the server; until then no token is kept) | Our cloud database and hosting provider |
| Sign in with Google (if you use it): your name, your email address and your Google account id (Google’s ID token also carries a link to your profile picture, which karvd does not use) | To make and recognise your account; your name is used only to suggest a display name, which you can change | Our cloud database and hosting provider |
| First name, date of birth, physiology setting, height, weight, waist | To work out your plan, targets and forecasts | Your phone and our cloud database |
| Training, cardio and swim sessions, sets, routines, your equipment | To run your training and show your progress | Your phone and our cloud database |
| Meals, food photos, meal descriptions (typed or spoken), water, nutrition targets | To log nutrition and work out targets | Your phone and our cloud database |
| Sleep and FitScore inputs | To show recovery and your FitScore | Your phone and our cloud database |
| Injuries and pain notes (optional, with your “health data” consent) | To make training suitable | Your phone; our cloud database only with your consent |
| Your GLP-1 medication answer (optional) | To show extra guidance | Your phone only. It is never sent to us. |
| Goal Wall body photos, body-fat estimate, goal pictures (optional, with the Goal Wall consent) | To show progress and make your goal pictures | Our cloud database provider’s private storage |
| Outdoor routes and location while you record a session (optional, with the GPS consent; “When In Use” only) | To map your route and measure distance and pace | Your phone and our cloud database |
| Apple Health data you allow (see section 3) | To count your workouts, sleep and steps towards your plan | Your phone and our cloud database (daily step counts stay on your phone) |
| Posts, comments, photos, videos, your display name and profile picture, circles and challenges you join | The social features | Our cloud database and our media storage provider |
| Coach calls (Premium, optional, with the coach call consent): what is kept afterwards is described in section 6. The audio and the words of the call are not kept | To let you talk to your AI coach, and to let the coach pick up where you left off | Our cloud database (notes and call times) |
| Your purchase state (Premium, Featured athlete) | To unlock what you bought | Our subscription management service and our cloud database |
| Push notification token (if you allow notifications) | To send reminders you asked for | Our cloud database, our push notification service and Apple’s push notification service |
| Diagnostics (crash and performance reports) | To fix faults | Our crash-reporting service |
| Usage events (optional, off until you agree) | To see which screens are used | Our usage analytics service |
| Install and invite attribution (a random install id, the invite link you tapped, and when the app was installed and opened). When you accept an invite, karvd also stores that install id with your account, in the record that links you and the person who invited you | To tell which invite link brought a friend, to give invite rewards to the right person, and to spot one device being used to redeem many invites. It runs without asking, but you can switch it off in Settings (see sections 2 and 8) | Our invite-attribution service (the id and events); our cloud database (the id kept with your account) |
2. Our lawful bases
- Contract (UK GDPR Article 6(1)(b)): your account, plan, training, nutrition, social features and purchases.
- Consent (Article 6(1)(a), and Article 9(2)(a) for health data): Apple Health, body photos and the body-fat estimate, injuries, GPS routes, sending photos and text to AI services, coach calls, analytics, contacts. You can withdraw any of these in Settings. Withdrawing does not undo what we did before.
- Legitimate interests (Article 6(1)(f)): keeping the community safe (checking posts), preventing abuse (including repeat invite redemptions from one device), fixing faults, and working out which invite link brought a friend to karvd (install attribution). We have weighed these interests against your rights and expectations, and you can object (see “Your rights”).
- Legal obligation: tax and accounting records for purchases.
Install attribution and the rules on storing information on your phone (UK PECR). To tell which invite link brought you in, the invite-attribution software in karvd stores a random install id on your phone and reads it. We do not ask you first. We rely on the exemption for storing and accessing information for statistical purposes that the Data (Use and Access) Act 2025 added to the Privacy and Electronic Communications Regulations. That exemption needs two things, and this is how we give them: clear information (this policy, and the text under the switch in Settings) and a simple way to object (Settings › Privacy › “Invite links: let karvd see which invite brought you in”, which is on until you turn it off). When you turn it off, the software stops at once and does not start again at any later launch. This is separate from the optional analytics choice, which stays off until you agree. It is not advertising: karvd does not use the advertising identifier (IDFA) or the vendor identifier (IDFV), does not use Apple Search Ads or SKAdNetwork attribution, does not connect it to advertising networks, and never shows Apple’s tracking prompt.
3. Apple Health and health data
If you connect Apple Health, karvd asks to read your workouts (with their distances), sleep, daily step count, and the heart rate recorded during workouts. It asks to write the sessions you record in karvd as workouts, and their route only if you turn that on. You can change this at any time in iOS Settings › Health.
- We use Health data only to run the app’s features for you: counting sessions towards your plan, recovery, FitScore and insights.
- We never use Health data for advertising, marketing or data mining, and we never share or sell it. It is not sent to analytics, to attribution, to the Shop, or to AI services.
- Heart rate is kept as an average and a maximum for each session, not as a stream.
- Daily step counts are read from Apple Health on your phone to work out your FitScore and are not saved on our servers. The other Health data we hold (workouts and sleep) is deleted when you delete your account (see section 8).
- karvd keeps its local database out of iCloud Backup.
karvd is not a medical device. It gives general fitness guidance, not medical advice.
4. Who receives your data (our processors)
We use these services to run karvd. Each acts on our instructions. We send each the minimum it needs.
| Service | What it receives | Why | Location |
|---|---|---|---|
| Our cloud database and hosting provider | Everything marked “our cloud database” in section 1: account, profile, training, nutrition, social posts and comments, Goal Wall photos (private storage), consent records, coach notes | Database, sign-in, file storage, server functions | London, UK |
| Our email delivery service | Your email address and the content of the sign-in and account emails we send you (codes, password reset) | Sending sign-in and account emails | Ireland (EU) |
| Our media storage provider | The photos and videos in your social posts, and the posters of videos. They are private and others see them through short-lived links only | Storage for social media | EU/US, global network |
| An AI service (images and text) | With the matching consent: equipment photos and meal photos you choose; your Goal Wall photos (cropped, no head) with your height, weight and targets, to estimate body fat and draw goal pictures; photos and videos in social posts, for the safety check. Never your name or email | AI recognition, estimates, illustrations and safety checks | US / global |
| An AI text service | The text of a meal you type or speak when needed to read it; a short summary of your training as numbers for the Insights text; the text of posts and comments, and display, circle and challenge names, for the safety check; during a coach call, the words of the call and the notes the coach works from, to write the coach’s replies and the notes afterwards | AI text reading, safety checks and the coach | US |
| Our live call service | The live audio of a coach call, to connect your phone to the coach. Recording and transcript storage are switched off | Connecting coach calls | US |
| The service that runs the AI coach | The live audio and words of a coach call, while the call runs. It keeps no recording or transcript | Running the coach during a call | London, UK |
| A speech-to-text service | The live audio of what you say in a coach call | Turning your speech into text | US |
| A text-to-speech service | The coach’s words, as text, during a coach call | Giving the coach a voice | US |
| Our subscription management service | Your random account id and your purchase receipts from Apple. When you delete your account, karvd asks it to delete your customer record | Subscriptions and restoring purchases | US |
| Our crash-reporting service | Crash and performance reports. No name, email or account id is attached, personal details are scrubbed, and IP addresses are not stored. Kept for about 30 days | Fixing faults | EU |
| Our usage analytics service | Only if you agree: a small set of usage events (such as app opened, screen viewed). No account id is attached, and no screen recording. Kept for up to 1 year. When you delete your account, the phone you delete from sends its analytics id (only if you agreed), and karvd asks the service to delete that person and their events | Understanding which features are used | EU |
| Our invite-attribution service | A random install id, the invite link that was tapped, the times the app was installed and opened, your device model, iOS version and IP address. It runs unless you switch off “Invite links” in Settings (section 2). karvd uses a version without advertising-identifier code, does not use the advertising identifier (IDFA), and on iPhone also switches off the vendor identifier (IDFV), Apple Search Ads and SKAdNetwork. It is not connected to advertising networks, so karvd never shows Apple’s tracking prompt. Only two events are sent, “invite opened” and “invite accepted”, with no values. When you delete your account, karvd asks it to erase the install id kept with your invite record and the one on the phone you delete from (while “Invite links” is on) | Telling which invite brought a friend | US |
| Our push notification service, and Apple’s push notification service | Only your device’s push token, and the reminder text to deliver | Delivering notifications you asked for | Our service: US. Apple: as Apple’s policy describes |
Other services karvd talks to, where the feature is used: Apple (Sign in with Apple, Health, push, purchases; and revoking the Apple token when an account is deleted), Google (Sign in with Google), a public food database (a barcode you scan is looked up), a map tile service (the map area you view for the outdoor map is requested), an exercise video library (exercise videos, with links signed per account), and Amazon (the Shop opens Amazon search links; we share nothing with Amazon, and what you do there is covered by Amazon’s own policy).
We can tell you which companies provide these services; ask at support@karvd.app.
We do not sell your personal data. We do not use it for advertising, and we do not share it with data brokers.
Transfers outside the UK. Some of these services are outside the UK (see the Location column). Where a provider is certified under the EU-US Data Privacy Framework, we rely on the UK Extension to that framework. Otherwise we rely on the UK International Data Transfer Addendum to the EU standard contractual clauses (or the UK International Data Transfer Agreement).
5. AI services, in plain words
Some features send content to AI services. Each has its own consent or notice, shown before the first use:
- Meals and equipment: photos or text you choose, to recognise food and gym equipment.
- Goal Wall: your cropped body photos, to estimate a body-fat range and draw illustrations. Estimates are approximate, not medical measurements.
- Insights: a summary of your training as numbers, to write a short text.
- Safety checks on social posts: text, photos and videos in posts and comments, and display, circle and challenge names, are checked automatically for safety by AI services before they appear. You see a notice before your first post or comment.
- Coach calls: see section 6.
AI output can be wrong. A person can always override an estimate.
What our AI providers commit to. Our AI providers’ terms do not allow them to use your data to train or improve their models. They keep it only for a limited time for abuse and safety monitoring, unless the law requires longer.
6. Coach calls (Premium)
Premium includes live voice calls with an AI coach. Calls are optional and need your coach call consent, which you can withdraw in Settings. The coach is an AI, not a person.
- The audio is streamed live and is not recorded. No recordings or transcripts are stored by the call services. Recording and transcript storage are switched off at the live call service.
- Who handles the call while it runs: our live call service (connects the call, US), the service that runs the AI coach (London, UK), a speech-to-text service (US), a text-to-speech service for the coach’s voice (US) and an AI text service (writes the coach’s replies, US). See section 4.
- What karvd keeps afterwards: short notes written after each call (a summary, where you stopped, open items, any commitment made, any plan change you accepted, and which coach led the call), the insight cards prepared for your check-in from your own training data, and call times (when the call happened, how long it lasted and how it ended). The words of the call are held in memory while it runs and are discarded once the notes are written. The notes are one shared memory, so that any coach can pick up where the last one left off.
- Control: the notes are part of your data export and are deleted with your account. If you withdraw the coach call consent, the notes are emptied.
- Safety: the coach does not give medical advice. See the Terms.
7. Your contacts
Only if you tap Connect contacts in Search (Contacts tab), and allow it in iOS, karvd uses your address book to show you which of your contacts are already on karvd.
- What is read: the email addresses (and names, to label the list on your screen). karvd does not read phone numbers, street addresses, birthdays, photos or notes.
- How it is checked: on your phone, each email address is trimmed, put in lower case and turned into a scrambled code (a SHA-256 hash). Only those codes are sent to karvd, in batches. Your contacts’ names and the email addresses themselves never leave your phone. Because a scrambled email is still derived from an email address, we treat the codes as personal data.
- What karvd keeps: nothing. The codes are compared with the codes of karvd members and then discarded: they are not saved and not written to logs. karvd keeps only a count of how many times you checked today, to stop people guessing email addresses.
- Who can be found: only people who turned on “Let friends find me” and whose email is confirmed. Anyone you blocked, who blocked you, or you muted is left out. If someone has your email in their contacts and you turned “Let friends find me” on, they can find you; they only see your name and picture.
- Staying in control: tap Disconnect contacts on the Contacts tab to make karvd forget that you connected (that choice is stored on your phone only). You can also switch Contacts off for karvd in iOS Settings, or turn off “Let friends find me” to stop others finding you this way. Disconnecting does not need an account request; there is nothing on karvd’s servers to delete.
- Inviting: the Invite button opens your phone’s share sheet with a private invite link. karvd never sends a message itself.
8. How long we keep it, and deleting it
| Data | Kept for |
|---|---|
| Account, profile, training, nutrition, sleep, posts and comments | Until you delete your account |
| Outdoor routes | Full route for 24 months, then only an outline |
| Goal Wall photos and goal pictures | Until you delete them, withdraw the Goal Wall consent, or delete your account. Withdrawing removes the photos and pictures and seals your Goal Wall rows |
| Photos and videos in posts | Until you remove the post or delete your account |
| Posts that fail the safety check | Up to 90 days for review, then deleted |
| Coach notes and call times | Until you delete your account, or until you withdraw the coach call consent (which empties the notes) |
| The install id kept with your invite record | Until you delete your account |
| The Apple token kept for revocation (only if you signed in with Apple) | Until you delete your account. At the very start of deleting your account karvd tells Apple to revoke it (once the Apple key is configured on the server) and then deletes it |
| Consent records | Until you delete your account. After that we keep a record that you withdrew, for up to 6 years, as evidence |
| Audit and abuse-prevention counters | Up to 6 years, without health data |
| Purchase records | 6 years, as UK accounting rules require |
| Crash reports | About 30 days |
| Usage events | Up to 1 year |
Deleting your data. In Settings › Account and data › Delete account and data, you can ask us to delete your account. We delete your files first, then your account and everything linked to it, and keep a deletion receipt with no health data. You can follow the request under Deletion request status. Deleting the app alone does not delete your account.
When you delete your account, karvd also asks our subscription management, usage analytics and invite-attribution services to delete what they hold about you. They do it on their own timetable, usually within 30 days. We ask only once your account is fully deleted, and a supplier that cannot be reached is asked again later; it never holds up your deletion. Two limits: karvd can only send the analytics and install ids held by the phone you delete from. So usage events tied to an earlier analytics id (from before you withdrew the analytics consent, which gives the phone a new id, or from another phone) cannot be found and are not deleted; they carry no name, email or account id. And with “Invite links” switched off, the phone does not send its install id; the install id kept with an invite record is still erased.
Withdrawing a consent. Each consent (Apple Health, GPS, Goal Wall, AI, coach calls, analytics, contacts) can be withdrawn in Settings, or in iOS Settings. What you withdraw stops being used from that point. Install attribution is not a consent: it runs under the exemption described in section 2, and you object to it with the switch “Invite links: let karvd see which invite brought you in” in Settings › Privacy. Turning it off stops it at once and at every later launch. It does not recall what the invite-attribution service already received, and it does not delete the install id already kept with an invite record; deleting your account does. Invite links still open the invite screen with the switch off.
Export. In Settings › Account and data › Export my data you can get a copy of your data.
9. Your rights
Under UK data protection law you can ask us to: tell you what we hold, correct it, delete it, restrict or object to how we use it, give you a portable copy, and stop automated decisions that affect you (karvd makes none with legal effect). Use the in-app tools above, or write to support@karvd.app. You can object to install attribution at any time with the switch in Settings (section 2). We reply within one month. You can also complain to the Information Commissioner’s Office (ico.org.uk).
10. Children
karvd is for people aged 18 and over. It asks for your date of birth and does not let younger people in. If you think a child has an account, write to us and we will delete it.
11. Security
Data is sent over encrypted connections. Files are in private storage with short-lived links. If you use a karvd password, our sign-in system stores it only as a salted hash, and it must be at least 8 characters; Apple and Google sign-in use no karvd password at all. Server keys for AI services are kept on the server only. karvd keeps its local database out of iCloud Backup. No system is perfectly secure; if a breach puts your rights at risk we will tell you and the ICO as the law requires.
12. Changes
If we change this policy in a way that matters, we will tell you in the app before it applies. We keep previous versions and will send one on request to support@karvd.app.
Safety screens
karvd remembers the date you saw its safety information, on your phone and with your account, so it does not show it again on a new phone. It does not ask for or store any health details for this. The same is true of the date you saw the notice about safety checks on posts.