Privacy
policy.
Self Iterate, Inc.
This Privacy Policy ("Privacy Policy") describes and governs the manner in which Self Iterate, Inc., a Delaware corporation ("we", "us", "our" or the "Company") collects, uses, maintains and discloses information about you when you visit our website and use our mobile application and other online services (the "Services").
Please read this Privacy Policy carefully before you start to use the Services. By accessing and/or using the Services, you accept and agree to be bound and abide by this Privacy Policy, and our terms of use available at https://self-iterate.com/terms (the "Terms of Use") incorporated herein by reference and to comply with all applicable laws, rules and regulations (collectively, "Applicable Law"). If you do not want to agree to this Privacy Policy, and the Terms of Use, you must not access or use the Services.
Personal Information We Collect
We collect information that identifies, relates to, describes, or could reasonably be linked to you ("Personal Information") in a variety of ways when you interact with our Services. The Personal Information we collect depends on how you use the Services and may include the following:
Information You Provide to Us
This may include the following:
Contact and profile information: your name, email address, and the profile details you choose to enter — date of birth, sex, height, body weight, injuries or limitations, training goals, experience level, a short bio and a profile photo. Sign-in is handled by Apple, Google, or an email address and password; we never see your Apple or Google password.
User-generated information: what you create in the app — workouts and programs you build, exercises you add, the sets you log, session history, body weight entries, body measurements, notes, and progress photos. Sponte has no social feed and no community features; nothing you log is published anywhere. A workout card you choose to share is exported by you through your own device's share sheet.
Payment and transaction data: information about subscriptions you buy through the Services. We do not collect, process, or store payment card numbers. Payment is handled entirely by the platform you bought through — Apple (App Store and StoreKit) or Google (Google Play Billing) — each under its own privacy policy. Subscription state reaches us through Qonversion, which acts as an entitlement broker: it tells us which tier your account is entitled to, and never handles your card details.
Communications: Any messages, feedback, or inquiries you submit to us.
Device and usage information: when you visit our website, we or our hosting provider record information such as your IP address (which may be used to derive your approximate geographic location), device type, browser type, operating system, referring URLs, pages viewed, links clicked, and the dates and times of your visits. The mobile app does not report screens viewed, taps, sessions, or crashes to us or to anyone else; the only device information it stores is a per-install identifier and a device name, used to enforce the one-device limit on the free and Basic tiers. Our service providers keep operational logs, including the IP address a request came from, for the time needed to deliver and secure the Services. We do not collect precise GPS-based location data.
Inferences: We may make inferences based on the information we collect.
Information Collected Automatically
When you access or use the Services, we may automatically collect certain information, including:
Website device and usage information, such as your IP address (which may be used to determine general location), browser type, operating system, referring URLs, pages viewed, links clicked, and the date and time of your visits;
Cookie and similar technologies on our website, limited to the storage needed to remember your theme preference and to serve the pages you request. We do not use cookies, pixels, or tags for advertising or for cross-site measurement; and
No analytics or advertising SDKs in the app. The Sponte mobile app contains no analytics SDK, no crash-reporting SDK, no advertising network, and no cross-app tracking. It does not read your advertising identifier (Apple's IDFA or the Android Advertising ID) and it does not track you across other companies' apps or websites. The only third parties the app communicates with are Google Firebase (authentication, and on the Premium tier cloud storage of your own training data), Qonversion (subscription entitlement), and the App Store or Google Play (sign-in and purchases). If this changes we will update this Privacy Policy before the change ships, and ask for your consent where the law requires it.
Information from Third-Party Integrations
With your permission, the Services connect to the health platform on your device — Apple Health (HealthKit) on iPhone, or Health Connect on Android — to exchange a narrow set of records (collectively, "Health Information"). With that permission granted, Sponte reads your body weight, so you do not have to log it twice, and writes the workouts you complete, the active calories they burned, and body weight you entered in Sponte, so that your training counts toward your daily activity. Nothing else is read or written. The connection is off until you turn it on in Settings, and you can revoke it at any time in the Health app on iOS or in Health Connect on Android. Health Information held by those platforms is governed by their own terms and privacy policies.
How we handle Health Information. We use it only to show you your own training and body-weight history inside Sponte. We do not use Health Information for advertising or marketing, we do not use it for data mining, we do not sell it, and we do not disclose it to third parties other than service providers storing it on our behalf as described under "Where Your Information Is Stored", or where you direct us to. Health Information is never stored in iCloud.
How We Collect Your Personal Information
We collect Personal Information from the following sources:
Directly. We collect Personal Information directly from you. When you register for the Services, submit information in an online form, request information from us, or otherwise communicate with us or our support personnel, you may provide us with information, for example, your name and email address.
From Third-Party Integrations. We may collect Health Information about you by importing information from third-party applications, if you permit us to do so. Imported Health Information is generally stored and processed on your device. By providing us with this information or allowing us access to the information from third-party applications, you consent to your information being collected, used, disclosed, processed, and stored by us in accordance with this Privacy Policy.
Automatically. We collect Personal information automatically through cookies and similar technologies when you access or use the Services, as described above.
Where Your Information Is Stored
Free and Basic: on the free tier and on Basic, your training data — workouts, programs, exercises, session history, body weight, measurements and progress photos — is stored and processed locally on your device and is not transmitted to our servers in the ordinary course of providing the Services. Your account record (email address, subscription tier, and the device holding the account) is still held by us, because an account is the thing you sign in to.
Premium: if you subscribe to Premium, that training data is also stored with Google Firebase (Cloud Firestore and Cloud Storage), acting as our processor, so that it follows your account across devices and reinstalls.
Health Information: body weight read from your device's health platform is kept alongside the rest of your training data, which means it stays on the device on Free and Basic, and is stored with our processor on Premium. The workouts and calories Sponte writes into the health platform live in that platform's own store, under its rules, not ours.
To provide the Services, we store and process your personal data in the United States, where the Company is based. By using the Services or otherwise providing information to us, you understand and consent to having any Personal Information transferred to and processed in the United States. If you reside in the European Union (the "EU"), we will transfer your Personal Information pursuant to EU data protection laws. You understand that the United States may not provide the same level of protections as the laws in your country. United States data protection and other relevant laws may not be the same as those in your jurisdiction. In certain circumstances law enforcement or regulatory agencies, courts or security authorities in the United States may be entitled to access your Personal Information.
How We Use Collected Information
We may collect and use your Personal Information for the following purposes:
To provide and operate the Services, including enabling features you activate, processing transactions, and providing customer support.
To improve the Services, by analyzing usage patterns and user feedback to develop and refine features and functionality. Where feasible, we use anonymized or aggregated data for this purpose.
To communicate with you, including responding to inquiries, sending account-related notices, and, where you have opted in, sending marketing communications.
To protect the Company and our users, including detecting, preventing, and addressing fraud, security incidents, and other harmful activity.
Restrictions. We do not use Health Information for advertising or marketing purposes.
To Whom We Share Your Personal Information
With service providers. We share information with vendors and contractors who assist us in operating the Services, such as cloud hosting providers, payment processors, analytics providers, and customer support services. These parties are authorized to use your information only as necessary to provide services to us.
With partners for research and development. We may share your information with third-party partners who help us in developing and improving the Services. Information shared for such purpose shall be anonymized and the third parties in which we share such information shall be subject to non-disclosure obligations.
With our subsidiaries and affiliates. We may disclose or share your information with our subsidiaries and affiliates to further facilitate your use of our websites and Services.
With third parties at your direction. When you choose to use third-party integrations (such as Apple Health) or share content to external platforms (such as Facebook or Instagram), we may share information with those platforms as necessary to enable the feature. Such sharing is governed by those platforms' own privacy policies.
For legal process and protection. We may disclose or share your information to satisfy any law, regulation, legal process, governmental request, or where we have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary to:
Protect our rights or interests, property or safety or that of others;
In connection with claims, disputes, or litigation - in court or elsewhere; and
Protect users of our website and Services and other carriers or providers from fraudulent, abusive, or unlawful use of such Services.
In corporate transactions. In the event of a financing, reorganization, merger, or sale of the Company, we may transfer your Personal Information to the relevant third parties involved in the transaction. Any such recipients will be required to protect your information under a nondisclosure agreement or comparable confidentiality obligation.
We Do Not Sell Your Personal Information
We do not sell your Personal Information for monetary consideration. We may share Personal Information with certain trusted service providers in order to provide and improve the Services. Certain disclosures may be considered "sharing" or "targeted advertising" under applicable privacy laws. You may opt out of such sharing as described in this Privacy Policy.
Third-Party Links and Websites
Our Services may contain advertising, links or other content from the websites and services of our partners, suppliers, advertisers, sponsors, licensors and other third parties (collectively, the "Third-Party Services"). We do not control the content or links that appear on these Third-Party Services and are not responsible for the practices employed by such Third-Party Services. In addition, these Third-Party Services may have their own privacy policies and customer service policies. Browsing and interacting on any of these Third-Party Services are subject to such Third-Party Services' own terms and policies.
Our Content on Third-Party Services
Our Services may be provided on or hosted on a third-party platform or otherwise make use of Third-Party Services. We do not control the content or links that appear on these Third-Party Services and are not responsible for the practices employed by such Third-Party Services. Your browsing and interacting on any of these Third-Party Services are subject to such Third-Party Services' own terms and policies. Any visit you make to those other services is at your own risk. Such third parties' use of any information you share is governed by the third party's privacy policy. We do not currently use remarketing or retargeting services, and we do not serve you ads based on your past activity. Were we to do so, such third parties may use tracking technology (e.g., cookies) to serve ads based on your activity on our Services and other websites and applications, subject to their own privacy policies, and this Privacy Policy would be updated first.
Your Choices
You have certain choices on how we treat your Personal Information, described below:
Modifications to Personal Information. You may review and request modifications to your Personal Information by editing your profile directly on our website or by contacting us at legal@self-iterate.com. Please note that we will retain data for as long as it is reasonably necessary to fulfill the purpose for which it has been collected or as required or permitted by applicable law. If you provide us with updated information, we will do our best to keep your information accurate and up-to-date. We will make good-faith efforts to make requested changes in any active database as soon as practicable.
Marketing Communications. You can opt out of promotional marketing communications by contacting us at legal@self-iterate.com. We may give choices about other emails and communications you receive from us. If you opt out, we may still send you non-promotional communications, such as those about your account or our ongoing business.
Ad Choices. Sponte does not show advertising and we do not share your information with advertising networks. If that ever changes we will update this Privacy Policy before it ships, and the options below will apply. Some advertisements and other content may be delivered by third-party advertising networks and advertisers that may use cookies and similar and/or your advertiser ID for mobile devices to collect and track information such as demographic information, inferred interests, aggregated information, and activity to assist them in delivering advertising that is more relevant to your interests. To find out more about third-party advertising networks and similar entities that use these technologies, see www.aboutads.info. If you would like to opt-out of such ad networks' and services' advertising practices, go to www.aboutads.info/choices to opt out in desktop and mobile web browsers. You may download the AppChoices app at www.aboutads.info/appchoices to opt out in mobile applications.
Tracking Technology. You may turn off part or all of our tracking software that has been placed on your computer by following the instructions on your browser. On a mobile device, you may turn off part or all of mobile tracking through your mobile device settings. However, if you prevent the use of tracking software or tracking through your mobile device, it will be more difficult, and may be impossible, for you to use the Service or portions of the Services.
Location and Analytics. If we use Third-Party Services to automatically collect your Personal Information, such Third-Party Services may offer you a choice to stop the automatic collection of your information. Please see our "How we collect your Personal Information" above with respect to our tracking tools.
Cookies. Most web browsers are set by default to accept cookies. You can usually set your browser to remove or reject cookies. Please note if you choose to reject, this could affect the availability and functionality of our Services.
Not Providing Personal Information. You may choose not to provide Personal Information to us. However, if you do not provide Personal Information, we may not be able to offer you all or part of our Services.
Account Deletion. You may delete your account at any time from within the app by going to Settings > Profile > Delete account. You can also delete it without using the app, by following the instructions at https://self-iterate.com/delete-account, which includes an email route to legal@self-iterate.com. Upon a verified deletion request, we will delete your profile, account credentials, and associated workout and activity data from our active systems within a reasonable time, except where retention is required by applicable law, necessary to complete an outstanding transaction, or otherwise permitted under this Privacy Policy. Aggregated and anonymized data derived from your account is not subject to deletion. Note that deleting your account does not cancel any active subscription; you must cancel separately through the platform through which you subscribed.
Information Security
We use commercially reasonable security technologies and procedures to help protect your Personal Information from unauthorized access, use or disclosure. However, we cannot guarantee the complete safety of your information. It is your responsibility to keep your information confidential.
Security Incident Notification
In the event of a security breach or unauthorized access to your Personal Information, we will notify you in accordance with applicable law, including applicable state breach notification statutes. Where required by law, notification will be provided to the email address associated with your account within the timeframe mandated by applicable law. If you believe your account has been compromised, please contact us immediately at legal@self-iterate.com.
How Long We Keep Your Information
We retain your Personal Information for the least amount of time necessary for our relationship with you, to provide you access to our Services, and in accordance with our data retention policies and applicable law. More specifically:
Contact and profile data is retained for as long as your account is active and for a reasonable period thereafter to fulfill any outstanding obligations or resolve disputes.
Health Information stored in connection with premium features is retained for as long as your account is active or as necessary to provide the Services. You may request deletion at any time by contacting us at legal@self-iterate.com.
When a paid subscription ends, nothing is deleted during the 30-day grace window that follows, so re-subscribing restores everything exactly as you left it. After that window, once the account settles on the free tier, data held in the cloud beyond the free tier's stated allowance is deleted, and the copy on your device is trimmed to the same allowance.
Aggregated and anonymized data may be retained indefinitely for product improvement, fraud prevention, and analytics purposes, as it cannot reasonably be used to identify you.
Our Services are Not Intended for Children
Our Services are not directed to children under the age of 13, and we do not knowingly collect Personal Information from them. In the European Economic Area and the United Kingdom, where a higher age of consent can apply, we do not knowingly collect Personal Information from anyone under 16 without the consent of a parent or guardian. If we obtain actual knowledge that we have collected Personal Information from a child below the applicable age, we will promptly delete it. If you believe we have mistakenly collected information from a child, please contact us at legal@self-iterate.com.
U.S. State-Specific Privacy Information
Depending on your state of residence, you may have certain rights with respect to your Personal Information under applicable state data privacy laws, including laws in California, Washington, Colorado, Connecticut, Virginia, and other states with comprehensive privacy legislation. These rights may include the right to:
Access the Personal Information we hold about you.
Request deletion of your Personal Information.
Request correction of inaccurate Personal Information.
Opt out of the sale or sharing of your Personal Information or its use for targeted advertising.
Appeal a denial of any of the above requests.
To exercise any of these rights, please contact us at legal@self-iterate.com. We may ask you to verify your identity before responding to your request. We will respond to verified requests within the timeframe required by applicable law.
You have the right to exercise these choices without being subject to discriminatory treatment. In addition, California law requires us to disclose that during the 12 months preceding the date of this Privacy Policy, the Company has not sold any Personal Information.
Washington My Health MY Data Act
If you are a Washington resident, certain health and fitness information we collect through the Services, including workout logs, exercise activity, movement data, fitness goals, body weight, and health metrics imported from third-party platforms such as Apple Health (collectively, "Consumer Health Data"), may constitute "consumer health data" regulated under the Washington My Health MY Data Act, RCW 19.373 ("MHMD"). We collect Consumer Health Data only with your prior affirmative consent and only to the extent necessary to provide the features you have enabled. We do not sell Consumer Health Data, and we do not share it with third parties except with service providers acting on our behalf subject to appropriate confidentiality obligations, or at your direction. We do not use geofencing technology to collect Consumer Health Data near health care facilities. To request access to, correction of, or deletion of your Consumer Health Data, or to withdraw consent to its collection or sharing, please contact us at legal@self-iterate.com. We will respond to verified requests within the timeframe required by applicable law.
"Do Not Track" Policy as Required by California Online Privacy Protection Act ("CalOPPA")
Our Services do not respond to Do Not Track ("DNT") signals. However, some third-party websites do keep track of your browsing activities. If you are visiting such websites, you can set your preferences in your web browser to inform websites that you do not want to be tracked. You can enable or disable DNT by visiting the preferences or settings page of your web browser. We also honor the Global Privacy Control ("GPC") opt-out preference signal. If you broadcast a GPC signal from a browser or browser extension that supports it, we will treat that signal as a valid request to opt out of the sale or sharing of your Personal Information for that browser, to the extent required by applicable law.
Information for European Economic Area Residents
This section applies if the processing of your Personal Information is subject to the data protection laws of the European Economic Area, the United Kingdom, or Switzerland (collectively, "European Data Protection Laws"). For purposes of this section, "Personal Information" refers to the same information described elsewhere in this Privacy Policy and constitutes "personal data" as defined under the GDPR.
Our Legal Bases for Processing Personal Information
We process Personal Information only when we have a lawful basis to do so under applicable law. Depending on the context and purpose of processing, our lawful bases may include:
Contractual necessity, such as processing necessary to provide the Services, fulfill orders, manage accounts, and perform transactions requested by you;
Compliance with legal obligations, including recordkeeping and regulatory requirements;
Legitimate interests, such as operating and improving the Services, preventing fraud, securing our systems, responding to inquiries, and conducting analytics and marketing activities where permitted by law; and
Consent, where required by European Data Protection Laws, including for certain cookie-based technologies and targeted advertising activities.
Where processing is based on consent, you may withdraw your consent at any time as described below.
Your Rights in Relation to Your Personal Information
In addition to any rights described elsewhere in this Privacy Policy, you may have the following rights under European Data Protection Laws:
Access. The right to request access to your Personal Information;
Rectification. The right to request correction of inaccurate or incomplete Personal Information;
Erasure. The right to request deletion of your Personal Information, subject to legal exceptions;
Data portability. The right to receive your Personal Information in a structured, commonly used, and machine-readable format and, where feasible, to have it transmitted to another controller;
Objection. The right to object to certain processing of your Personal Information, including processing based on our legitimate interests;
Restriction of processing. The right to request restriction of processing in certain circumstances; and
Withdrawal of consent. Where processing is based on consent, the right to withdraw consent at any time, without affecting the lawfulness of processing prior to withdrawal.
Complaints and Supervisory Authorities
You have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or where an alleged infringement of European Data Protection Laws has occurred.
International Transfers
Personal Information may be transferred to and processed in countries outside of Europe. Where required, we rely on appropriate safeguards recognized under European Data Protection Laws, such as standard contractual clauses or other lawful transfer mechanisms. To exercise your rights or obtain additional information, please contact us at legal@self-iterate.com. We may request additional information as necessary to verify your identity and respond to your request in accordance with applicable law.
Usage and Deletion of Personal Information
You may request what Personal Information we have collected, used and disclosed about you as well as the identity of the third parties to which we have disclosed your Personal Information. You may also request deletion of your Personal Information. Please note that we may not delete all of your information if: (1) we need it to complete a service as requested by you or perform under a contract we have with you; (2) we need such information to repair any errors to our Services or detect data security violations; or (3) we need such information to protect against fraud or illegal activity or to comply with applicable law. Please note that if we delete your Personal Information, we may not be able to provide you the Services with the same functionality.
To make any request for Personal Information or deletion, please send an email to legal@self-iterate.com.
Changes to this Privacy Policy
We have the discretion to update this Privacy Policy at any time. We encourage you to frequently check this page for any changes. You acknowledge and agree that it is your responsibility to review this Privacy Policy periodically and become aware of modifications. Subject to applicable law, your continued use of our Services shall be deemed an acceptance of our revised policy. If we make material changes to this Privacy Policy, we will notify you by posting an announcement on the Site or by sending you an email prior to the change becoming effective. Material changes include, but are not limited to, changes to the categories of Personal Information we collect, the purposes for which we use it, or the third parties with whom we share it.
You Can Contact Us
If you have any questions about this Privacy Policy, you can email us at legal@self-iterate.com.