Privacy Policy
Last updated: October 18, 2026
This Policy explains how the Treyne app (package com.treyne.app) and treyne.com website ("Treyne", "we", "us") process your personal data under Brazil's General Data Protection Law (Law No. 13,709/2018, "LGPD") and Google Play policies. Treyne is independently developed and operated by its developer, who acts as the data controller. Privacy contact: [email protected].
Summary: your workouts, history, food and hydration records are stored on your phone. Our servers receive only what is necessary for login, purchases, AI features and crash diagnostics. We do not sell your data, show ads or use the advertising ID.
1. Data we process
| Category | Examples | Where it is stored |
|---|---|---|
| Account | Name, email, account identifier (UID), login method (email and password or Google), profile photo if you choose one | Firebase Authentication (Google); photo on your phone |
| Workouts and progress | Plans, exercises, weights, reps, history, achievements, timers | On your phone |
| Health and wellness | Goals, meals, calories, hydration, dietary preferences and restrictions, and information you give the assistant (for example, weight, height, routine, injuries) | On your phone; sent to the server only when you use an AI feature |
| Meal photos | Image taken for nutritional analysis | Sent for processing and not stored on our servers |
| Assistant messages | Questions, answers and workout or plan context sent to Treyner | History on your phone; sent for processing and not stored on our servers |
| Barcodes | Scanned product barcode number | Looked up on Open Food Facts |
| Purchases | Subscription plan, status, purchase token, coin balance and history, linked to a hashed account identifier | Google Play and our server |
| AI usage | Weekly usage counts, linked to a hashed identifier | Our server |
| Shared workouts | Workout you choose to share through a QR code | Cloud Firestore (Google) |
| App diagnostics and usage | Device model, system, app version, crash logs, usage events, Firebase installation identifier, app integrity checks | Firebase Analytics, Crashlytics and App Check (Google) |
We do not collect location, contacts, SMS, microphone data or the advertising ID. The camera is used only when you choose to photograph a meal or scan a QR code or barcode.
2. How we use data
- To create and maintain your account, sign you in and allow account deletion;
- to provide app features such as workouts, timers, reminders, ongoing workout notifications, food and hydration tracking;
- to process meal analyses and AI assistant conversations when you use them;
- to process subscriptions and purchases, provide benefits and manage coin balances and usage limits;
- to protect the Service against fraud, abuse and unauthorized access;
- to fix crashes, measure performance and improve the app;
- to handle support requests and comply with legal obligations.
3. Legal bases (LGPD)
- Performance of a contract (article 7, V): to provide the Service you requested, including your account, purchases and app features;
- Consent (article 7, I, and article 11, I): for health data you choose to provide and for sending photos and messages to AI features. You may withdraw consent at any time by stopping use of these features or deleting your account;
- Legitimate interest (article 7, IX): for security, fraud prevention, crash diagnostics and app improvement, always respecting your rights;
- Compliance with a legal obligation (article 7, II): where the law requires records to be retained.
4. Who we share data with
We share data only with providers necessary to operate the Service, who process it on our behalf or under their own policies:
- Google (Firebase Authentication, Cloud Firestore, Analytics, Crashlytics, App Check and Google Play Billing), for login, workout sharing, diagnostics, security and payments;
- OpenAI, to generate assistant responses and analyze meal photos. Under its policies, OpenAI may retain this data for a limited period for security and abuse prevention and does not use API data to train models;
- Open Food Facts, which receives only the scanned barcode number;
- Our server's hosting provider and Cloudflare, which delivers the website and app media;
- Authorities, when required by law, court order or to protect rights.
We do not sell, rent or share your data for advertising.
5. International transfers
Some providers, such as Google, OpenAI and Cloudflare, and our server may process data outside Brazil, including in the United States. These transfers take place under article 33 of the LGPD, with providers that adopt appropriate contractual safeguards and security measures.
6. How long we keep data
- Data on your phone: until you delete it, uninstall the app or delete your account. If Android backup is enabled, Google may keep a backup according to your Google account settings;
- Account: until account deletion;
- Meal photos and assistant messages: not stored on our servers after processing;
- AI usage counts: automatically deleted after about 35 days;
- Purchase and coin records: for as long as necessary to meet legal, tax and fraud prevention obligations and defend against disputes;
- Workouts shared through a QR code: for as long as necessary for the feature to work;
- Diagnostic data: according to Google's Firebase Analytics and Crashlytics retention periods, up to 14 months.
7. Security
We use encrypted connections (HTTPS), authentication, app integrity checks, hashed identifiers and restricted server access. No system is completely secure, so we cannot guarantee absolute security. If a significant incident occurs, we will notify affected people and Brazil's ANPD as required by law.
8. Your rights
Under article 18 of the LGPD, you may request confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary data; portability; deletion of data processed with consent; information about sharing; and withdrawal of consent. You may also complain to Brazil's National Data Protection Authority (ANPD). To exercise your rights, email [email protected] from your account's email address. We will respond within 15 days.
9. Account deletion
You may delete your account through the app or by email. See the steps and what is deleted on the Delete account page.
10. Children and teenagers
Treyne is intended for adults 18 or older and is not directed at children. We do not knowingly collect data from minors. If we learn that this has happened, we will delete the data.
11. Changes
We may update this Policy. The current version is always on this page with its last updated date. Significant changes may be announced in the app.
12. Contact
Data protection officer and privacy contact: [email protected].