Privacy Policy

Last updated: 2026-09-28T00:00:00.000Z

This privacy policy describes how Tideloop (“the App”) handles your personal data. The App is built and operated by Mattijs Bliek, an individual (“we”, “us”), on a server we run ourselves. If you have any questions about this policy, contact us at [email protected].

Data we collect

We collect only the data you provide directly through the App:

• Workout data: cycles, templates, exercises, sets, target reps, completed reps, and timestamps.
• Account data: email address, hashed session tokens, and authentication credentials (passkeys or one-time passwords).
• Optional Apple Health access: if you grant permission, the App saves completed workouts to Apple Health and reads workout samples back from HealthKit only to find and remove a workout it saved earlier, for example when you undo a completed workout. This data stays on your device.

We do not collect location, contacts, photos, advertising identifiers, browsing data, or in-app purchase data.

How we store and protect your data

• All workout and account data is stored in a SQLite database on a self-hosted server we operate.
• Data is encrypted in transit using TLS.
• Apple HealthKit data never leaves your device through the App; reads are limited to workout samples and are used on-device only.
• Session cookies are required for authentication and are functional only — we do not use cookies for analytics or advertising.

Who we share your data with

We do not share, sell, rent, or trade your personal data with third parties. The App does not connect to advertising networks, marketing platforms, or analytics vendors. The only external services involved are:

• Resend: used to deliver one-time-password email codes during sign-in. Email content is the OTP only.
• Sentry: used for crash and error reporting and for performance tracing (timings of requests and screens, sampled from a fraction of sessions), in both the App and the server. Stack traces and traces are anonymized and we explicitly scrub personally identifiable information at the SDK level (sendDefaultPii: false, plus an outbound scrubber in the App that drops the user field). Sentry sees a randomly generated session ID per install and the technical details of any crash or trace, but nothing else.
• Apple Sign in with Apple / Google Sign-In: only if you choose to use them. These providers handle authentication on Apple’s / Google’s side and return an authentication token; we never receive your provider password.

HealthKit data handling (Apple required disclosure)

If you grant the App permission to read or write Apple Health data:

• The App reads HealthKit workout samples solely to find a workout it saved earlier so it can be removed when you undo a completed workout. Reads stay on your device.
• The App writes completed workout sessions (start time, end time, activity type, optional metadata) to HealthKit so they appear in your Health summary.
• We never transmit HealthKit data off-device, and we never use HealthKit data for advertising, marketing, or sale to third parties.
• You can revoke HealthKit access at any time from iOS Settings → Health → Data Access & Devices.

Data retention and deletion

• Your data is retained for as long as your account is active.
• To delete your account and all associated data, open Settings in the App (iOS or web) and choose Delete account. Deletion is immediate and permanent: your programs, workouts, history, custom exercises, preferences, passkeys and sign-in records are removed from our server and you are signed out.
• If you use the iOS app with Apple Health sync on, workouts it already wrote to Apple Health are stored by Apple Health on your device, not by us, so they stay there when you delete your account. You can remove them in the Health app.
• If you can’t use the in-app option, email [email protected] from the address you signed up with and we will delete your account for you.

Children’s privacy

The App is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe we have collected such data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the “Last updated” date at the top of this document. The current version of this policy is always available at https://tideloop.fit/privacy.

Contact

For privacy questions, data access requests, or deletion requests, email [email protected].