Privacy Policy

This privacy policy applies to the VelocityLift app for mobile devices and the services that belong to it, operated by Lars Schneider (together the "Application"). Lars Schneider is referred to as the "Service Provider".

Data controller

• Name: Lars Schneider
• Address: Tannenweg 6, 56075 Koblenz, Germany
• Email: velocityliftdev@gmail.com

No data protection officer has been appointed, as there is no legal obligation to do so. For any data protection request, use the contact details above.

Overview

VelocityLift measures barbell movement in videos. The analysis runs entirely on your device. Videos, single frames and audio are never uploaded for it. The Application works without an account and without an internet connection.

Data leaves your device only in these cases, each described below:

Processing on your device

The Application processes videos and, where recorded, their audio to determine barbell movement and velocity. It stores your training history (sets, repetitions, measurements, loads, notes, custom exercises, RPE ratings), the videos of your sets and your settings locally.

• Camera and microphone for recording. Audio is always recorded through the device's built-in microphone.
• Video import through the system's photo picker; the Application only sees the file you choose.
• Motion sensor and the camera's focal length during a recording, to correct for the phone's tilt. These values stay on the device.
• On-device machine learning. Trained models recognise weight plates in the picture and detect faces, the latter only to tell whether a set was filmed from the front or behind and to pixelate faces before an optional image contribution. No facial features are stored or transmitted; only the result "front / behind / unknown" is stored.
• Notifications report a finished analysis. With Pro or credits an analysis can continue in the background on Android; a foreground service then shows its progress. Nothing is transmitted for this either.

Legal basis: performance of the service you requested (Art. 6(1)(b) GDPR). As this processing takes place on your device only, the Service Provider has no access to it.

Advertising in the free version (Google AdMob)

The free version shows ads by Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) while a newly recorded or imported set is being analysed, and on request as reward videos for credits. Never during a recording.

Google processes device and usage data for this, in particular the advertising ID (Android) or IDFA (iOS, only after you allow tracking), the IP address, approximate location, device and app information, ad interactions and diagnostics. Videos, frames, audio and training data are not passed to Google.

• Legal basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), obtained through Google's consent form (User Messaging Platform, IAB TCF) at first start. Without consent only limited, non-personalised ads are shown where Google permits this.
• Withdrawal: at any time in Settings › Ad privacy choices; on iOS also in the system settings under Tracking.
• Reward videos for credits: to confirm the reward, the Application passes your RevenueCat customer ID (anonymous without an account, your account ID when signed in) and a verification token generated by RevenueCat to Google.
• With VelocityLift Pro or VelocityLift Ad-Free the advertising SDK is not started at all.
• Google's information: policies.google.com/technologies/partner-sites

Purchases and subscriptions

VelocityLift Pro is offered as a monthly or annual subscription or as a one-time purchase; VelocityLift Ad-Free as a one-time purchase. Payment, billing, renewal and cancellation are handled entirely by Google Play or the App Store under their own terms; the Service Provider receives no payment details. Subscriptions are cancelled in the store's subscription management. Promo codes are redeemed in the store; the Application does not transmit the code.

To verify and manage purchases the Application uses RevenueCat, Inc. (USA) as a processor. RevenueCat receives the store receipt (product, purchase and expiry date, transaction ID, store country, currency, price, renewal and refund status), a customer ID (a random anonymous ID, or your account ID when signed in), the IP address and technical information about app version, operating system and device language. The Application sends no name, email address or advertising ID and no videos, images, audio or training data to RevenueCat. Only if you consented to usage statistics does RevenueCat also receive the random Google Analytics app instance ID and report purchases and subscription events to Google Analytics.

• Legal basis: performance of the contract (Art. 6(1)(b) GDPR); the analytics link on consent (Art. 6(1)(a) GDPR).
• Retention: as long as a purchase or subscription exists and until the end of the contract with RevenueCat, after which the data is deleted. On request to velocityliftdev@gmail.com the customer record at RevenueCat is deleted; a paid purchase can be reassigned afterwards via "Restore purchases".

Credits for reward videos

In the free version you can watch reward videos for credits and spend them on single Pro features or 24-hour passes. Credits are not money and cannot be paid out. Google confirms a completed video directly to RevenueCat, which credits it. When you redeem credits, the Application sends your RevenueCat customer ID, the chosen feature and a random request ID to the Service Provider's service at Cloudflare, Inc. (processor). It debits the credits at RevenueCat, grants a pass if applicable and keeps a receipt (ID, feature, price, time) for up to 12 months and a short-lived counter against abuse. The IP address is technically visible but not stored by the service. Legal basis: Art. 6(1)(b) GDPR.

Optional account and sync (Firebase)

You can create an optional account (email and password, or a Google account) to back up your training history, sync it between devices and use purchases, credits and passes on several devices. Every feature works without an account.

• Provider: Google Firebase (Google Ireland Limited) as processor. Training data is stored in Cloud Firestore in the region europe-west3 (Frankfurt). The account itself is managed by Firebase Authentication in data centres in the USA; logged IP addresses are kept for a few weeks, account data until the account is deleted and then removed within 180 days.
• Account data: email address, account ID, sign-in and creation times, with Google sign-in the Google account ID and the profile data Google passes on.
• Synced training data: sets and repetitions with all measurements, loads, notes, calibration and camera angle, full bar paths, custom exercises and RPE profiles, and the file path of a video on the recording device. Videos, frames and audio are never synced.
• Linking with purchases: when signed in, RevenueCat uses your account ID so that purchases, credits and passes are available on other devices.
• What you had before signing in: right after you sign in, the Application sends the anonymous RevenueCat customer ID it used until then, together with proof of your sign-in, to the Service Provider's credits service at Cloudflare, Inc. (processor). The service moves that customer's credits and passes to your account and then deletes the anonymous customer at RevenueCat, unless it holds a store purchase of its own or belongs to another customer. It keeps the pairing of the two IDs and what was moved for 30 days, so that nothing is moved twice. Legal basis: Art. 6(1)(b) GDPR.
• Legal basis: Art. 6(1)(b) GDPR.
• Deletion: Settings › Account & sync › "Delete cloud data" or "Delete account" (including all cloud data). Your local history stays on the device.

Optional usage statistics and error diagnostics

Only with your separate, voluntary consent (at first start or in Settings › Privacy). Declining does not limit any feature. Until you consent, all three services are switched off. Provider: Google Firebase (Google Ireland Limited) with Google Analytics 4, Firebase Crashlytics and Firebase Performance Monitoring.

• Usage statistics: defined events about steps of use (e.g. recording started, analysis finished, result viewed, purchase screen opened), technical result states, error codes and durations. Google Analytics itself records time, app version, device type, operating system, language, approximate location derived from the IP address and, on Android, the install source from Google Play (install referrer).
• Error diagnostics: a fixed error category and the stack trace (code locations, no content, no error messages, no file paths), on Android also system-reported crashes and "app not responding".
• Identifiers: a random installation ID links the events; the data is pseudonymous, not anonymous. Image contributions do not carry this ID. No advertising ID, no Android ID, no ad personalisation.
• Never transmitted: recordings, videos, images, audio, file paths, notes, loads, velocities, range of motion, RPE values, exercise names, account data.
• Legal basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
• Withdrawal and deletion: the switch in Settings › Privacy stops collection immediately. "Delete statistics data" there asks Google, through the Service Provider's privacy service at Cloudflare, to delete all Google Analytics data of this installation; Google deletes within days to weeks. Crashlytics reports cannot be deleted per user and expire after 90 days.
• Retention: Google Analytics events up to 14 months and user-level data 2 months, Crashlytics 90 days, Performance Monitoring 30 days for IP-associated events and 60 days otherwise.

Optional image contributions to improve plate detection

Users aged 16 or older can contribute small image crops around the weight plate so that the Application's detection gets better. The feature is off by default and only becomes active after a one-time explicit consent. After that, the Application sends one image in the background only when the plate detection was wrong: you selected the plate yourself, or you confirmed a load that the plates it read on the bar cannot add up to. At most one per set, only from sets recorded after your consent, without showing it first. Faces are pixelated on the device beforehand; this is not a guarantee.

• Data: the image crop (no video, no audio), exercise type, load, repetition and calibration values, your marking of the plate or the confirmed load, and the detection result on that image, app and model version and the month. The upload is anonymous: no installation, account, device, advertising or purchase ID; your IP address is only used to transmit it and is not stored.
• Purposes: review, labelling and preparation, and training, validation, testing and evaluation of the detection models, which are shipped with the Application. No identification of persons, no advertising, no profiling, no publication or sale of the dataset.
• Legal basis: consent (Art. 6(1)(a) GDPR); for third persons visible in an image, legitimate interest (Art. 6(1)(f) GDPR), with a right to object.
• Recipients: Cloudflare, Inc. (Workers and R2, storage in the EU) as processor for receiving contributions. Every image is reviewed by hand; images in which a person can be recognised are deleted. The others are taken into the dataset under a new random name with no link to the upload and are managed at Supervisely OÜ, Ahtri tn 12, Tallinn, Estonia (annotation platform, servers in Germany; content is used only to operate the platform). No personal data reaches Supervisely.
• Retention: contributions not taken into the dataset are deleted after 90 days; images taken in are anonymous and kept permanently.
• Withdrawal: the switch in the settings stops new contributions. Contributions already sent carry no identifier and cannot be assigned to you, so they cannot be shown to you or deleted individually (Art. 11 GDPR). Models already trained are not affected.

Export and other apps

When you export or share a result, a video or your data, the Application hands the selected data to the photo app or the app you choose. Their own privacy terms apply. Nothing is exported automatically.

Local storage and backups

Your training history and videos stay on your device until you delete them or uninstall the Application. When signed in, deleted sets are also removed from the cloud and on your other devices. On Android the app data is excluded from cloud backup; the local database can be transferred when you move to a new device. On iOS the app data is part of your device or iCloud backup with Apple, except the store of the usage statistics.

International data transfers

Google, RevenueCat and Cloudflare may process data in the USA. Transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, otherwise on Standard Contractual Clauses (Art. 46 GDPR). Data processing agreements under Art. 28 GDPR are in place with the processors named above.

Automated decision-making

There is no automated decision-making with legal or similarly significant effects (Art. 22 GDPR). The machine-learning models only measure your lifts on your device.

Children

The Application is not intended for children under 16. Image contributions require confirming an age of at least 16. If you believe a child has provided personal data, contact velocityliftdev@gmail.com and it will be deleted.

Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)), in the Application where described above or by email.

Without an account the Service Provider knows no names or email addresses and can only identify your data if you provide your identifier (account email, or the installation ID shown in the settings). Most data exists only on your device anyway.

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in your country of residence. The authority responsible for the Service Provider is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany. Other EU authorities: edpb.europa.eu/about-edpb/members_en; in the UK the Information Commissioner's Office: ico.org.uk.

California residents (CCPA/CPRA)

You have the right to know, delete and correct personal information, to opt out of the sharing of personal information for cross-context behavioural advertising (in the Application through Settings › Ad privacy choices, or by buying Pro or Ad-Free) and not to be discriminated against for exercising these rights. The Service Provider does not sell personal information. Requests: velocityliftdev@gmail.com.

Security

Transmissions are encrypted (TLS). Cloud data is isolated per account; only the signed-in account can access its own data. No security measure can rule out every breach; in the event of a breach that poses a risk to you, the Service Provider will notify the supervisory authority within 72 hours and, where the risk is high, you without undue delay.

This website

This policy covers the Application and the services that belong to it. The website velocitylift.app itself is a plain, static site hosted on Google Firebase Hosting: it sets no cookies, embeds no analytics and shows no ads. When you open the site, Google processes technical request data (such as IP address, time and requested page) in automatically kept server logs, on the basis of legitimate interest (Art. 6(1)(f) GDPR), to deliver and secure the site. The site has no contact form; the only way to reach the Service Provider through it is the published email address.

Changes

This policy is updated when what the Application transmits, or why, changes. For statistics and image contributions the Application asks for your consent again when a change affects their purposes. Previous versions are available on request.

Effective date: 2026-10-17

Contact: velocityliftdev@gmail.com. Requests are answered within one month, extendable by two months where necessary (Art. 12(3) GDPR).