This is an English translation for convenience. The French version prevails in case of difference.

Privacy Policy

Last updated: November 5, 2026

1. Data controller

PrimeFeat is a training tracking service available on the web (https://www.primefeat.com) and on mobile. The data controller is Louis Ferret, sole trader (entrepreneur individuel, micro-entreprise), SIRET 108 797 747 00012, whose contact details are set out in the Legal Notice (Mentions légales, in French).

For any question or to exercise your rights: contact@primefeat.com. No data protection officer (DPO) has been appointed to date; requests are handled directly by the publisher.

This policy applies to both the web version and the mobile version, which share the same accounts and the same database.

2. Data we process

Account: email address, username, password (hashed, never readable in plain text). With “Continue with Google”, the identifier of the associated Google account.
Profile: first name, date of birth, sex, goal, level.
Physical condition: weight, height, body measurements, performance, records, workouts, exercises, sets, loads, RPE, durations.
Daily tracking: calories, macros, body weight, hydration, steps, cardio, sleep, and the scanned products you record yourself (name and nutritional values).
Apple Health (iPhone, only if you connect it): read-only access to steps, active energy, resting heart rate, sleep and workouts, to fill in your daily tracking and import your workouts. Nothing is written to Health.
Progress photos: only if you add them; stored in a private space, never shared.
Social features (if you use them): friendships, groups, challenges, feature ideas submitted and votes (Premium), and the elements made visible to other members (username, avatar, XP, day streak, records, volume, submitted ideas, as well as, on your profile card, the month you signed up, your numbers of workouts, friends and records, and your bio if you choose to display it). Your friends also see your recent workouts and your volume per muscle. The “Private profile” setting limits your profile card to your username and photo for non-friends; you then remain present in the leaderboards. Referrals: the person you refer sees your username.
AI features: the content of your messages to the coach and aggregated training signals (volume, consistency, weight trend, records), sent to the AI provider without your name, your email or your account identifier.
Subscription: billing email, customer identifier at the payment provider, subscription status and dates, invoice history. Bank card details are entered directly with the payment provider and are never transmitted to us.
Push notifications (if enabled): a subscription token linked to your browser or device.
Technical data: preferences stored on your device, server access logs (IP address, timestamp, browser) kept by the hosting providers, technical error logs for correction purposes.
Internal usage analytics (can be refused in Settings → Usage analytics): usage events (opening the app, signup steps, workout started or finished, Premium page viewed…), linked to the account or, without an account, to a random identifier stored on the device. No third-party tracker, no IP address recorded, retention of 13 months at most, aggregated statistics only.

3. Purposes and legal bases

Providing the service (account, training, tracking, statistics, activated social features) — performance of the contract (art. 6.1.b GDPR).
Calculating your personalized goals and displaying your progress — performance of the contract.
Health data (weight, body measurements, sleep, heart rate, Apple Health data) — explicit consent (art. 9.2.a GDPR), given by entering this data or by connecting Apple Health; can be withdrawn at any time by deleting this data or by disconnecting Health in the settings.
Managing the Premium subscription and payments — performance of the contract; retention of invoices — legal obligation (art. 6.1.c).
AI features (program generation, coach, review) — performance of the contract.
Reminders and notifications — consent (art. 6.1.a), revocable at any time.
Security, abuse prevention, bug fixing, aggregated usage measurement — legitimate interest (art. 6.1.f).
Complying with legal obligations and requests from authorized authorities — legal obligation.

4. Recipients and processors

We do not sell your data and do not use it for advertising purposes. We use the following providers, governed by data processing agreements:

Supabase, Inc. — hosting of the database, authentication, server functions and file storage. Data hosted in the European Union.
Render Services, Inc. (United States) — hosting of the web application and the site; technical logs (IP address, user-agent).
Groq, Inc. (United States) — inference for the AI features, only after your explicit agreement (Settings > Sharing with AI). Receives your messages to the coach and the relevant training data (goal, level, sex, age, weight, height, program, workouts, records, daily tracking), with no directly identifying data (no name, email or account identifier).
Mistral AI (France, European Union) — backup AI service, used only if Groq does not respond, with the same data and the same agreement.
OpenRouter, Inc. (United States) — backup AI service, used only if Groq and Mistral do not respond.
Stripe Payments Europe, Ltd. (Ireland) and its entities — payments and subscriptions. Stripe also acts as an independent data controller for fraud prevention.
Push notification services of browsers and operating systems (Apple, Google, Mozilla) — delivery of notifications if you have enabled them.
Administrative or judicial authorities — only where required by law.

5. Transfers outside the European Union

Some providers (Render, Groq, OpenRouter, Stripe, RevenueCat, Resend, push services) are located or operate outside the European Union, notably in the United States. These transfers are governed by the safeguards provided for by the GDPR, in particular the European Commission's standard contractual clauses and, where applicable, the EU–US data protection framework (Data Privacy Framework).

6. Retention periods

Account and tracking data: for as long as your account exists.
After account deletion: erasure within 30 days, excluding short-rotation encrypted backups.
Billing data and invoices: 10 years (accounting and tax obligations).
Technical error logs: automatically purged (within 12 months at the latest).
Push notification tokens: deleted upon deactivation or when they become invalid.

7. Security

Each table in the database is protected by row-level access control: you can only access your own data. Photos are kept in a private space, accessible only through temporary signed URLs. Passwords are hashed on the server side. All communications are encrypted via HTTPS/TLS. Third-party service keys remain on the server side.

8. Your rights

In accordance with the GDPR and the loi Informatique et Libertés (French Data Protection Act):

Access and portability: full export from Settings → Export my data (JSON) and the training log (CSV).
Rectification: from Settings → Edit profile.
Erasure: from Settings → Delete account (actual deletion, database and storage).
Restriction and objection to processing based on legitimate interest.
Withdrawal of consent (notifications) at any time, without retroactive effect.
Setting post-mortem directives concerning your data.

To exercise these rights: contact@primefeat.com. We respond within one month. You may also lodge a complaint with the CNIL, the French data protection authority (3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr).

9. Automated decisions

The programs and reviews generated by AI are indicative recommendations: they produce no legal effect and no right depends on them. No decision producing legal effects is made in a fully automated way.

10. Minors

PrimeFeat is reserved for people aged at least 15. We do not knowingly collect data concerning minors under the age of 15. If you hold parental authority and believe that your child has provided us with data, contact us to have it deleted.

11. Local storage and cookies

The application uses neither advertising cookies nor third-party trackers for tracking purposes. Local storage in the browser or on the device (session, language and display preferences) is strictly necessary for the service to work. The payment provider may set technical and anti-fraud cookies during a payment.

12. Changes

This policy may be updated. In the event of a significant change, you are informed in the application. The date of the last update appears at the top of this document.

13. Contact

Publisher / data controller: Louis Ferret — see the Legal Notice. Contact: contact@primefeat.com.