_Last updated: 2026-10-18_
Spotter is an AI lifting coach. It uses your phone's camera to score your squat reps. This policy explains, precisely, what happens to that camera feed and to everything else the app touches.
The short version: your workout video never leaves your phone. It is analysed live, on the device, and discarded frame by frame. If you switch on recording, the clip is saved on your phone — kept out of your backups, deletable by you, and cleared automatically — and it is still never uploaded and never seen by us. Voice commands are recognised on your device and no audio is stored. We don't ask for an account, a name, or an email. The only things that reach our servers are a handful of numbers describing how a rep went.
1. Camera and body-pose data
This is the part most people want to understand, so it comes first.
- The video is processed entirely on your device, using Apple's on-device Vision framework. Frames are held briefly in memory while they are analysed and are then discarded. No video is ever uploaded, transmitted, or seen by us or anyone else. The app contains no code capable of sending video anywhere.
- You can choose to record a set. When you turn recording on, that set is saved as a video file inside the app's own storage on your iPhone, so you can watch a rep back against its score. That file is excluded from device backups, so it is not copied to iCloud. It is never uploaded, never added to your photo library, and never shared. You can delete any clip, or all of them, in History → Set clips, and clips are cleared automatically in any case. Recording is off unless you switch it on, set by set.
- Microphone and voice commands. Lifts the camera can't score are logged by hand or, if you switch it on, by voice — you say "eight done" and the set is logged. When hands-free is on, the microphone is used only while that screen is open, and speech is recognised entirely on your device using Apple's on-device dictation. No audio is recorded, saved, uploaded or sent to any server, including ours and Apple's: if your iPhone can't recognise speech on-device, we switch the feature off rather than send your audio anywhere. Hands-free is off until you turn it on, and the on-screen button always remains.
- While a set is running, the app derives the position of a few body joints (shoulder, hip, knee, ankle) from each frame in order to measure how deep you squatted and how controlled the movement was. This joint data exists only in memory, only for the instant it is used, and is never stored or transmitted — not to us, and not to anyone else.
- We do not use this data to identify anyone. It is not face geometry, not a fingerprint, not an iris or retina scan, not a voiceprint, and not a scan of hand geometry. It cannot be used to recognise you, and we do not attempt to. It measures how a movement was performed, not who performed it.
- We do not sell, lease, trade, or otherwise profit from camera or body-pose data, and we do not disclose it to anyone, because we never receive it in the first place.
- Retention and destruction schedule. Because camera and body-pose data are never collected by us, we hold none of it and there is nothing for us to retain. On your device, each frame and its derived joint positions are discarded immediately after analysis — within a fraction of a second — and in all cases when the set ends or the app closes. Recorded clips, if you make any, are kept on your device for up to 14 days (and at most 20 clips, or 1.5 GB) and then deleted automatically.
What does survive a set is a small set of numbers: how many reps you did, and a depth score, a tempo score and an overall score for each one.
2. What stays on your device
Stored locally, in the app's own storage, and never copied to us:
- Your training profile — experience level, goal, chosen program, and the working weight the coach has calculated for each lift.
- Your workout history — logged sets, rep counts, per-rep scores, dates, and streak.
We do not have a copy of any of it. Deleting the app deletes all of it. If you use the Apple Watch companion, this information moves directly between your iPhone and your Watch and does not pass through us.
3. What we send off your device
Only the following leaves your phone, and only when the relevant feature runs:
- Rep scores, to write your coaching notes. After a set and after a session, the app sends the numeric scores (for example: rep 1, depth 88, tempo 79, overall 79) and the name of the exercise to our coaching service, which passes them to Google's Gemini API to generate a short piece of coaching text. No video, no images, no joint coordinates, no name, no email, no account identifier, and no device identifier are included.
- Your goal, experience level and — if you choose to enter it — your sport, when you ask the in-app coach to pick a program for you. This runs once, during setup. The sport field is free text and optional; whatever you type is sent to our coaching service and on to Google's Gemini API so the recommendation can account for it. Please don't type anything into it you wouldn't want processed that way. Leave it blank and nothing is sent.
- An abuse-prevention token. To stop the coaching service being flooded, our server counts requests per caller per day. It does this using a one-way, salted hash of your IP address combined with the current date — an opaque token that cannot be turned back into your address and cannot be linked to you across days. The raw IP address is not stored. The counter expires automatically after 48 hours.
4. Purchases
Subscriptions are sold and processed entirely by Apple through the App Store, using StoreKit. Apple validates your subscription on your device. We never see your name, your card details, or your Apple ID, and no third-party billing provider is involved.
5. Use of artificial intelligence
Two features use AI:
- On-device movement scoring — Apple's Vision framework, running locally as described in section 1. Nothing is sent anywhere.
- On-device speech recognition — Apple's dictation, running locally, only while hands-free logging is switched on and visible. Nothing is sent anywhere.
- Written coaching notes and the program recommendation — Google's Gemini API, reached through our own server, receiving only the numeric scores and setup answers described in section 3.
We use a paid Gemini tier under which Google does not use the content sent to it to train its models. The AI writes coaching text only; it does not make any decision about you that produces a legal or similarly significant effect.
6. Who processes data on our behalf
- Apple — App Store distribution and subscription processing.
- Cloudflare — hosts our coaching service and its rate-limit counters.
- Google — the Gemini API that generates coaching text.
We use no advertising networks, no analytics SDKs, no crash-reporting SDKs, and no tracking or attribution SDKs of any kind. We do not sell or share personal information, and we do not use it for cross-context behavioural advertising.
7. What we never collect
No account, no sign-in, no name, no email address, no phone number, no contacts, no location, no advertising identifier, no device identifier, no photos, no health records, no audio or voice recordings, and no video — any clip you record stays on your device and never reaches us.
8. Health information
Spotter measures athletic performance — how deep and how controlled a squat was. It is not a medical device, it does not diagnose or infer any health condition, and we do not derive health information from what it measures. It is not a substitute for professional medical or coaching advice. See our Terms of Use.
9. How long anything is kept
- Camera frames and joint positions: discarded immediately after analysis, on your device. Never received by us.
- Your workouts and profile: on your device, until you delete the app.
- Rep scores sent for coaching text: processed to produce the reply and not retained by us in any identifiable form afterwards.
- Set clips you chose to record: on your device, for up to 14 days / 20 clips / 1.5 GB, then deleted automatically. Deletable by you at any time, and deleted with the app. Never received by us.
- Voice command audio: never stored at all — it is recognised live on your device and discarded. Never received by us.
- Abuse-prevention counters: hashed, and automatically deleted after 48 hours.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete, export, restrict or object to the processing of your personal data, and to lodge a complaint with a supervisory authority — in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.
The Irish supervisory authority (lead authority for this Service) is:
Data Protection Commission (DPC) 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland Website: <https://www.dataprotection.ie> Online complaint form: <https://www.dataprotection.ie/en/contact/how-make-complaint>
We would appreciate the chance to address your concern first — email info@kalibrefin.com — but you are not required to contact us before going to the DPC.
Because Spotter has no account and stores your training data on your own device, most of this is already in your hands: deleting the app erases everything it holds. For anything we hold, contact us at the address in section 13 and we will respond within the period your law requires.
Californian residents: we do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not offer financial incentives for personal information.
11. International transfers
Our coaching service runs on Cloudflare's global network and calls Google's Gemini API, which means the small amount of data described in section 3 may be processed outside your country, including in the United States. We rely on our providers' data protection terms and standard contractual clauses where applicable.
We rely on the EU–US Data Privacy Framework (DPF): Cloudflare, Inc. and Google LLC are self-certified under the EU–US DPF, and the European Commission's adequacy decision of 10 July 2023 recognises DPF-certified transfers to the United States as providing an adequate level of protection. Where the Framework does not apply, we rely on the Standard Contractual Clauses in our providers' data protection terms (and, for UK users, the UK International Data Transfer Addendum).
The transfer is small by design: a handful of numeric rep scores and the setup answers described in section 3. No video, no audio, no account identifier and no contact details are included.
12. Children
Spotter is a barbell strength-training app intended for adults. It is not directed to children, and we do not knowingly collect personal data from children under 13 (or the equivalent minimum age where you live). If you believe a child has provided us with personal data, contact us and we will delete it.
13. Who we are, and how to reach us
The data controller for the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Irish Data Protection Act 2018 is:
Can Ayan (sole trader) Ireland Email: info@kalibrefin.com
We are established in the European Union, so no Article 27 representative is required.
Questions, requests, or complaints: info@kalibrefin.com
14. Türkiye'deki kullanıcılar için aydınlatma (KVKK m.10)
Veri sorumlusu: Can Ayan (Spotter), İrlanda. İletişim: info@kalibrefin.com
İşlenen veriler ve amaç: Setinizin kamera görüntüsü yalnızca cihazınızda işlenir, kaydedilmez ve hiçbir şekilde tarafımıza ulaşmaz; kayıt özelliğini siz açarsanız video yine yalnızca telefonunuzda saklanır. Sunucumuza ulaşan tek şey, koçluk metninin yazılabilmesi için gönderilen sayısal tekrar puanları ile kurulum sırasında verdiğiniz hedef, deneyim düzeyi ve — yazarsanız — spor bilgisidir.
Toplama yöntemi: Uygulama üzerinden, elektronik ortamda.
Hukuki sebep: KVKK m.5/2-c (sözleşmenin ifası) ve m.5/2-f (meşru menfaat — hizmetin kötüye kullanımının önlenmesi).
Aktarım: Bu sayısal veriler Cloudflare ve Google LLC altyapısı üzerinden yurt dışında işlenir; bu, KVKK m.9 kapsamında yurt dışına aktarımdır ve hizmetin sunulabilmesi için zorunludur. Görüntü ve ses hiçbir koşulda aktarılmaz.
Haklarınız: KVKK m.11 kapsamındaki haklarınızı info@kalibrefin.com adresine başvurarak kullanabilirsiniz; başvurular 30 gün içinde yanıtlanır. Uygulamayı silmeniz, cihazınızda tutulan tüm antrenman verinizi ve kayıtlarınızı siler.
15. Changes
If we change how the app handles data, we will update this page and change the date at the top. Material changes will be highlighted here.