Stele keeps your training on your phone. No account is required. Optional features send the limited data described below to provide the service you choose. We do not sell your data or track your use of the app.
This policy explains what stays on your device, what optional features send, who processes it and how long it is kept.
Stele is made by an independent developer based in the Republic of Belarus. Questions about this policy, or about your data: support@getstele.app.
The app records what you enter: training programs, workouts, sets, reps and weights, body weight, recovery marks, session notes and your settings. All of it is written to storage on your own device by the app itself. None of it is transmitted to us, and we have no way to read it.
No name, email address or phone number. No contacts. No location, precise or approximate. No photos. No advertising identifier or device fingerprint. Optional services use random installation identifiers, a random identifier for this conversation, and store purchase proof as described below. No crash reports. No usage statistics, analytics or behavioural data. The app contains no analytics, advertising or tracking components of any kind.
With your permission the app reads dietary energy, so the Body screen can show what you have eaten beside your training; body weight, so weigh-ins recorded elsewhere appear in your trend; and heart-rate variability, resting heart rate and sleep, so recovery can be shown against your own baseline. It writes back only the weigh-ins you type into the app, so your other apps show the same number. On iPhone this is Apple Health; on Android it is Health Connect.
Health data is read on the device, used only to show your trends and recovery context and to evaluate the existing performance-gated deload rule, and is never transmitted to us, shared with anyone, or used for advertising or profiling. This is about the figures the app reads from Apple Health or Health Connect; anything you type yourself into the AI chat is a separate matter, described below. You can withdraw the permission at any moment in your phone's settings, and the app keeps working without it.
Four optional features send data: composing a program with AI, WHOOP sync, inviting a friend, and verifying a Google Play purchase. Everything else described above stays on your phone. All four go through a small server of ours, which exists so that no key has to be shipped inside the app, where it could be read out.
If you ask the app to write or convert a training program, what you typed in that conversation — and any file you attach to it, such as a coach's plan — is sent to our server and passed on to OpenRouter, which routes it to the company whose model answers — today OpenAI. Through OpenRouter, TypeSafe AI also receives the latest message, attachment kind and size, a short text excerpt when available, and exercise names generated by the answering model. Its Jev decision model checks whether the request concerns training and matches generated names to our exercise catalogue. Binary attachments, the rest of the conversation, your onboarding answers, identifiers and purchase proof are not sent to TypeSafe AI. We name them because you are entitled to know where your words go; if the model changes, this document changes with it. Your training answers from the first-run questions travel with it, because a program is written from them: how long you have trained, what you are training for, and your sex and the year you were born if you gave them. A random identifier for this installation goes too. It is not linked to you, is not an advertising or device identifier, and is generated by the app itself, and it is not what the allowance is counted against. Each conversation also carries a random identifier for this conversation, generated by the app, so a follow-up is not counted as another conversation. It is not linked to you either. On iPhone the conversation also carries a subscription receipt — Apple's signed proof of what was bought, not a card number — so the server can tell a subscription from a lifetime purchase and can ask Apple whether that purchase is still yours, including after a refund or a revocation. The receipt is checked and not kept. Apple's answer may be remembered for a few minutes. What is kept is a one-way hash of Apple's original transaction identifier, not the receipt.
What is not sent: your training history, your sets and weights, your body weight, your recovery marks and your notes. None of that is part of the conversation.
Anything you type is sent, including anything you choose to say about your body. The app invites you to mention an injury or a limitation, because a program written around one is a better program — but that is your choice to make, and whatever you write goes with the rest of the conversation. It is not stored by us, not added to any profile, and not used for anything beyond answering you. Do not write what you would rather not send.
Our server keeps no copy of the conversation. It holds a one-way hash of the purchase, how many conversations that purchase has used, a monthly total of the model's token cost, and the identifier for this conversation together with how many requests it has used. A lifetime purchase's conversation count is kept until that allowance is spent. A subscription's conversation count starts again each calendar month. The token-cost total starts again each calendar month either way. OpenRouter, OpenAI and TypeSafe AI process the data sent to them under their own terms and privacy policies as our processors. They are not permitted to use it to train models. OpenRouter and OpenAI are based in the United States, so this is a transfer outside your country if you are elsewhere — see "International transfers" below. If you never use this feature, nothing is ever sent.
On Android, buying Pro or restoring a purchase sends the product ID and an opaque Google Play purchase token to our relay. The relay forwards them to Google, using package app.stele, to check ownership, expiry and refunds. This also happens on launch, when the app returns to the foreground, and periodically while it is open after a purchase. AI requests carry the same purchase proof for access checks. These records contain no card number or payment credentials. Purchase tokens and Google's purchase responses are processed in real time and are not retained or logged by our relay. The allowance record keeps a one-way hash of the purchase lineage — the order, or the chain of purchase tokens Google links — and not the purchase token itself. The token is stored in the app's private storage while access remains active, separate from training backups. Purchase lookup may also use a separate per-IP abuse counter on our relay, deleted after two minutes. Google processes purchase records under its own privacy policy. Purchase proof is never passed to the AI provider.
WHOOP sync is off unless you turn it on. There are two ways to connect, and they differ in what passes through us.
With the Connect WHOOP button, the sign-in code your phone receives is sent to our server, which exchanges it with WHOOP for access tokens and hands them back. It has to be done there rather than in the app because the exchange needs a secret that cannot safely live inside a shipped app. Our server keeps no copy of that code or of your tokens; they are stored on your device.
If instead you register an application in your own WHOOP developer account and paste its Client ID and Secret into the app, your phone talks to WHOOP directly and nothing passes through us at all.
Either way, the credentials and tokens are stored only on your device, are deliberately excluded from the app's own backup file, and what comes back is your recovery score, stored on your device like everything else. WHOOP is a separate company and your use of it is governed by WHOOP's own terms and privacy policy.
Invites are optional. If you open Invite a friend, or enter a friend’s code, the app sends our server a random identifier for this installation (separate from AI), invite codes and one number: the count of qualifying workouts. The workouts themselves, their dates, durations and sets stay on your phone. When a month of Pro is due, the app also sends the signed App Store purchase record described above, so the right store offer can be chosen. Our server keeps the installation identifier, codes, redemption time, count and reward states for about 13 months after the last change; write to support@getstele.app to request earlier deletion.
On iPhone, the app also sends an ephemeral Apple DeviceCheck token to our relay, which forwards it to Apple to query and update per-device anti-abuse bits. This prevents a device from earning another friend reward by reinstalling. We do not retain the token or log it. Apple stores a per-device bit indicating that a friend reward has been authorized; that bit survives reinstall and is separate from our 13-month records. Bit 1 is left unchanged. Apple handles this data under its own privacy policy. No advertising identifier is used, and this check is not used for tracking. Android does not send a DeviceCheck token; rewards there remain unavailable until store reward delivery and device verification exist.
The app can write a Markdown report and a JSON archive of everything it holds. Where they go is your choice: the app's own folder, or a folder you pick — including one that syncs to a service such as iCloud Drive or Google Drive. If you pick such a folder, that service handles the file under its own privacy policy. We never see these files.
This website and our small server run on Cloudflare. The website counts its visitors with Cloudflare Web Analytics, which sets no cookies, stores nothing on your device and uses no identifier for you: we see only totals — how many visits, to which pages, from which referring site, country and kind of device. This is about the website only; the app contains no analytics.
If you leave your email address on this website to hear when the app is out, we keep that address, the language of the page, which phone you chose, the date, and — if you came by a friend's link — that friend's invite code, so the free month can reach you. To limit repeated sign-ups, our server also keeps your IP address separately for at most two minutes; it is not attached to your email record. It is used for one email, when the app reaches the App Store or Google Play, sent through an email delivery service acting for us; then the address is deleted, and in any case within 18 months. It is stored on Cloudflare, never sold or shared, and never used for anything else. To be taken off the list sooner, write to support@getstele.app. The app itself never asks for your email.
We do not sell or rent your data or disclose it to advertisers or data brokers. Service providers process data for the optional features and website services described above, including AI requests, invite records and the waiting list. Apple, Google, WHOOP and any cloud storage service you choose handle data under their own policies.
Apart from invite records (see Inviting a friend) and waiting-list addresses (see The waiting list), we keep nothing, so we have nothing to retain or to delete. What you enter stays on your device until you delete it in the app or delete the app itself — removing the app removes everything it stored. Files you exported stay where you put them and are yours to delete. Health and notification permissions are revoked in your phone's settings. WHOOP is disconnected with the Disconnect button on the WHOOP screen, which erases the stored credentials and tokens from the device.
Your data sits in the app's private storage, protected by the operating system's sandbox and by your device passcode and disk encryption. Connections to our relay, Google and WHOOP use HTTPS. No storage or transmission is perfectly secure — we limit processing and retention as described above.
The app is not directed at children under 13, or under the minimum age set by the law where you live. We do not knowingly process personal data from children under that age. Contact us if you believe a child has used an optional service.
Where the GDPR applies: the app processes what you enter on the basis of your consent, given by using it, and optional off-device processing is limited to the services described above. Store purchase verification is necessary to deliver and restore the purchase contract. Brief per-IP abuse counters protect the security of those services. Health data is a special category under Article 9 and is handled only with the explicit consent you give through your phone's own Health permission prompt — only on the device, to draw your own figures back to you and evaluate the existing performance-gated deload rule. You can withdraw that consent at any time in your phone's settings, and the app keeps working without it.
If you use the AI feature, that conversation goes to servers in the United States, which for a reader outside it is a transfer abroad; it happens on the basis of your consent, given by using a feature that is off until you open it. Google Play purchase verification also transfers purchase proof through our Cloudflare relay to Google; Google processes it under its own transfer safeguards. If you connect WHOOP, your phone sends your request to WHOOP's servers wherever those are; if you choose a folder that syncs to a cloud service, that provider stores the file wherever it stores files. Both act under their own policies and their own transfer safeguards.
Data that never leaves your device stays under your control. Where the GDPR, the Republic of Belarus's personal data law or a comparable law gives you rights of access, correction, deletion or portability, those rights are met inside the app: everything is on screen, editable, exportable from the Export tab, and removable by deleting the data or the app. For optional-service data and retained records described above, contact us to request access or deletion. You also have the right to complain to a supervisory authority — in the EEA or the UK, your national data-protection authority; in Belarus, the National Centre for Personal Data Protection.
We do not sell personal information or use it for cross-context behavioural advertising. Optional processing and retained records are described above. Contact us with requests to know or delete the data we process.
If this policy changes in a way that matters, the app shows the new version and asks you to accept it again. The version and date are at the top of this document.
support@getstele.app