Updated 16 October 2026

Privacy
Policy

Your privacy is important to us. In this Privacy Policy, we explain how we collect, use and protect your personal data in the Tsemppi service.

This is a translation of the original Finnish document. In case of any discrepancy, the Finnish version shall prevail. Read the original Finnish version

1. Data controller

The processing of your personal data is the responsibility of:

Tsemppi Fitness Oy

  • Business ID: 3377898-6
  • Address: Kolmas Linja 30 B, Helsinki
  • Email: info@tsemppiapp.fi

2. What data we collect

We collect the following data in order to provide the service:

Basic information

Name, email address, date of birth, gender

Account information

Username, password (encrypted), profile picture

Training data

Training history, workouts, weights, repetitions, progress data

Body data

Height, weight, limitations (optional)

Health and fitness data

Workouts you import from Apple Health or Health Connect: type, duration, distance, energy burned, heart rate and elevation gain (optional)

Location data

The GPS route of outdoor workouts, and your location for gym search (optional, see section 5)

Usage data

How you use the application, device information, IP address

Feedback and surveys

Your answers to questions the application asks occasionally, such as where you heard about Tsemppi, and the reason you may give when deleting your account. Answering is always voluntary (see sections 6 and 10)

Note: Your heart rate and any injuries or limitations you tell us about are health data. We process them only with your explicit consent (Article 9(2)(a) GDPR), which you give by switching on the feature in question. We store heart rate only if you connect Apple Health or Health Connect and import workouts from there. You can delete imported workouts and the limitations you have entered at any time, and the processing then ends. Training, body and health data are voluntary, and you decide what you store.

3. Artificial intelligence and data processing

Tsemppi uses artificial intelligence to create personalised training programmes. Here we explain exactly how the AI works:

What data the AI uses

  • •Goal: Muscle growth, strength, fat loss or performance
  • •Level: Beginner, intermediate or advanced
  • •Training frequency: How many times a week you want to train
  • •Workout duration: Target time per workout
  • •Equipment: Gym, basic equipment or home training
  • •Limitations: Any injuries or limitations (knee, shoulder, back, hip)

Third-party AI service

We use an OpenAI language model to generate training programmes. When you create a new training programme:

  • •We send OpenAI only the onboarding information listed above (goal, level, frequency, duration, equipment, limitations)
  • •We do not send personal identifiers such as your name, email address or username
  • •OpenAI does not use the data to train its models when the service is used via the API
  • •The data is processed in accordance with EU data protection regulations

Data storage

  • •Your account data, training data and other data created in the service are stored in data centres located in the EU
  • •Generated training programmes are stored in your account, not at OpenAI
  • •Some of the service providers we use also process data outside the EU and the EEA, including in the United States. For those transfers we rely on the European Commission’s standard contractual clauses or on other safeguards required by EU law. The list of service providers is in section 8.

Limitations of AI: The AI creates a training programme based on the information you provide and our existing exercise database. AI does not replace professional advice, and we recommend consulting a doctor before starting a new exercise programme, especially if you have health-related limitations.

4. Strength level and muscle points

Tsemppi calculates metrics describing your progress based on your training data:

Strength level metric

The strength level is based on standardised powerlifting formulas and takes into account:

  • •Weights lifted: Maximum lifts in different exercises
  • •Body weight: Relative strength in relation to body weight
  • •Gender: Comparison with gender-specific averages

Muscle map and progress

The muscle map visualises the load of your workouts:

  • •Intensity: Calculated based on sets, repetitions and weight
  • •Target muscles: Each exercise targets specific muscle groups as defined in our exercise database
  • •PR tracking: Personal records are saved automatically

Note: These metrics are indicative and are intended to motivate you and to track progress. They are not medical assessments.

5. Application permissions

Tsemppi may request the following permissions on your device. Each permission is optional, and you can manage them in your device settings:

Camera
Optional

We use the camera to take a profile picture and to save workout videos and progress photos to your profile.

Notifications
Optional

We use notifications to remind you of workouts, to notify you of community activity (likes, comments, followers) and of replies to support messages.

HealthKit (iOS)
Optional

The HealthKit integration enables training data to be synchronised with Apple’s Health app, so that you can track all your physical activity in one place.

Health Connect (Android)
Optional

The Health Connect integration brings workouts from your watch and other fitness apps into your training history (type, duration, distance, energy burned, heart rate and elevation gain), and saves the workouts you finish in Tsemppi and your weight to Health Connect. We read only the data types you allow, and we never use them for advertising. We do not read workout routes from Health Connect.

Location
Optional

When you start an outdoor workout, Tsemppi records the GPS route, distance and pace, including while the screen is locked, and stops as soon as you finish. The route coordinates stay on your phone: our server stores only the distance, splits and the shape of the route, without coordinates. In gym search, your location is sent to Google’s place search to find gyms near you, and it is not stored.

Note: The application works fully without these permissions. We only request permission when you use the feature in question for the first time.

6. How we use your data

We use your data for the following purposes:

  • ✓Creating personalised training programmes with AI — performance of the contract
  • ✓Tracking your progress and visualising it as a muscle map — performance of the contract
  • ✓Managing your user account and signing you in — performance of the contract
  • ✓Providing community features (if you share your workouts) — performance of the contract
  • ✓Processing health data in your training programme — explicit consent
  • ✓Customer communication and support — performance of the contract
  • ✓Developing and improving the service — legitimate interest
  • ✓Developing the service on the basis of your voluntary feedback answers — legitimate interest
  • ✓Ad measurement in the app (section 10) — consent

7. Data security

We protect your data carefully:

🔐
Encryption

All data is encrypted both in transit (TLS) and at rest. Passwords are hashed using the bcrypt algorithm.

🛡️
Secure infrastructure

The database and files are located in data centres in the EU. Our servers are in Germany. Some service providers also process data outside the EU, see sections 3 and 8.

🔑
Access control

Authentication based on JWT tokens, 90-day session validity

📋
Regular audits

We review our security practices regularly

8. Sharing of data

We do not sell your data

Your personal data is never sold to third parties for marketing purposes.

We share data only as follows:

  • •OpenAI: Generating your training programme. Only onboarding data, no personal data
  • •MongoDB Atlas: The main database, where your account data and training data are stored
  • •Google Cloud Storage: Storage of profile pictures, workout pictures and community post images, and storage of employee benefit receipts in a protected folder
  • •RevenueCat: Managing subscriptions and trial periods. Receives the subscription identifier and the subscription status
  • •Resend: Emails sent by the service, such as the welcome message and password reset. Receives your email address and name
  • •Expo Push Notification Service and Firebase Cloud Messaging: Delivery of push notifications. Receive your device’s notification token
  • •Sentry: Error and crash monitoring. Contains no training or health data
  • •PostHog (EU region): Usage analytics. You can refuse analytics: Settings → About → Analytics
  • •Google Places: Gym search. Your location is sent for the search and is not stored
  • •Apple and Google sign-in: Alternative sign-in method. We only receive your email address and name
  • •Ad measurement (Meta and TikTok): Only with your consent, and only in the app. See section 10
  • •Website analytics and ad measurement: Only with your consent, and only on the website. See section 9
  • •Community features: To other users only if you choose to share your workouts
  • •Legal obligations: To the authorities only where required by law

9. Cookies and tracking on the website

Running the website

Necessary cookies keep the website working: signing in, the session and the language choice. These cannot be switched off and they do not require consent.

Required
Visitor counts without cookies

We measure which pages are read and which pages lead to the app stores. This measurement stores nothing on your device and reads nothing from it. The identifier is random and disappears when you close or reload the page. Events pass through our own server to PostHog (EU region), and your IP address is not passed on. We do not build user profiles. The basis is our legitimate interest in improving the website.

No cookie

Analytics and ad measurement, only with consent

With your consent we also use the following tools. They set cookies or use browser storage, and some of them transfer data outside the EU.

Google Analytics 4 (Google Ireland Ltd)

Visitor numbers and behaviour on the website.

Consent only
Microsoft Clarity (Microsoft Ireland)

Session recordings and heatmaps that show us where on a page visitors stop.

Consent only
Meta Pixel (Meta Platforms Ireland Ltd)

Measuring and targeting advertising.

Consent only
TikTok Pixel (TikTok Technology Limited)

Measuring and targeting advertising.

Consent only

The legal basis is your consent (Article 6(1)(a) GDPR). Before you consent, these tools are not loaded at all. You can give or withdraw your consent at any time:

Transfers outside the EU

The parent companies of these services are in the United States and data may be processed there. For those transfers we rely on the European Commission’s standard contractual clauses or on other safeguards required by EU law.

Ad measurement in the app is a separate matter from website tracking. It is described in section 10.

10. Ad measurement in the app (Meta and TikTok)

The app includes ad measurement by Meta (Facebook and Instagram) and TikTok. It lets us see which advert a download or a subscription came from. We use the Meta SDK (react-native-fbsdk-next) and the TikTok Business SDK.

Nothing is sent before you consent. We ask for your consent once, before you create an account, in a separate view. If you do not consent, ad measurement stays switched off entirely and nothing is sent from your device to the advertising platforms.

What is sent for ad measurement:

  • •Device identifiers: the advertising identifier and technical details of the device
  • •App events: installing the app, opening it and registering
  • •Purchase events: taking out a subscription and the value of the subscription

Purpose and legal basis

We use this data to measure and target advertising: we can see which adverts lead to downloads and subscriptions, and the advertising platforms can target advertising. The legal basis is your consent (Article 6(1)(a) GDPR).

Differences between operating systems

iOS

The app does NOT use App Tracking Transparency or the IDFA advertising identifier. Measurement is based on Apple’s SKAdNetwork and on aggregated data that cannot be linked to an individual user.

Android

The app uses the Google Advertising ID (GAID). You can reset or delete the advertising ID in your Android device settings.

Recipients and transfers outside the EU

Meta Platforms Ireland Ltd

Advertising platform. Also processes the data for its own purposes, such as targeting advertising.

Meta Privacy Policy
TikTok Technology Limited

Advertising platform. Also processes the data for its own purposes, such as targeting advertising.

TikTok Privacy Policy

Both companies are established in the EU (Ireland), but the data may also be transferred for processing outside the EU and the EEA, including to the United States. The safeguards required by EU law are used for these transfers, such as the European Commission’s standard contractual clauses. Further details of the transfers and the grounds for them can be found in those companies’ own privacy policies.

Withdrawing your consent. You can withdraw your consent at any time in the app: Settings → About → Ad measurement. After withdrawal the app sends no new events. You can ask Meta and TikTok to delete data already sent through their own channels.

11. Data retention period

  • 👤User data: We retain it for as long as your account is active
  • 💪Training data: We retain it for as long as your account remains valid, so that you can track your progress
  • 🗑️After account deletion: Data is deleted within 30 days
  • 📊Anonymised statistics: We may retain anonymised data in order to develop the service
  • 💬Feedback answers: We retain them on our own server for as long as your account is active. When you delete your account, your answers are anonymised: they are detached from the account and the texts you have written are deleted, so your choices remain only in anonymous statistics. The reason you give when deleting your account is stored without your name, email address, username or exact time, so it cannot be linked to you.
  • ⏰Session expiry: After 90 days of inactivity, you must log in again

12. Your rights (GDPR)

You have the following rights in relation to your personal data:

Right of access

You can request a copy of all data collected about you

Right to rectification

You can correct inaccurate or incomplete data

Right to erasure

You can delete your account in the application settings ("right to be forgotten")

Right to restriction of processing

You can restrict the processing of your data in certain situations

Right to data portability

You can receive your data in a machine-readable format

Right to object

You can object to the processing of your data for marketing purposes

Right to withdraw consent

You can withdraw a consent you have given at any time. Withdrawal does not affect the lawfulness of processing carried out before it

To exercise your rights, send an email to info@tsemppiapp.fi. We will respond to your request within 30 days.

13. Underage users

Tsemppi is intended for people aged 15 and over.

  • •We do not knowingly collect personal data from anyone under 15
  • •If we learn that a person under 15 has created an account, we delete the account and the data associated with it
  • •If you are under 18, you need your guardian’s consent to take out a paid subscription
  • •A guardian has the right to review and delete a minor’s data by contacting info@tsemppiapp.fi

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes:

  • 📱By notification in the application
  • 📧By email
  • 🌐On our website

We recommend that you review this Privacy Policy regularly. By continuing to use the service after the changes, you accept the updated Privacy Policy.

15. Right to lodge a complaint

If you consider that the processing of your personal data infringes data protection legislation, you have the right to lodge a complaint with a supervisory authority:

Office of the Data Protection Ombudsman

  • Visiting address: Lintulahdenkuja 4, 00530 Helsinki
  • Postal address: P.O. Box 800, 00531 Helsinki
  • Email: tietosuoja(at)om.fi
  • Switchboard: +358 (0)29 566 6700

16. Contact us

If you have any questions about data protection or wish to exercise your rights:

📧
📍Kolmas Linja 30 B, Helsinki
🏢Tsemppi Fitness Oy (Business ID: 3377898-6)

This version replaces the version dated 14 October 2026. The previous version is available: 14 October 2026