This policy explains how the ASA mobile app, the software of the ASA training machine and the fitnessasa.com website process personal data. It also serves as the privacy notice required by Turkey's Personal Data Protection Law No. 6698 (KVKK). If the Turkish and English versions differ, the Turkish version prevails.
In short: We keep only the data needed to run the service. We show no ads, do not sell your data, and the app contains no advertising or user-tracking tools. You can delete your account at any time from inside the app.
1. Data controller
Mehmet Salcan
Email: destek@fitnessasa.com
2. Data we process
| Data | Source | Purpose |
|---|---|---|
| Email address, password (stored only as an irreversible hash) | You, when signing up by email | Creating your account, signing in, sending verification and password emails |
| Name, email and account identifier shared by Apple or Google | That service, when you sign in with Apple or Google | Signing in. With Sign in with Apple you can choose to hide your email. |
| Name | You (optional) | Shown on your profile and in the "paired accounts" list on the machine you pair with |
| Height and body weight | You (optional; in your profile and programs) | Letting the machine calculate the arm height for each exercise (height) and the calorie estimate in workout reports (body weight) |
| Programs | You (created in the app or on the machine's screen) | Storing your programs, syncing them between machine and phone, sending them to the machine |
| Workout records: date and duration, exercises, sets, reps, weights, arm heights, a force and cable-position curve per set | The machine, as you train | Showing you your history and set curves |
| Machine pairing: the machine you paired with, your role (owner or member), pairing time; status of programs you send to the machine | When you scan the QR code on the machine and when you send a program | Deciding whose data a machine may access, delivering programs to the machine |
| Technical records: IP address, sign-in times, app version, a random device identifier used for app updates | The app and our service providers' servers | Security, abuse prevention, delivering app updates |
Camera
The app uses the camera only to scan the pairing QR code on the machine's screen, and only with your permission. Images are not stored or sent anywhere.
The machine's own records
To work without internet, the ASA machine also keeps workouts and programs in its own memory. When it is online, it sends workouts to the account you paired with. The machine connects to the cloud with an account that belongs to the device, not to a person, and can access only the data of people paired with it. Workouts done before the machine is paired move to the account of the first person who pairs with it (the machine's owner).
3. Purposes and legal bases
- Account, programs, workout records and machine pairing: providing the service you asked for, i.e. performing our agreement with you (KVKK Art. 5/2-c).
- Technical records and security: our legitimate interest in keeping the service and your account secure (Art. 5/2-f).
- Height and body weight: because this may be considered health data, it is processed only with your explicit consent (Art. 6). Providing it is optional; without it, arm heights are calculated for a default height. You can withdraw consent at any time by deleting this information.
- Legal obligations: lawful requests from competent authorities (Art. 5/2-ç).
4. Who receives data
We do not sell your data or share it for advertising. We use the following service providers to run the service; they process data only on our behalf and only to provide it:
| Provider | Purpose | Server location |
|---|---|---|
| Supabase | Database, accounts and sign-in, set curve files | European Union (Sweden) |
| Resend | Sending verification and password emails | EU and/or USA |
| Expo | Building the app and delivering updates to your phone | USA |
| Cloudflare | Domain, this website, email forwarding | Global network |
| Apple, Google | Authentication if you sign in with them; app stores | Per their own policies |
These providers' servers are outside Turkey. Transfers of data abroad are subject to Article 9 of the KVKK. When you sign in with Apple or Google, their own privacy policies also apply.
5. Retention and deletion
We keep your data while your account exists. When you delete your account, your profile, programs, workout records, set curves and machine pairings are deleted from the cloud immediately. They may remain in our providers' technical backups and logs for a limited period (usually up to 30 days). See Delete your account for the steps.
The local record in the machine's own memory stays on the machine. If you want that deleted too, write to destek@fitnessasa.com.
6. Security
All connections between the phone, the machine and the servers are encrypted (HTTPS/TLS). Passwords are stored irreversibly. Access rules in the database ensure no one can see anyone else's data; a machine can access only the data of people paired with it. The phone cannot run the machine's motor.
7. Your rights
Under Article 11 of the KVKK you have the right to:
- learn whether your personal data is processed and request information about it,
- learn the purpose of processing and whether data is used accordingly,
- know the third parties, in Turkey or abroad, to whom data is transferred,
- request correction of incomplete or inaccurate data,
- request deletion or destruction of your data and notification of this to recipients,
- object to an outcome against you resulting solely from automated analysis,
- claim compensation for damage caused by unlawful processing.
Send your request to destek@fitnessasa.com from your account's email address. We respond free of charge within 30 days. If you are not satisfied, you can complain to the Turkish Personal Data Protection Board (KVK Kurulu).
8. Children
ASA is not designed for people under 16. If you learn that a child under 16 has created an account, write to us and we will delete it.
9. Changes
If we update this policy, we change the effective date and announce significant changes in the app.