Privacy Policy

Last updated: September 25, 2026

1. Data controller

The data controller is:
GAUTHIER Maxence (sole proprietorship, France)
SIRET: 10547132000017 — Dijon, France
Contact email: support@nostaapp.com

2. Our privacy commitments

• You don’t need an account to use Nosta.
• No external server receives, stores or processes your training data.
• No ad trackers and no tracking across apps or websites. The only measurement built in is anonymous usage stats, described in section 7.
• No ad networks, no profiling and no selling of data to third parties.

3. Data stored on your iPhone

To make the app work, the following information is stored in your device’s internal storage, and in your own iCloud for the items covered by the backup copy described in section 4:

• Name you enter: your first name.
• Apple ID: if, and only if, you use “Continue with Apple”, the anonymous identifier Apple sends back. It’s only used to find your data on another device and never leaves your phone and your iCloud. We never receive your real name or your email address.
• Profile: age, gender, weight, height, goal, motivation, where you train and your equipment, plus your answers to the coach (experience, sleep, consistency, time available).
• Training history: exercises done, sets, weights, reps and how each set felt.
• Progress photos: if you choose to add any, they stay isolated in the app’s secure storage.
• Preferences: language, units, reminders, rest and display options.

4. Backup copy in your iCloud

At the end of each workout, Nosta saves a copy of your training data to the key-value storage of your own iCloud account, using the Apple service designed for it.

It is stored in your personal iCloud space, counts toward your quota, and is encrypted by Apple. We have no access to it, direct or indirect, and no data goes through a server we own.

What the copy includes: your first name, profile, program, weights and workout history. What it doesn’t include: your progress photos and profile photo, which are too large for this storage — they stay on your device and are only covered by Apple’s regular iPhone backup.

It is only read in one case: a fresh install with no local data. You can delete it at any time with the “Delete my account” button in the Profile tab, which also erases the iCloud copy, or turn off Nosta’s iCloud access in Settings → [your name] → iCloud.

5. Apple Health (HealthKit)

With your prior consent, Nosta can save your finished workouts to Apple’s Health app. Nosta never reads any medical or personal data from Apple Health and only writes the date, duration and type of each workout. You can revoke this permission at any time in: Settings → Health → Data Access & Devices → Nosta.

6. Subscriptions and payments

All payments are handled securely by the Apple App Store. We never see your card number or payment details.

To check whether your subscription is active and to follow the app’s business activity, Nosta uses RevenueCat, Inc. (United States), a service provider specialized in validating subscriptions. Apple sends it your transactions.

• What RevenueCat receives: that a purchase, a free trial, a renewal, a cancellation or a refund happened, the plan involved, how far you got in sign-up, and an anonymous identifier generated for your device.
• What RevenueCat doesn’t receive: your first name, profile, program, weights, workouts, photos, health data or payment details.
• Purpose: unlocking the paid features for you and measuring the app’s activity. This data is never used for advertising and is never sold.
• Legal basis: performance of the contract between us, under Article 6(1)(b) of the GDPR.
• Transfer outside the EU: since RevenueCat is based in the United States, this processing involves a transfer covered by the European Commission’s standard contractual clauses.

You can ask us to delete this subscription data by emailing support@nostaapp.com.

7. App usage stats

To see which sign-up and subscription screens work and which ones make people give up, Nosta sends anonymous usage signals to TelemetryDeck GmbH (Augsburg, Germany).

• What a signal contains: the name of the screen opened or the button tapped, the time spent on the previous screen and, for your goal, your motivation and where you train, the answer you picked. It also carries the app’s language and units, its version and your iOS version.
• What it never contains: your first name, age, weight, height, weights lifted, workouts, photos, health data or any advertising identifier.
• Identifier: signals are tied to an identifier generated at random on your phone, which can’t identify you. The “Delete my account” button replaces it with a new one.
• How long: once you subscribe, the app reports it one last time and then sends no more signals. After that, only RevenueCat passes subscription events on to TelemetryDeck (trial ending, renewal, cancellation), tied to the same random identifier.
• Legal basis: our legitimate interest in improving the app (Article 6(1)(f) of the GDPR). The data is anonymous and never used for advertising.
• Hosting: TelemetryDeck relies on hosting providers based in the European Union and the United States; any transfer is covered by the European Commission’s standard contractual clauses.

8. Your rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have full and immediate control over your information:

• Access and correction: everything is visible and editable right in the app.
• Full deletion: the “Delete my account” button in the Profile tab erases everything. Deleting the app also removes all local data.
• Complaints: if you believe your rights aren’t being respected, you can file a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority in your own country.

9. Contact

For any question about the privacy of your data, email us at: support@nostaapp.com.