Privacy policy

Who we are

Workout Mover is an Android app made by Kuoste, a sole proprietorship in Helsinki, Finland (business ID 2963138-3). In this policy “we” means Kuoste and “the app” means Workout Mover. You can reach us at info@kuoste.fi.

What the app accesses, and why

The app only accesses what you give it permission to, and uses it only to show your workouts and copy them where you ask.

Health Connect

If you connect Health Connect, the app reads these data types:

• Exercise sessions: the type, start and end time of each workout.
• Exercise routes: the GPS route of a workout, to draw it on the map and include it in copies.
• Heart rate and distance recorded during workouts, for the workout's charts and summary and to include in copies.

It asks to read history older than 30 days, because moving your whole workout history is the app's main purpose, and to read in the background, so new workouts are copied without you having to open the app. The app only reads from Health Connect. It doesn't write, change or delete anything there.

Files you choose

When you pick or share workout files with the app (for example an export ZIP from Garmin, Suunto, Polar, Zepp or Strava, or single FIT, GPX or TCX files), it reads the workouts in them. It reads only the files you choose.

Services you connect

You can connect services as destinations for copies of your workouts:

• Google Drive: the app asks only for access to files it creates itself (the drive.file scope). It can't see or open any other file in your Drive.
• Dropbox and OneDrive: the app has access only to its own app folder (Apps/Workout Mover), not to the rest of your storage.
• intervals.icu: through an API key that you create at intervals.icu and paste into the app.

You sign in to these services on their own sign-in pages; the app never sees your passwords. The app receives an access token or key, which it stores encrypted on your phone (see below).

Where your data goes

Only where you send it. When a destination is connected, the app uploads copies of your workouts to it directly from your phone, as workout files (FIT) that contain the workout's time, type, route, heart rate and distance. If you have set privacy zones or trimmed a workout, the copy leaves out those parts of the route. Once a copy is at a service, that service's own privacy policy applies to it.

The app adds copies and never deletes or overwrites files or workouts in any of your accounts.

Map background. The map's background (streets, terrain, place names) is loaded from VersaTiles, an open map service built on OpenStreetMap data. Like any website, it receives your phone's IP address and which map areas are being shown. It receives no workout data: your routes are drawn on the phone itself.

Nothing else leaves your phone. The app contains no analytics, advertising or tracking code.

What is stored on your phone

• Your workouts (their files, summaries and the simplified routes for the map), your settings, privacy zones and area rules, and a log of what was copied where.
• Access tokens and keys for the services you connect, encrypted with a key kept in the Android Keystore.

This data stays in the app's private storage on your phone. The app is excluded from Android's cloud backup, so it isn't copied to your Google account either. Disconnecting a service in the app removes its token. Clearing the app's storage in Android's settings, or uninstalling the app, deletes everything it stored on the phone. Copies you have already sent to other services stay there until you remove them yourself.

What we receive

From the app: nothing. We don't run a server that the app reports to, and we have no access to your workouts, health data, location or accounts.

From Google Play: Google provides app developers with aggregated statistics such as install counts, and with crash and performance reports from users who have chosen to share them with developers. These don't identify you. Google's privacy policy covers what Google Play itself collects.

When you email us: we use your email address and message only to reply, and delete them when they're no longer needed.

Health data

Data read from Health Connect and from your workout files is used only to provide the app's features to you. We:

• don't sell it or transfer it to anyone, other than the services you yourself choose to copy your workouts to;
• don't use it for advertising, or to determine credit-worthiness, insurance or employment;
• don't use it to train artificial intelligence or machine learning models;
• don't let anyone read it, ourselves included.

The app's figures (such as intensity minutes and the VO2max trend) are estimates for personal interest, not medical advice.

Google user data

Workout Mover's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The app uses Google Drive access only to save copies of your workouts into files it creates in your Drive, at your request.

Your rights

Under the EU General Data Protection Regulation you have the right to access, correct and delete personal data held about you, and to object to its use. Because the app keeps your data only on your phone, you're in control of it there: you can disconnect services in the app, and clear the app's storage in Android's settings or uninstall it to delete everything it holds. We hold no workout or health data about you to hand over or delete. For anything else, email info@kuoste.fi.

You can also complain to the Finnish data protection authority, the Office of the Data Protection Ombudsman.

Children

The app isn't directed at children under 16, and we don't knowingly collect any data from them.

Changes to this policy

If the app starts handling data in a new way, for example new data types or new services, we'll update this page and the date at the top before the change reaches the app.