Privacy Policy

Last updated: 5 October 2026

WODLINE is being incorporated. The registered company name, address and MERSIS number will be published on this page once incorporation is complete. Until then, please send any request to privacy@wodline.app.

This policy explains how personal data is processed when you use the wodline.app website, the WODLINE web app and the mobile apps running on WODLINE's platform (the "Service"). For the statutory notice under Turkish data protection law, see also the KVKK Notice. The Turkish version of this policy is the governing text; this English version is provided for convenience.

1. Who is responsible?

Data controller

WODLINE

Email

privacy@wodline.app

• Gym data: Gyms are the data controllers of the gym data of their members and staff (membership, bookings, attendance, the gym's programming and scores entered at the gym). For this data WODLINE acts as a data processor on the gym's behalf.
• Personal account data: WODLINE is the data controller of your personal space (used without a gym), the workouts you create yourself, your athlete profile and your social network activity.

If you use a mobile app published under your gym's brand, the app runs on WODLINE's platform and your data is protected in line with this policy.

2. What data do we process?

Gym owners and managers

Name, email, username, gym details, subscription and support records.

Athletes and gym members

• Account: name, email, username, profile photo
• Membership (on the gym's behalf): plan, start and end dates, payment records
• Gym use (on the gym's behalf): class bookings, attendance and check-in records
• Training and performance: scores from gym workouts, workouts you create and plan yourself, benchmark results, personal records and the loads you use
• Body measurements: measurements such as weight and body fat. This may be health data and is only processed when your gym or you enter it.
• Pain and injury records (only with your explicit consent): the body area and side you mark, type (pain, injury, strain), how long it has lasted, 0–10 severity and its updates, your notes, and notes your coach adds to the record. This is health data; details below under "Pain and injury records".
• Connected apps (only if you connect them): your workouts from Apple Health or Strava (type, date, duration, distance, heart rate, energy burned); from Apple Health also daily steps, active energy, resting heart rate, heart rate variability (HRV) and sleep duration. This is health data.
• Social network: athletes you follow and who follow you, reactions and comments, your privacy settings
• Member messages: the text messages you exchange with another member, and your message settings
• AI Coach: when you use the feature, the messages you write, generated workout drafts and replies
• Notifications: if you allowed them, your device's notification key (push token) and notification preferences

All users

IP address, session information, device and browser information, error logs.

3. What do we use the data for?

• Providing the Service: accounts, gym management, bookings, workout planning and progress features
• Calculating progress indicators such as levels, badges and monthly challenges
• Sending reminders for your planned workouts and your bookings
• Keeping accounts secure and preventing abuse
• Detecting and fixing errors
• Sending required service messages (activation, password reset, booking notifications)
• Meeting legal obligations

We do not sell your data, use it for advertising, or share it with third parties for advertising or profiling. Our mobile apps do not track you across other companies' apps and websites.

Pain and injury records

• Purpose: tracking your pain and injuries and letting your gym's coaches adapt your training. The recovery ideas the app shows are general information, not medical advice.
• Legal ground: your explicit consent (KVKK art. 6). It is optional; without it your membership and classes continue the same. Consent is asked separately for this purpose, with the text shown in the app before your first entry, and is never ticked in advance.
• Who sees it: you and the people in a coaching role at your gym (owner, manager, head coach, coach, personal trainer); the front desk role does not. Coaches see only records created after you gave consent; earlier records are visible to you only. Records are not shared with other gyms, other athletes or the social feed.
• Withdrawing and deleting: you can withdraw consent at any time under Privacy and sharing → Health data permissions; coaches lose access at once, and the records stay visible to you only for 30 days and are then deleted. "Delete my data now" deletes them straight away. When you leave a gym your consent there closes and the same period applies.

4. Separation between gyms

Each gym's data is kept separate on the platform. Database-level access rules prevent users of one gym from accessing another gym's data. Within a gym, access is limited by role; for example, a member can only see their own data. Workouts and measurements in your personal space are not shared with gyms.

5. Social network and athlete profile

• Public profile: other signed-in WODLINE users can see your username, name, profile photo and the activity you share.
• Private profile: your activity is only visible to followers you approved and to athletes who are active members of the same gym as you.
• Activity only shows a summary (for example the workout type, duration, score). The content of your own workouts is only shown if you turn on "share workout details". Gyms' programming is never shared on the social network.
• If you turn off showing your scores or achievements in your gym, that gym activity is not shown on the network either.
• You can change the visibility of each activity separately, including making it visible only to you.
• Your comments are visible to people who can see the activity. When you block a user, mutual visibility and comments are removed.
• You can change your username once every 30 days; some names are reserved to prevent abuse.

Messages between members

You can exchange written messages with athletes who are active members of the same gym as you, or whom you follow and who follow you back. Only text is stored; there is no way to send photos. Links and inappropriate language are filtered automatically, and a message the filter refuses is not stored. The filter may not catch everything. In the app, messages are seen only by the two members writing to each other; gym owners, managers and coaches cannot read them. On WODLINE's admin screens, message content is shown only when one of the two reports the chat, limited to the last 30 messages of the chat; before sending a report, the app asks the reporting member to agree to these messages being sent. Messages are not end-to-end encrypted and are stored with the hosting provider listed in section 8. Message notifications do not contain the text of the message.

A first message arrives as a request: you can accept it, remove it from your inbox or block the sender. A request you remove disappears on your side; the message stays stored and its sender still sees it. In your message settings you can limit who may write to you, or turn messaging off completely. A chat with someone you blocked disappears for both of you and no messages can be sent. You can report a chat; WODLINE reviews reports. Member messaging is off for members whose recorded date of birth shows they are under 18. Messages are kept until your account is deleted: when you delete your account the messages you sent are deleted, and the messages the other person sent stay in their account. The copy of messages sent with a report is deleted when the reporting or the reported account is deleted.

6. AI Coach

When you use the AI Coach, your message and the workout context needed to answer it are sent to Groq. Replies are generated by AI, may be wrong, and do not replace the judgement of a coach or health professional. Drafts you save are stored among your own workouts.

7. Notifications and connected apps

• Device notifications are only sent if you allow them. You can withdraw permission at any time in your device settings.
• Signing out removes that device from your account's notifications.
• Apple Health: you make the connection yourself in the iPhone app, and only the data types you allow on the iOS permission screen are read. WODLINE does not write to Apple Health. The data is used to show your workouts among your own workouts and to calculate the recovery summary on your home screen.
• Apart from the optional sharing described below, workouts and daily health data from Apple Health and Strava are shown only to you; your coach, your gym and other members cannot see them, and they are not posted to the feed. Imported workouts count toward your streak, badges and monthly challenges; a badge or level earned this way may appear like your other achievements, depending on your privacy settings.
• Optional sharing: if you turn on "Share measured recovery with my coach" in the pre-class check-in, the coaches and staff of your gym see one word for that day: "normal" or "below normal". Your sleep, heart rate and HRV numbers are not shared. This sharing is based on your explicit consent and is off by default; you can turn it off at any time. Turning it off, or removing the Apple Health connection, deletes the shared words; a shared word is also deleted automatically after the following day.
• This data is not used for advertising, marketing or profiling; it is not sold or shared with third parties. It is stored only with the hosting providers listed in section 8; it is not stored in iCloud.
• You can remove a connection at any time in the app under Profile → Connected apps. Removing it deletes the workouts and daily data received from that app, and no new data is received. You can also withdraw the Apple Health permission on your iPhone under Settings → Health → Data Access.

8. Service providers

Mobile apps are distributed through the Apple App Store and Google Play, whose own privacy policies apply.

9. Cookies and browser storage

We use essential authentication cookies to keep you signed in, and browser storage for settings such as your theme. We do not use advertising or cross-site tracking cookies.

Vercel Web Analytics sets no cookies. It receives the address of each page opened (the query string is removed and usernames and record numbers in the address are replaced with a placeholder) and, as with any web request, IP address and browser information. When the sign-up page opens, a button is clicked or a form step is completed, and for some actions in the member app, it also receives an event name and fixed labels (such as language, plan or duration). Name, email, phone, gym name and typed text are not included in these events.

10. Security

Data is encrypted in transit (HTTPS). Passwords are stored as irreversible hashes. Access is limited by role-based permissions and database access rules.

11. Retention and account deletion

Data is kept for as long as your account or your gym's subscription exists, and for the periods required by law.

• You can delete your account yourself in the app under Account → Delete my account. Deletion cannot be undone.
• Deleting removes your login, athlete profile, follow relationships, activity, comments, reactions, the messages you sent to other members, your own workouts, the measurements and records in your personal space, and your profile photo.
• Deleting your account also deletes your pain and injury records in every gym you are a member of and closes your consents. Consent and deletion records are kept as evidence, without any health value.
• The gyms' own records of you (membership, payments, attendance and gym scores) remain under the gym's responsibility as data controller and are unlinked from your account. You can ask the gym to delete them.
• If you have an owner, manager or coach role at a gym, that role must be handed over before the account can be deleted.
• When a subscription ends, gym owners can ask for the gym's data to be exported and deleted.

12. Users under 18

For gym members under 18, obtaining the consent of a parent or guardian is the gym's responsibility. If you are under 18, you need the consent of a parent or guardian before opening a personal account without a gym.

13. Your rights and contact

To exercise your rights under Turkish data protection law (KVKK) or ask about this policy, write to privacy@wodline.app. When we make a material change to this policy, we update the date above and, where required, let you know.