Crush
Privacy
Last updated: 14 September 2026
In short
Crush only collects what you type in and, if you connect Apple Health or Health Connect, what you allow it to read. There are no ads, no analytics tools, no profiling, and no data is ever sold or handed to anyone else.
There is one exception, and it stays on the phone: when the app closes because of an error, the error message is written to a local log. It never leaves on its own. You will find it in Settings, under “Diagnostics”, and you decide whether to send it and to whom.
Your data lives in Europe, only you can read it, and you can take it with you or delete it whenever you want from this very app.
What we collect
An account needs an email address and a password, which we never store in plain text.
So the app can do what it does, we keep what you enter:
- your profile: first and last name, year of birth, sex, height, goal, discipline and level
- your plans, your workout history, the exercises you add, your skill progress, the equipment your gym does not have, your settings and any workout you left half done
- your body measurements: weight and circumferences
- the photos and videos you choose, that is your profile picture and your form demonstrations
Sex, year of birth, weight and circumferences are used to work out the indices the app shows — body mass, estimated fat, lean mass — and to read your weight trend against your goal. Nothing else.
If you connect Apple Health
On iPhone you can connect Crush to Apple Health. It stays off until you turn it on, and iOS asks for your permission for each type of data.
On Android the same applies to Google Health Connect: same data, same rules, and you grant permissions in Health Connect.
Crush writes the workouts you finish to Apple Health: duration and calories.
From Apple Health it reads, and keeps with the rest of your data:
- the average and maximum heart rate of each workout, including those done before you connected it
- the weight recorded by scales or other apps, on days when you did not enter it yourself
- the calories recorded by Apple Watch during the workout, instead of the estimate
It also reads workouts from other apps, only to avoid counting calories twice: those are not kept.
Data read from Apple Health is used only for what is written here. It is never used for advertising, sold or handed to anyone.
This is health data
Weight, circumferences, body indices and heart rate fall under the special categories of personal data set out in Article 9 of the GDPR.
We process it only on the basis of your explicit consent, which you give by choosing to enter it: it is optional, and the app works without it. You can withdraw that consent at any time by deleting the data or your account.
For data read from Apple Health, you give consent by turning on “Connect to Health” and accepting the iOS permissions. You withdraw it by turning it off, or from the Health settings; what was already read stays until you delete the workouts, the measurements or your account.
What we do not collect
We do not collect your location, your contacts, your advertising identifier, your browsing history, or any data about how you use the app.
Crush contains no third-party components for analytics, advertising or tracking. The error log is written by the app itself and never leaves the phone: no external service receives it.
Where it lives
On Supabase, which hosts the database and files on Amazon Web Services infrastructure in the Central Europe region (Frankfurt, Germany). It never leaves the European Economic Area.
Supabase processes the data on our behalf, as a data processor.
How it is protected
- every database row is tied to your account by a rule the database itself enforces: another user cannot read your data even knowing its identifier
- photos and videos live in private stores, isolated per user, and open only through expiring links
- traffic between the app and the servers is always encrypted
- a working copy stays on your phone so the app works offline, and it is wiped when you sign out
For how long
As long as you keep your account. There is no automatic expiry, and we keep no copies of people who leave.
Your rights
You can exercise the rights set out in Articles 15-22 of the GDPR at any time: access, rectification, erasure, restriction, objection and portability.
In practice, without having to ask anyone:
- access and rectification: every piece of data is visible and editable on the screen it belongs to
- portability: Settings → Data → Export backup produces a file with everything; Export history as CSV gives you your workouts as a table
- erasure: Settings → Account → Delete account immediately removes your account, data and files from our servers, with no undo
You also have the right to lodge a complaint with your data protection authority.
Children
Crush is not aimed at children under 16 and does not knowingly collect their data. If you believe a child has created an account, write to us and we will delete it.
If this policy changes
If it changes in any substantial way we will tell you inside the app, before the changes take effect. The date at the top tells you the latest revision.
Who is responsible for your data
The data controller is Alex Citeroni.