Privacy Policy

Last updated: 8 September 2026 · Applies to the Karico app and karico.app

Karico computes your training loads from what you actually lift. To do that it holds data about you — some of it sensitive. This page says exactly what, why, where it is kept, and what you can do about it, in plain words rather than legal boilerplate.

1. Who we are

UpWeb di Oppo Riccardo, with registered office at Via Irlanda 118, 09045 Quartu Sant'Elena (CA), Italy, VAT number IT03567550920 ("we", "us"), is the data controller for the personal data described in this policy.

For any question about your data, write to karico.app@gmail.com.

2. What this policy covers

This policy covers the Karico mobile app for iOS and Android and the karico.app website. Where the two differ, we say so.

The website itself collects nothing: it has no forms, no accounts, no analytics and no cookies. Everything below about health and training data concerns the app.

3. Where your data actually lives

This is the part most privacy policies get vague about, so we will be blunt.

Almost everything stays on your phone. Your plans, sessions, sets and loads, food diary, recipes, body measurements, cardio activity and Journey progress are stored locally, on the device. We cannot read them. They are not on our servers.

A few optional features use our cloud, and only these put anything online:

• Backup — if you turn it on, a copy of your data so you can restore it on a new phone. Readable only by your own identity. Body measurements and Apple Health data are excluded from it: they never leave the device.
• Community — if you choose a nickname. Your nickname, level, title and gym become visible to the other members of your gym.
• Verified foods — the corrections you make to a product's nutrition values, shared anonymously so everyone benefits.
• Usage statistics — four anonymous events, described in section 7, which you can switch off.

The cloud runs on Supabase, on servers inside the European Union. Nothing is transferred outside the EEA, with the exception of Apple and Google, who handle payments under their own terms.

4. What we collect, and why

Most of what exists is information you enter yourself, and it exists because without it the app cannot do its job. The right-hand column says whether it stays on the phone or reaches our cloud.

Health data

Body weight, body fat and your food diary are health data under Article 9 of the GDPR, a special category with stronger protection. We process them only with your explicit consent, given in the app when you enable those features. You can withdraw it at any time: the features stop and the data is deleted.

You can use Karico for training alone, without ever entering body measurements or food.

5. Apple Health and Health Connect

With your permission, Karico reads weight, body fat, lean mass and height from Apple Health (on iPhone) or Health Connect (on Android) to update your measurements, and writes back the weigh-ins you enter by hand.

It also reads the day's active calories and steps, which go into your calorie balance. Since 28 August 2026 these are the source for cardio, replacing GPS tracking: Karico no longer uses your location, for any reason. The permission was removed from the app entirely.

6. How we identify you

Karico does not ask you to register, and there is no password to choose. To tie together your backup, your community profile and the usage statistics, the app generates a random identifier on the device: a string of characters containing no name, no email address, no phone number and no advertising identifier.

How long it lasts, concretely:

• On iPhone it is kept in the system keychain and survives if you uninstall the app. It has worked this way since the first version.
• On Android it is kept with the app's data: it comes back if you have Google's system backup enabled and restore it, otherwise uninstalling gives you a fresh one. Android does not let apps keep an identifier beyond uninstall, and we do not work around that limit.

We want to be precise about what this means. An identifier that lasts over time is not anonymous in the strict sense — it is pseudonymous. On its own it does not say who you are, but it does let the same device be recognised over time, and so we treat it as personal data with every protection described here.

If you link your Apple ID

You can stay anonymous forever: that is the default. If you choose Sign in with Apple — so your backup, Journey and community follow you to a new phone — from that moment our cloud also holds the email address attached to your Apple ID, or the anonymous relay address if you chose "Hide My Email". We use it only to recognise you when you come back. We do not write to you, we do not pass it on, it goes on no list. Deleting your account removes it.

7. Usage statistics

This section applies from version 1.2.0 of the app. Earlier versions collect nothing of the sort.

To understand how many people finish the initial setup, how many complete a workout, and how many are still there a week later, Karico records four events: setup completed, first plan ready, workout completed, cardio activity completed.

Each event carries only the device identifier, the platform, the app version and the date it happened. Never collected or transmitted: the content of your workouts (exercises, loads, reps, duration), your food data, your body measurements, or any location data.

There is no third-party analytics tool in Karico, and no automatic crash-reporting system either. The numbers are only ever read in aggregate, are not shared with anyone, and are not used for advertising or profiling.

If the phone has no connection when an event happens — common in a gym — it waits on the device and is sent later. The date recorded stays the date it happened, not the date it was sent.

The legal basis is our legitimate interest in knowing whether the app works for the people using it (Art. 6(1)(f) GDPR); that toggle is the simplest way to object. Events are deleted automatically after 14 months.

8. What we never do

• We do not sell your data. Not to anyone, in any form.
• We do not use your training or health data for advertising.
• We do not share your data with insurers, employers or gyms.
• We do not build advertising profiles from what you eat or how much you lift.
• We do not track your location. The app has no location permission at all.

9. What other people can see

If you choose a nickname and join a gym, the other members of that gym see your nickname, your level and your title on the board, the leaderboard and the Journey map.

They never see your loads, your weight, your body fat or your food diary.

You can hide yourself from the Journey map at any time in Settings → Privacy, and you can leave the gym from the app.

10. Who we share data with

We use a small number of providers to run the service. They act as data processors on our instructions and cannot use your data for their own purposes.

The food scanner

When you scan a barcode, the app sends the barcode alone to Open Food Facts, a French non-profit that maintains an open food database. No account details, no identifiers, nothing that says the request came from you. Open Food Facts cannot know who scanned what, and neither builds nor receives a profile of your diet.

Payments

The Karico Premium subscription is bought and managed inside your Apple account (on iPhone) or your Google Play account (on Android). They take the payment, handle renewals and handle refunds under their own terms. We never see or store your card details — we receive only the fact of whether the subscription is active.

11. How long we keep it

• Backup, community profile and posts: as long as you use the app. After 24 months with no contact with the cloud, the account is deleted automatically.
• Usage statistics: 14 months, then automatic deletion.
• Verified foods: indefinitely. They serve everyone and contain no personal data.
• Data on your phone: until you delete it or uninstall the app. That is your copy, and it is not on a clock.

12. Deleting your account and data

You can delete the local data by uninstalling the app.

Everything in the cloud goes from inside the app: Settings → Privacy → "Delete account and cloud data". This removes your community profile, board posts, gym membership, backup, usage statistics and the account itself, including any link to your Apple ID. From that moment you start again as a new user, with a new identifier. It cannot be undone.

What stays is the corrections you made to products' nutrition values: they are a collective contribution, and the reference to who made them is removed at the same time, so they are no longer traceable to you.

If you would rather we did it, write to karico.app@gmail.com and we will, within 30 days.

13. Your rights

Under the GDPR you can, at any time: see what we hold about you, correct anything wrong, delete your account and everything in it, export your data in a portable format, object to processing based on legitimate interest, and withdraw consent for health data with no effect on anything else.

Account deletion and data export are in the app settings, so you do not have to ask. For anything else write to karico.app@gmail.com: we answer within 30 days.

If you think we have handled your data badly, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority where you live.

14. Security

Data travels encrypted (TLS) and is stored encrypted at rest. Every row in the cloud is protected by rules that let it be read and changed only by the identity that created it: no other device can reach your backup or your profile, not even if it tries.

No system is perfectly safe. If a breach ever affected your rights, we notify you and the authority within 72 hours, as the law requires.

15. Children

Karico is not for people under 16, and we do not knowingly collect data from them. If you believe a child is using it, write to us and we will delete the account.

16. Cookies

The karico.app website uses no cookies and no analytics. There is nothing to consent to, which is why you have not seen a banner.

If that ever changes we will ask for your consent before anything is set, and update this page.

17. Changes

If we change how we handle your data in any way that matters, we say so in the app before it takes effect. The date at the top of this page always shows the current version.

18. Contact

Questions, requests, complaints: karico.app@gmail.com

UpWeb di Oppo Riccardo · Via Irlanda 118, 09045 Quartu Sant'Elena (CA), Italy · VAT IT03567550920