Privacy Policy

Overview

This policy explains how we collect, use, and protect personal data when you use the Embers of Strength mobile application (the "App"), available on the Apple App Store and Google Play.

The App is provided by Avantra Services Ltd, a company registered in England and Wales with company number 14871429. Our registered office is Suite 1-2 Brookfield Court, Selby Road, Leeds, United Kingdom, LS25 1NB.

This policy is written to support compliance with the UK GDPR, the Data Protection Act 2018, and the privacy requirements of Apple and Google.

1. Who we are and our role

Avantra Services Ltd is the data controller responsible for the personal data described in this policy. The App is developed and operated by us for the Embers of Strength client and trainer experience.

If you have any questions about this policy or your data, contact us at hello@avantraservices.co.uk.

2. Data we collect

We collect and use the minimum personal data needed to provide the App, maintain account access, support trainer-client workflows, and keep fitness and nutrition records available to the correct user.

• Account and contact data, including display name, email address, Firebase Auth user ID, authentication provider IDs, role, optional avatar URL, and account timestamps.
• Profile and settings data, including measurement units, fitness goal, optional body weight, and app settings.
• Trainer-client relationship data, including active trainer-client links, display names, and client goals where needed for the trainer experience.
• Fitness activity data, including workout templates, workout assignments, completed workout logs, set logs, reps, weights, duration, calories estimates, active minutes, streaks, personal records, and progress summaries.
• Nutrition data, including food log names, servings, meal type, calories, protein, carbohydrates, fat, macro targets, and trainer visibility where a trainer-client link exists.
• Food images when you choose the camera food-recognition feature. The selected or captured image may be securely transmitted to Firebase AI Logic using the Vertex AI Gemini backend so it can identify food and estimate nutrition. Embers does not intentionally store the food photo as part of your account or food log.
• Crash and diagnostic data from Firebase Crashlytics, including crash reports, stack traces, device, operating system and app information, Firebase installation identifiers, diagnostic logs, and custom keys. Crashlytics reports are linked to the signed-in Firebase user ID.
• Trainer exercise videos where a trainer chooses to upload demonstration content. Associated metadata may include the trainer's user ID, exercise information, upload identifiers, asset and playback identifiers, file size, duration, processing status, and thumbnail information.
• Device and app identifiers needed for Firebase Authentication, app security, and normal app operation.

3. Tracking, advertising, and data we do not collect

• We do not collect payment card details.
• We do not sell personal data.
• We do not use third-party advertising.
• We do not use collected data for cross-app tracking or targeted advertising.
• We do not use IDFA-based advertising tracking.
• We do not knowingly collect personal data from children under 13.

4. Third-party services we use

The App relies on selected third-party services to provide authentication, app distribution, data storage, and linked media features.

• Firebase Authentication, provided by Google, for account sign-in and authentication state.
• Cloud Firestore, provided by Google, for secure app data storage.
• Firebase App Check, provided by Google, to help protect backend services from abuse.
• Firebase Crashlytics, provided by Google, for crash reporting, troubleshooting, app reliability, and security diagnostics.
• Firebase AI Logic / Vertex AI, provided by Google, using the Gemini backend for food-image analysis when you choose that feature.
• Mux for trainer-uploaded exercise video processing, hosting, playback, thumbnails, and related upload status handling.
• Sign in with Apple where available.
• Google Sign-In where available.
• Apple App Store and Google Play as app distribution platforms.
• YouTube / Google where trainers add YouTube exercise links and users choose to open or view that linked content.

5. Why we use your data and our legal basis

Under the UK GDPR we rely on the following legal bases:

• Performance of a contract: to create and maintain your account, authenticate you, provide the App's core functionality, and make your fitness, nutrition, and trainer-client data available to you.
• Legitimate interests: to keep the App secure, maintain app reliability, diagnose crashes, reduce failures, support trainer-client workflows, and improve the service in a way that is balanced against your rights.
• Consent: where required, for example where your device asks you to allow camera, photo library, or another permission.
• Legal obligation: where we are required by law to retain, disclose, or otherwise process data.

6. How we share data

We share personal data only where needed to provide the App, comply with law, or protect our rights and users.

• With the service providers listed in this policy where they process data for app operation.
• With Apple and Google as app platform operators and authentication or distribution providers.
• With an actively linked trainer or client where the App feature requires that visibility.
• With authorities, regulators, legal advisers, or professional advisers where required by law or necessary to protect legal rights.

7. International transfers

Some providers may process data outside the UK. Where this happens, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, standard contractual clauses, or an adequacy decision.

8. Data retention

We keep account and app data for as long as your account is active and for a reasonable period afterwards, then delete or anonymise it unless we need to keep limited information for legal, accounting, security, or dispute-resolution reasons.

Crashlytics diagnostic data is retained according to Firebase and Google Cloud settings and terms. We use this data only for app reliability, troubleshooting, security, and reducing crashes, not for advertising or tracking.

Food images sent for cloud analysis are used to identify food and estimate nutrition. Embers does not intentionally store those photos in your account or food log. Provider-side processing and temporary retention are governed by the applicable Google Cloud and Firebase terms.

Trainer exercise videos uploaded through the App are processed and hosted by Mux so they can be shown to linked clients. Videos remain stored until they are replaced, removed, or otherwise deleted under the applicable retention process.

You can delete your account from within the App, or contact us about access, correction, or deletion. Some records may remain in backups for a limited period before routine deletion.

9. Your rights

Under UK data protection law you have the right to access, correct, delete, restrict, or object to our processing of your data, the right to data portability, and the right to withdraw consent where processing is based on consent. You can delete your account from within the App, or contact hello@avantraservices.co.uk about access, correction, or deletion.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Security

We use appropriate technical and organisational measures, including encryption in transit, access controls, Firebase security rules, and secure authentication flows, to protect your data. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the regulator of any breach where legally required.

11. Health, fitness, and nutrition data

The App supports fitness, workout, nutrition, and body-weight tracking. This information can be sensitive. The App is intended to support coaching and personal tracking and is not a medical device or a substitute for medical advice.

12. Children

The App is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it where required.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version with a revised last updated date and, where changes are significant, notify users within the App or by another appropriate method.

14. Contact

Avantra Services Ltd

Suite 1-2 Brookfield Court, Selby Road, Leeds, United Kingdom, LS25 1NB

Company number 14871429 (England and Wales)

Email: hello@avantraservices.co.uk