Privacy

TILO is a training, nutrition and sleep app in private beta. This page says plainly what the app stores, what this website does, and what neither of them does.

What the app stores

Your workouts, exercises and plans; food entries and recipes; body metrics such as weight and measurements; sleep entries; and your settings. This data lives on your device. If you create an account, it is also synced to our backend (hosted on Supabase) so you can restore it on a new phone.

Apple Health and Health Connect

TILO can read data such as sleep, steps and weight from Apple Health (iOS) or Health Connect (Android). This only happens after you grant permission in the system dialog, and you can withdraw it at any time in iOS Settings, Health Connect or TILO’s own settings. Imported values are treated like any other entry in the app: stored for you, and synced only if you have an account.

Photos, voice and AI features

Some features send something you choose — a meal photo, a label, a piece of equipment, or the text of a voice note — to an AI provider so it can be recognised and turned into an entry. Voice is turned into text by your phone’s own speech recognition first. Recognition and written insights currently use Anthropic’s Claude models; Ask TILO questions are answered through Perplexity’s web search. Nothing is sent unless you start that action. Progress photos you keep in the app stay with your own data and are not published anywhere.

What we do not do

• We do not sell your data, and we do not share it with advertisers or data brokers.
• We do not use your health data for advertising or profiling.
• There are no advertising or social tracking scripts in the app or on this site.

This website

tilofit.com is a set of static files. It sets no cookies, uses no analytics or tracking pixels, and uses no localStorage or similar browser storage. Its one form is the contact form described below. Fonts, the 3D body models and the 3D library are served from this site itself, so your browser makes no requests to third parties. The site is hosted on Cloudflare, which processes your IP address and standard request data to deliver the pages and protect against abuse. The “Join the beta” links open your own email app; we only receive what you choose to send.

Your data, your call

You can delete individual entries in the app, and you can ask us to delete your account and everything synced with it. Write to us and we will do it.

Who is responsible

The controller for the processing described here, in the sense of Art. 4 (7) GDPR, is:

Mykyta Hakhovych
Zechliner Str. 2
13055 Berlin
Germany
saplingang@gmail.com

TILO is run by a private individual, not a company. No data protection officer has been appointed, because the conditions of Art. 37 GDPR and § 38 BDSG are not met. Full legal details are in the Impressum.

Your rights

Under the GDPR you can ask for access to your data (Art. 15), correction (Art. 16), deletion (Art. 17), restriction of processing (Art. 18) and a copy in a portable format (Art. 20), and you can object to processing based on legitimate interests (Art. 21). Where processing is based on your consent — for example Apple Health access or sending a meal photo for recognition — you can withdraw it at any time, without affecting what was done before.

Write to saplingang@gmail.com and we will act on it. You also have the right to complain to a supervisory authority (Art. 77 GDPR). The competent one here is the Berlin Commissioner for Data Protection and Freedom of Information.

The contact form

If you use the contact form, what you type is sent straight to the operator’s mailbox. This site keeps no copy: there is no database behind the form, submissions are not logged, and request logging is switched off for it. Only the fields you fill in are transmitted — a message, and optionally your name and email address, which are needed only if you want an answer.

Your message is processed to answer you (Art. 6 (1) (b) and (f) GDPR — replying to an enquiry) and for nothing else: no marketing, no profiling, no sharing with third parties. It then lives only in the operator’s mailbox at Google (Google Ireland Limited, acting as the email provider) and is deleted once the exchange no longer needs to be kept.

Sending the form is protected against automated abuse by a short-lived, per-connection request count held in memory by Cloudflare. It stores no message content and builds no profile.

Contact

Questions, requests or corrections: saplingang@gmail.com, or the contact form.