DWAYN
Privacy policy
Version of 26 September 2026. This is a translation; the French version prevails.
Dwayn is a workout app with an AI-based coach, a food journal and challenges between friends. To work, it processes health data: this page explains which data, why, who it is shared with and how you stay in control.
- Your data is only used to run the app. No advertising, no selling, no ad trackers or audience analytics.
- The AI coach receives your training and health data, but never your name or email address.
- You can delete your account at any time from the app: deletion is immediate and permanent.
1. Contact
For any question about your data: contact@dwayn.app
2. Data we process
| Category | Details |
|---|---|
| Account | Email address, first name or nickname, password (stored only as an irreversible hash), Google identifier if you sign in with Google, profile photo if you add one, language, time zone, invite code. |
| Questionnaire | Age bracket, goal, level, available days and duration, training places, equipment, free description of what you expect, fall risk (65 and over), declaration of no contraindication (PAR-Q questionnaire). |
| Health data | Weight, height, body fat and body measurements; weight goals; activity level; completed or missed workouts, sets, loads, reps, perceived effort, records; food journal (foods, calories, macronutrients), favourite meals, meal plan; limitations or pain you mention to the coach. |
| Meal photos | Analysed to estimate calories, then not kept on our servers (see section 4). |
| Conversations with the coach | Your messages and the coach's replies, and the changes it made to your programme. |
| Social | Friends list, duels and scores, ranking score, consistency points, completed challenges. |
| Subscription | Plan subscribed to, renewal date and purchase history (renewals, cancellations). We never receive your payment details: payment is handled entirely by Google Play. |
| Technical | AI usage log (date, use, model, amount of text processed, cost — without the content of the exchanges), activity days, server logs (including IP address), notification token if you enable notifications. |
We do not collect your date of birth, sex, location or contacts.
3. Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Create and manage your account, provide the features (programme, workouts, tracking, nutrition, duels), manage your subscription | Performance of the contract (terms of use) |
| Process your health data, including through the AI model | Your explicit consent (GDPR article 9.2.a), given through a dedicated checkbox when you create your account |
| Security, abuse prevention, cost control (AI usage quotas), backups | Legitimate interest in providing a safe and available service |
| Notifications (workout reminders, friends' activity) | Your consent, given and withdrawn in your phone settings |
No decision with legal effects is made about you automatically. The programme suggested by the AI is bound by fixed safety rules, but it does not replace the advice of a doctor or a qualified coach.
4. Who receives your data
Hosting
Our servers and database are hosted by OVHcloud in France (Roubaix). Backups are stored on the same server.
Artificial intelligence model
To generate your programme, answer in the chat, build your meal plan and analyse your meal photos, we send the necessary information to OpenRouter (United States), which passes it to the provider of the model in use: currently an OpenAI model, served by OpenAI or by Microsoft Azure depending on availability and, as a fallback during outages, a Google Gemini model.
- Sent: your questionnaire answers, your latest measurements and goals, your programme and recent workouts, your last 12 messages with the coach, and the meal photo when you analyse one.
- Never sent: your name, email address, password or profile photo.
- These providers apply their own retention terms: some may keep requests for a limited time, in particular to detect abuse. We do not keep meal photos on our servers, but we cannot guarantee their immediate deletion on their side.
Other providers
- Google, only if you choose "Continue with Google": we receive your email address, first name and an account identifier.
- Speech recognition: if you dictate a message, your voice is transcribed by your phone's speech recognition service (Google or Apple), which may process it on its servers. We only receive the text, never the recording.
- Google Play and RevenueCat (United States), only if you subscribe: Google Play takes the payment; RevenueCat checks the subscription on our behalf and receives your internal identifier (never your name or email) and your purchase history. When you delete your account, we also ask RevenueCat to erase this data.
- Google Firebase Cloud Messaging (United States), only if notifications are enabled: Google's delivery service receives your device's notification token and the notification text.
Other users
- Your friends see your first name, profile photo, number of workouts in the last 7 days, current streak, duels won and your score.
- In the global ranking, you appear anonymously (rank, score, games played) unless you choose to show your name.
- Your duel opponents see your scores in that duel.
We do not sell or rent your data and do not share it for any other purpose.
5. Transfers outside the European Union
OpenRouter, OpenAI, Microsoft, Google and RevenueCat are located in the United States. These transfers rely on your explicit consent, given when you create your account, and on the contractual safeguards offered by these providers. Without this transfer, the AI coach cannot work.
6. How long
- Your data is kept as long as your account exists.
- When you delete your account, it is erased immediately and permanently from the database, and disappears from backups within 14 days at most.
- The AI usage log is kept without any link to you (anonymised) for cost tracking.
- Technical server logs are erased automatically by rotation, after a few weeks at most.
7. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, and to withdraw your consent at any time (withdrawal does not affect processing already carried out).
- Export your data: "Me" tab → Export my data (JSON file). For a complete copy of everything we hold, write to us.
- Delete your account: "Me" tab → "Delete my account". Other options: account deletion page.
- Withdraw your consent to health data processing: since the app cannot work without it, withdrawal means deleting your account.
- For any other request: contact@dwayn.app, from your account's email address. We reply within one month.
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL, or with the authority of your country.
8. Security
- All communications are encrypted (HTTPS).
- Passwords are stored as an irreversible hash (scrypt); sign-in tokens are short-lived and rotated with reuse detection.
- On your phone, sign-in tokens are kept in the system's secure storage. The app also stores your language, preferences and not-yet-synced workouts locally.
- Server access is key-restricted, and the app's administration only gives access to aggregated statistics, never to the content of your account.
9. Minimum age
Dwayn is for people aged 18 or over. If you believe a minor has given us data, write to us and we will delete the account.
10. Changes
If this policy changes significantly, the app will tell you and ask for your agreement again before you continue.