This Privacy Policy explains how NORDIC APP STUDIO LTD ("we", "us" or "our") processes personal data when you use the Two Plates iPhone application, visit 2pl8s.app, communicate with us, or use related services (together, the "Service").
NORDIC APP STUDIO LTD is the data controller for processing that we determine. Apple and other service providers may act as independent controllers or processors for their own services. Their privacy notices also apply.
1. What this policy covers
This Policy covers personal data processed when you:
- install, configure or use Two Plates;
- create a training profile or log workouts;
- choose to read information from Apple Health;
- enable optional data sharing, analytics or crash reporting;
- purchase or manage a subscription;
- visit 2pl8s.app; or
- contact support or exercise a privacy right.
2. Data stored locally and in private iCloud
Two Plates stores the information needed to personalise your programme and record progress. Depending on what you provide, this can include:
- your chosen display name;
- age or age bracket, gender and preferred units;
- height, body weight and other profile information;
- training history, current strength, goals, schedule, equipment and experience;
- injuries, limitations, spotter access and safety preferences;
- workout plans, completed exercises, sets, repetitions, weights, notes and failed-repetition markers;
- progress calculations, estimated and confirmed maxes, ETA values, streaks and achievements; and
- messages exchanged with the on-device coach.
This information is primarily stored using Apple's on-device storage technologies. If iCloud synchronisation is available and enabled, it may be stored in your private CloudKit database so it can synchronise across your Apple devices. Apple controls the iCloud account and infrastructure.
The legal basis for processing necessary to provide the app is performance of the contract with you. Optional profile fields are processed when you choose to provide them.
3. Apple Health data
With your explicit permission, Two Plates may read body mass, height, date of birth and biological sex from Apple Health. The app does not write data to Apple Health.
Apple Health access is optional and controlled through iOS settings. If you decline access, you can enter information manually or use the app without the unavailable fields.
Health data is used only to personalise calculations, programming and display inside the Service. Exact birth date, body measurements, injuries and safety setup are excluded from the optional Firebase profile described below. We do not use Health data for advertising or sell it.
The legal basis is your consent. You can withdraw Health access at any time in iOS Settings. Withdrawal does not automatically erase values already copied into your Two Plates profile; you can change or delete those values in the app or delete the app data.
4. On-device Apple Intelligence
When supported and enabled, Two Plates uses Apple's on-device Foundation Models to provide coaching text. The compact coaching context and your message are processed on your device by Apple's system model. NORDIC APP STUDIO LTD does not receive the content of those on-device conversations through this feature.
Availability and system processing are controlled by Apple and your device settings. Apple's terms and privacy information apply to Apple Intelligence.
5. Optional data sharing, analytics and crash reports
If you enable data sharing, Two Plates may use Firebase services provided by Google to process analytics events, crash reports and a private, pseudonymous profile document. Authentication for this private document may use an automatically generated anonymous Firebase identifier.
The private profile may include:
- your chosen display name;
- coarse age bracket and gender;
- unit system, acquisition source and activity level;
- weekly training frequency and a rounded starting bench estimate;
- derived progress statistics, current goal and rounded target;
- goal ETA, Two Plates confirmation status and confirmed plate milestone; and
- the date of your latest workout.
It deliberately excludes your exact birth date, free-text attribution answers, body measurements, injuries, spotter details and safety setup.
Firebase Remote Config and App Check may process limited technical information needed to deliver configuration, protect the backend and control minimum supported versions. Technical data can include app version, device or operating-system information, network information, timestamps and security tokens.
The legal basis for analytics, crash reports and the private profile is your consent. You can turn sharing off in Two Plates settings. Turning it off disables collection and requests deletion of your private Firebase profile document. Some previously generated aggregate statistics or records retained for security and legal compliance may not be reversible.
6. Subscription and purchase information
Subscriptions are purchased through Apple's App Store using StoreKit. Apple processes payment information and your Apple Account. NORDIC APP STUDIO LTD does not receive your full payment card details.
Two Plates uses RevenueCat in observer mode to record subscription and purchase events for entitlement and purchase analytics. Data may include product identifier, purchase status, transaction information, subscription status, country or currency information supplied by the store, and a pseudonymous app user identifier.
We process purchase and entitlement information to perform the subscription contract, restore access, prevent fraud, analyse purchases and comply with accounting or legal obligations.
7. Website and communications
2pl8s.app is a static website and does not currently use advertising trackers or analytics cookies. Like most web servers, it may temporarily record IP address, browser or device information, requested pages, timestamps and error information in server logs for delivery, security and troubleshooting. The legal basis is our legitimate interest in operating and protecting the website.
If you email us, we process your email address, message and any information you choose to include in order to respond, provide support, protect legal rights and maintain appropriate business records. Avoid sending unnecessary health or other sensitive information by email.
8. Purposes and lawful bases
We process personal data for the following purposes and lawful bases:
- Provide the Service and subscriptions: performance of our contract with you.
- Apple Health access: your explicit consent.
- Optional analytics, crash reporting and private profile sharing: your consent.
- Security, fraud prevention, service integrity and website logs: our legitimate interests and, where applicable, legal obligations.
- Payments, tax, accounting and legal claims: performance of contract and compliance with legal obligations.
- Support communications: performance of contract, your request, and our legitimate interest in supporting users.
Where we rely on legitimate interests, we assess the necessity of the processing and balance it against your rights and interests. Where we rely on consent, you may withdraw it for future processing.
9. Service providers and recipients
Depending on the features you use, personal data may be processed by:
- Apple: App Store, StoreKit, iCloud, CloudKit, HealthKit, Apple Intelligence, device and operating-system services.
- Google Firebase: Remote Config, App Check, anonymous authentication, Firestore, Analytics and Crashlytics.
- RevenueCat: subscription event recording and purchase analytics.
- Hosting and email providers: website delivery, server security and support communications.
- Professional advisers and authorities: where reasonably necessary to establish legal claims, protect rights or comply with law.
We require processors acting on our instructions to protect personal data and use it only for agreed purposes. Some providers act independently for parts of their service, such as Apple processing App Store purchases.
10. International transfers
Some providers may process data outside the EU or EEA. Where GDPR transfer rules apply, transfers are supported by an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful safeguard. Provider privacy notices may contain further information about locations and safeguards.
11. Retention
We retain personal data only for as long as needed for the purposes described in this Policy:
- on-device data remains until you delete it, reset the app or remove the app and its data;
- private iCloud data follows your iCloud settings, Apple retention rules and deletion actions;
- the optional Firebase profile is retained while sharing is enabled or until deletion is requested, subject to backup, security and legal retention;
- analytics and crash information is retained according to configured provider retention periods and then deleted or aggregated;
- purchase and accounting information is retained for the period required to administer subscriptions and comply with law;
- support correspondence is retained while needed to resolve the request and protect legitimate legal interests; and
- website security logs are retained for a limited period appropriate to security and troubleshooting.
Deleting the app does not cancel an App Store subscription. It may also not delete data held in iCloud, Firebase, RevenueCat, Apple transaction records or support systems. Contact us if you need help locating the relevant deletion controls.
12. Your privacy rights
Subject to applicable law, you may have rights to:
- receive information about processing and access your personal data;
- correct inaccurate or incomplete data;
- request erasure;
- restrict processing;
- object to processing based on legitimate interests;
- receive certain data in a portable, machine-readable format;
- withdraw consent at any time for future processing; and
- complain to a competent data protection authority.
To exercise a right, email dataprotectionofficer@nordicapp.studio. We may need to verify your identity before fulfilling a request. Rights can be subject to legal exceptions, including obligations to retain certain records.
If you are in Sweden, you may complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), through imy.se. You may also complain to the supervisory authority where you live or work.
13. Security
We use technical and organisational measures intended to protect personal data against accidental loss, misuse, unauthorised access, alteration and disclosure. Measures may include access controls, authentication, encryption provided by Apple and service providers, private database rules, App Attest or App Check, logging, backups and software updates.
No system is completely secure. Protect your device, Apple Account and email account with appropriate passcodes and security settings, and contact us if you believe your information has been compromised.
14. Children
Two Plates is not directed to young children. If local law requires parental consent for a minor to use the Service or provide personal data, the minor must use the Service only with that consent. If you believe a child has provided personal data unlawfully, contact us so we can investigate and take appropriate action.
15. Changes to this Policy
We may update this Policy to reflect changes in the Service, providers, law or data practices. Material changes will be communicated in a reasonable manner where required. The latest update date appears at the top.
16. Contact
For privacy questions or requests, contact dataprotectionofficer@nordicapp.studio.
For general app support, contact support@2pl8s.app.