KASHUB Privacy Policy

Effective date: 22 September 2026 · Version 2026-09-v2

At a glance

KASHUB is a fitness and bodybuilding app with an AI coach. To work, it stores the training, nutrition, body-measurement, photo and lab data you choose to enter.
We never sell your data and never use health data for advertising.
Health data, physique photos and voice messages are processed only with your explicit consent, which you can withdraw at any time.
You can delete your account and all of its data yourself: Profile › Settings › Delete Account.
We do not use your device's location, contacts or messages.
Questions or requests: contact@kashubapp.com.

1. Who we are and what this policy covers

This Privacy Policy explains how Logian Creative ("KASHUB", "we", "us"), based in Istanbul, Türkiye, collects, uses, shares and protects personal data when you use the KASHUB mobile application for iOS and Android (the "App") and the website kashubapp.com (together, the "Services"). Logian Creative is the data controller for the Services under the EU/UK General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK), and the "business" under the California Consumer Privacy Act as amended (CCPA/CPRA).

If you apply to a competition inside the App, the Competition Privacy Notice and Competition Terms also apply. Our Terms and Conditions govern your use of the Services.

2. Information we collect

2.1 Information you provide

Account information. When you sign in with Google or Apple we receive your name and e-mail address (or Apple's private relay address if you use "Hide My Email"). We do not receive or store your Google or Apple password.
Profile information. Date of birth, height, weight, gender, training experience, goals and preferred language, entered during onboarding and editable in your profile. A phone number is optional and used only if you provide it for your profile or a competition application.
Health and fitness information. Workout programs and sessions (exercises, sets, reps, loads, RIR), cardio sessions, nutrition plans and meal/food logs, body measurements (weight, body-fat and muscle percentage, circumferences), physique ("posing") photos and comparison records, and laboratory results you upload as PDF or photo together with the values extracted from them. This is sensitive / special-category data and is processed only with your explicit consent (see Section 4).
AI coach conversations. Text messages, photos and voice messages you send to the AI coach, the coach's replies, and any files you attach. Voice messages are converted to text; the transcript is kept as part of the conversation.
Competition applications. If you apply to a competition: application photos, height, weight, date of birth, phone number, category, application status and your consent record.
Support communications. Messages you send us by e-mail, including the app version and diagnostic details you choose to include.

2.2 Information collected automatically

Device and app data. Device model, operating system and version, app version and build, language, time zone, screen size, IP address, and pseudonymous identifiers generated for your installation (for example a Firebase installation ID and a PostHog distinct ID).
Usage data. Which screens you open and which features you use (for example "quick start tapped", "coach tool opened"), session length, and errors. We use this to understand how the App is used and to fix problems.
Crash and performance data. Stack traces, device state and app state at the time of a crash or slowdown (Firebase Crashlytics).
Purchase data. Subscription status, product identifier, purchase and renewal dates, price and currency, and store-generated transaction identifiers. Payment is handled by Apple App Store or Google Play; we never receive your card or bank details.
Push notification token. A device token used to deliver notifications you have allowed.
Advertising identifier. On iOS, only if you allow tracking in the App Tracking Transparency prompt; on Android, the Advertising ID subject to your device settings. Used solely to measure which campaign brought you to KASHUB (attribution), never to show you ads.

2.3 Information we do not collect

We do not request or use your device's location. Analytics and attribution providers may infer an approximate (city-level) location from your IP address.
We do not access your contacts, calendar, messages, or other apps, and we do not read data from Apple Health, Google Health Connect or wearables.
The camera and microphone are used only at the moment you take a photo or record a voice message, and only after you grant the permission.

3. How we use information

Provide and operate the Services: create and secure your account, store and sync your programs, plans, measurements, photos and conversations across your devices, and show your progress.
AI coaching: generate personalised training, nutrition, posing and preparation guidance from your messages, photos and stored records (see Section 5).
Subscriptions and quotas: verify your Pro / Pro Max entitlement, apply usage limits, and restore purchases.
Reminders and notifications: on-device reminders (meal times, lab analysis ready) and, if you allow them, push notifications about your account and features.
Competitions: receive and evaluate applications, notify you of the outcome and deliver any prizes.
Safety, security and fraud prevention: protect accounts, detect abuse, multiple accounts and manipulated content, and enforce our Terms.
Improve the Services: analyse usage, diagnose crashes, test features and measure performance.
Attribution: measure which channel or campaign led you to install the App (with your consent where required).
Communicate with you: respond to support requests and send service messages (for example changes to this policy).
Comply with law: meet tax, accounting and other legal obligations and respond to lawful requests.

We do not use your health and fitness data, photos or conversations for advertising, and we do not sell or rent any personal data.

4. Legal bases (EEA, UK and Türkiye)

Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c): account, profile, purchases and delivery of the Services.
Explicit consent (GDPR Art. 9(2)(a); KVKK Art. 6): health and fitness data, physique photos, lab results and voice recordings. You give this consent when you first enter such data and can withdraw it at any time by deleting the data, deleting your account, or contacting us. Withdrawal does not affect processing that already took place.
Consent (GDPR Art. 6(1)(a)): push notifications, attribution using the advertising identifier.
Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-f): usage and crash analytics, security and fraud prevention, and improving the Services, balanced against your rights.
Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç): tax and accounting records, responses to authorities.

5. AI features

The AI coach uses large language and vision models operated by third-party AI providers. When you send a message, photo or voice recording, that content, together with the parts of your stored data the coach needs (for example your recent workouts, nutrition logs, measurements, active training block and competition status), is transmitted to the provider to generate a reply. Under our agreements with these providers, your content is not used to train their models and is retained by them only as long as needed to generate the response and meet their abuse-monitoring obligations.

AI output can be inaccurate. Suggestions, meal plans, programs and lab-result interpretations are for informational purposes only and are not medical advice; consult a qualified professional before making health decisions. We do not make decisions with legal or similarly significant effects about you based solely on automated processing.

6. How we share information

We share personal data only with the following categories of recipients, and only for the purposes described above:

Service providers (processors) that act on our instructions:
- Google Firebase — crash reporting, app analytics, push notifications (privacy)
- PostHog — product analytics, hosted in the EU (privacy)
- AppsFlyer — install attribution (privacy)
- RevenueCat — subscription management (privacy)
- Cloudflare — file storage and content delivery for photos, audio and lab files (privacy)
- AI model providers — generating coach responses (Section 5)
- Hosting and infrastructure providers for our backend servers
App stores and sign-in providers: Apple and Google process your purchases and sign-in under their own privacy policies.
Competition jury: only if you apply to a competition, your application photos, measurements and age are shared with jury members bound by confidentiality. The jury does not see your phone number or e-mail.
Legal and safety: courts, regulators and law-enforcement where required by law, or where necessary to protect the rights, safety or property of you, us or others.
Business transfers: if Logian Creative is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction under the same protections; we will notify you.

We do not share personal data with data brokers or advertising networks. We do not "sell" or "share" personal data as those terms are defined under the CCPA/CPRA.

7. International transfers

We are based in Türkiye and our service providers operate in the European Union, the United Kingdom, the United States and other countries. Where personal data is transferred outside your country, we rely on: the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum for transfers from the EEA/UK; for the United States, providers certified under the EU-US Data Privacy Framework where available; and, for transfers from Türkiye, your explicit consent as required by Article 9 KVKK. You can request a copy of the relevant safeguards by contacting us.

8. Data retention

Account, profile, health and fitness records, photos, lab files and conversations: for as long as your account exists. When you delete your account, this data is deleted or irreversibly anonymised within 30 days and removed from backups within 90 days.
Individual items (a photo, a measurement, a conversation) are deleted immediately when you delete them in the App, and from backups within 90 days.
Purchase and billing records: for the period required by tax and commercial law (10 years in Türkiye).
Crash and usage analytics: up to 24 months, then deleted or aggregated.
Attribution data: up to 24 months.
Competition application data: as described in the Competition Privacy Notice.
Support e-mails: up to 3 years.

9. Security

We protect personal data with technical and organisational measures, including TLS encryption in transit, encryption at rest for stored files, short-lived access tokens with refresh-token rotation, role-based access to production systems, logging and monitoring, and regular security reviews. Sensitive credentials on your device are stored in the operating system's secure storage (iOS Keychain / Android Keystore). No method of transmission or storage is completely secure; if we become aware of a breach affecting your data, we will notify you and the competent authority as required by law.

10. Your rights and choices

Depending on where you live, you have the right to:

Access the personal data we hold about you and receive a copy in a portable format;
Correct inaccurate or incomplete data (most profile data can be edited in the App);
Delete your data (see below);
Restrict or object to certain processing, including processing based on legitimate interests;
Withdraw consent at any time, without affecting prior processing;
Not be discriminated against for exercising your rights;
Lodge a complaint with a supervisory authority (Section 11).

How to exercise your rights

Delete your account and all data in the App: Profile › Settings › Delete Account. This is immediate and cannot be undone.
Delete individual items: photos, measurements, meals, sessions and conversations can be deleted from the relevant screen.
Notifications and tracking: manage push notifications and, on iOS, tracking permission in your device settings; meal reminders can be switched off in App settings.
All other requests: e-mail contact@kashubapp.com from the address linked to your account. We may ask you to verify your identity. We respond within 30 days (45 days for California requests, extendable once as permitted by law) and free of charge, unless requests are manifestly unfounded or excessive. You may use an authorised agent where the law allows; we will verify the agent's authority.

11. Regional disclosures

11.1 European Economic Area and United Kingdom

Logian Creative is the controller. You may complain to your local data protection authority; in the UK this is the Information Commissioner's Office (ico.org.uk). Where required, we will appoint an EU or UK representative and publish their details here.

11.2 Türkiye (KVKK)

This policy also serves as the information notice under Article 10 KVKK. Personal data is collected electronically through the App and the website, on the legal bases in Section 4, and may be transferred abroad to the recipients in Section 6 with your explicit consent under Article 9. You may exercise the rights in Article 11 KVKK by e-mailing contact@kashubapp.com; requests are answered within 30 days. Complaints may be lodged with the Personal Data Protection Board (KVKK Kurulu).

11.3 California (CCPA/CPRA)

In the preceding 12 months we have collected the following categories of personal information: identifiers (name, e-mail, phone number, device and account identifiers, IP address); personal information under Cal. Civ. Code §1798.80 (name, contact details); characteristics of protected classifications (date of birth, gender); commercial information (subscription and purchase records); internet or network activity (usage and crash data); audio and visual information (photos, voice messages); inferences (fitness level, goals); and sensitive personal information (health data, photos revealing physique, account log-in credentials in the form of tokens). Sources: you, your device, Apple/Google, and our service providers. Purposes: Section 3. Disclosures for a business purpose: to the service providers in Section 6.

We do not sell or share personal information, have not done so in the preceding 12 months, and do not knowingly sell or share the personal information of consumers under 16. We use sensitive personal information only for the purposes permitted by Cal. Code Regs. tit. 11 §7027(m), so no "Limit the Use of My Sensitive Personal Information" link is required. Because we do not sell or share personal information, we do not process opt-out preference signals such as Global Privacy Control for that purpose. You have the rights to know, delete, correct, and to non-discrimination; exercise them as described in Section 10.

11.4 Washington, Nevada and Connecticut consumer health data

This section is our Consumer Health Data Privacy Policy under the Washington My Health My Data Act and similar laws in Nevada and Connecticut. Categories of consumer health data collected: body measurements and weight, workout and cardio activity, nutrition intake, physique photos, laboratory results and the values extracted from them, and health-related content in AI coach conversations. Sources: you, directly, through the App. Purposes: providing the App's features you request, AI coaching, competition evaluation (if you apply), security, and legal compliance (Section 3). Categories shared and recipients: the service providers listed in Section 6 (hosting, storage, AI model providers) and, for competition applicants, the competition jury. We do not sell consumer health data and do not share it for advertising. Your rights: to confirm whether we collect or share your consumer health data, to access it and receive a list of third parties with whom it was shared, to withdraw consent, and to have it deleted (including from backups and by third parties we shared it with). Exercise these rights as described in Section 10; if we deny a request you may appeal by replying to our response, and we will explain the outcome of the appeal in writing.

11.5 Other United States states

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and others) have the rights to access, correct, delete and obtain a copy of their personal data, to opt out of targeted advertising, sale and profiling with legal or similarly significant effects (none of which we perform), and to appeal a denied request. Exercise these rights as described in Section 10.

11.6 Brazil (LGPD)

Logian Creative is the controller under the Lei Geral de Proteção de Dados. You may exercise the rights in Article 18 LGPD, including confirmation, access, correction, anonymisation, portability, deletion and information about sharing, by contacting contact@kashubapp.com. Complaints may be lodged with the Autoridade Nacional de Proteção de Dados (ANPD).

11.7 Canada

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. You may request access to or correction of your personal information and may withdraw consent subject to legal or contractual restrictions. You may contact the Office of the Privacy Commissioner of Canada with complaints.

12. Children

The Services are not directed to children under 13, or under 16 in the European Economic Area and the United Kingdom, and we do not knowingly collect personal data from them. Competitions are open only to users aged 18 or older. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Health disclaimer and HIPAA

KASHUB is a fitness application, not a medical device or healthcare provider. It does not diagnose, treat or prevent any disease. We are not a "covered entity" or "business associate" under the U.S. Health Insurance Portability and Accountability Act (HIPAA); the health data you store in the App is protected by this policy and the laws referenced in it, not by HIPAA. Always consult a qualified healthcare professional before starting a training or nutrition program or acting on any lab-result interpretation.

14. Third-party links and services

The App may contain links to third-party websites (for example our blog, Instagram, or the App Store and Google Play). Their privacy practices are governed by their own policies. Our website uses only strictly necessary cookies; no advertising cookies are set.

15. Changes to this policy

We may update this policy from time to time. The effective date and version at the top will change, and for material changes we will notify you in the App or by e-mail before they take effect. Previous versions are available on request.

16. Contact us

Data controller: Logian Creative, Istanbul, Beyoğlu, Türkiye
E-mail: contact@kashubapp.com
Website: kashubapp.com