← seto

Privacy Policy

Effective date: 1 August 2026 · Last updated: 18 October 2026

This Privacy Policy explains how the seto mobile application, website, and related backend services (“seto”, “we”, “us”, or “our”) collect, use, store, and share personal data.

seto does not sell personal data, does not share personal data with advertisers, and does not use personal data for cross-app advertising or behavioural advertising.

1. Who we are

seto is operated by Aleh Laliyeu, an individual based in Poland. There is currently no separate legal entity operating seto. If this changes, this Privacy Policy will be updated to identify the new data controller.

For privacy questions or requests, contact: Email: [email protected].

Aleh Laliyeu is the controller responsible for personal data processed through seto.

2. Who may use seto

You must be at least 13 years old to use seto.

seto is not directed to children under 13, and we do not knowingly collect personal data from children under 13.

Users who have not reached the age of legal majority in their country may use seto only with the permission of a parent or legal guardian. Where applicable law requires parental authorization for the processing of personal data, the parent or legal guardian must provide or authorize that consent.

If you believe that a child under 13 has provided personal data to seto, contact us at [email protected]. We will investigate the request and delete the relevant data where appropriate.

3. Personal data we collect

We collect only the information reasonably necessary to operate, secure, and improve seto.

3.1 Account data

When you create an account, we may collect:

• your email address;
• your password in securely hashed form;
• your internal seto user identifier;
• your email-verification status;
• authentication and session information;
• the date your account was created and last accessed.

Your email address is required to register, verify your account, sign in, recover your password, and receive essential account-related messages. We do not store your password in readable form.

3.2 Apple and Google sign-in data

When you use Sign in with Apple or Google Sign-In, we may receive:

• a provider-specific account identifier;
• your email address;
• your name, if the provider makes it available;
• a profile-image URL, if the provider makes it available.

The exact information received depends on your settings and the information provided by Apple or Google. Apple and Google independently process information relating to your use of their authentication services under their own privacy policies.

4. Profile and fitness data

When you use seto, you may choose to provide:

• display name;
• age in years;
• sex;
• height;
• weight;
• training experience;
• primary training goal;
• equipment availability;
• training preferences;
• preferred measurement units;
• body measurements you choose to record over time — for example body weight, body-fat percentage, lean mass, and circumferences such as waist, chest, hips, neck, shoulders, arms and thighs.

seto asks for your age in years and does not require your complete date of birth.

Some profile information may be used to personalise training recommendations. Optional fields can generally be left blank, although certain personalised features may not work without the relevant information.

5. Workout and training data

When you create or record workouts, we may process:

• exercises performed;
• custom exercises created by you;
• sets and repetitions;
• weights and resistance values;
• workout and exercise duration, and rest times between sets;
• how hard a set or a workout felt — for example repetitions in reserve, perceived exertion, or an easy / normal / hard answer;
• workout dates and times;
• workout templates and routines;
• training history and personal records;
• statistics calculated from your workouts;
• optional workout notes.

At the effective date of this Privacy Policy, seto does not collect user-uploaded progress photographs or workout videos. Screenshots of the app attached to error reports and support requests are described in § 12.

5.1 Apple Health (iPhone)

On iPhone you can choose to save the workouts you finish in seto to Apple Health. seto asks once, after your first finished workout, and you can turn it off at any time in the app (Profile → Apple Health) or in the Health app.

• seto asks only for permission to write workouts. For each finished workout it saves the workout type (strength training), its start and end time, and its pauses. It does not write calories or any other measurement.
• seto does not read your Health data. It looks up only the workouts it saved itself, to update one you edit or to delete one when you ask it to.
• Nothing from Apple Health is sent to our servers or to any third party. Health data is never used for advertising or marketing and is never sold.
• When you delete a workout that seto saved to Apple Health, seto asks whether to delete it there too. Deleting your seto account does not remove workouts already saved in Apple Health; you can delete them in the Health app.

6. Physical limitations and health-related information

seto may allow you to select physical limitations or injuries from a predefined list so that workouts can be adapted to your circumstances. Providing this information is optional.

Information about injuries and physical limitations may constitute health-related personal data. We use selected limitations only to:

• adapt exercise selection;
• exclude potentially unsuitable exercises;
• personalise workout recommendations.

You may use seto without providing physical limitations, and you can remove a selected limitation at any time in the app's training settings.

seto also learns two kinds of limitation from how you use it. When you swap out an exercise such as a pull-up or a dip because it was too hard or too easy, seto records your capability for that kind of movement. When you swap one out because you lacked the mobility for it, seto records the joint range that exercise demanded, so that exercises needing it are not suggested again. Both are kept with your account, are used only to adapt exercise selection, and are deleted with your account.

You may also record, optionally, how you felt before and after a workout, your energy level, how many hours you slept the night before, and muscle soreness. These entries may constitute health-related personal data. We use them only to show your history, to adjust suggested loads, and to estimate muscle recovery.

seto is a fitness application. It does not provide medical diagnosis, treatment, physiotherapy, or professional medical advice. Consult a qualified healthcare professional before beginning a new exercise programme if you have an injury, medical condition, or other health concern.

7. Automated workout personalisation

seto may use an internal algorithm to generate or adjust workout recommendations based on information such as:

• age, training goal, and training experience;
• workout history and previous performance, including how hard recent workouts felt;
• available equipment;
• selected physical limitations, and the movement capabilities and mobility limits described in § 6;
• sleep, energy, and soreness entries, where you have made them.

This processing takes place within seto's own systems. At the effective date of this Privacy Policy, workout and health-related data are not sent to OpenAI, Anthropic, Google Gemini, or another external generative-AI provider for workout generation.

Automated workout personalisation does not produce legal effects and is not intended to make decisions that similarly significantly affect you. Recommendations are informational and should be adjusted based on your personal condition, experience, and professional medical advice where appropriate.

8. Device, session, and security data

When you access seto, we may automatically collect:

• device model and OS type/version;
• app version;
• IP address and user-agent information;
• language and locale settings;
• request dates and times;
• authentication and session identifiers;
• a random identifier created for this installation of the app, used so that a workout open on more than one of your devices is controlled from one device at a time;
• a short record of each synchronisation your device sends — the time, the device, how many items of each kind were sent or refused, never their contents;
• login and verification events, including failed login attempts;
• limited server and security logs;
• information required for rate limiting and abuse prevention.

We use this information to operate the app, maintain active sessions, let you view and manage active devices, protect accounts, detect suspicious activity, prevent abuse, apply rate limits, and diagnose technical problems.

9. Push notifications

seto does not currently send push notifications. If push notifications are introduced — for example, workout reminders or account-security alerts — this Privacy Policy will be updated before that processing begins, notification permission will be optional and revocable at any time in your device settings, and we will avoid intentionally including sensitive health information in notification content shown on a locked device.

10. Subscription and payment data

seto Pro subscriptions are purchased through the Apple App Store on iOS or Google Play on Android.

Apple or Google processes your payment information. seto does not receive your complete card number, card security code, bank-account details, or billing address.

Through Apple, Google, and RevenueCat, we may receive:

• subscription status, product/plan identifier;
• purchase, renewal, cancellation, expiration, and trial status;
• transaction or subscription identifier;
• the internal seto user identifier associated with the purchase.

We use this information to confirm purchases, provide seto Pro access, manage subscription entitlements, prevent fraud, and respond to subscription-support requests.

Deleting your seto account does not automatically cancel an active Apple App Store or Google Play subscription. You must cancel the subscription through your Apple or Google account settings.

11. Transactional email

We may use your email address to send essential transactional messages, including:

• email-verification messages;
• password-reset messages;
• account-security notifications;
• email-change confirmations, if this feature is available;
• account-deletion confirmations;
• important service or subscription notices.

We use Resend to deliver transactional email. At the effective date of this Privacy Policy, we do not use your email address for third-party advertising.

12. Diagnostics, error monitoring, and support requests

12.1 Error reports

We use Sentry to identify crashes, backend errors, performance problems, and unexpected application behaviour.

Diagnostic information may include stack traces, error messages, affected files and code locations, app and backend versions, device and OS information, request or error identifiers, timestamps, your internal seto user identifier, and — where necessary to investigate an account-specific backend error — your account email address.

When the app records an error, the report also includes a screenshot of the screen that was open at that moment and a technical outline of that screen's layout. The screenshot shows whatever the app was displaying at the time — for example a workout in progress or your profile. It is kept only with that error report and is deleted together with it (§ 17).

Our Sentry configuration is set not to collect default personal data (IP address, cookies) and redacts values for known sensitive fields such as passwords and authentication tokens before an error report is sent. Apart from the screenshot, diagnostic reports are not designed to include the full content of your workouts, notes, measurements, or selected physical limitations, but because diagnostics are generated automatically at the time of an error, we cannot guarantee that no such data will ever appear incidentally in a report directly connected to the error being investigated.

If you send a support request (§ 12.2) after the app has recorded an error during the same session, your message and contact email address are also attached to that error report in Sentry, so that the two can be read together.

12.2 Support requests

You can write to us from inside the app — from Profile → Help & support, or with the Report this link shown when a screen fails to load. A support request contains:

• the category you choose and the message you type;
• a screenshot of the screen you were on — the app attaches it automatically and shows it to you before you send, and you can remove it;
• your account email address or, if you are not signed in, the email address you enter so that we can reply;
• a diagnostic snapshot that the app adds automatically, so that we can understand the problem without asking you a series of technical questions:
  • app version and build;
  • device model, operating system and version, free storage space, time zone, app language, preferred weight unit, light/dark theme, and text-size setting;
  • whether you are signed in, your internal seto user identifier, when your account was created, and how many workouts you have completed;
  • your subscription status and plan, including trial, expiry, and renewal status;
  • the screen you are on, the item it shows (for example an exercise), and the last screens you opened, with the time spent on each;
  • a short technical log of recent app events, including up to three recent requests that failed and their error codes;
  • sync status, the number of changes waiting to sync, and the size of the app's local database;
  • network status, and whether notifications and workout reminders are allowed;
  • if a workout is in progress: its name, when it started, and how many exercises and sets it has — never the weights or repetitions you logged;
  • the identifier of the most recent error report (§ 12.1), if there is one.

We use support requests to answer you and to find and fix the problem you describe. Answering your request is part of providing seto to you; the diagnostic snapshot and the screenshot are processed on the basis of our legitimate interest in diagnosing faults quickly (§ 15).

Support requests are stored in seto's own database and their screenshots in Cloudflare object storage (§ 14). We are told about a new request by an email to our own mailbox that contains the request, and we reply to you by email; both are delivered through Resend. We may also receive a short alert in a private Telegram chat; that alert contains only the request number, its category, the platform and app version, and a link to our administration panel — no message text and no other personal data.

When you delete your account, your support requests are anonymised and their screenshots are deleted (§ 17).

13. Analytics, advertising, tracking, and cookies

The seto mobile application contains no third-party product-analytics SDK, advertising SDK, session-replay service, or cross-app tracking technology.

In particular, the seto app does not use services such as Meta Pixel or Meta advertising SDK, AppsFlyer, Adjust, Mixpanel, Amplitude, or Firebase Analytics. The in-app usage statistics described in § 13.2 are sent by our own server, not by the app, to PostHog, which processes them on our behalf.

seto may use aggregated statistics provided by Apple App Store, Google Play, RevenueCat, and infrastructure providers to understand installations, subscriptions, technical performance, and service reliability.

If a new analytics or monitoring provider is introduced, this Privacy Policy and the relevant Apple App Privacy and Google Play Data Safety disclosures will be updated before or at the time the new processing begins.

13.1 Website (seto.fit)

The website stores two kinds of information in your browser.

Strictly necessary (no consent required): your language choice (cookie seto-lang, 12 months), your light/dark theme choice (browser local storage), and your own cookie choice (cookie seto-consent, 6 months). None of these is transmitted to a third party, and you can remove them at any time by clearing the website's site data in your browser. Our hosting provider (Cloudflare) may additionally set strictly-necessary cookies for security and bot protection.

Analytics (only with your consent):

• Google Analytics 4 (Google Ireland Limited) — aggregated usage statistics: pages viewed, referring site, approximate location derived from a truncated IP address, browser and device type, and a few interaction events such as joining the waitlist or clicking a store badge. Google Signals, advertising features, and cross-site tracking are switched off.
• Microsoft Clarity (Microsoft Ireland Operations Limited) — heatmaps and session recordings that show how visitors scroll and navigate. Text typed into form fields is masked before it leaves your browser, so the email address you enter into the waitlist form is never recorded.

No analytics script is loaded and no analytics cookie is set until you click “Accept” on the consent card shown at the bottom of the page. “Decline” is presented with equal prominence, costs nothing, and does not limit the website in any way; simply continuing to browse is not treated as consent. You can withdraw or change your choice at any time via the “Cookie settings” link in the website footer: withdrawing stops collection immediately and deletes the analytics cookies set on seto.fit. Either choice is remembered for six months, after which we ask again.

Cookies set with your consent: _ga and _ga_* (Google Analytics, 13 months); _clck (Microsoft Clarity, 12 months) and _clsk (Microsoft Clarity, 1 day). Google and Microsoft may process this data in the United States; both participate in the EU-U.S. Data Privacy Framework and are bound by standard contractual clauses (see § 16).

13.2 In-app usage statistics

The seto app records a small number of product events — for example that the app was opened, onboarding was completed, a workout was finished, a paywall was shown, or a purchase was completed or cancelled. Each event carries only its name, a few short tags (such as the plan chosen or a count), the platform, the app version, the time, and either your internal user identifier (when you are signed in) or a random identifier created for this installation of the app (when you are not). The installation identifier is not your device's advertising identifier; it is erased when you turn statistics off or delete the app. Events never contain workout content, body measurements, or contact details.

Our server stores these events and passes a copy to PostHog (PostHog Inc., using its EU Cloud hosted in the European Union), which processes them on our behalf so that we can see aggregate figures, such as how many people come back a week after their first workout. Because the copy is sent by our server, PostHog receives neither your IP address nor your location. We use these statistics to understand which features are used and to keep seto reliable, on the basis of our legitimate interest (§ 15).

You can turn this off at any time in the app: Profile → Data & privacy → Share usage statistics. While it is off, the app records no usage events, and our server neither stores nor forwards usage events about you. Purchases, subscriptions, and workout sync keep working as before.

When you delete your account, the link between these events and you is removed at the same moment; the remaining anonymous counts are kept for aggregate statistics (§ 17). PostHog's copy carries only the internal or installation identifier, neither of which leads to you once your account is deleted, and it expires within 12 months.

13.3 Launch waitlist

If you join the launch waitlist on seto.fit, we store your email address, the platform(s) you chose (iPhone, Android or both), and where the signup came from: the country derived by our hosting provider from your connection (your IP address itself is not stored), the page and form you used, the website language, and the referring website or campaign tag in the page address, if any. This is stored with Resend and used only to send you one email on each chosen platform's launch day and to understand which countries and channels the interest comes from. It is not combined with Google Analytics or Microsoft Clarity data. You can unsubscribe with the link in that email or by writing to [email protected], and we delete the list once both apps have launched.

14. Service providers

We use third-party service providers to operate seto. They receive only the information reasonably necessary to perform their services.

These providers may also process technical information necessary to prevent abuse, maintain security, comply with law, and operate their infrastructure.

Some providers, including Apple and Google, may act as independent controllers for certain activities, such as store accounts, payments, and transactions.

15. Legal bases for processing

Where the General Data Protection Regulation or similar law applies, we rely on the following legal bases.

Performance of a contract: account, workout, subscription, and session data, where necessary to create and maintain your account, save and synchronise workouts, calculate training statistics, manage seto Pro access, and provide customer support.

Consent: optional profile fields and selected physical limitations, — once introduced — push notifications, and website analytics cookies (§ 13.1). You can withdraw consent at any time through the relevant app or device settings, the “Cookie settings” link in the website footer, or by contacting us.

Legitimate interests: limited technical, diagnostic, and security information, necessary to secure accounts and infrastructure, prevent fraud and abuse, apply rate limits, diagnose errors, and protect our legal rights; the screenshots and diagnostic snapshots attached to error reports and support requests (§ 12); and the in-app usage statistics described in § 13.2, which you can switch off in the app at any time. We do not rely on legitimate interests for behavioural advertising.

Legal obligations: limited information retained where necessary to comply with applicable law, respond to a valid legal request, prevent fraud, resolve payment or subscription disputes, or establish, exercise, or defend legal claims.

16. International data transfers

seto's primary backend infrastructure is hosted in the European Union, on servers located in France. Some providers identified in this Privacy Policy are established in the United States and may process or access information from outside the European Economic Area.

Where applicable law requires transfer safeguards, personal data is transferred using an applicable mechanism such as an adequacy decision, Standard Contractual Clauses approved by the European Commission, or another legally recognised transfer mechanism.

17. Data retention

• Account, profile, and workout data: retained while your account remains active, and hard-deleted immediately when you delete your account (see § 18) — except where limited retention is required by law or necessary to prevent fraud, resolve disputes, or establish or defend legal claims.
• Sessions and refresh tokens: refresh tokens normally expire within 30 days unless revoked earlier; they are also deleted immediately on account deletion.
• Rate-limit and security records: retained only for the period necessary to apply the relevant security restriction.
• Synchronisation records: a short record of each synchronisation your device sends — the time, the device, how many items of each kind were sent or refused, never their contents — kept for 30 days to investigate sync problems, and deleted with your account.
• Diagnostic and server logs: Sentry diagnostic events — including their screenshots and any support message attached to them (§ 12.1) — are generally retained for up to 90 days, subject to Sentry's retention configuration.
• In-app usage statistics (§ 13.2): de-linked from your account the moment the account is deleted and kept only as anonymous aggregates afterwards. PostHog keeps its copy for at most 12 months.
• Website analytics: Google Analytics event data is retained for 14 months; Microsoft Clarity session recordings for 30 days and aggregated heatmap data for 13 months. Your consent choice itself is stored in your browser for 6 months.
• Subscription records: retained for as long as necessary to provide paid access, resolve billing disputes, prevent fraud, and comply with legal requirements. Apple, Google, and RevenueCat retain their own transaction records under their respective policies.
• Support requests and correspondence (§ 12.2): retained for as long as reasonably necessary to answer the request, document its resolution, prevent abuse, and protect legal rights. When you delete your account, your support requests are anonymised at the same moment: your contact email address, your message, our reply and internal notes, the link to any related error report, and the identifying parts of the diagnostic snapshot are erased, and the screenshots are deleted. Only non-identifying details are kept, for statistics: the category, status, and dates, the name of the screen the request was sent from, the platform, the app version, the operating-system version, the app language, and the text-size setting. Support emails already delivered remain in the mailboxes they were delivered to.
• Backups: residual copies may briefly remain in encrypted, access-controlled backups until the normal backup-rotation cycle overwrites them; they are not used for ordinary business purposes after a deletion request.

18. Account and data deletion

Registered users can initiate account deletion inside the app through Settings → Account → Delete account, or by contacting [email protected]. See also seto.fit/delete-account.

When you delete your account, seto hard-deletes the account and every user-keyed dependent record — workouts, sets, exercises, routines, measurements, personal records, gyms, favorites, notes, and refresh tokens — in a single database transaction. There is no soft-delete flag and no grace period: deletion is immediate and permanent, and there is no restore path.

One exception: support requests you sent are anonymised rather than deleted. In the same step, your contact email address, your message, our reply and internal notes, and the identifying parts of the diagnostic snapshot are erased, and the screenshots are deleted; only non-identifying details such as the category, dates, platform, and app version remain (§ 17).

Deletion does not remove information independently retained by Apple, Google, RevenueCat, or another independent controller, and does not cancel an active Apple or Google subscription (see § 10). Limited information may also be retained where required by law or to resolve a payment dispute or legal claim.

Deleting the seto app from your device does not by itself delete your account.

19. Your privacy rights

Depending on where you live and the law that applies, you may have the right to access, correct, delete, restrict, or object to processing of your personal data; withdraw consent; request data portability; and lodge a complaint with a data-protection authority.

You can view and edit most of your profile, workout, and measurement information directly inside the app. To make another privacy request, email [email protected]. We may need to verify that the request relates to you before providing, changing, or deleting personal data.

Where the GDPR applies, we normally respond without undue delay and within one month; this period may be extended where legally permitted, and we will notify you if an extension applies.

If you are located in Poland, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). You may also contact the data-protection authority in the country where you live or work.

20. Security

We use technical and organisational measures designed to protect personal data, including encryption in transit (TLS), secure password and token hashing, database access controls, authentication and session protections, rate limiting, infrastructure monitoring, and restricted access to production systems.

No electronic service can guarantee absolute security. If you believe you have discovered a security vulnerability, contact [email protected] rather than disclosing it publicly.

21. Third-party links and services

seto may contain links to websites or services operated by third parties. This Privacy Policy does not govern third-party services that seto does not control. Review the privacy policy of a third-party service before providing information to it.

22. Changes to this Privacy Policy

We may update this Privacy Policy when seto's features, service providers, or data-processing practices change, or when legal or regulatory requirements change. For material changes, we will provide reasonable notice through the app, by email, or through another appropriate method. Where a change requires new consent, we will request that consent before beginning the relevant processing.

The effective date and “Last updated” date at the top of this Privacy Policy identify the version currently in effect.

23. Contact

For privacy questions, access requests, deletion requests, complaints, or other data-protection matters, contact:

Aleh Laliyeu
Poland
Email: [email protected]