Privacy Policy

Last updated: October 18, 2026

Testo ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use the Testo mobile application and web platform.

1. Information We Collect

Everything below except the last item is information you enter yourself, in the app or on the web; the last item is recorded by our server while you use the service. Testo does not read your phone's sensors or any health app.

Account information: your name, your email address and your password, which is stored only as a one-way hash. While you confirm your email address or reset your password, a six-digit code is stored until it is used or expires.
Profile: gender, date of birth (used to calculate your age; a profile created with an earlier version of the app or on the web may hold only an age), height, weight, goal (lose fat, maintain or build muscle), activity level, years of training experience, body fat percentage, and the daily calorie, protein, carbohydrate and fat targets calculated from these.
Goal history: each goal you set and the date you set it.
Weekly check-ins: weight, waist, neck and hip circumference, and an optional note.
Workouts: the sets you log (exercise name, weight, repetitions, warm-up or working set, date), your training and rest days, and the custom programs you create (program, day and exercise names, number of sets).
Cardio sessions: activity, duration and intensity; distance, speed, incline and a name for an "other" activity when you enter them; and the calories estimated from these.
Nutrition: the foods you log (name, amount, calories, protein, carbohydrate and fat, whether it was cooked, whether it is an animal protein) and your daily water intake.
Usage information: when your account last used the service, whether that was from the iOS app, the Android app or the web (worked out from the type of app making each request; the request's address and the details of your device are not stored), and the days on which your account was active. It is kept for at most 13 months.

We do not collect your location, contacts, photos, advertising identifier or any other device identifier, and the app contains no analytics or advertising SDK. As with any internet service, your device's IP address reaches our server with each request: it is used to answer the request and to limit abusive traffic, and it is not saved in our database (our hosting provider may keep it for a short time in its technical logs).

Some settings are kept only on your phone and never sent to us: the order of today's exercises and the ones you skipped, the rest time you chose for each exercise, your last cardio session (for logging it again), and the reminder notifications, which are scheduled on the device.

2. How We Use Your Information

To calculate your daily calorie and macro targets, the targets for your next sets and the estimated calories of your cardio sessions.
To show your progress: charts, weekly review, records.
To send account verification and password reset emails. If our support team sets a new password for your account, we may also email you about that change.
To keep the service secure, for example by limiting how many requests one account or one address can make.
To see how many people use Testo, how often and on which platform, so that we can keep the service running and decide what to improve. This information stays with us: it is never used for advertising and never shared.

3. Advertising and Tracking

Testo currently shows no advertising and does not track you. The app does not request the Android advertising ID, does not present the iOS App Tracking Transparency prompt, and does not load any advertising SDK. No device identifier is collected, and no data about you is shared with an advertising network.

If advertising is introduced in a future version, this policy will be updated before that version is released, the relevant store declarations will be changed to match, and on iOS your permission will be requested through App Tracking Transparency first.

4. Data Storage and Security

Your data is stored on secure servers hosted by Railway (railway.app) using MySQL. We use industry-standard security measures including HTTPS encryption, bcrypt password hashing, and JWT authentication tokens. On mobile devices, your authentication token is stored in the secure keychain (iOS) or keystore (Android) via expo-secure-store.

5. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We share data only with:

Brevo — for transactional email delivery (verification codes, password reset codes and account notices). Receives your email address.
Railway — for hosting and database infrastructure.

No advertising network, analytics provider, or subscription platform receives your data in the current version. Reminder notifications are scheduled locally on your device and are not sent through any push service.

6. Data Retention and Deletion

We retain your data for as long as your account is active. You can delete your account and all associated data yourself, from inside the app — open Profile, then Settings, then "Hesabı Sil" (Delete Account). The same option is available on the web at Profile. Deletion is immediate and permanent: your account, your profile (including your date of birth), goal history, nutrition and water logs, workout logs and sessions, cardio sessions, weekly check-ins, custom programs and usage information are removed in a single transaction and cannot be recovered.

If you start registering but never confirm your email address, that unconfirmed record (name, email address and password hash) stays until you register again with the same address or ask us to delete it. If an administrator ever acted on your account — for example confirmed your email address manually, set a new password for it when you could not reset it yourself, suspended the account or deleted it at your request — our internal security log keeps a record of that action with your email address.

Instructions and what exactly is deleted: testo-production-0218.up.railway.app/account-deletion. If you cannot access the app, email us at the address below and we will delete your data within 30 days.

7. Children's Privacy

Testo is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us immediately.

8. Your Rights

You have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Delete your account and all associated data at any time, directly in the app.
Withdraw consent by deleting your account, which removes everything we store about you.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page.

10. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at:
testoapp.official@gmail.com