Privacy Policy
Effective date: July 20, 2026


1. Introduction


Flex ("we", "our", or "us") is a fitness timer and training-tracking application for iPhone, iPad, Apple Watch, and Apple TV. Flex is operated by David Kelen, an individual developer based in France. This Privacy Policy explains what information we collect, how we use it, where it is stored, who can access it, and your rights in relation to it.

By using Flex, you agree to the collection and use of information as described in this policy. If you have any questions, you can contact us at flex@davidkelen.com.


2. Who Operates Flex


Flex is developed and operated by David Kelen as an individual, not through a registered company. For the purposes of data protection law, David Kelen is the data controller for the information described in this policy. We are based in France, and French and EU law govern how we handle your data; see Section 10 for the rights this gives you.


3. Information We Collect


3.1 Account Information

To use most features of Flex, you create an account by signing in with your email address and a password, or with Sign in with Apple. We collect:

This is used to identify your account, enable sync across your devices, and send you important service communications (e.g. subscription confirmations or changes to this policy). We do not collect your phone number or payment card details; payment is handled entirely by Apple or Stripe, as described in Section 3.11.


3.2 Workout & Training Data

Flex stores the data you generate while using the app, including:

Where this data is stored depends on how you signed in; see Section 4 for the full explanation. In both cases, it is stored under your personal account and is never shared with other Flex users.


3.3 Apple HealthKit

Flex requests permission to read your heart rate and active energy (calories) data from Apple Health, to show heart rate graphs and calorie estimates in your workout history. Flex also requests permission to write completed workout sessions and estimated active energy burned back to Apple Health.

Data read from HealthKit stays within the app and is synced only as part of your workout history (Section 3.2). We never use HealthKit data for advertising and never sell it to third parties. You can review or revoke HealthKit access at any time in iOS Settings → Privacy & Security → Health → Flex.


3.4 Location Data

Flex requests location access; including the ability to continue tracking your location in the background; so it can record your route, distance, pace, and elevation during outdoor workouts, even while your phone is locked or your Apple Watch's screen is off. Location data is only recorded while you have an active outdoor workout running. We do not track your location at any other time, and we do not use location data for advertising, profiling, or any purpose other than recording the route of the workout you started.


3.5 Bluetooth Device Data

If you pair a Bluetooth heart rate strap (e.g. Polar, Wahoo, or Garmin) instead of, or in addition to, an Apple Watch, Flex connects to it over Bluetooth to read live heart rate data during your workout. This data is treated the same as any other heart rate data described in Section 3.2; we do not collect any other information from the paired device.


3.6 Camera (Apple TV Pairing) (Invite TestFligth Only)

Flex's Apple TV app displays a QR code to pair with your iPhone. The iPhone app uses your camera solely to scan that code. No photo or video is captured, stored, or transmitted; the camera feed is processed on-device in real time to decode the code and is immediately discarded.


3.7 Apple Music Library

If you grant access, Flex can control Apple Music playback during your workout (play, pause, skip). We do not collect, store, or transmit any information about your music library or listening activity; access is used only to control playback in the moment.


3.8 Photo Library

If you choose to export a visual summary ("route art") of a completed activity, Flex requests permission to add that image to your photo library. Flex cannot read, browse, or access any other photo on your device; this permission is add-only.


3.9 Siri & Shortcuts

Flex supports starting a workout hands-free via Siri or the Shortcuts app (e.g. "Start a workout in Flex"). Voice input for these requests is processed by Apple according to Apple's own Siri & Dictation privacy practices, not by us. We only receive the resulting instruction (e.g. which workout to start).


3.10 Notifications

Flex schedules local notifications on your device for things like rest-period alerts and workout reminders. These are generated and delivered entirely on your device; no notification content is sent to or from our servers.

Flex is built to support push notifications sent from a server in the future (for example, to notify you about your subscription). This is not active yet. If we turn it on, we will update this section to describe exactly what a push notification contains before doing so.


3.11 Payment Information

If you subscribe through the App Store, all payment processing is handled entirely by Apple. We never see or store your payment card details; we only receive a subscription status from Apple's StoreKit (active, expired, etc.).

If you subscribe through our website, checkout is handled entirely by Stripe on a Stripe-hosted payment page. Stripe collects your payment card details and billing address directly; these never pass through our servers. To connect your subscription back to your Flex account, we store your Stripe customer ID linked to your account, and Stripe stores your Flex account ID (a random identifier, not your email or password) as metadata on your Stripe customer record. Stripe's own privacy practices govern the payment data it collects; see Section 5.


3.12 What We Don't Collect

Flex's software includes some Google Firebase components (such as Analytics, Crashlytics, and Cloud Messaging) as part of the underlying Firebase platform, but as of the effective date of this policy, we have not activated or do not actively use them: Analytics collection is explicitly disabled, and we do not use Crashlytics, Performance Monitoring, Remote Config, or any advertising or tracking identifier (such as Apple's IDFA). Flex does not show ads and does not use your data for advertising or profiling. If this changes, we will update this policy before it does.


4. Where Your Data Is Stored


Where your workout, health, and preference data (Section 3.2) is stored depends on how you sign in:

In both cases, your account record itself (email address, and the Sign in with Apple name if provided) is managed through Firebase Authentication, regardless of which sign-in method you use; this is the identity system that lets you log in, but it does not itself hold your workout or health data if you signed in with Apple.


5. Third-Party Services


Flex relies on the following third-party services, each with their own privacy practices:


6. Who Inside Flex Can Access Your Data


Flex is operated by David Kelen, together with any staff or contractors specifically designated to help operate the service. Through an internal admin tool, authorized personnel can view and edit account-level information only; your email address, display name, account creation and last sign-in time, whether your account is disabled, your beta-tester status, and your subscription status and preferences.

This admin tool cannot access the contents of your workout history, health data, heart rate data, or GPS routes. That data is protected by account-level access rules (Section 4) that restrict it to your authenticated account, and is not exposed through any internal tool.


7. How We Use Your Information


We use the information we collect to:

We do not use your data for advertising, profiling, or sale to third parties, and we do not send marketing emails; only transactional communications directly related to your account or subscription.


8. Data Retention & Deletion


We retain your data for as long as your account is active, so the app can function.

When you delete your account from within the app, your login credentials are deleted immediately; you will no longer be able to sign in. The underlying workout, health, GPS, and preference data associated with your account (Section 3.2) is not deleted automatically; we purge it manually within 30 days of your deletion request. If you would like your data removed sooner, or want to confirm it has been deleted, contact us at flex@davidkelen.com.

Data stored locally on your device is deleted when you uninstall the app.


9. Data Security


Your data is transmitted using industry-standard encryption (TLS) and stored at rest using the encryption provided by Apple's iCloud/CloudKit or Google Firebase, depending on your sign-in method (Section 4). Access to your data is protected by your account credentials and by platform-level security rules that restrict access to your authenticated account. No general member of our team; only authorized personnel described in Section 6, and only to the account-level fields described there; has access to your data.


10. Your Rights


EU / France / GDPR

As we are based in France, French and EU data protection law (the GDPR) applies to our processing of your data. If you are in the European Economic Area, you have the right to:

The legal basis for processing most of your data is contract performance (to deliver the service you signed up for). Health-related data; heart rate and other data accessed via HealthKit or location tracking during a workout (Sections 3.3 and 3.4); is only collected after you actively grant the relevant permission, which we rely on as your explicit consent. You can withdraw that consent at any time by revoking the permission in iOS Settings, which stops future collection (see Sections 3.3 and 3.4 for how).

California / CCPA–CPRA

California residents have the right to know what personal information is collected, the right to delete personal information, the right to opt out of the sale or sharing of personal information (we do not sell or share your personal information), and the right to non-discrimination for exercising these rights.

To exercise any of the rights above, contact us at flex@davidkelen.com. We will respond within 30 days.


11. Children's Privacy


Flex is not directed at, and may not be used by, anyone under the age of 16. We do not knowingly collect personal information from anyone under 16. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.


12. International Data Transfers


If you sign in with email and password, your data is stored on Google Firebase infrastructure, which may process or store data outside your country of residence, including in the United States. Transfers from the EEA are covered by Google's adherence to the EU–U.S. Data Privacy Framework and standard contractual clauses.

If you sign in with Sign in with Apple, your data is stored in your personal iCloud account under Apple's CloudKit infrastructure. Its location is governed by Apple's own data residency practices for your Apple ID, not by us.


13. Changes to This Policy


We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. If changes are material, we will notify you via email (to the address on your account) at least 14 days before they take effect. Continued use of Flex after that date constitutes acceptance of the updated policy.


14. Contact Us


For any questions, requests, or concerns about this Privacy Policy or your data, please reach out:

Flex | David Kelen
Email: flex@davidkelen.com
Based in France