Privacy policy
PerfectForm is an iPhone app that grades exercise form from video. This page says what we collect, why, who helps us run the service, how long we keep it and what you can ask of us.
"We" means Emmanouil Kaparos Kaparakis, Andrea Koumpi 2, 19003 Markopoulo, Greece. We are established in Greece. We decide how this data is used, which makes us the controller under EU data protection law (the GDPR). Write to us at privacy@mail.getperfectform.app.
The short version
- We keep your account email and the sets you upload: the video and the tags you type.
- To grade a set, its video goes to VLM Run, a vision service that finds body positions. The exercise check sends a few still frames through VLM Run's TypeSafe route. Jev, the model that writes filming tips, gets numbers and exercise names only, never video.
- New sets stay on your own account. Older sets tagged with another athlete's email stay shared with that account.
- No ads, no analytics, no tracking. We never sell your data.
- Email us to get a copy of your data or to delete it.
What we collect
Your account
- Your email address. If you sign up with email, also a password, which our sign-in provider stores only as a one-way hash.
- With Sign in with Apple: an Apple user identifier and the email Apple gives us, which may be a private relay address. Apple's sheet offers to share your name; the app does not keep it.
- When you signed up, whether with Apple or email, whether an invite brought you, and your weight unit (kg or lb).
Sets and sessions you upload
- The video. Sets filmed in the app have no sound. A video you import from your photos is uploaded as the file you picked, sound included if it has any.
- The tags you type: the exercise, the load, any set inputs the exercise asks for (such as a climbing hold colour), and when it was filmed. New sets carry your account's own email.
- What the analysis produces: body positions frame by frame (the points of the joints), each rep's grade and angles, a copy of the video with a skeleton drawn on it, charts, filming tips and a processing log.
- For a session (one long video of a whole workout): the sets cut from it, a still image of each, and the exercise suggested for each.
We use body positions only to grade the exercise, never to recognise who someone is.
People you film
You film yourself, or someone who agreed, on your own account. The app no longer asks you to tag another athlete's email or sends athlete invites. If you film someone, tell them that their video is analysed by an outside service; the app reminds you. If you are in a set someone else filmed and want it removed, email us.
Purchases
Apple takes the payment. We never see your card or your Apple ID. Through RevenueCat we receive what you bought, when, the store's transaction number, whether it was a test purchase, refunds, and your plan's renewal or end date. We keep your sets balance and its history: every set credited, used or given back.
Technical data
When the app talks to our servers, they record standard request logs: IP address, time and what was asked for. We use them to keep the service secure and to fix faults. Supabase keeps project logs for 7 days on our Pro plan.
What we do not collect
No analytics or advertising code, no tracking across apps or websites, no location, no contacts, no microphone. The camera and your photos are used only after you allow them in iOS, and the app reads only the videos you choose. If you turn on saving to the camera roll, sets you film are also saved to your own photos, on your phone.
Why we use it
Under EU law each use needs a legal basis. Here are ours.
- To give you the service you signed up for (contract): your account, storing and grading your sets, keeping older shared sets available, your balance and purchases, and the verification and password reset emails.
- To keep the service safe and affordable (legitimate interests): request logs, daily spending limits and preventing abuse.
- To meet legal duties (legal obligation): keeping purchase records for tax.
- To fix problems (legitimate interests): We look at a set only when you ask for help, or to fix a grading error you report.
We do not use your videos to train AI models. VLM Run's gateway stores no media and does not train on what we send. TypeSafe AI does not train on customer data without prior consent.
Grades are automated feedback on exercise form. They have no legal or similarly significant effect on you.
Who processes it for us
These services handle your data on our behalf, only to run PerfectForm.
Supabase
Database, file storage and sign-in · AWS eu-west-1, Ireland (EU)
Your account, your sets' videos, tags and results, and your purchases are stored here.
Our processing computer
A computer of the operator in Greece (the operator's own Mac)
Downloads a set's video, runs the analysis, sends frames to VLM Run, and uploads the result. Its working copy is deleted after each analysis (see How long we keep it).
VLM Run
The vision gateway · Palo Alto, United States. The gateway does not store the media it receives.
Receives the video, or frames from it, and returns body positions. For a session it receives a small copy: 480 pixels tall, 4 frames a second, no sound. The exercise check sends a few still frames of a set through VLM Run's TypeSafe route. For deadlifts it also receives frames cropped to the lifter, which an image model (Google's Gemma 4, run as a TypeSafe "System One" model on VLM Run's gateway) reads to judge the back. For climbing it also tracks the holds.
TypeSafe AI
Exercise check, filming tips and checks · San Francisco, United States
May receive still frames of a set through VLM Run's TypeSafe route, and the numbers measured from them. Jev, its model for filming tips, receives text summaries only: numbers about the movement (reps, angles, how long the athlete was in frame, brightness), the exercise's name and the exercises to choose from. Jev never receives video or images, an email or a name. It suggests a filming tip, flags reps worth a second look and suggests the exercise of each set cut from a session.
Resend
Email delivery · United States (us-east-1)
Sends the verification email and the password reset. It receives the recipient's address and the message. Past athlete invites named the coach's email and the exercise; they never contained a grade or a video.
Apple
Sign in with Apple, App Store payments
Handles sign-in with your Apple ID, payments, refunds and subscriptions. Apple's own privacy policy applies to what Apple collects.
RevenueCat
Purchase receipts · United States
Checks your App Store purchases with Apple and tells our server what to credit. It receives your PerfectForm account number (a random identifier), your purchase and subscription history and the technical details its app code sends, such as the app version and store country. It never receives your videos or your email.
Sharing between people
- New sets stay on your own account. The app no longer asks you to tag another athlete's email. Older sets tagged with another athlete's email stay shared with that account, including an account created later with that email. The athlete also sees the email of the account that filmed it.
- Sets cut from a session stay private until the person who filmed them confirms them.
- Either person can hide an older shared set from their own list. The other person keeps it. Hiding never deletes.
- Only the person who filmed a set can change its tags. If an older set was tagged with the wrong email, email us and we remove the share.
- Nobody else. We do not sell data, show ads or share with data brokers. We disclose data to authorities only when the law requires it.
How long we keep it
- Your account: until you delete it.
- Sets, their tags and results: until the set or your account is deleted. In the app you can delete a set whose analysis failed; to delete any other set, email us.
- The original video of a set is deleted 30 days after the set's latest analysis, once the set has been graded. Its results stay (the graded video, pictures and rep list), but the set can no longer be analysed again. A set kept whole from a session loses its video the same way. A set that has never been graded keeps its video, so it can still be analysed.
- A session's video is deleted once it has been cut into sets. If no sets were found, it stays until you keep it as one set or discard it. Sets you remove when you confirm a session are deleted.
- Copies on our processing computer: the working folder is deleted after each analysis. A cache of converted videos and VLM Run replies is kept so that analysing a set again is not paid twice, and is deleted after 14 days unused.
- Purchase records: 5 years, as Greek tax law requires, even after the account is deleted, without any video.
- Past invites: we keep the address an invite went to, so it is never sent twice. The app no longer sends athlete invites.
Your rights
Wherever you live, you can ask us to:
- send you a copy of your data, including your videos, in common formats you can take elsewhere;
- correct something that is wrong;
- delete your account and everything you uploaded, or a set someone else filmed of you;
- stop or limit a use you object to.
Email privacy@mail.getperfectform.app from the address you sign in with, so we know it is you. It is free, and we answer within one month. You can withdraw camera or photos access at any time in iOS Settings, PerfectForm.
In the EU and UK these are your GDPR rights of access, rectification, erasure, restriction, objection and portability. You can also complain to a data protection authority: in Greece the Hellenic Data Protection Authority, or the one where you live.
Security
Data travels encrypted (HTTPS). Storage is private: each account can read only its own sets and the sets tagged with its email, enforced by the database's access rules. The keys that can read everything stay on our servers and are never in the app.
Data outside the EU
Your account and sets are stored in the EU. Resend, RevenueCat, VLM Run and TypeSafe AI are in the United States. Transfers to VLM Run rely on the EU Standard Contractual Clauses, as do transfers to TypeSafe AI. Transfers to Resend and RevenueCat rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. The UK has an EU adequacy decision.
Children
PerfectForm is not for anyone under 16, and we do not knowingly keep data of a user under 16. If you think a child has an account, email us and we delete it. If you film an athlete under 16, a parent or guardian must agree first.
Changes to this policy
When we change this policy we post the new version here with a new effective date. If a change affects how your data is used, we tell you in the app or by email before it applies.
Contact
privacy@mail.getperfectform.app
Emmanouil Kaparos Kaparakis, Andrea Koumpi 2, 19003 Markopoulo, Greece