1. Data Controller
BUBBLE DOTS S.L. ("Trevo", "we", "us", "our") is the data controller responsible for the processing of personal data collected through the Trevo mobile application and the trevoworkouts.com website (together, the "Service").
- Legal name: BUBBLE DOTS S.L.
- Spanish Tax ID (NIF): B27657832
- Registered office: Calle del Bruc 149, 08037 Barcelona, Spain
- Contact: develop@bubbledots.co
2. Information We Collect
a) Account information
- Email address and password (the password is stored only as a salted hash by our authentication provider).
- Sign in with Apple: we receive an Apple relay email and a user identifier; we never receive your Apple ID password.
b) Workout and fitness information
Information you provide when logging workouts or using the Service:
- Workout logs: exercises, sets, repetitions, weights, volume, duration, dates and optional notes.
- Raw input you submit for logging (typed text or voice transcripts).
- Personal records, statistics, streaks and progress history derived from your logs.
- Custom routines and saved training programs.
- Body measurements you choose to track (e.g. weight, body fat, circumferences).
- Unit preferences (kg/lb) and app language settings.
c) Onboarding preferences
During setup you may answer optional questions about your training goals, experience, focus areas and similar preferences. These answers are used to personalize your experience inside the app.
d) Subscription information
Subscription status, plan and purchase history managed through Apple and RevenueCat. We never receive or store full payment card details.
e) Technical and usage information
- Device model, operating system version, app version, language, time zone and App Store country.
- Product analytics events collected via Mixpanel (EU endpoint:
api-eu.mixpanel.com), when enabled. - Diagnostic data (crashes, errors, user id and optional email) collected via Sentry when enabled. Production builds do not attach screenshots or view hierarchies to crash reports.
- Live Activity session stats (exercise/set counts) displayed on your Lock Screen while a live workout is active. This data stays on your device and is managed by iOS.
3. How We Use Information
- Provide the core Service: AI-assisted workout logging, live sessions, routines, history, records and progress tracking.
- Personalize guidance based on your preferences and logged training data.
- Manage subscriptions, trials and restores with Apple and RevenueCat.
- Respond to support requests.
- Detect bugs, improve features and protect the Service from abuse.
- Comply with legal obligations (tax, accounting, legal claims).
4. Voice Logging and AI Processing (Not Medical Advice)
Trevo lets you log workouts by typing or speaking. When you use voice logging:
- Speech is converted to text on your device using Apple's on-device speech recognition.
- The resulting text (not raw audio) is sent to our servers for AI parsing into structured workout data.
Trevo uses artificial intelligence to interpret natural language workout descriptions. Automated outputs may be inaccurate. You can always review and edit results before saving.
Trevo does not provide medical, nutritional or training advice, diagnosis or treatment. Always train safely and consult a qualified professional for health or medical guidance.
5. Legal Basis (GDPR)
We process your personal data under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD) on the following bases:
- Performance of a contract (art. 6.1.b): to provide the Service you signed up for.
- Consent (art. 6.1.a): for optional permissions such as microphone and speech recognition when you choose voice logging.
- Legitimate interests (art. 6.1.f): to secure the Service, prevent abuse, improve features through aggregate analytics, and defend legal claims.
- Legal obligation (art. 6.1.c): to keep accounting and tax records.
6. Service Providers and Data Sharing
We share the minimum amount of data required with the following providers (data processors):
- Apple Inc. — App Store purchases, Sign in with Apple, Live Activities.
- RevenueCat, Inc. (USA) — subscription lifecycle management.
- Supabase, Inc. — authentication, database and serverless functions (including AI workout parsing).
- AI language-model providers — text parsing of workout descriptions, acting as data processors. Your data is not used to train third-party models.
- Mixpanel, Inc. — product analytics (EU endpoint).
- Sentry (Functional Software, Inc.) — crash reporting (EU ingest when configured).
We do not sell or rent your personal data. We may disclose data when required by law or to protect rights, property or safety.
7. International Transfers
Some providers (notably RevenueCat, Supabase and AI processors) may process data outside the European Economic Area. Where required, we rely on the European Commission's Standard Contractual Clauses (SCCs) and additional safeguards.
8. Data Retention
- Active accounts: we keep your data for as long as your account is active.
- Account deletion: when you delete your account from Settings → Delete account, your workout logs, routines, profile and related data are removed from our active database within 30 days. Encrypted backups are rotated and purged within 90 days.
- Billing records: invoices and subscription data are retained for up to 6 years to comply with Spanish tax and accounting law.
- Diagnostic data: crash reports up to 90 days; analytics events up to 24 months.
9. Your Rights
Under GDPR you can exercise the following rights by writing to develop@bubbledots.co:
- Access, rectification, erasure.
- Restriction and objection to processing.
- Data portability.
- Withdraw consent at any time (without affecting processing carried out before the withdrawal).
- Lodge a complaint with the Spanish Data Protection Authority — Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.
You can also delete your account directly from the app: Settings → Delete account.
10. Children's Privacy
Trevo is intended for users aged 16 and over (or the minimum age required in your country to consent to data processing). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
11. Security
We apply technical and organisational measures including encryption in transit (HTTPS/TLS), encryption at rest in our database, salted password hashing, row-level security in Supabase, and principle of least privilege. No system can guarantee absolute security.
12. Cookies (Website)
The trevoworkouts.com website may use strictly necessary cookies (for example, to store language preferences). The mobile application does not use cookies.
13. Changes to This Policy
We may update this Privacy Policy to reflect changes in our Service or legal obligations. Material changes will be notified in the app or by email. The "Last updated" date above always reflects the latest version.
14. Governing Law
This Privacy Policy is governed by Spanish law. Any dispute arising from it will be submitted to the Courts and Tribunals of Barcelona, Spain, unless mandatory consumer protection rules provide otherwise.