Privacy Policy

Last updated: 1 October 2026

What the app accesses, and why

• Camera — to shoot your progress photos. Images are processed on your device.
• Photo library (optional) — Profile → Privacy → Photo Storage lets you choose Device only or Also in Photos. With Also in Photos, each check-in is also saved to a "CheckIn Pro" album in your own photo library. Comparison images and timelapse videos are saved there only when you tap Save or Share. If your photo library syncs to iCloud Photos or Google Photos, that is your Apple or Google account, governed by their terms — CheckIn Pro does not receive anything.
• Microphone & speech recognition — only when you use the optional "let's go" voice trigger to start a hands-free session. The trigger uses your device's speech recogniser (Apple or Google), which may process audio on their servers under their privacy terms. CheckIn Pro never receives, records, or stores audio.
• Motion (camera frames) — Motion mode analyses the live camera feed on-device to detect when you are in frame and holding still. Those frames are never saved or transmitted.

Where your data goes

• Photos you capture are stored in the app's private storage on your device (and, if you chose it, your photo library).
• Weight and measurements you log, your shows and dates, alignment, labels and settings are stored on your device only.
• Background removal and clean-up run entirely on your device. The results are cached on the device and can be cleared at any time in Profile → Storage.
• Backup and offload files are created only when you ask, and go only where you send them through your device's share sheet — Files, iCloud Drive, Google Drive, a computer, or a coach. CheckIn Pro never receives them.
• Your photos and check-in data are never uploaded to any CheckIn Pro server. (The only CheckIn Pro service is the invite relay described under Sharing with your coach, which carries a sealed message between two phones — never photos or check-in data.)

Subscriptions

CheckIn Pro offers an optional Premium subscription. Purchases are processed by the Apple App Store or Google Play, and subscription status is managed through RevenueCat. This involves an anonymous, app-generated identifier, your purchase and subscription state, and a few anonymous usage counts: how many check-ins you've completed and, as week numbers, when you installed the app and last checked in; whether you finished setup; and how many shows you've set up, photos you've imported, exports you've made, capture sessions you've started and times the upgrade screen was shown; taps on the in-app news and announcements; whether Google Drive connected for coach sharing; and, for Coach Mode, whether it's on and how many coaches or clients you're connected with. These are numbers only, not the content behind them. We use this to deliver Premium features and to understand, in aggregate, how people use the free version and when they subscribe. It is not linked to your identity and is not used for advertising or tracking. Your progress photos, measurements and show details are never sent. See Apple's, Google's and RevenueCat's privacy policies for how they process purchase data.

News in the app

The app's Home screen may show a card linking to an article on this website. To know whether there is anything current to show, the app fetches one small file from checkinpro.gamifiedapps.com. That request carries no identifier and nothing about you or your check-ins; if it fails, the card simply doesn't appear. Tapping the card opens the page in an in-app browser, and the note about embeds below applies to it.

Third parties

The app includes no advertising and no analytics that profile you. The only third parties are the ones above: your device's speech recogniser, the app store you bought from, RevenueCat for subscription status and — only if you turn on coach sharing — Google Drive (your own account) and the invite relay on Cloudflare.

This website

This website counts visits with Cloudflare Web Analytics, which sets no cookies, does not fingerprint you and does not track you across other sites. It tells us things like how many people visited and which link brought them here, in aggregate only. Store links on this site may carry a campaign tag (for example, "instagram") so the App Store and Google Play can tell us how many installs came from each channel; that tag identifies the channel, never you. Tapping a store button also adds one to an anonymous daily count for that store and channel (no cookies, nothing about you), so we can see how many visitors head to the store. See Cloudflare's privacy policy.

Some pages embed posts or videos hosted by Instagram or YouTube. When a page with an embed loads, those services receive your request and may set their own cookies, exactly as if you had visited them — their terms apply to that, not ours.

Sharing with your coach (optional)

Coach sharing is off until you turn it on under Profile → Coaching → Session Sharing with Coaches (Profile → Privacy & Storage in versions before 1.0.10).

• Where your photos go: you sign in with Google, and the app uploads the check-ins you choose to a "CheckIn Pro" folder in your own Google Drive. The app asks Google only for access to files it creates itself — it cannot see anything else in your Drive. Your Google sign-in happens on your device; CheckIn Pro never receives your Google account details.
• Encrypted before upload: each photo, and the list of your photos with their details, is encrypted on your phone (AES-256) before it leaves. Only the coaches you add can decrypt it; Google stores files it cannot read. The folder is shared by link so your coach can open it without a Google account. Folder and file names are not encrypted: anyone with the link could see your show name, session dates and pose names, but not your photos or measurements. Share the link only with your coach.
• Your coach's phone: their CheckIn Pro downloads previews and, when they open a photo, the full-size image, and keeps these on their device so they can view them. It cannot edit or delete your photos.
• Removing a coach locks them out of everything you share afterwards, and the copies on their phone are deleted the next time their app checks in. Removing your last coach empties the folder. We cannot recall screenshots or exports your coach already saved outside the app.
• Invite relay: when you invite your coach with a link, a small CheckIn Pro service (hosted on Cloudflare) passes one sealed, encrypted message between your phone and theirs so the two apps can connect. It cannot read that message, never receives photos, names or check-in data, and deletes the message once your phone picks it up, or after 7 days at most. It also keeps anonymous daily totals of how many invites were accepted and connections made: a date and a number, with nothing about who.
• Stopping: turn Session Sharing off, remove your coaches, or delete the "CheckIn Pro" folder from your Google Drive. You can revoke the app's Drive access at any time in your Google Account under Security → Third-party apps.

Your control

• Delete any photo, or a whole show, from the in-app Library at any time. Deleting a photo also removes its background-removal and clean-up files.
• Manage or delete the "CheckIn Pro" album from your device's Photos app.
• Deleting the app deletes everything it stored on your device. There is no account to close. If you used coach sharing, also delete the "CheckIn Pro" folder from your Google Drive.

Delete your data

Everything on your device is deleted when you delete the app (see above). The only data held anywhere else is the subscription record described under Subscriptions: the anonymous identifier, your purchase and subscription state, and the usage counts.

To have that record deleted, email physiquetracker@gmail.com with the subject “Data deletion” and the Member ID shown in the app under Profile → Your profile. We delete it within 30 days and reply to confirm. CheckIn Pro has no accounts and never receives your photos.

If you used coach sharing: your shared check-ins live in a "CheckIn Pro" folder in your own Google Drive, which you control — remove your coaches in the app (removing the last one empties the folder) or delete the folder in Google Drive, and revoke the app's access in your Google Account under Security → Third-party apps. Copies on a coach's phone are deleted the next time their app checks in. Invite-relay messages are sealed and delete themselves when picked up, or within 30 days at most; there is nothing in them we could identify you by.

Deleting the record does not cancel a subscription. Cancel it in your App Store or Google Play subscription settings; your purchase history also stays with Apple or Google under their policies.

Contact

Questions about this policy: physiquetracker@gmail.com