Evenstride privacy

This policy explains what happens to your information when you use the Evenstride app. Evenstride is made by Sunset Bytes Pty Ltd (ABN 92 699 875 128) (“Sunset Bytes”, “we”, “us”). We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, for people in the European Economic Area (EEA) or the United Kingdom, the GDPR and UK GDPR. Our general Privacy Policy covers our websites and other products. See also the Evenstride Terms of Use.

The short version

• Without an account, your health and fitness information stays on your phone. That’s your food log, weight, measurements, sleep, steps, goals, workouts and photos. We can’t see it.
• If you sign in, we keep a backup of your Evenstride data (not your photos) on our server in Sydney, Australia, so you can restore it on a new phone.
• If you join a gym, trainer or coach, you choose what they see with a switch for each kind of data, and you can change it any time. Progress photos and your full food diary are off unless you turn them on.
• Evenstride is free because it shows ads from Google AdMob. Your health, fitness and food information and your photos are never shared with advertisers, and data from Apple Health or Health Connect is never used for advertising or marketing.
• We don’t sell your information.
• You can export or delete it. Export my data and Erase everything are in the You tab, and You → Account → Delete account deletes everything we hold.

What we collect and why

• Profile (name, sex, year of birth, height, activity level, training experience, equipment, diet, units), at onboarding: to estimate your energy needs and suggest plans.
• Health and fitness (weight, body measurements, goals, food and water, workouts, sleep, steps, check-ins, days you mark as sick, travelling or injured), as you log them: to track your progress and adjust your targets.
• Photos (progress, food and profile photos), when you take or choose them: to show your progress, meals and profile.
• Account (email address, name if Apple or Google provides it, account id), if you sign in: to create your account, back up your data and connect you with a coach.
• Coaching (what you share with your coach, messages, bookings), if you join a business: to provide coaching between you and your coach.
• Push notification token and settings, app version, language and time zone, if you sign in and allow notifications: to send the notifications you’ve chosen, at sensible times.
• Barcodes and food search words, when you look up a packaged food: to find its nutrition information.
• Advertising identifiers and device information, collected by Google’s ad SDK: to show, limit and measure ads (see Advertising).

We don’t collect your precise location, contacts or microphone, and Evenstride has no analytics or crash-reporting tools of its own.

Health information is sensitive information

Health and fitness details are “sensitive information” under Australian privacy law and “special category” data under the GDPR. We only collect and use it with your consent and to provide Evenstride’s features to you:

• You choose to enter it, or to connect Apple Health or Health Connect.
• If you sign in, it’s backed up so you don’t lose it. Signing in is optional for personal use.
• It’s shared with a coach only through the sharing switches you set.

You can withdraw consent at any time by turning sharing off, disconnecting Apple Health or Health Connect, erasing your data or deleting your account. We never use health information for advertising or marketing, and never sell it.

Information on your phone

Evenstride saves what you enter in a file in the app’s private storage on your phone, with your photos alongside it.

Evenstride keeps these files out of your phone’s own backups: they aren’t included in iCloud Backup or computer backups on iPhone, or in Google’s Android backup or copied to a new phone on Android. To keep your data when you change phones, sign in (your account backup brings it back) or use Export my data.

You can:

• export your data (except photos) as a file: You → Export my data. If you work at a business, the file includes your place in it (the business’s name, your role and your staff profile) but not its clients’ information
• erase everything on the phone: You → Erase everything, or uninstall the app.

Signing in and your account backup

You don’t need an account to use Evenstride for yourself. You need one to back up your data, to start a business, or to join a gym, trainer or coach. You can sign in with:

• email and password. We email a 6-digit code to confirm your address and to reset your password. Your password is checked with a protocol that means it’s never sent to us.
• Sign in with Apple. Apple shares your name (the first time only) and your email. If you choose Hide My Email, we receive an Apple relay address instead of your real one.
• Sign in with Google. Google shares your name, email address and profile.

Accounts are run by Amazon Cognito in Sydney. Signing in with different methods creates separate accounts, even with the same email.

Your account backup. When you sign in, when you sign out, and when you tap You → Account → Back up now, Evenstride uploads a copy of your Evenstride data to our server, including your health and fitness information and anything read from Apple Health or Health Connect. It doesn’t include photos. If you work at a business, it doesn’t include the business’s clients’ information either: that’s kept with the business on our server, and comes back from there when you sign in. Signing out clears your phone; signing back in restores it.

Coaching: sharing with a gym, trainer or coach

Gyms, personal trainers and coaches (“businesses”) can use Evenstride to coach their clients. If a business invites you and you join, here’s how it works.

You choose what they see. Before you join, and any time later in You → Your coach, you set a switch for each kind of data. The choice is separate for each business.

• Weight trend (starts on): your weigh-ins and trend, goal, weekly check-ins, body measurements (with your sex and age, to work out body fat), Evenstride’s latest “back on track” suggestion, and the days you marked as sick, travelling, injured or at an event (not your notes).
• Workouts (starts on): workouts done, how often you train, and recent personal bests.
• Food (starts on): days logged and average energy each week, not every meal.
• Favourite meals (starts on): which planned meals you eat most.
• Full food diary (starts off): every food entry, so your coach can check and correct it.
• Sleep and steps (starts on): weekly averages, not each night.
• Progress photos (starts off): copies of your progress photos (below).

Turning a switch off stops sending that data, and our server stops showing what it already has. Your coach sees the most recent 12 weeks of what you share.

Who at the business sees it. The owner and managers, and your own trainer. Other trainers see you only if you’re assigned to them or the business lets all its trainers see all clients. Other clients never see your information; if you book a class, they see only that a place is taken.

What the business adds. Your coach can send you plans, meal weeks, targets, notes and messages, and can correct entries in logs you share with them. When you start with a trainer, they may record your goals, injuries, a pre-exercise health screening and starting measurements with you. That’s stored with the business and seen by its staff, not shown in your app as such; you can ask us for a copy.

Messages between you and the business are stored on our server so both sides can see them.

Leaving. You can leave in You → Your coach, or by joining a different coach. Leaving, being removed, or the business closing deletes your client record, shared reports, messages, corrections, bookings and shared photos from that business on our server. When you leave, your phone keeps your own copy of your messages, check-in recaps and technique notes, and the plan, meal week and targets they last sent, under You → Past coaching. It’s part of your Evenstride data: it’s in Export my data and your account backup, and you can delete it there any time. Plans, meal weeks and meals they sent stay on your phone. A coach’s phone keeps a working copy of what you share while you’re their client; it’s replaced the next time their app updates from our server.

Businesses are responsible for how they use your information. Gyms, trainers and coaches are independent of Sunset Bytes. We provide the tool and store the data; they decide what to do with what you share and what they record, and they have their own obligations under privacy law. Ask them about their privacy practices.

If you run a business. Your name, email, role and staff profile are visible to your team, and your trainer profile to your clients. Your business profile, branding and logo are shown to your clients and on invites. Invites can include the invitee’s name and email, which are deleted when the invite is used or two days after it expires. Only collect and share client information you’re allowed to, keep it confidential, and use it only to coach them.

Progress photos

Progress photos are off unless you turn on “Share progress photos with my coach”, when you join or any time later in You → Your coach. While it’s on and you’re signed in:

• A smaller copy of each progress photo (resized, and without location or camera details) is uploaded, including photos you took before turning it on. Photos taken while you’re offline wait on your phone and are sent later.
• The copies are stored encrypted on our server in Sydney, Australia.
• Only the owner and managers of that business, and your own trainer, can see them. Coaches see them through links that expire after 15 minutes, and their phone keeps them only in memory while the app is open.

The shared copies are deleted from our server when you delete that photo on your phone, turn sharing off, leave the business (or are removed, or it closes), or delete your account. Your originals always stay on your phone. Your profile photo and your own food photos are never uploaded.

Coaches and gyms: a photo you add to one of your own meals is uploaded when you send a meal week that includes it, so the clients you send it to see it. Your business logo is uploaded so it shows on invites and in your clients’ app. They’re deleted when you replace them or close the business.

Coach packs

A coach can also make a pack file of plans, meal weeks, their name, logo and a message, and send it to people directly (AirDrop, email, messages). Packs never pass through our server and never contain anyone’s logs, weights or photos. Opening a pack doesn’t share anything back.

Push notifications

If you’ve signed in and allow notifications, Evenstride registers your phone with our server to send coaching notifications: new messages, plans and bookings, session reminders, and for coaches, clients joining and checking in. To do this we store a push token (an identifier for your phone’s app), your platform, app version, language, time zone and notification settings.

Notifications are delivered by Google Firebase Cloud Messaging, and on iPhone through Apple’s Push Notification service. A message from your coach (or client) is the text of its notification. Other notifications say who did what, such as “Olive sent you a training plan”, never your numbers.

• Choose which kinds you get in You → Notifications.
• Quiet hours (9 pm to 7 am on your phone’s time, on unless you turn them off) hold back everything except booking changes and session reminders.
• Turn them off completely in your phone’s settings.
• Your registration is deleted when you sign out, delete your account, or don’t open Evenstride for 120 days.

Reminders you set in You → Settings → Reminders are scheduled on your phone and don’t go through our server.

Apple Health and Health Connect

If you turn it on (You → Settings), Evenstride reads your steps, sleep and weight from Apple Health (iPhone) or Health Connect (Android), and writes your weigh-ins and workouts back so your other health apps can see them.

What Evenstride reads becomes part of your Evenstride data: it’s stored on your phone, included in your account backup if you sign in, and shared with your coach only through your sharing switches (weight with Weight trend, sleep and steps with Sleep and steps).

Data from Apple Health or Health Connect is never used for advertising or marketing, never shared with advertisers or data brokers, never sold, and never used for anything other than Evenstride’s health and fitness features. You can turn this off in Evenstride, and choose exactly what Evenstride can read in the Health app or Health Connect.

Looking up packaged foods

When you scan a barcode or choose “Search online” when adding food, Evenstride sends the barcode number or the words you searched for to Open Food Facts (openfoodfacts.org), a free, non-profit food database in France. As with any website, Open Food Facts receives your phone’s IP address. Nothing else is sent: not your name, food log or health information. Products you look up are saved on your phone so they work offline. See Open Food Facts’ privacy policy.

Advertising (Google AdMob)

Evenstride uses Google AdMob to show ads. Google and its partners may collect and use:

• your device’s advertising identifier, if you allow it
• your IP address and approximate location from it
• information about your device and how you interact with ads
• diagnostic information.

This is used to show, limit and measure ads, and may be used to personalise ads.

Your choices:

• EEA, UK and Switzerland, and some US states: Evenstride shows Google’s consent form before any ads load, and you can change your choices any time in You → Privacy choices.
• iPhone: you may be asked whether to allow tracking. If you don’t, your advertising identifier isn’t shared. You can change it in Settings → Privacy & Security → Tracking.
• Android: you can delete or reset your advertising ID in your phone’s settings.
• Elsewhere, you can manage ad personalisation in Google’s My Ad Center.

Evenstride works fully whichever you choose.

None of your health, fitness or food information, and none of your photos, is ever given to Google or any advertiser. Ad requests from Evenstride carry no information about what you log. Ads are limited to content suitable for a general audience.

See Google’s privacy policy and how Google uses information from apps that use its services.

Links to other services

“Watch how to do it” opens a YouTube search, and a gym’s address opens Google Maps. Their own privacy policies apply there.

Where your information is stored, and overseas recipients

Our server is hosted by Amazon Web Services in Sydney, Australia. That’s where your account, backup, coaching data and shared photos are stored.

Some services we use are run from or may process information in other countries:

• Google (Firebase Cloud Messaging, AdMob): the United States and other countries where Google operates
• Apple (push notifications, Sign in with Apple): the United States and other countries
• Open Food Facts: France.

We choose established providers with their own security and privacy commitments, and send them only what they need. Under Australian Privacy Principle 8 we remain accountable for information we disclose to them, except where you direct the disclosure (for example, choosing Sign in with Apple or Google), or where they’re acting under their own terms (such as Google’s ad data). For people in the EEA or UK, see If you’re in the EEA or UK below.

Security

• Information is encrypted in transit (HTTPS) and encrypted at rest on our server.
• Every request needs your sign-in, and the server checks who you are and what you’re allowed to see, including your sharing switches, on every request.
• Photos are stored privately and reached only through links that expire after 15 minutes.
• Your sign-in is kept in your phone’s secure storage (the iPhone Keychain or Android’s encrypted storage).
• Access to our servers is limited to the Sunset Bytes people who run Evenstride. We look at personal information only to help you when you ask, to keep the service secure and working, or when the law requires.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we’ll tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

How long we keep it

• On your phone: until you delete it, erase everything or uninstall.
• Account and backup: until you delete your account.
• Shared coaching data and messages: while you’re with that business; deleted from our server when you leave, are removed, or it closes. When you leave, your own copy (Past coaching) stays on your phone and in your backup until you delete it.
• Shared progress photos: until you delete the photo, turn sharing off, leave, or delete your account.
• Invites: until used, or two days after they expire.
• Push registrations: until you sign out or delete your account, or 120 days without opening Evenstride.
• Server logs (used to fix problems and keep the service secure; they include IP addresses): 30 days.
• Our database’s automatic backups: deleted information can remain for up to 35 days before it’s overwritten.

Deleting your data

• Everything on your phone: You → Erase everything, or uninstall Evenstride.
• Your account and everything we hold: You → Account → Delete account. This deletes your account, your backup, your shared photos, push registrations and your place in every business (if you own a business, the whole business is deleted, after you confirm). You can choose to erase your phone too.
• Without the app: email us from the address on your account and we’ll delete it within 30 days. See deleting your Evenstride account.
• If you signed in with Apple: you can also stop using Sign in with Apple with Evenstride in your Apple Account settings (Sign in with Apple).

Children

Evenstride is for people aged 13 and over. If you’re under 18, please check with a parent or guardian before signing in or joining a coach. Users under 18 get maintenance energy targets only, never a weight-loss target. If you think a child under 13 has given us information, contact us and we’ll delete it.

Health information

Evenstride gives general fitness and nutrition guidance, not medical advice. Check with your GP before starting a new diet or exercise program. See the Terms of Use for more.

Your rights

You can ask us to:

• access the personal information we hold about you, including anything a business recorded about you in Evenstride
• correct it if it’s wrong
• delete it
• export it (You → Export my data, or ask us for what’s on our server).

Email us and we’ll respond within 30 days. We may need to confirm it’s you. If a business holds information about you outside Evenstride, ask them directly.

If you’re in the EEA or UK

Who’s responsible. Sunset Bytes Pty Ltd is the controller of your information in Evenstride. A gym, trainer or coach you join is the controller of what they record about you.

Our legal bases.

• Providing the service you asked for: your account, backup, coaching and notifications.
• Your explicit consent: health information (what you log, and anything read from Apple Health or Health Connect) and sharing it with a coach. You give it by turning those features on, and can withdraw it any time by turning them off, erasing your data or deleting your account.
• Consent: personalised ads, where the law requires it.
• Our legitimate interests: keeping Evenstride secure and working.

Your rights. As well as the rights above, you can restrict or object to how we use your information, ask for it in a portable format, and withdraw consent at any time (this doesn’t affect what we did before). You can also complain to your local data protection authority (in the UK, the Information Commissioner’s Office).

Your information goes to Australia. If you sign in, your information is stored on our server in Sydney, Australia. The EU and UK haven’t recognised Australia as giving adequate protection (there’s no “adequacy decision”), so we want to be plain about how it’s protected:

• we transfer it because it’s needed for the service you ask for (your backup, and coaching with a business you join) and, for health information, with your explicit consent
• it’s encrypted in transit and at rest, and only the Sunset Bytes people who run Evenstride can reach our servers
• we’re bound by the Australian Privacy Act 1988 and the Australian Privacy Principles, and give the same protections and rights described in this policy to everyone, wherever they live
• we’ll only disclose it to a government authority if Australian law requires it.

If you don’t sign in, your information stays on your phone. Google and Apple, which we use for notifications, ads and sign-in, rely on adequacy decisions or standard contractual clauses for their own transfers.

Our representative. Before Evenstride launches in the EEA or UK, we’ll name a representative there, as the GDPR and UK GDPR require, and add their details here.

Changes to this policy

When this policy changes we’ll update the date at the top. If a change affects how we use information you’ve already given us, we’ll tell you in the app before it takes effect.

Contact and complaints

Sunset Bytes Pty Ltd, Level 1, 63–73 Ann Street, Surry Hills NSW 2010, Australia.
Email support@sunsetbytes.com.au, or see Evenstride support.

If you have a concern about your privacy, email us first and we’ll respond within 30 days. If you’re not satisfied, you can complain to the Office of the Australian Information Commissioner (1300 363 992). In the EEA or UK, you can also contact your local data protection authority.