Legal

Privacy Policy

Last updated: October 3, 2026

Noostaa is a personal workout app for sessions planned with AI assistants, followed on iPhone, and optionally recorded or imported with Apple Health and Apple Watch. This Privacy Policy explains what information Noostaa collects, how it is used, and the choices available to people who use the Noostaa website, iOS app, API, CLI, MCP, and ChatGPT app integrations.

Who Is Responsible for Your Information

Noostaa is published and provided by Metalone Media (Metalone OÜ, Estonia). Metalone OÜ is responsible for the personal information processed through Noostaa as described in this policy. References to “we,” “us,” and “our” mean Metalone OÜ.

Information We Collect

We collect the information needed to provide the product:

• Account information from our authentication provider, such as your user identifier, email address, profile information, OAuth tokens, and login session details.
• Subscription and entitlement status, purchase and restore results, and the RevenueCat app-user identifier used to verify access. RevenueCat processes subscription information for Noostaa; Apple processes App Store transactions and payment details.
• Training plans and workout content you create, import, edit, or send through Noostaa, including titles, summaries, equipment, workout blocks, exercises, target duration, target effort, scheduled dates, recording activity type, and planning notes.
• Workout session feedback you submit, including completion status, effort, optional rating, comments, timestamps, set-level exercise feedback, completed reps or duration, actual load, skipped sets, and performance summaries.
• Apple Health and Apple Watch workout data when you choose to enable Health access, including workout records, start and end times, duration, active energy, distance, heart rate summaries, source, and related data quality indicators. Noostaa may also write completed Noostaa workouts and active energy to Apple Health when you enable those features.
• Imported workout activity records from Apple Health, including source identifiers used to avoid duplicate imports and link activity history.
• Assistant connection information for CLI, MCP, ChatGPT, or other assistant workflows, including connection status, client type, permissions, sync cursors, and the workout data those tools read or write after you authorize them.
• Device tokens when you register a device for app functionality such as notifications.
• Technical information such as IP address, request metadata, authentication events, API logs, diagnostic logs, and basic server observability data needed to operate and secure the service.

How We Use Information

We use information to authenticate users, check subscription access, provide workout planning and workout-following features, record and summarize workouts, import authorized Apple Health activity, sync data across devices and integrations, power Noostaa's API, CLI, MCP, and ChatGPT app tools, maintain security, troubleshoot problems, prevent abuse, and improve product reliability.

Apple Health and Apple Watch

Apple Health access is optional and controlled through iOS permissions and Noostaa settings. Noostaa uses HealthKit data only for workout functionality: recording workouts, saving completed Noostaa workouts and active energy, importing workouts you authorize, and showing training history and performance summaries. Noostaa does not use Apple Health data for advertising, tracking, marketing, or data mining.

ChatGPT App and Assistant Integrations

When you connect Noostaa to ChatGPT, an MCP client, the Noostaa CLI, or another assistant, the integration can read or write the Noostaa data that you authorize. For example, it may list workouts, create workouts, update workout fields, archive workouts, read workout session history, acknowledge assistant sync cursors, or read aggregate workout stats for your authenticated account. Noostaa does not give an assistant access to other users. Any information you provide to ChatGPT or another assistant is also handled under that provider's own terms and privacy policy.

Authentication Providers

Noostaa uses third-party authentication infrastructure to sign users in and issue OAuth tokens. That provider may process account and login information according to its own privacy practices. Noostaa stores or receives the tokens and account identifiers needed to maintain your session and authorize API access.

RevenueCat processes subscription identifiers, entitlement status, and purchase or restore information so Noostaa can verify subscription access across the app and connected services. Apple processes App Store purchase details and payment. Noostaa does not receive payment card information.

Website

The Noostaa website loads its fonts from Google Fonts. When you visit the site, your browser requests those font files from Google, which receives your IP address and standard request information such as your browser type and the page that made the request. Google handles that information under its own privacy policy. The website does not use advertising or analytics cookies. If you choose a light or dark theme on the website, that choice is saved only in your browser's local storage and is not sent to Noostaa.

How We Share Information

We do not sell personal information and do not use personal information for cross-app or cross-site tracking. We share information only as needed to operate Noostaa, comply with law, protect rights and security, process subscriptions, or complete actions you request through connected services. Service providers may process data for hosting, authentication, app distribution, subscription status, observability, email or support, and infrastructure operations.

Storage and Security

Noostaa stores user content in backend databases and uses access controls so authenticated requests are scoped to the user's private account. The iOS app stores login credentials in secure device storage and may keep local workout cache, outbox, settings, and Apple Health import cursor data on the device. No internet service can guarantee perfect security, but we use reasonable technical and organizational measures to protect information.

Data Retention

We keep account, subscription, workout, training plan, workout session, imported activity, assistant connection, and device information for as long as needed to provide Noostaa, comply with legal obligations, resolve disputes, and maintain security. If you delete content, we remove it from active product surfaces unless retention is required for backups, logs, security, or legal reasons.

Your Choices

You can choose what workout information you add to Noostaa. You can enable or disable Apple Health read and write features in the app and in iOS settings, disconnect assistant integrations, archive workouts, remove registered devices, or delete your Noostaa account from the Account screen. Account deletion removes your Noostaa account record and Noostaa workout data from active systems and signs you out locally, but it does not delete records controlled by third-party authentication, Apple, or other assistant providers. You can also contact us to request access, correction, export, or deletion of your account information where applicable law gives you those rights.

Children

Noostaa is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

International Use

Noostaa may process information in countries other than where you live. By using Noostaa, you understand that your information may be transferred to and processed in those locations.

Changes

We may update this Privacy Policy as Noostaa changes. If changes are material, we will take reasonable steps to notify users, such as updating this page or providing notice in the app.

Contact

For privacy questions or requests, contact privacy@noostaa.com.