Last updated: October 14, 2026 — consent version 1.4
SkillScan is an AI calisthenics form-analysis app. This policy describes what data the app handles and how.
If you create an account, we store your email address and the profile details you choose to provide. Authentication is handled by Supabase. If you sign in with Apple or Google, we receive the email address that provider gives us (Apple may give a private relay address), and from Google also your name and profile photo.
If you add a profile photo, it is stored at a web address that is not published anywhere, but anyone who has that address can open it. Other athletes are never shown it.
Before your first plan, the app asks eight questions: the skill you want, the step you are on, about how long you can hold it, what you think breaks first, how often you train, what equipment you have, any joint to work around (wrists, elbows or shoulders), and where you heard about SkillScan.
To draw your first plan before you have an account, the app sends your step, your hold estimate, how often you train, your equipment and the joint you named to our server once. That request is not stored. When you create an account, all eight answers are stored with your profile, where they set your plan's doses and the coaching described below.
When you scan an attempt, your video is uploaded to our analysis server, hosted on Fly.io in Paris, France. There it is processed with Google's MediaPipe pose-estimation software — which runs entirely on our server, so your video is never sent to Google — to measure how long you held the position and how much of that met the gymnastics Code of Points. The video is deleted immediately after processing, whether the measurement succeeded or failed. Videos are not retained, published, or used for any other purpose.
The measurement itself is kept, because your training history is the product — it is how next month's scan can be compared with this one.
For each scan we store the numbers you were shown (seconds held, seconds clean, the deduction bands, joint-angle averages, the tier, step and resistance band you declared, and whether the clip came from the camera or your library) and the skeleton series those numbers were measured from: the position of 33 body points, several times a second, for the length of your hold. That is a stick figure over time. It includes points for your head, hands and feet, because a skeleton without them is not a skeleton.
It is not a picture. No frame of your video is kept, no image of your face is kept, and the series cannot be turned back into either. We keep the skeleton rather than only the final numbers so that a measurement we invent next year can be applied to the scans you have already taken, without asking you to film them again.
It is stored for as long as your account exists, it is deleted with your account, and it is not shared with anyone — including Anthropic.
The training plan stores the training sessions you mark as done and, if you choose to answer, which joint hurt in them (wrists, elbows or shoulders). That answer is used to make your next session lighter. Which joint hurt in a session is never shared with anyone; our analytics record only whether a session had pain, never which joint.
The plan is computed by fixed rules from your own scans and answers; no AI service is involved and no additional data leaves the service to produce it.
The plan is general fitness guidance, not medical advice. Stop on pain and see a professional.
If you are subscribed, or in your free week, the app asks Anthropic's Claude, an AI service, to write coaching for your scan. It does this on its own: after each scan you take, when you open Train and your newest scan has no coaching yet, right after you subscribe, and when you tap "Try again" on coaching that did not arrive. If you are not subscribed and not in a free week, nothing is sent to Anthropic.
What is sent is your scan's numbers — seconds held and clean, the deduction bands, your joint angles over the hold (about one reading a second), the tier you declared and the measurement's own notes — and five of your answers to the questions before your plan: how far along you are (from the step you chose), what you think breaks first, how often you train, your equipment, and the joint you named, so the coaching can work around it. Your video, your skeleton series, your name, your email and your account id are never sent to Anthropic. Under Anthropic's commercial API terms, this data is not used to train their models.
SkillScan has an opt-in ladder: a per-tier list of athletes ranked by their best clean seconds. It is off by default. If you choose to join it, other signed-in SkillScan athletes can see the display name you choose, your best clean seconds, your declared tier and the date of that scan. They never see your video, your skeleton series, your email, your full name or your profile photo. Only holds filmed with the in-app camera can appear; the tier is the one you declared. You can leave the ladder at any time in Settings → Leaderboard, and your row disappears immediately. Deleting your account removes it.
To understand whether the app works — which screens are reached, whether a scan completes, whether the paywall is seen — we send usage events to PostHog, an analytics service, hosted in the European Union. These events are linked to your account id and describe what happened in the app ("a scan completed", "the paywall was viewed"), never what was measured: your seconds held, seconds clean, joint angles and skeleton series are not sent to PostHog. PostHog also records when the app is opened and closed.
Your answers to the questions before your plan are sent to PostHog too, including your hold estimate, which is your own guess and not a measurement, and where you heard about SkillScan, which is kept on your PostHog profile. For the joint to work around, PostHog is told only whether you named one, never which. Events sent before you have an account carry no account id; when you create one, they are joined to it.
RevenueCat (see Purchases) also sends your subscription events — a free week started, a payment, a renewal, a cancellation — to PostHog, linked to the same account id. Under PostHog's terms, this data is not used for anything except showing us our own analytics.
Subscriptions are billed by Apple. We use RevenueCat, a subscription service, to know whether your account is subscribed; it receives your purchase state and your account id — never your videos, your measurements, or your skeleton series. Payment details stay with Apple and never reach us.
If you become a founding member, we store your founding member number and the date you joined with your profile.
If you are among the first fifty founding members, the note the developer writes to you about your first week is stored with your account and shown only to you.
Reminders — your training days, the end of your free week — are scheduled on your phone itself, and nothing about them is sent to us. If the app registers your phone for push notifications, its device token is stored with your account so we can deliver them, and is deleted with it. You can turn notifications off at any time in your phone's settings.
If the app crashes, a crash report is sent to Firebase Crashlytics, a Google service: the app version, your phone's model and system version, what the app was doing when it failed, and a random identifier for this installation. Crash reports are not linked to your account.
Our server's logs, kept by Fly.io for a limited time to run and debug the service, record requests to it, which include your IP address and, for some requests, your account id. They never contain your video.
You can delete your account from inside the app at any time: Settings → Delete account. Deletion is immediate and permanent — it removes your profile, your onboarding answers, your AI-consent record, your profile photo, and every scan and every skeleton series you have ever recorded. It cannot be undone.
Deletion also removes your training sessions and pain answers and any note written to you.
Records held by the services named above are not removed by the app: usage events in PostHog, subscription records in RevenueCat, crash reports in Crashlytics and server logs at Fly.io are kept under those services' own retention. To have your PostHog and RevenueCat records deleted, email us from the address on your account and we will delete them.
Deleting your account does not cancel a paid subscription; Apple controls billing, so cancel separately in your App Store settings. If you have trouble deleting your account, contact us at the address below.
ahmedmannai.dev@gmail.com