Private by design, honest about what leaves your phone.

Effective date: November 2, 2026

This Privacy Policy explains how SmoothWeek ("SmoothWeek," "we," "us," or "our"), operated by independent developer Zsolt Magyar, handles information when you use the SmoothWeek iPhone app or this website. Contact: [email protected].

Version scope: The version 1.6.1 controls described here apply when that version is installed. Earlier releases may use broader or automatic backups and may retain Health & Progress records; those differences are explained below.

1. Local data, workout content and optional business-data backup

SmoothWeek stores your professional profile, client names and contact details, notes, appointments, attendance, payment and package records, expenses, inventory, activity history, templates and settings locally. Some business data is shared with the app’s private Apple App Group container for widgets and Live Activities.

Local workout content can include exercise sets, repetitions, weights, durations, instructions, notes and personal plans. Optional workout sheets store an approved snapshot, drawn client or trainer signature images, signing times, archived versions and PDFs. A drawn signature records approval of the displayed snapshot; SmoothWeek does not verify the signer’s identity or certify its legal effect. A business or club logo may also be selected from an image or file.

Health & Progress recording, body-composition calculations and progress-photo capture are not available in version 1.6.1. Records and photos created in earlier releases can remain locally for compatibility until you explicitly delete them under Data & Backup. That removal remains available without an active Pro subscription.

In version 1.6.1, iCloud Backup is off until you review its scope and explicitly enable it. It saves selected business data to the private CloudKit database associated with your Apple Account: names and contact details, appointments and attendance, payment and package records, expenses, inventory, the general exercise library, business/club settings and logo, and general app settings. Activity backups contain only reviewed business-event metadata and fixed titles, with no arbitrary detail or before/after text.

New business-data backups exclude personal workout logs, plans, layouts and personal logging overrides; saved workout documents, signature images and PDFs; client, session, payment and expense notes; detailed activity text; and retired Health & Progress settings, measurements and photos. These remain local. Do not put health details into names, appointment labels, general library entries or other business fields that are backed up or mirrored to Calendar.

Normal updates to the existing app preserve your on-device records. Excluding content from the new iCloud backup does not delete it from your phone. Workout logs, personal plans, notes, signatures and saved PDFs remain stored locally when you update. Deleting the app and reinstalling it is different from a normal update.

If the device or app data is lost, local-only content cannot be recovered from SmoothWeek iCloud Backup. Persistent database directories are marked for exclusion from system device backups, including related storage files. This is system backup guidance and does not promise removal of historical Apple backups or independently created copies.

Some earlier releases automatically backed up a broader workspace, potentially including notes, workout content, signatures, PDFs or legacy tracking records. Older backups remain readable. After you enable the new backup or explicitly restore an older copy, SmoothWeek attempts an account- and workspace-verified replacement of its current cloud snapshot with the business-only format. Until that succeeds, the older cloud copy may still contain previously included content. A failed replacement retains both copies and reports an error. No deletion of historical Apple-managed backups is promised.

Turning backup off stops future uploads but does not delete an existing cloud copy. Onboarding offers review and opt-in before checking for an existing backup. A new-device restore recovers only content actually present in the accepted backup; current business-only backups cannot recreate excluded local content. Apple controls account access, storage, platform encryption and service availability. Backup is for recovery, not a SmoothWeek account or real-time collaboration service.

Information or files you deliberately share to WhatsApp, Messages, Mail, Files or another app are handled by that service under its own terms.

2. Temporary calendar links

When you explicitly choose Calendar or Both and start an SMS, WhatsApp, or Instagram send action, SmoothWeek creates a temporary bearer link for the recipient. To create it, the app sends only the event title, start time, end time, time zone, and an optional location to the SmoothWeek calendar-link service hosted by DreamHost. The service also records the creation time and technical expiry time.

The calendar-link service does not receive or place in the calendar file prices, currencies, invoices, payment status, package balances, internal notes, NEW or other internal client classifications, phone numbers, email addresses, Instagram usernames, or other client contact details. The calendar description is generic and contains no financial communication.

Anyone who possesses the link can open or import the appointment, so treat it like a bearer link and share it only with the intended recipient. The recipient chooses whether to import the event into their own calendar. SmoothWeek does not automatically add, edit, or delete an event in the recipient’s calendar.

Email calendar sharing remains a standard .ics attachment prepared on the device and does not require the temporary link service.

3. Subscriptions and purchase information

Apple processes App Store purchases, billing, renewal, cancellation, refunds, and payment credentials. SmoothWeek does not receive your full card or bank details. Apple provides purchase and entitlement information needed to unlock Pro and comply with billing decisions.

SmoothWeek uses RevenueCat to reconcile subscription products and Pro entitlement status. RevenueCat may process an anonymous app-user identifier, product identifier, purchase/receipt information, entitlement status, subscription dates, offer type, storefront or country information made available by Apple, and technical request data necessary to provide the service. Automatic device-identifier collection is disabled in SmoothWeek’s RevenueCat configuration. RevenueCat’s global PostHog integration is not enabled.

4. Optional Product Analytics

Product Analytics is off until you make an explicit choice after onboarding. Refusing does not restrict the app. You can change the choice at any time under Settings → Privacy & Security → Product Analytics.

If you allow analytics, SmoothWeek sends a limited event stream to our EU-hosted PostHog project. It includes a random app-scoped install identifier; event names; aggregate client/session counts; closed categories such as entry point, plan, offer type, and subscription source; and app version, build, platform, locale, plan state, and analytics schema version.

Analytics does not include client or provider names, phone numbers, email addresses, notes, message text, locations, client/session IDs, exact session dates or times, PIN or biometric information, payment free text, Apple Account identifiers, advertising identifiers, or cross-app tracking data. SmoothWeek does not use PostHog autocapture, session replay, heatmaps, advertising features, or feature-flag polling.

Before consent, eligible one-time milestones may be retained locally but are not sent. Repeatable and subscription events are not backfilled. Opting out stops future delivery and clears the pending local analytics queue. Events already received by PostHog are not automatically erased solely by changing the setting; you may request deletion as described below.

5. Device permissions and system features

Calendar conflict checking: With your permission, SmoothWeek reads timed events from the calendars you select to check overlaps. This check is processed on device and does not copy those external calendar events into the workspace or app backup. All-day events are ignored for conflict checking.

Optional Calendar mirroring: If you separately enable mirroring and grant full Calendar access, SmoothWeek creates or uses a linked SmoothWeek calendar and creates, updates or removes its mirrored appointment events. Mirrored fields include client name, session type, date/time, optional location and a SmoothWeek session link. Workout results, internal notes, prices and signatures are not included. The linked calendar may belong to iCloud or another account configured in Apple Calendar, so its account provider can store and synchronize those event fields. Disabling mirroring stops future synchronization; it does not itself delete existing events. This is separate from app iCloud Backup and from calendar-link sharing.

Calendar sharing: The recipient of a calendar link or .ics file chooses whether to import it. SmoothWeek does not automatically modify the recipient’s calendar through this sharing action.

Notifications: SmoothWeek requests permission contextually and schedules local reminders, including session and known Pro-expiry warnings. It does not operate a remote-push notification service.

Device authentication: Apple’s LocalAuthentication framework reports whether authentication succeeded. App Lock and protected full-data erasure can use Face ID, Touch ID or the device passcode. SmoothWeek does not receive, store or transmit biometric templates or your device passcode. Protected erasure still requires a typed confirmation and final review.

Contacts and selected images: The native picker lets you select specific contact details or a business logo image. Selected contact details are copied into the client record and may be included in business-data backup. A business logo can be included with business settings. SmoothWeek does not upload the address book or photo library as a whole.

6. Why we process limited external data

• to create a temporary calendar link only when you request that action;
• to create and restore the private iCloud workspace backup you expect from the app;
• to provide, verify, restore, and secure subscription access;
• to comply with Apple purchase, refund, and entitlement decisions;
• with your consent, to understand aggregate product activation, reliability of core flows, and subscription lifecycle;
• to answer support and privacy requests you send to us;
• to protect the service, enforce our terms, or meet legal obligations.

Where the GDPR or similar law applies, the relevant legal bases are performance of the service contract for requested calendar-link, backup, and subscription functionality; consent for optional Product Analytics; legitimate interests in security and support where those interests are not overridden by your rights; and compliance with legal obligations.

7. Retention and deletion

Calendar-link data expires after the event’s end time plus 30 days. Expired records are removed automatically or during service maintenance, and the link can no longer be used to import the event.

In version 1.6.1, Data & Backup → Delete personal data allows targeted deletion of workout entries, plans, saved workout sheets and client/session notes without renewing Pro. Deleting an entry or plan also removes that session’s saved plans, signed versions, signature images, PDFs and copied workout history so those copies do not retain the deleted content. A saved sheet version can be deleted separately. Client-wide or all-workout removal is also available, including orphaned saved documents. Business records and the general exercise library are kept. Retired Health & Progress records and photos have a separate explicit deletion action.

These targeted actions remove local content. An older cloud backup can retain previously included content until a successful business-only replacement or full-data cloud deletion. Shared, imported or historical copies outside SmoothWeek must be managed where they were saved.

Erase All Data deletes the local workspace and app-owned temporary exports, resets setup and requests deletion of the current private CloudKit backup. Cloud removal can require connectivity or a retry. Pending removal is reported in Data & Backup; check its status before uninstalling. Uninstalling does not itself request cloud deletion, and iOS controls removal of local app storage. Neither action cancels an Apple subscription.

Full-data erasure offers a separate choice to remove verified mirrored events from the linked SmoothWeek calendar. If you keep them, the events remain while the app forgets its link. If you request removal, other calendars and moved or imported copies remain untouched. If Calendar removal fails, the workspace is kept for a retry or a different choice; some verified events may already have been removed before a later failure. The app does not delete an entire calendar or unrelated events.

Temporary workout PDF files are removed after their preview/share use ends. Abandoned app-owned exports are eligible for cleanup after 24 hours, and full erasure clears owned temporary exports. Files already handed to another app, imported Calendar events and copies made by recipients cannot be recalled by local deletion.

Subscription expiration, revocation or billing retry does not automatically delete local or cloud workspace data. Business editing is restricted in Locked Demo Mode, but the privacy deletion tools and full-data reset remain available. Restore Purchases restores access rights; cloud restore is a separate operation.

Pending optional analytics events are kept in a bounded local queue and cleared when you opt out. Opting out does not automatically delete events already received by PostHog. Subscription/processor data and Apple-managed records remain subject to the retention and rights described in this policy and the providers’ policies. Contact us about data we control.

8. Service providers and international transfers

• Apple Privacy Policy — private iCloud/CloudKit backup, App Store purchases, and Apple platform services.
• RevenueCat Privacy Policy — subscription entitlement infrastructure.
• PostHog Privacy Policy — optional consented product analytics, using EU hosting.
• DreamHost Privacy Policy — website hosting, the dynamic calendar-link service, and ordinary technical and security logs that may include request time, network address, user agent, status, and requested link path.
• Cloudflare Privacy Policy — website edge delivery, security and Web Analytics performance measurements. Beacon data documentation.

These providers may process information in countries different from yours. Where required, transfers rely on applicable contractual or legal safeguards. The website does not use advertising pixels or the app’s PostHog integration. Cloudflare provides edge delivery and security and may inject a Web Analytics performance beacon into served pages. This beacon sends page-load and traffic measurements to Cloudflare; it is separate from optional in-app Product Analytics. DreamHost and Cloudflare may process ordinary technical request and security data for delivery, abuse prevention and reliability.

9. Your choices and privacy rights

Depending on where you live, you may have rights to be informed, access, correct, delete, restrict or object to processing, withdraw consent, obtain portable data, and complain to a supervisory authority. California residents may also have rights to know, correct, or delete certain personal information and to receive equal service when exercising applicable rights. SmoothWeek does not sell or share personal information for cross-context behavioral advertising.

Email [email protected] with “Privacy request” in the subject. We may ask for limited information needed to verify and locate the relevant install or support record. We aim to respond within the period required by applicable law. Because core workspace data is local and we have no user account, we may not possess or be able to remotely retrieve it.

10. Children

SmoothWeek is a general productivity tool for independent professionals and is not directed to children under 13. We do not knowingly collect personal information from children through the app. If you believe a child has provided information through support or optional analytics, contact us.

11. Security

We use reasonable technical and organizational safeguards appropriate to the limited data flow, including local app-container protections, Apple’s private CloudKit database and encrypted asset storage, optional device authentication, HTTPS for external requests, strict request allowlists, cryptographically random calendar-link tokens, hashed token storage, rate limiting, limited retention, strict analytics allowlists, and minimized identifiers. Calendar links are not searchable by design, but possession grants access until expiry; protect them like other private shared links. No system is completely secure, and you should protect your device, Apple Account, passcode, backups, links, and exported communications.

12. Changes and contact

We may update this policy when the app, providers, or law changes. The effective date above identifies the current version. Material changes will be presented through an appropriate in-app or website notice when required.