Privacy Policy
Note: This updated Privacy Policy will take effect on November 1, 2026. Until then, our current Privacy Policy remains in force — see it here.
1. Who we are
OWNU is a strength training app helping you train smarter. The company behind OWNU is:
Oberg Fitness AB
Org. no. 559153-9779
Our contact details, including how to contact us and our Data Protection Officer (DPO), are set out in Section 15.
2. What this Policy covers
This Policy covers both our website (ownuapp.com) and the OWNU app, as well as related support, marketing, survey, and feedback interactions. It explains what personal data we collect, why, who we share it with, and what rights you have.
We are committed to presenting this information in a way that is clear and easy to understand, so that you can make informed choices about your data.
3. Data we collect and why
On the website
Depending on how you use our website, we may collect technical data such as your IP address, browser type, device, pages visited, approximate location derived from IP, and how you interact with the site. We may also collect your name, email address, and other information you choose to provide if you fill in a form, respond to a survey, or otherwise contact us.
As summarised in the table below, we use this data for different purposes and on different legal bases depending on the type of processing. This includes running the website, analysing traffic, improving the user experience, collecting feedback, and, where applicable, serving and measuring advertising.
Website hosting and visitor logs
Running the website, maintaining security, and monitoring performance
Legitimate interests
Website analytics data (for example page views, sessions, traffic source, device type, browser, and approximate location derived from IP)
Understanding website traffic, measuring campaign effectiveness, and improving the user experience
Consent
Advertising and audience tracking data (for example page views, clicks, conversions, IP address, browser, device information, and ad-related events, and data collected through tools such as the TikTok Pixel and Pinterest Tag)
Measuring advertising performance, tracking conversions, creating retargeting audiences, and optimising advertising
Consent
Name, email address, survey responses, and other information you choose to submit through website forms
Responding to your enquiries, collecting feedback, and processing form or survey submissions
Legitimite interest
See Section 7 for more detail on cookies and tracking and Section 8 for marketing communications.
In the app
When you use the OWNU app, we collect the personal data needed to provide core app features, personalise your experience, and keep the service secure and working properly. The main categories of personal data we collect in the app, together with the purposes and legal bases for that processing, are summarised in the table below.
Name, email address
Creating and managing your account
Contract
Date of birth / age
Tailoring safe training content; verifying minimum age
Contract
Login data via Google Firebase
Secure authentication
Contract
Training preferences (goals, experience, workout types)
Personalising your training programme
Contract
Pregnancy / post-pregnancy status
Offering safe and appropriate training content
Explicit consent
Training log (exercises, weights, sets, reps, progression)
Providing the core training service
Contract
Progress pictures (optional)
Enabling the progress tracking feature you choose to use
Explicit consent
App usage, diagnostics, and analytics data (features used, session data, crash logs, request and device data)
Operating the service, improving app performance, troubleshooting issues, and understanding feature usage
Contract for service operation; consent for app analytics, diagnostics, troubleshooting, and feature-usage analysis
Subscription status, tier, and purchase events
Managing your subscription, access to paid features, and related subscription performance analysis
Contract for subscription management; consent for subscription analysis
Payment and billing data
Processing payments, refunds, and related billing records
Contract
Support messages and related support data (such as email address, account ID, device and app information relevant to the issue, and any information you choose to provide in support conversations)
Providing customer support, handling internal follow-up, maintaining continuity in support conversations, and handling complaints
Legitimate interests for the processing of support communications and related data. Contract where responding to your request is necessary to perform our agreement with you. Consent where Intercom stores an identifier on your device prior to or independently of a support interaction
Transactional messages, surveys, and form submissions
Sending service communications and collecting feedback you choose to provide
Contract for service communications; consent for optional surveys and forms
Heart rate, sleep data, and other health metrics from connected wearables
Enriching your training insights
Explicit consent
Location data (gym check-in)
Enabling location-based features
Explicit consent
Social features data (connections, activity sharing)
Enabling social and community features
When you choose to share a summary of your workout to an external platform, we process the selected activity databased on your explicit consent (Article 6(1)(a) and, where applicable, Article 9(2)(a) GDPR). You control what information is included and sharing requires anactive choice from you each time.
Legitimate interests
Where we rely on legitimate interests as a legal basis, we have assessed that our interests in maintaining website security and performance, responding to enquiries, and handling optional feedback are real and current, that the processing is necessary to achieve those purposes, and that our interests are not overridden by your privacy interests or fundamental rights. Processing in the app that relies on app-based tools accessing or storing information on your device is instead based on your consent where required. You have the right to object to processing based on legitimate interests at any time (see Section 9).
4. Sensitive and health data
Health data, biometric data, and similar sensitive categories receive a higher level of legal protection under GDPR. As a starting point, processing such data is prohibited unless a specific exception applies.
The following data we collect falls into this category:
- Pregnancy and other health information: provided during onboarding to allow us to offer appropriate training programmes
- Progress pictures: voluntarily uploaded photos that may reveal information about your physical health or body composition
- Heart rate, sleep data, and other biometric data: collected from wearable devices or health apps you choose to connect to OWNU (such as Apple Health, Google Fit, Garmin, or similar)
For each of these data types, we rely on your explicit consent as the legal basis. Consent must be freely given, specific, and informed. You have the right to withdraw your consent at any time, and it must be just as easy to withdraw consent as it was to give it.
Explicit consent, as opposed to ordinary consent, is specifically required when processing sensitive personal data such as health information.
We collect explicit consent for each type of sensitive data separately, at the point where you choose to provide it. You can withdraw consent and delete this data at any time through the app settings.
Our commitment on health data: We apply specific safeguards to protect your health data, such as restricted access, encryption, and clear limits on how it can be used and shared. Where special category data is processed on the basis of consent, you can withdraw that consent at any time.
5. Who we share your data with
We share your data only with trusted service providers and selected advertising platforms that help us run the website and app, provide support, process payments and subscriptions, send communications, collect feedback, and measure usage and marketing. Depending on the processing activity, they may act as data processors or service providers, or as controllers in their own right . We do not sell your data.
We work with providers in the following categories:
Authentication and infrastructure
Secure login, data storage, app hosting
Analytics
Understanding how the app and website are used
Payments and subscriptions
Processing payments and managing your subscription
Email and messaging
Sending service communications and communications you have opted in to, and measuring delivery and engagement for opted-in marketing emails
Advertising
Serving and measuring ads, tracking campaign performance, and building advertising audiences. Where tools such as the TikTok Pixel or Pinterest Tag are used, OWNU and the relevant platform are joint controllers for the collection and measurement of data through the tool, and the platform is an independent controller for its subsequent use of the data.
Customer support
Managing support conversations
Website hosting and performance
Hosting the website, CDN, security
Survey and feedback tools
Collecting optional form responses, surveys, user feedback, and research inputs
6. International transfers
Several of our service providers are based in the United States. Personal data may only be transferred to a country outside the EU/EEA under certain conditions, and we must ensure an adequate level of protection for individuals' rights and freedoms. We rely on EU Standard Contractual Clauses (SCC) as the legal mechanism for transfers to the United States. Where applicable, we also rely on the EU–US Data Privacy Framework (DPF) for providers certified under that framework.
You can request information about the specific safeguards in place for any transfer by emailing privacy@ownuapp.com.
7. Cookies and tracking
On the website: We use cookies and similar tracking technologies for analytics, advertising, audience measurement, retargeting and website functionality. Only strictly necessary cookies are placed without your consent. All other cookies, including analytics and marketing cookies, require your prior consent, managed through our cookie banner.
For a full list of cookies and tracking technologies used, their providers, and how to manage your preferences, see our Cookie Policy.
In the app: The app does not use browser cookies, because cookies are a browser-based technology. Instead, we use app-based analytics, subscription, and support tools and similar technologies to operate the app, understand how it is used, improve performance and functionality, and manage support. Where these tools access or store information on your device for purposes that are not strictly necessary, we rely on your consent. For a broader overview of the personal data we collect in the app and how we use it, see Section 3 under “In the app”.
8. Marketing communications
We only send you marketing emails, push notifications, and similar marketing messages if you have actively opted in. We do not use pre-ticked boxes.
Your consent covers specific communication types and channels and, where applicable, the use of email engagement measurement in marketing emails, such as tracking whether an email is opened or a link is clicked. We use this information to measure campaign performance, understand what content is relevant, and improve our marketing communications. You can withdraw consent and manage your preferences at any time:
- Through Settings in the app
- By clicking “Unsubscribe” in any marketing email
- By contacting privacy@ownuapp.com
We log each consent with a timestamp and the text you saw at the time.
We use Customer.io to segment users based on marketing email engagement activity and tailor the communications you receive. Current segments include trial users, subscribers, inactive users, cancelled trial users, cancelled subscribers, and super-users. We may also use advertising platform tools, including TikTok and Pinterest tools where you have given the required consent, for advertising measurement, retargeting, optimisation, and personalisation Where such segmentation or advertising activity involves evaluating personal aspects relating to you in order to personalise content or marketing, this constitutes profiling under Article 4(4) GDPR. You have the right to object to profiling for direct marketing purposes at any time and without giving a reason. See Section 9 for how to do this. This right is absolute: if you object to profiling for direct marketing, we must stop processing your data for that purpose without any balancing of interests.
9. Your rights
Under GDPR, you have the right to access, correct, delete, restrict, and port your personal data. You also have rights in relation to automated decision-making.
Here is a summary of your rights and how to use them:
Access
Get a copy of the data we hold about you
Email privacy@ownuapp.com
Rectification
Ask us to correct inaccurate data
Update in app settings, or email us
Erasure
Ask us to delete your data
Email privacy@ownuapp.com
Restriction
Ask us to pause processing while a dispute is resolved
Email privacy@ownuapp.com
Portability
Receive your data in a machine-readable format
Email privacy@ownuapp.com
Object
Object to processing based on legitimate interests. Object to direct marketing, including profiling for direct marketing purposes. This right is absolute and requires no justification.
Email privacy@ownuapp.com; for marketing, use unsubscribe link or app settings
Withdraw consent
Withdraw consent for health data, marketing, cookies, surveys, or other consent-based processing at any time
App settings, unsubscribe link, cookie banner, or by contacting us
Complaint
Lodge a complaint with the supervisory authority
Contact IMY at imy.se
We respond to all rights requests within one month. Requests are free of charge.
Supervisory authority: You have the right to lodge a complaint with the competent supervisory authority in your jurisdiction. In Sweden, this is IMY Integritetsskyddsmyndigheten (imy.se, imy@imy.se, +46 8 657 61 00).
10. How long we keep your data
We keep personal data only for as long as is necessary for the purposes for which it was collected.
Account and authentication data
For as long as your account is active and, where needed, for up to 24 months after account deletion or inactivity to allow reactivation, handle support issues, and comply with legal obligations
Training data and preferences
For as long as your account is active and, where relevant, for up to 24 months after account deletion or inactivity to support account reactivation and customer support
Sensitive and optional feature data
This includes pregnancy or other health information, connected wearable data, and location data where the relevant feature is enabled. We keep this data only for as long as your account is active and you continue to use the relevant feature, or until you withdraw your consent, disconnect the integration, or disable the feature, as applicable. The data is then deleted within 30 days, subject to limited backup retention for up to 90 days.
Progress pictures
Until you delete them, withdraw your consent, or close your account. They are then deleted within 30 days, subject to limited backup retention for up to 90 days.
App usage, diagnostics, and analytics data
Technical logs are generally kept for up to 30 days. Product and usage analytics may be kept for longer, typically up to 7 years, depending on the tool and purpose.
Support messages and records
Customer support messages are generally kept for up to 24 months after a support case is closed. Internal support handling and troubleshooting records are generally kept for up to 60 days.
Transactional messages and service communications
Generally, for as long as your account remains active, and for a limited period afterwards where needed to document delivery of essential service communications or handle related issues.
Subscription, payment, and revenue records
Generally, up to 7 years where required for bookkeeping, tax, accounting, and related business record-keeping.
Social features data
For as long as your account is active and you use the relevant social feature, and where needed for account recovery, abuse prevention, or support, for a limited period afterwards.
Marketing consent records
For as long as necessary to demonstrate compliance, typically for as long as you remain subscribed to marketing and for up to 5 years afterwards. We may keep suppression records for longer to ensure that we continue to respect your opt-out.
Website hosting and visitor logs
Generally, up to 90 days.
Website analytics data
Generally, up to 14 months, but only while your consent remains valid. If you withdraw consent, we stop the related analytics going forward.
Advertising and audience tracking data
Generally, up to 24 months, but only while your consent remains valid. If you withdraw consent, we stop the related advertising and audience tracking going forward. Some aggregated reporting data may be kept longer in line with provider settings.
Forms, survey responses, and direct contact details
Generally, up to 36 months, unless we need to keep them longer to handle an ongoing matter or demonstrate compliance.
11. Security
We protect your data with appropriate technical and organisational measures, including encryption in transit, access controls, and secure cloud infrastructure. In the event of a data breach posing a risk to your rights and freedoms, we will notify the relevant supervisory authority (IMY) within 72 hours and inform affected users where required.
12. Children
OWNU is not intended for anyone under 16 years of age. We collect date of birth during registration and use this to verify that users meet the minimum age requirement. If a user is identified as being under 16, their account will not be activated and any data collected during registration will be deleted. We do not knowingly collect data from children under 16. If you believe we hold data about a child, please contact us at privacy@ownuapp.com.
13. Changes to this Policy
When we make material changes to this Policy, we will notify you, for example, via a notice in the app or by email, before the changes take effect. Where a change affects processing based on your consent, we will seek fresh consent before the new processing begins.
14. Additional rights in other jurisdictions
Depending on where you live, you may have additional privacy rights or be entitled to additional disclosures under laws other than the GDPR. These laws may apply based on your country, state, or place of residence.
For example, users residing in certain U.S. states may have rights under state privacy laws such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and other similar U.S. state privacy laws. Where such laws apply, we will comply with them and may provide supplemental notices or disclosures relevant to users in those jurisdictions.
If you would like more information about the privacy rights that may apply to you based on your place of residence, please contact us using the details below.
15. Contact
Oberg Fitness AB
Fänrikens gata 7, 183 72 Täby, Sweden
If you have questions about our privacy practices, this Policy, or the exercise of your privacy rights, or if you would like to contact us or our Data Protection Officer (DPO), please use the contact details above. If your enquiry is intended for the DPO, please include “DPO” in the subject line.
