Privacy policy

1. Controller and contact

The Willn project determines the purposes and means of the processing described here and is responsible for it. The service is currently in free beta. The controller’s legal identity, postal address and privacy contact must be published before any commercial opening. In the meantime, testers can exercise their rights through the secure privacy portal, after verifying their phone number with a code received in Messages.

An account created in the app without a phone number does not use this portal or the STOP command: in the app, Profile, “Exporter mes données” gives the full copy and “Supprimer mon compte” deletes it; any other request (rectification, restriction, objection) can be sent to contact@getwilln.com.

2. Data processed

• Profile: first name, phone number, time zone, goal, coaching style and preferences, and the channel tag carried by the signup link (for example “tiktok”). Depending on the help requested, conversational onboarding may also collect age, height, weight, the sex parameter chosen to estimate energy needs, schedule, activity, eating habits, allergies and reported limitations. Every question can be skipped.
• Waiting list: once the beta places are taken, and only if you tap “Keep my place and let me know”, Willn keeps your first name, number, chosen coach and character, language and arrival channel, to tell you when a place opens and apply the promised discount. This data is erased two months after the last contact if you have not signed up.
• Coaching: messages, meals and estimated macros, water, weight, sleep, workouts, reported injuries and useful memories.
• Menus and groceries: menus, recipes, ingredients and shopping list prepared by the coach and shown in the app, as well as the items you add or tick there.
• Attachments: photos, sent in Messages or in the app Chat, and voice messages are processed temporarily to respond, without Willn retaining the files after analysis.
• Transport: phone number, technical identifiers, delivery status and temporary message copies in the iMessage gateway.
• Security: consent records, verifications, anti-abuse scope decisions, technical logs and AI usage costs.
• Duo, only if you turn it on: the link with the friend you chose, your sharing settings (exercise details, missed-workout alert, notifications) and invitation codes, stored as irreversible hashes.
• Free access: activation status and dates needed to operate your account. No payment method is requested or sent to Stripe for the free beta.
• Website visits, once traffic measurement is enabled: aggregated statistics, without cookies, on pages viewed, referring page, browser, operating system, device type and country.

In the iPhone app

• Account: you sign in with Apple, with a code sent to your e-mail address, or with a code received in Messages if your account was created on the website. With Apple, Willn asks for neither your name nor your e-mail: it only receives an identifier specific to Willn. Willn keeps only an irreversible hash of this identifier or of your e-mail address, never the plain value. Your phone number is only requested for the plan that includes iMessage.
• Onboarding answers: first name, the coach’s name, gender and character, age, height, weight, target weight and desired pace, the sex parameter used to estimate needs, goals, activity, experience, training places and equipment, training days, duration and time of day, meals per day, diets and food preferences, allergies, number of people and cooking time, obstacles and how you heard about Willn. They form your coaching profile. Your first name, your age (to check that you are an adult) and your consent are required.
• Tracking entered in the app: water, weight, completed workouts, sets, reps, loads and how the session felt. It joins the same tracking as in Messages.
• Chat: your messages and the coach’s replies join the same conversation as in Messages. The app only uses the camera or your photo library when you choose a photo to send.
• Device: for each signed-in iPhone, a sign-in token, the generic device name provided by iOS (for example “iPhone”) and the dates of sign-in and last use. The iPhone keeps the token in the iOS keychain; Willn keeps only a hash of it. The app also keeps your onboarding answers on the iPhone.
• Plan: App or App + iMessage, monthly or yearly, with its status and dates. During the beta, this choice is recorded without any payment.
• App Store purchases, once subscriptions open: Apple collects the payment. Willn will receive the purchase information from Apple: transaction identifier, product, price and storefront country, purchase and period-end dates, renewals, cancellations or refunds. It is used to open or close your access. Willn receives neither your name, nor your Apple Account e-mail address, nor your bank details.
• Notifications, once available and only if you allow them: the notification token Apple assigns to your iPhone, used to send you your coach’s messages and your reminders.

The service is only for people aged 18 or older.

3. Purposes and legal bases

• Creating the account on the website or in the app, signing you in, delivering messages (Messages or the app Chat) and providing the requested coaching, including menus and shopping lists: performance of the service.
• Personalizing coaching using health or wellness data: explicit consent.
• Managing your plan and, once they open, your subscriptions purchased in the App Store: performance of the contract. Keeping proof of sales: legal accounting obligation.
• Sending you notifications, if you allow them in iOS: performance of the requested service. You can turn them off at any time in your iPhone settings.
• Preventing abuse, securing the service and enforcing the cost cap: Willn’s legitimate interest in protecting its service, subject to the user’s rights.
• Measuring website traffic without cookies, once enabled: Willn’s legitimate interest in knowing how its website is used, with aggregated statistics only, under the conditions in which the CNIL exempts it from consent.
• Telling people on the waiting list when a place opens: consent, given by tapping “Keep my place and let me know” and withdrawable at any time by replying STOP.
• Sharing your workouts with a duo friend: explicit consent, given when you ask your coach for a duo code or send a friend’s code. You can withdraw it at any time with STOP DUO, and each sharing setting can be changed separately.
• Responding to rights requests and legal obligations: compliance with a legal obligation.

Health-data consent is given explicitly before any personalized coaching: in the web flow, by ticking the dedicated box in the app before creating the account or, for an invited tester, by replying J’ACCEPTE to the iMessage invitation. It can be withdrawn at any time with STOP or through the portal; for an account created in the app without a phone number, see section 1. Withdrawal does not affect the lawfulness of processing already carried out.

4. Artificial intelligence and decisions

In Messages and in the app alike, the coach is an AI, even when it carries the name you chose for it. Before coaching begins, the web flow or iMessage invitation states this clearly. Replies, nutrition estimates, menus and shopping lists, suggested memories, selective summaries of older exchanges and follow-ups are produced or selected using AI. These summaries retain useful coaching context after raw messages are deleted; they are neither complete nor exact transcripts. They may be inaccurate and should be checked. Willn does not use AI to make decisions that produce legal or similarly significant effects on the user. The service does not diagnose conditions, prescribe treatments or serve emergencies.

5. Recipients and providers

• Supabase : authentication, database and server functions, with the main project configured in Paris.
• Cloudflare : transport gateway and iMessage queue in an EU-restricted D1 database, website delivery and, once enabled, cookie-free website traffic measurement.
• OpenAI API : generating replies, menus and shopping lists, analyzing images (including those sent in the app Chat), transcribing voice messages, creating selective summaries of older exchanges and checking the name chosen for the coach, with application storage disabled. OpenAI also receives a random technical identifier specific to your account, which helps it detect abuse.
• Resend : sending sign-in codes by e-mail. E-mails are sent from its European region (Ireland), but Resend, a US company, stores your address and the message containing the code in the United States. Resend never receives your coaching data.
• Stripe : not used for free beta signup. This flow creates no Stripe payment or subscription.
• Your duo friend : only if you create or accept a duo, and only your workouts (planned, completed, and missed if you turn on the alert), with exercise details if you choose. Never your meals, weight, health data, memories or messages. Nothing from their own messages is passed to you beyond their workouts.
• Apple Messages and iCloud : iMessage transport and copies in Messages on the Willn Mac and the user’s devices, subject to Apple’s settings and terms.
• Apple (app, sign-in and App Store) : app distribution, “Continue with Apple” sign-in, delivery of notifications if you allow them and, once they open, subscription sales. For these purchases, Apple collects the payment and handles renewal, cancellation and refunds. Apple is responsible for its own processing, described in its privacy policy.

These providers receive only the data necessary for their role. Some processing may involve transfers outside the European Economic Area. Supabase, Cloudflare, OpenAI and Resend processing agreements provide transfer mechanisms, including standard contractual clauses. Sendblue remains configured only as an inactive backup and receives no data while the local gateway is active; any public reactivation will require users to be informed again.

6. Retention periods

• Raw messages, in Messages and in the app Chat alike: up to 90 days in the Willn database.
• Cloudflare gateway: 7 days after delivery; 30 days for a permanently failed message.
• Mac worker: text deleted after successful forwarding; up to 30 days only for failures awaiting retry; idempotency metadata retained for 90 days.
• Photos, including those sent in the app Chat, and audio files: Willn does not retain the file after analysis.
• Coaching memory, summaries, weight, performance and nutritional totals: retained while you have access to the service. After a trial or subscription actually ends, they are retained for 60 days to let you resume, then erased by the daily cleanup unless access has resumed. This period does not start when you click cancel and does not apply to active free-beta testers.
• This erasure includes conversations still in the Willn database and onboarding answers. The shorter retention periods above still apply. An account-deletion request does not wait for the 60-day period. Administrative account data and necessary evidence remain separate from coaching memory.
• Menus and shopping list: kept while the account exists, then deleted with it.
• Subscription data, including App Store purchase information once it exists: for the account’s lifetime, then as long as necessary for accounting, tax, evidence and fraud-prevention obligations.
• Duo: the link and its settings exist while the duo is active. They are deleted as soon as you send STOP DUO or STOP, request restriction or object, or either account is deleted. Invitation codes expire after 72 hours.
• App account: the hash of the Apple identifier or e-mail address is kept while the account exists, then deleted with it.
• iPhone sign-in: up to 180 days, or until you sign out. The token hash is deleted with the account.
• Verification codes: 10 minutes; portal session: 15 minutes.
• App sign-in codes, by e-mail or in Messages: valid for 10 minutes, five attempts at most. Willn keeps only a hash of them.
• Notification token, once notifications are available: kept while the iPhone is signed in, and deleted at the latest with the account.
• On your iPhone: the sign-in token is removed when you sign out; onboarding answers stay in the app until you delete it.
• AI cost measurements: up to 13 months.
• OpenAI: up to 30 days in abuse-monitoring logs by default; API data is not used to train models unless the account holder explicitly opts in.
• Resend: e-mail address and code message kept for 30 days, then deleted by Resend.
• Website traffic measurement, once enabled: detailed data kept for 7 days by Cloudflare, then statistics available for 6 months.
• Messages on Apple devices: retention is governed by each device’s Messages settings. A 30-day setting and an erasure procedure for the Willn Mac are prerequisites for public launch.
• Rights requests: as long as needed to process them, followed by any legally required evidence-retention period.

7. Your rights

Depending on your situation, you can request access, portability, rectification, erasure or restriction, object to processing, and withdraw consent. The portal lets you download data, including copies still in the gateway, stop coaching, delete the account and cloud copies controlled by Willn, cancel an active subscription when deleting the account, and submit a detailed request. A restriction or objection request immediately suspends messages and follow-ups while it is reviewed. You can also lodge a complaint with the CNIL.

In the app, the Profile lets you sign out (the iPhone’s token is then revoked), download a copy of your data (“Exporter mes données”) and permanently delete your account (“Supprimer mon compte”). An App Store subscription is cancelled in your Apple ID settings: deleting the account does not stop it. Notifications can be turned off in your iPhone settings. For any other request, write to contact@getwilln.com.

8. Security, cookies and updates

The website and the app have no direct access to tables containing personal data; sensitive operations go through server functions. The app identifies itself with a token specific to each iPhone, and Willn keeps only hashes of tokens and codes. Exchanges between the Mac, the gateway and Willn are authenticated, signed, replay-protected and idempotent. Consent is logged without copying conversation content.

Neither the website nor the app shows advertising or uses advertising trackers. Once enabled, the website traffic measurement (Cloudflare Web Analytics) will work without cookies or browser fingerprinting, and only produce aggregated statistics reserved for Willn. It will be configured to meet the conditions under which the CNIL exempts it from consent. Any significant change to this policy will be communicated and, where necessary, new consent will be requested.

The language selector remembers your French or English choice for one year in the willn_language cookie. Without a saved choice, the country supplied by the hosting provider and your browser language determine the display language. Willn does not request your GPS location or store your IP address for this feature.

Related documents