Privacy Policy

Last updated 28 July 2026

Luka is an AI strength & conditioning coach. To coach you it has to know things about your body and your training — so this page says exactly what it keeps, who else ever sees it, and how to take it all back.

Who we are

Luka is operated by The Pro Project Collective (ABN 42 512 136 505), of 5 Tasman St, Merimbula NSW 2548, Australia. We are the data controller for the information described here. For anything on this page, contact privacy@downloadluka.com.

What this covers

The Luka mobile app for iPhone and Android, the Luka web app, this website, and the back-end services behind them. It covers both kinds of user: athletes, who train with Luka, and coaches and support staff, who use it to run a squad. Where a section applies to only one, it says so.

What Luka stores

Your account

• Your email address, or the private relay address Apple gives us if you use Sign in with Apple.
• How you signed in. We never see or store a password — sign-in is a one-time emailed code or Apple.
• Whether you use Luka as an athlete or as staff, and your subscription state.

Your profile

• Name, and optionally a profile photo.
• Sex, date of birth, height and weight — used to scale training and interpret your numbers.
• Sport, position, level, available equipment, and which days and times you train.
• Your training philosophy, your goals, and the hours you work or study, so Luka plans around your real week.
• Injury history, in your own words, if you choose to give it.

Your health and wellbeing

This is the sensitive part, and we treat it that way. Daily check-ins record your sleep, energy, how you feel, your stress, and which areas of your body are sore, plus any note you add. Availability records whether you're injured, ill or away, and for how long.

Your training

• Sessions Luka plans for you and the exercises in them.
• Sessions you log — sets, reps, load, duration, how hard it felt (RPE), and the score.
• Your fixtures and results, jump-test (CMJ) results, streaks, and badges earned.

Your conversations with Luka

The messages you exchange with Luka are stored so your history is there next time you open the app. They are yours: no member of club staff can read them, and we do not read them except where you ask us to help with a specific problem, or where we must to investigate abuse or comply with the law.

If you join a club

Which club and squad you belong to, your role in it, and a single explicit setting: whether you share your wellbeing data with that club's staff. It is off unless you turn it on.

If you are a coach or support staff

• Your club's name, its squads, its invite codes, and who else is on staff.
• The sessions and fixtures you plan, the loads you set, and how you logged each session afterwards.
• What you record about players you coach: notes, flags you action, and adjustments such as easing a player in a session. Where that concerns a named athlete, it forms part of their data too — they can see it, and their rights below apply to it.
• GPS and tracking files you import. If you upload data from a GPS vest or another performance system, it is stored against the players it names. Only upload data you are entitled to share — see the coach obligations in the Terms of Use.

Service records

We keep a usage ledger of AI requests — when one happened, what it was for, which model answered and how many tokens it used — to run rate limits and the free tier. It does not contain the content of your messages. Our servers also keep short-lived technical logs (IP address, timestamp, error) that let us keep the service up and stop abuse.

What never leaves your phone

• Photos and videos. Anything you film in Movement Lab or attach to a session stays in the app's storage on your device. We operate no media storage and never upload them. If you ask Luka to analyse one, that single image is sent for analysis (see below) and the response comes back — the file itself is never stored on our servers.
• Your calendar. If you allow calendar access, Luka reads your events to place training around them. The calendar itself is never uploaded.
• Notifications. Reminders are scheduled locally on your device. We collect no push tokens and cannot send you anything remotely. If we add server-sent reminders we will store a device token for that purpose, ask first, and say so here.

Wearables and Apple Health

Luka does not read from a wearable or from Apple Health today. If you choose to connect one later, this is the commitment: we read only the categories you authorise, only to inform your training and readiness, and you can disconnect at any time from your device's own settings and from ours. Health data obtained through Apple Health, or from a device such as a Whoop or Oura, is never used for advertising or marketing, never sold, and never disclosed to a third party for their own purposes — including to your club, unless the same wellness-sharing switch is on.

The community board

Luka has an opt-in community board with leaderboards and shared programmes. It is off until you join it. If you do, other athletes can see your display name, your club and country if you set them, and the streak or consistency figure the board ranks on — plus any training week you deliberately publish. They never see your check-ins, your soreness, your injuries, your conversations with Luka, or anything else in this policy. Leave the board and your entry goes with you.

How the AI works

When you talk to Luka, your message goes to our server, which adds the parts of your profile and training history needed to answer well, and sends that to our AI provider. Any image you submitted for analysis goes with it. Your name, email and account identifier are not sent — the request is made by us, not by you. Under our agreement with the provider, your content is not used to train their models.

Luka's answers are generated. They can be wrong, and they are advice, not instructions — described further under “Luka is not a medical service” below.

Who else sees your data

We do not sell your data, we do not share it for advertising, and we run no advertising or analytics SDKs. It reaches other companies only where they are needed to run the service:

And one that isn't a company: your club's staff — only if you joined a club and turned wellness sharing on. Staff can read what they need to coach you safely: your readiness, your load, your soreness and availability. They cannot write to your data, and they can never read your conversations with Luka. Turn the switch off, or leave the club, and they stop seeing it.

We may also disclose data where the law requires it, and to a buyer if the business is ever sold — in which case this policy travels with it and we will tell you first.

Where your data goes

The providers above operate in the United States, so your data is transferred and stored outside Australia, the EEA and the UK. For transfers out of the EEA or UK we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), plus the data processing terms in each provider's agreement. For Australian users, we take reasonable steps under APP 8 to ensure recipients handle your data consistently with the Australian Privacy Principles.

Why we're allowed to hold it

For anyone in the EEA or UK, our lawful bases are:

• Performing our contract with you — your account, your profile, the training we write, your logs, your subscription.
• Your explicit consent for health and wellbeing data, which is special category data under Article 9. You give it by completing a check-in or recording an injury, and you withdraw it by deleting that data or your account. Sharing with club staff rests on a separate, specific consent — the sharing switch.
• Our legitimate interests in keeping the service secure, preventing abuse, and understanding aggregate usage — never in a way that overrides your rights.
• Legal obligation, for tax and accounting records.

In Australia, health information is sensitive information under the Privacy Act. We collect it only with your consent and only for the purpose you gave it: coaching you.

No decisions made about you by machine

Luka scores your readiness and suggests what tonight should be. Those are suggestions. No selection, contract, medical or other decision with a legal or similarly significant effect is made automatically — your coach decides, with Luka's reasoning visible to them and overridable at every point.

Young athletes

Luka is built for athletes including those under 18, and it is not intended for children under 13. In the EEA and the UK, if you are under 16 a parent or guardian must read this page and agree before you use Luka.

A parent or guardian may contact us at privacy@downloadluka.comto see, correct, or delete their child's data. We do not advertise to anyone, profile anyone for marketing, or sell anyone's data, at any age. If a young athlete joins a club, the same sharing switch applies — staff see nothing until it is on.

What you can do

• See and correct it. Everything is visible in the app and your profile is editable in Settings.
• Export it. Settings → Data → Export my data gives you a machine-readable copy of everything.
• Delete it. Settings → Account → Delete account removes your profile, training, check-ins, logs and conversations from our servers and from the device. It is immediate and cannot be undone. Deleting your account does not cancel an App Store subscription — cancel that in your Apple ID settings.
• Withdraw sharing. Turn off wellness sharing, leave the club, or leave the community board, at any time.
• Object or restrict. Depending on where you live you may also ask us to stop or limit a particular use, and to receive your data in a portable form.
• Complain. In Australia, to us first and then the OAIC (oaic.gov.au). In the EEA, your national data protection authority. In the UK, the ICO.

Most of this is a tap in the app. For anything else, email privacy@downloadluka.com and we will answer within 30 days. We will never charge you for a request or treat you differently for making one.

If you are in the United States

We do not sell your personal information and do not share it for cross-context behavioural advertising — under California law or any other. We collect sensitive personal information (health and fitness data) only to provide the service you asked for, and not for inferring characteristics about you. California, and residents of other states with similar laws, have the rights to know, correct, delete, and to appeal a refusal; exercise any of them at privacy@downloadluka.com, or through an authorised agent.

How long we keep it

Security

Data is encrypted in transit and at rest. Every table enforces row-level security, so one athlete's rows are unreadable to another at the database level rather than by convention. Staff access to a member's data is read-only and gated on that member's consent. Sign-in is passwordless, so there is no password of yours to steal from us.

No system is perfect. If a breach happens that is likely to cause you serious harm, we will notify you and the relevant regulator — under the Notifiable Data Breaches scheme in Australia, and within 72 hours under the GDPR.

Luka is not a medical service

Luka gives training and recovery guidance. It does not diagnose or treat injuries and is not a substitute for a doctor or physiotherapist. If something is sharp, worsening, or comes with swelling, giving way or numbness, see a professional.

Cookies and this website

This site runs no advertising, no analytics and no tracking cookies, so there is no consent banner to dismiss. The web app sets a cookie only to keep you signed in, and stores your session locally in your browser. That is all.

Changes

If we change this policy we'll update the date at the top, and tell you in the app when the change is significant. If a change means collecting something new that needs your consent, we will ask before it happens, not after.

Contact

privacy@downloadluka.com — or see the support page. The Terms of Use cover the rest of the relationship.