Privacy Policy

This policy covers the Legato iPhone app and this website. “Legato”, “we” and “us” mean the developer of Legato. You can reach us at support@trainlegato.com.

02Using Legato without an account

An account is optional. Without one, your profile, quiz answers, splits, sessions and settings are saved only on your phone, in the app’s own storage. We don’t receive any of it. Deleting the app, or using Settings › Reset Legato, removes it.

03If you create an account

An account backs up your progress and syncs it between your devices. You can sign in with email (a password or a one-time code sent to your inbox) or with Sign in with Apple. When you are signed in, we store:

• Account details: your email address. With Sign in with Apple this can be a private relay address if you choose to hide your email. Passwords are handled by our sign-in provider and are never stored in plain text.
• Your profile: the name you enter, your age if you give it, your quiz answers (such as your training style, your rest habits and which apps you said distract you) and your device look (finish, pad, screen and accent).
• Your splits: the workouts you create, with their exercises, sets, reps, weights, rest times and training days.
• Your sessions: for each finished workout, its name, start and end time, sets done, total volume, average rest, “mental reps”, and whether you unlocked your apps early.
• Your settings: units, sounds, haptics, reminder time, which music service you use, hard lock, and a few app states (such as which level-up screen you have already seen).

We use this only to run Legato for you: to show your history, streak, levels and Monthly Wrapped, and to keep your devices in sync. Your subscription status is not stored with your account; it comes from your App Store purchase.

04What we never collect

• Which apps or websites you lock (see below).
• Your music files, and your music libraries or listening history.
• Your payment details.
• Your location, contacts, photos or health data.
• Advertising identifiers. Legato contains no ads and no analytics or tracking tools.

05Locked apps and Screen Time

Legato uses Apple’s Screen Time (Family Controls) to lock the apps you pick while you train. You choose those apps in Apple’s own picker. iOS hands Legato only an encrypted token for your choice, which Legato cannot read: we can’t see which apps or websites you picked, only how many. That token stays on your phone and is never uploaded, not even when you have an account.

When you tap “Stay dialed in” on the block screen, your phone counts it as a mental rep. Only that number is added to your session.

06Music services

Apple Music

If you connect Apple Music, Legato asks iOS for access to your music library. It reads your library playlists and their songs on your phone to show and play them. The songs stream through Apple Music. Your library is not sent to us.

SoundCloud

If you connect SoundCloud, you log in on SoundCloud’s own page; we never see your SoundCloud password. To finish the login, the one-time code from SoundCloud passes through a small server function of ours that trades it for access tokens and does not store them. The tokens are then kept in your iPhone’s Keychain, and Legato loads your playlists and likes and streams songs directly from SoundCloud. Signing out of Legato also logs this phone out of SoundCloud.

Spotify

Legato does not connect to your Spotify account. It can only open the Spotify app on your phone.

My Tracks

Audio files you import are copied into Legato’s private folder on your phone. They are never uploaded. Your account only stores which music service you use, not your songs.

Apple Music and SoundCloud handle your data under their own privacy policies.

07Purchases (Legato Pro)

Legato Pro subscriptions are bought and paid for through Apple. We never receive your card or payment details. To check whether your subscription is active and to restore it on a new phone, we will use RevenueCat, a subscription service, which receives purchase information from Apple, such as your subscription status and transaction details.

08Training reminders

Reminders for your training days are scheduled on your phone itself. They are not sent from a server, and you can turn them off in Settings or in your iPhone’s notification settings.

09Launch email (website)

If you enter your email address on this website, we store that address and the date you signed up, so we can email you when Legato is available on the App Store. We use it for nothing else, and we don’t share it.

• The legal basis is your consent, which you give by submitting the form.
• The address is stored in our Supabase database. Only we can read it; the website itself can only add addresses, never read them.
• We delete the list once the launch email has been sent. You can ask us to remove your address earlier by emailing support@trainlegato.com.
• The website sets no cookies and uses no trackers or analytics, also not around the form.

10Who processes data for us

We don’t sell, rent or share your data with anyone else, and we don’t use it for advertising.

11Security

All data is sent over encrypted connections. On our servers, every account can only read and change its own data; this is enforced by the database itself. Music service tokens are stored in your iPhone’s Keychain, on that device only.

12How long we keep it, and deleting it

We keep your account data for as long as you have an account. You can delete your account at any time in the app: Settings › Account › Delete account. This immediately deletes your account and, with it, your profile, splits, sessions and settings from our servers.

The copy on your phone stays, so you can keep training without an account. To remove that as well, use Settings › Reset Legato or delete the app. Deleting your account does not cancel a Legato Pro subscription; you manage that in your Apple ID settings.

13Your rights (EU/GDPR)

We process account data because it is needed to provide the account and sync you ask for (performance of a contract), and to keep Legato secure and working (legitimate interest). Under the GDPR you have the right to:

• get a copy of your data, and receive it in a portable format;
• have your data corrected or deleted;
• restrict or object to how we use it;
• lodge a complaint with a data protection authority, such as the Autoriteit Persoonsgegevens in the Netherlands, or the authority where you live.

Email support@trainlegato.com to use any of these rights. We reply within one month.

14Children

Legato is not meant for children under 13, and we don’t knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

15Changes to this policy

When this policy changes, we update the date at the top. For important changes we will also let you know in the app.

16Contact

Questions about your privacy? Email support@trainlegato.com.

This website uses no cookies, no analytics and no third-party scripts.