Privacy Policy

Siyar Yamin

Am Pfenningberg 58a, 4040 Plesching, Österreich

Email: siyar.yamin1@gmail.com

• No ads, no tracking, no sale of data.
• Without an account, all workouts stay on your device only.
• Sensor and camera data (proximity and motion sensors, TrueDepth depth measurement) is processed on the device only and never stored or transmitted.
• Apple Health, Health Connect and Strava are only used if you turn them on or connect them yourself.
• You can export and permanently delete your account and cloud data in the app at any time.

Workouts, settings and daily goals are stored locally on the device. Nothing is transmitted to us.

• Account data: email address, password (stored only hashed), username, optionally display name, profile picture and country.
• Training data: exercise, repetitions (also per round/set and per minute or 10 seconds), duration, time, workout type and settings, counting method.
• Social data: friendships and requests, groups, challenges, blocks and reports.
• Security data: IP address and time of sign-in attempts (abuse protection), deleted after 24 hours at the latest.

• **Apple Health / Health Connect**: only if you turn on saving to Health, the app writes finished workouts (exercise, repetitions, duration, time) to your device's health data. The app does not read health data. The data stays on your device or in your Apple/Google account; we do not receive it.
• **Strava**: only if you connect your Strava account, finished workouts (title, description, duration, time) are transferred to Strava Inc., USA. For this we store the access tokens issued by Strava and your Strava athlete ID on our server. You can disconnect at any time in the settings; we then revoke access at Strava and delete the tokens. Strava's own privacy policy applies to processing by Strava.

• Reminders: local notifications, no push server.
• Lock screen / Dynamic Island or ongoing notification: shows repetitions and time only during a workout.
• Sensor recording (Settings → Sensor tuning): created on your device only and shared only if you share the file yourself.

• Providing account, sync, friends, groups and challenges: performance of contract (Art. 6(1)(b)).
• Appearing in public rankings (country, region, continent, world): only with your consent (Art. 6(1)(a)), off by default and revocable any time in your profile.
• Abuse and attack protection (rate limits, reports): legitimate interest (Art. 6(1)(f)).
• Apple Health / Health Connect and Strava: at your request to provide the feature (Art. 6(1)(b)); for health data additionally your explicit consent by turning it on or connecting (Art. 9(2)(a)), revocable at any time by turning it off or disconnecting.

• Signed-in users: username, display name, profile picture and country (for search).
• Friends: your training results (friends ranking).
• Group and challenge members: your repetitions in the respective period.
• Public rankings: only with consent.
• Your email address is never visible to other users.

• Supabase Inc. (database, authentication, file storage), servers in Frankfurt am Main (EU), under a data processing agreement (Art. 28 GDPR).
• Apple and Google as distribution platforms under their own privacy policies.
• Strava Inc., USA – only with an active connection (see 4a). The transfer to the USA takes place at your request (Art. 49(1)(b) GDPR) or, where applicable, under the EU-US Data Privacy Framework.

Apart from a Strava transfer you connect yourself, we do not transfer data to third countries; where Supabase uses sub-processors outside the EU, this is based on EU Standard Contractual Clauses.

Data is kept until you delete your account. Deleting your account also revokes a Strava connection at Strava. After deletion all data is removed immediately; it may remain in the hosting provider's backups for up to 30 days. Sign-in logs are deleted after 24 hours.

• Proximity and motion sensors: only to count repetitions, processed locally.
• Camera: to take a profile picture and (iPhone) to count push-ups by measuring distance with the TrueDepth camera. No images are stored or transmitted; only the distance is evaluated on the device.
• Photos: only when you actively choose a profile picture.
• Notifications: only for reminders and the ongoing workout display.
• Health (Apple Health / Health Connect): write only, only after turning it on.
• Vibration and sound: workout signals.

You have the right of access, rectification, erasure, restriction, data portability, objection and to withdraw consent at any time. Export and deletion are available directly in the app under Profile. You may also lodge a complaint with the competent supervisory authority: Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, www.dsb.gv.at.

Use with an account is permitted from age 16; younger persons only with parental consent.

Encrypted transmission (TLS), sign-in stored in the device keychain, database-level access control (Row Level Security) and limits on sign-in attempts.

We update this policy when the app changes. The current version is always available in the app.