Privacy policy

1. Data controller

The controller is Rafał Bajda, Przeworska 9b/62, 04-382 Warszawa, Polska, Poland, registered in CEIDG (Centralna Ewidencja i Informacja o Działalności Gospodarczej), NIP (tax ID): 1133016791, REGON: 386531184. Contact: [email protected].

2. Without an account

Your progress, reminder time and settings are stored only on your phone. Our server does not receive them.

To handle the subscription, the app connects to the App Store or Google Play and to RevenueCat, sending a random identifier and purchase data, but not your progress.

3. With an account

After you sign in with Apple or Google we process:

• your Apple or Google account identifier and e-mail address, if you share it (Apple lets you hide it);
• your training history: sets, tests, pauses and their dates;
• hashes of device tokens and the dates of account creation and last sync;
• a link between your account identifier and your subscription status in RevenueCat, so a purchase keeps working on a new phone.

4. Purposes and legal bases

We process data for these purposes:

• running the account, backing up and restoring progress: performance of a contract (GDPR art. 6(1)(b));
• support, including a manual streak correction at your request: performance of a contract;
• a log of administrative actions and security: legitimate interest (GDPR art. 6(1)(f));
• website statistics, only with your consent: consent (GDPR art. 6(1)(a)).

5. Exercise data

We store push-up counts and dates. We do not ask for your weight, health or medical results. The reason for a pause is not recorded.

6. Technical data

When the app connects to our server, or a browser to this site, infrastructure providers process your IP address and the time and type of the request. This serves security and fixing errors, and our server logs are kept for up to 30 days. The legal basis is legitimate interest (GDPR art. 6(1)(f)).

7. Contacting us

When you write to us, we process your e-mail address and the message in order to reply. Mail to the support address is forwarded by Cloudflare to a Gmail mailbox. We keep messages for as long as needed to resolve the matter and any claims. The legal basis is performance of a contract or legitimate interest.

8. Who receives data

We use these providers:

• Railway Corp.: server and database hosting, signed-in users only (servers in the EU, US company).
• RevenueCat, Inc.: subscription status, also without an account in the app (USA).
• Apple Distribution International Ltd.: App Store subscription sales and Sign in with Apple (Ireland / USA).
• Google Ireland Ltd.: Google Play subscription sales, Google sign-in and the Gmail mailbox for support e-mail (Ireland / USA).
• Cloudflare, Inc.: delivering this site and forwarding support e-mail (USA).
• When Apple and Google sell a subscription or handle sign-in, they also act as independent controllers under their own privacy policies.

9. Transfers outside the EEA

Some providers operate in the USA. Transfers rely on the European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

10. How long we keep data

We keep account data until you delete the account. Deleting in the app immediately erases the account, devices, logins and training history.

The one exception is the log of administrative actions: an entry about a correction (account identifier, the date of the day, the reason) remains after deletion so that support actions stay accountable. It holds no e-mail address or training history.

Apple or Google and RevenueCat keep payment history under their own rules.

11. Your rights

You have the right to access your data (GDPR art. 15), rectify it (art. 16), erase it (art. 17), restrict processing (art. 18), port it (art. 20), object (art. 21) and withdraw consent (art. 7(3)).

Send your request to [email protected]. We may ask you to confirm the account is yours. We reply within a month; complex cases can take two more months, and we will tell you if so. We provide data in a machine-readable format. Requests are free unless manifestly unfounded or excessive.

You can complain to the supervisory authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl.

12. Voluntary data

Providing data is voluntary. Without an account you give us neither your progress nor your e-mail address. Without signing in, however, we cannot keep a server copy, and without purchase data the store cannot handle a subscription.

13. Security

Connections to the server are encrypted (TLS). We store device tokens on the server only as hashes, and on the phone in its secure storage. The support panel is password-protected and limited to the administrator, and its actions are logged.

14. Data breaches

If a breach may put your rights at risk, we report it to the Polish authority UODO within 72 hours of detecting it (GDPR art. 33). If the risk is high, we also tell you without undue delay (GDPR art. 34): what happened, which data it involves and what we have done.

15. Children

The app is not meant for people under 16 and we do not knowingly collect their data. If we learn an account belongs to such a person, we delete it.

16. Automated decisions

We make no solely automated decisions with legal effects and do not profile you for marketing. We do not sell data.

17. Changes

We announce material changes to this policy in the app.