1% Club System
Last updated: [DATE — set this to the day you publish] Effective: [DATE]
1. Who is responsible for your data
1% Club System (“the app”) is operated by:
[YOUR FULL LEGAL NAME] [STREET ADDRESS] [POSTCODE, CITY] [COUNTRY] Email: [SUPPORT@YOURDOMAIN]
Operating as a sole trader. Under the EU General Data Protection Regulation (GDPR), this person is the data controller for the personal data described below.
If you have a question about this policy or your data, use the contact address once it is confirmed. Under GDPR, rights requests generally require a response without undue delay and within one month. Permitted extensions require notice and reasons. [CONFIRM THE MONITORED REQUEST PROCESS BEFORE PUBLICATION.]
2. The short version
- The app stores your training data so it is available on your devices.
- It records your sex, age and bodyweight, because the percentile and tier system cannot compare you to anything meaningful without them.
- There is no advertising, no analytics and no tracking. Your data is not sold, rented or shared with advertisers. There are no third-party marketing SDKs in the app.
- Other people see your data only if you deliberately join a group or share a card or link.
- You can delete your account and everything in it from inside the app, at any time, without asking anyone.
The rest of this document is the precise version.
3. What the app collects
3.1 Account data
| Data | Where it comes from | Why |
|---|---|---|
| Email address | You, at sign-up | Identifies the account, enables sign-in and password recovery |
| Password | You, at sign-up | Authentication. Stored only as a salted hash by our authentication provider — it is never visible to us |
| Apple / Google account identifier | The provider, if you use “Sign in with Apple” or Google | Authentication without a separate password |
| Account creation and update timestamps | Automatic | Account administration |
If you sign in with Apple or Google, we receive an account identifier and, depending on your choices with that provider, an email address. We do not receive your password or your contact list.
3.2 Profile data — including health data
| Data | Why it is needed |
|---|---|
| Sex (M/F) | Benchmark curves differ by sex; without it a percentile is not comparable |
| Age | Performance curves shift with age |
| Bodyweight | Most calisthenic benchmarks are relative to bodyweight |
| Training experience (years) | Adjusts the expected bracket |
| Discipline (calisthenics / strength / hybrid / endurance) | Chooses which benchmarks apply |
| Units (kg / lb) | Display preference |
| Display name | How you appear to other members of a group you join |
This is health data. Under GDPR Article 9, data about your physical condition — which bodyweight, combined with an identified account, is — receives special protection. We process it only on the basis of your explicit consent (Art. 9(2)(a)), which you give during onboarding when you enter these values, and which you can withdraw at any time by deleting your account (section 8).
We do not use this data to infer anything about your health beyond computing the training benchmarks the app displays to you.
3.3 Training data
- Workouts: start and end time, and your bodyweight at the time of the workout
- Exercises within each workout, and their order
- Sets: repetitions, duration in seconds, weight, and whether completed
- Performance log entries: the computed value, percentile, tier, and whether the entry was a personal record
- Goals you set, and when you achieved them
- Custom exercises you create, including any name, notes and benchmark numbers you enter
- Training plans, templates, weekly schedules and saved challenges
- Notes you write, including notes pinned to an exercise and notes attached to a workout
- Progress within the app’s Marks and Climb systems
- Equipment you tell the app you have available
3.4 Photos
If you add a photo to a custom exercise, the image is stored in a private storage bucket that only your account can read. Photos are never public and are never shown to other users, including members of your groups.
3.5 Free-text you type
Some screens let you type notes freely — for example, notes for a training plan where you may choose to mention an injury or a time constraint. Whatever you type is stored with your account like any other training data.
Please do not enter medical details you would not want stored. The app does not need them, and there is no medical purpose to anything it does with them.
3.6 What the app does not collect
- No advertising identifiers (IDFA / AAID)
- No analytics or behavioural tracking
- No location data
- No contacts, calendar or microphone recordings
- No background collection of any kind
- No cookies used for tracking
The app contains no third-party advertising, analytics or tracking SDK.
4. Camera, photo library and notifications
The app asks for these permissions only at the moment you use the corresponding feature, and it works without them:
- Camera — to scan a plan QR code, or to photograph a custom exercise
- Photo library — to pick an image for a custom exercise
- Notifications — rest-timer alerts and workout reminders
Notifications are generated on your device. The app does not use push notifications, does not register a push token, and no server is told when you train.
5. Legal basis for processing (GDPR Art. 6 and 9)
| Purpose | Legal basis |
|---|---|
| Creating and maintaining your account | Performance of a contract (Art. 6(1)(b)) |
| Storing and syncing your training data | Performance of a contract (Art. 6(1)(b)) |
| Processing sex, age and bodyweight (health data) | Your explicit consent (Art. 9(2)(a)) |
| Showing your results to a group you joined | Your consent, given by joining (Art. 6(1)(a)) |
| Keeping the service secure and preventing abuse | Legitimate interests (Art. 6(1)(f)) |
You may withdraw consent at any time. Because the percentile system cannot function without sex, age and bodyweight, withdrawing that consent means deleting your account — see section 8.
6. Who your data is shared with
6.1 Other users — only if you choose
- Groups. If you join a group, other members can see your display name and the activity the app posts to that group’s feed: personal records, tier changes, skill unlocks and completed workouts, including the exercise, the value achieved and the tier. They cannot see your email address, sex, age or bodyweight — group members reach each other’s names through a database view that exposes nothing but a name, so this is enforced by the database itself rather than only by the app.
- Shared cards and links. If you share an exercise card, plan or challenge, the content of that share is visible to whoever receives it. You choose when this happens; nothing is shared automatically.
Your display name is not derived from your email address. New accounts start with a neutral placeholder, and the app asks you to choose a name before you first appear in any group.
6.2 Service providers
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication and file storage | [REGION — set this to your Supabase project’s region, e.g. EU (Frankfurt)] |
Supabase acts as a data processor: it stores and processes data on our instructions and may not use it for its own purposes. Where data is transferred outside the European Economic Area, the transfer is covered by the European Commission’s Standard Contractual Clauses.
We do not sell, rent or trade your personal data. We have no advertising partners.
6.3 Legal disclosure
We may disclose data if required by law, but only to the extent required, and we will tell you unless legally prohibited from doing so.
7. How long data is kept
- While your account exists: your data is kept so the app can show your history and compute your progress.
- When you delete your account: all data described in section 3 is deleted immediately and permanently, through a cascading delete across every table that references your account, plus deletion of your stored photos.
- Backups: deleted data may persist in our provider’s encrypted backups for up to [30] days, after which it is overwritten. It is not restored or used.
- Data on your device: deleting the app removes the local copy. Uninstalling the app alone does not delete your account on the server — use the in-app deletion described below.
8. Your rights
Under GDPR (and comparable laws elsewhere) you have the right to:
- Access your data and receive a copy
- Rectify data that is wrong — most of it is editable directly in the app
- Erase your data (“right to be forgotten”)
- Restrict or object to processing
- Data portability — receive your data in a machine-readable format
- Withdraw consent at any time
- Complain to a supervisory authority. In Austria this is the Datenschutzbehörde (dsb.gv.at); elsewhere in the EU, your national authority.
Exercising them
Deletion — in the app, immediately: Profile → Delete account. This is a two-step confirmation, after which your account and all associated data are permanently removed. No request, no waiting period, no contacting us.
Be aware that deleting your account also deletes any group you own, which removes that group for its other members. The app warns you about this before it proceeds.
Everything else: email [SUPPORT@YOURDOMAIN] once the monitored request process is available. The GDPR response period described in section 1 applies.
Getting a copy of your data
You have the right to receive your personal data in a structured, commonly used, machine-readable format (GDPR Art. 20).
[CONFIRM WHICH OF THESE IS TRUE AT LAUNCH AND DELETE THE OTHER. Do not ship a promise of an in-app export that does not exist — see legal/README.md.]
If in-app export has shipped: Profile → Export my data. This produces a file containing your profile, your full workout and set history, every performance log with its computed percentile and tier, your goals, custom exercises, plans, templates, schedules and notes. You can save or share it like any other file, and you do not need to ask us for it.
If it has not: email [SUPPORT@YOURDOMAIN] and we will send you a complete export within 30 days, at no charge.
Two things worth knowing about any export:
- It contains your own data only. Group feeds include other people’s entries, which are their personal data, not yours; your export carries only the entries you generated.
- Photos you attached to custom exercises are included as the image files themselves.
Note that the “Ask AI about my training” feature produces a summary of your recent training for use with an AI assistant. That is a convenience feature, not a data export — it is deliberately partial, and it does not satisfy the right described here.
9. Minimum age
You must be at least 16 years old to use 1% Club System.
The app is not directed at children. Because a profile combines age with bodyweight and sex, we would otherwise be processing a child’s health data, which requires verifiable parental consent that this app does not implement. The minimum age is therefore enforced at sign-up and in the database itself.
If we learn that an account belongs to someone under 16, we will delete it. If you believe a child has created an account, email [SUPPORT@YOURDOMAIN] and we will remove it promptly.
10. Security
- All traffic between the app and our servers uses TLS.
- Your login session is stored in your device’s secure keystore (iOS Keychain / Android Keystore), not in ordinary app storage.
- Database access is protected by row-level security, so each account can reach only its own rows.
- Exercise photos are stored in a private bucket readable only by the owning account.
- Passwords are stored only as salted hashes, by our authentication provider.
No system is perfectly secure. Where required by GDPR Article 33, a breach is reported to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness. Where Article 34 requires notifying affected people, that notification is made without undue delay. [VERIFY THE INCIDENT RESPONSE PROCESS BEFORE PUBLICATION.]
11. International users
The app is operated from [COUNTRY]. If you use it elsewhere, your data is transferred to and processed in the region named in section 6.2.
California residents: we do not sell or share personal information as defined by the CCPA/CPRA, and we do not process it for cross-context behavioural advertising. You have rights to know, delete and correct, exercisable as described in section 8.
12. Known limitations we want to be upfront about
Good privacy practice means telling you what is imperfect, not only what is polished.
- Deleting your account deletes groups you own, for everybody in them. There is currently no way to transfer ownership first.
- Data you have already shared cannot be recalled. A share link or card that you sent to someone stays with them, and deleting your account does not retrieve it.
13. Changes to this policy
If this policy changes in a way that materially affects your rights, we will tell you in the app before the change takes effect, and where the law requires it, ask for your consent again. The “Last updated” date at the top always reflects the current version.
14. Contact
[YOUR FULL LEGAL NAME] [STREET ADDRESS] [POSTCODE, CITY], [COUNTRY] Email: [SUPPORT@YOURDOMAIN]