Privacy Policy

1. Data Controller and Contact Information

The controller of your personal data is Michał Rożenek, ul. Radlińskie Chałupki 123A, 44-313 Wodzisław Śląski, Poland, Tax Identification Number (NIP): 6472505696, Business Registry Number (REGON): 243202020 (the "Controller," "Steelz," or "we").

For privacy and data protection matters, you may contact us by email at: rozenekdev@gmail.com.

Apple, Google, and app store operators may independently process data in connection with their own login, app distribution, payment, and account management services. The scope of that processing is governed by their own privacy policies.

2. How We Collect Data

We collect data:

• directly from you when you create an Account, save workouts, routines, notes, or preferences, or contact us;
• from Apple or Google when you use their sign-in services;
• from the Apple App Store, Google Play, and RevenueCat, to the extent necessary to obtain technical information confirming the status of your Premium subscription;
• automatically from your device and IT infrastructure to the extent necessary to operate, maintain, and secure the Service.

3. Categories of Data We Process

Depending on how you use Steelz, we may process the following categories of data:

Account and login data:

• user ID, email address, first name, or profile name, if provided by the sign-in provider;
• information about whether you signed in through Apple or Google, your account ID with that provider, and tokens required for authentication and session management;
• the date the Account was created, Account status, and basic information about Account settings.

Workout data and user content:

• workout and routine names, selected exercises, sets, repetitions, weights, rest periods, and workout duration;
• body weight attached to a saved workout where the user enabled the optional body-weight volume feature;
• workout history, personal records, summaries, and statistics generated from data saved by the user;
• notes, custom names, and other content entered in the app's text fields.

Settings and preferences:

• default workout values, rest-period length, warm-up, sound, and haptic settings, and information about whether selected app sections are enabled;
• language, units, and other preferences affecting how the app works, if saved to the Account.

Premium-related data:

• subscription status, product and transaction identifiers, start, renewal, or expiration dates, and information about entitlement to Premium features;
• we do not receive complete payment card details or complete details of any other payment instrument.

Technical and security data:

• IP address, request date and time, API request information, response status, session identifiers, tokens, and cryptographic hashes of refresh tokens;
• technical information about the app version, operating system, or an error, where necessary to operate, diagnose, or protect the Service;
• security logs and information needed to detect abuse and unauthorized access.

Contact and complaint data:

• email address, identifying information provided in a message, the content of correspondence, and information needed to handle an inquiry, complaint, or data-related request.

4. Data Stored Only Locally on Your Device

Not all data used by the app is transmitted to Steelz. The following data is stored only locally on the user's device:

• measurements of individual body parts, body-weight measurement history, and other body metrics, except for a body-weight value attached to a saved workout after the optional body-weight volume feature is enabled;
• daily check-offs in the Daily Essentials section, especially those relating to water, protein, or supplements. This data is reset according to how the feature works and is not synchronized with the Account.

The data identified above as stored only locally is not transmitted to Steelz servers or accessible to the Controller. The exception is the user's current body weight attached to a workout being saved when the user enables the optional body-weight volume feature. This value is transmitted solely to calculate workout volume for selected exercises.

Steelz does not create a server-side backup of data stored only locally. Depending on the operating system settings and app configuration, local data may be included in a device backup maintained by Apple or Google. Steelz has no access to such backups and does not determine how long they are retained.

Deleting the app, device failure, loss of the device, or changing devices may result in the permanent loss of local data if it was not included in an available system backup.

5. Health-Related Data and Free-Text Fields

Steelz does not require you to provide diagnoses, information about illnesses, treatment, injuries, rehabilitation, health-related contraindications, heart rate, medical parameters, or data from medical devices. The app is not intended to diagnose, treat, rehabilitate, or draw medical conclusions about a user.

Do not enter this type of information in notes, routine names, descriptions, or other free-text fields synchronized with the Account. If a user nevertheless enters such data, Steelz does not process it for medical purposes or health profiling.

Body weight transmitted through the optional body-weight volume feature is used solely as a mathematical input for a workout calculation. Steelz does not use it for diagnosis, health assessment, the creation of health indicators, or health profiling.

6. Purposes and Legal Bases for Processing

The legal bases listed below apply to personal data transmitted to Steelz systems or otherwise available to the Controller. Data stored only locally on the user's device is not transmitted to Steelz and is not synchronized with the app's backend.

We process your personal data:

1. 6.1to enter into and perform a contract, including creating and managing the Account, enabling login, synchronizing workout data, providing app features, calculating workout volume using body weight at the user's request, and administering Premium - under Article 6(1)(b) of the GDPR;
2. 6.2to comply with legal obligations, including tax, accounting, settlement, and complaint-handling obligations - under Article 6(1)(c) of the GDPR;
3. 6.3for Steelz's legitimate interests, including securing the app and Accounts, preventing abuse, detecting errors, maintaining technical logs, and establishing, pursuing, or defending legal claims - under Article 6(1)(f) of the GDPR.

Providing data is voluntary. However, data required to create an Account and provide the Service is necessary to use features that require login, synchronization, or Premium. If you do not provide optional data, only the relevant feature may be unavailable or unable to work as intended.

Use of the body-weight volume feature is voluntary. Once enabled, the user's current body weight is transmitted to Steelz when a workout is saved and stored as part of that workout's information, solely to calculate its volume for selected exercises. Turning the feature off stops body weight from being transmitted for subsequent workouts. Values stored previously nevertheless remain stored with the data of the workouts with which they were saved. The legal basis for continued retention is the performance of a contract (Article 6(1)(b) of the GDPR), insofar as necessary to provide an accurate workout history saved at the user's request. These values are used solely to calculate, present, and recalculate the volume of those workouts, including after the feature is re-enabled, and are not used as the user's current body weight for new workouts. Steelz does not use them for health analytics, health assessment, or profiling. A value attached to a particular workout is deleted together with that workout, with the Account, or when an applicable data request is fulfilled.

All other body-metric data is stored exclusively on the user's device. Steelz has no access to it, does not receive it, and does not process it in its systems. The user decides whether to enter, change, or delete it.

If you sign in through Apple or Google, the app sends a token from the selected provider to the Steelz backend, and the backend verifies it with that provider. We receive the data needed to verify your identity and create or manage the Account, including your provider account ID, email address, and, if provided by the provider, your first name or profile name.

We do not receive the password to your Apple or Google account. Sign-in providers also process data under their own terms as independent controllers.

For Apple, we may store an encrypted token needed to revoke access when the Account is deleted. For Google, access may be revoked through an in-app mechanism or through Google account settings, depending on the current technical implementation.

7. Synchronization, Infrastructure, and Security

The data synchronized with the Steelz backend includes Account data, workouts, routines, preferences, and personal records and, where the user enables the optional body-weight volume feature, body-weight values attached to saved workouts. Synchronization enables use of the Account, retention of workout history, operation of statistics, use of the Service across devices, and restoration of data after changing devices.

Synchronization does not include data identified in this Policy as stored only locally, particularly body measurements, local body-weight measurement history, and daily check-offs in the Daily Essentials section. This data is not transmitted to Steelz servers, and Steelz cannot access its contents.

The backend API is hosted by Render Services, Inc. in the Frankfurt region. The database is maintained using services provided by Neon, LLC, an entity affiliated with Databricks, Inc., also in the Frankfurt region. These providers process data on behalf of Steelz to the extent necessary to provide hosting and maintain the infrastructure and database.

Selecting a region located in the European Economic Area means that the primary data-storage infrastructure is located in the EEA. However, this does not exclude technical access, support services, or the use of subprocessors located in other countries. The rules governing transfers of data outside the EEA are described later in this Policy.

Data transmitted between the app and the backend is protected using TLS encryption. Refresh tokens are stored in the backend as cryptographic hashes and are rotated. In the mobile app, tokens are stored in the device's secure system storage.

We use technical and organizational measures appropriate to the nature of the data and the identified risks. However, no IT system can guarantee absolute security. Users should use the current official version of the app, properly secure their device, and promptly report any suspected unauthorized access to their Account.

8. Subscriptions, RevenueCat, and App Stores

Premium purchases are made through the Apple App Store or Google Play. The applicable Store operator processes payment and transaction data under its own terms. Steelz does not receive complete payment card details or complete details of any other payment instrument.

We use RevenueCat to technically verify subscription status and Premium entitlements. RevenueCat receives data needed to identify the transaction and access rights, such as a user or installation identifier, product and transaction identifiers, subscription status, and the relevant subscription dates.

Deleting your Steelz Account or the app does not automatically cancel a subscription managed through the Apple App Store or Google Play. You must cancel the subscription in the settings of the applicable Store.

9. No Marketing Analytics or AI Processing User Data

• The app does not provide users with AI tools to which user data would be transmitted;
• We do not use Firebase Analytics, Google Analytics, Meta Ads, Google Ads, or other behavioral analytics or advertising tools.

Before implementing any features that change this model, we will update the Privacy Policy and the relevant privacy notices.

10. Data Recipients

Data may be disclosed to the following categories of recipients, only to the extent necessary for the relevant purpose:

• Render - backend and API infrastructure hosting;
• Neon - database hosting;
• RevenueCat - technical administration of subscription status and Premium entitlements;
• Apple and Google - login, app distribution, Store administration, and transaction processing; for their own services, these entities may act as independent controllers;
• providers of technical, security, legal, accounting, or support services, where their involvement is necessary and subject to appropriate confidentiality or data protection obligations;
• public authorities, courts, or other authorized entities where disclosure is required by law.

We do not sell users' personal data or disclose it to advertisers for behavioral advertising.

11. Transfers Outside the European Economic Area

The primary backend and database infrastructure has been selected in the Frankfurt region within the European Economic Area. However, certain providers or their subprocessors, particularly Apple, Google, RevenueCat, Render, or Neon, may process data or provide technical access from outside the EEA.

In such cases, depending on the recipient and country, we use the safeguards required under Chapter V of the GDPR, including an adequacy decision issued by the European Commission, participation by an eligible recipient in the EU-U.S. Data Privacy Framework, the European Commission's Standard Contractual Clauses, and, where necessary, supplementary technical and organizational measures.

12. Data Retention Periods

We retain Account, workout, routine, preference, and personal record data for as long as the Account is used. This includes body weight stored as part of workout information after the body-weight volume feature is enabled. Turning the feature off does not delete values previously stored with workouts; they are retained with the relevant workout until the workout or Account is deleted or an applicable data request is fulfilled. After the Account is deleted, this data is removed from active systems, except where continued retention is necessary to comply with a legal obligation, handle a complaint, or establish, pursue, or defend legal claims.

After the Account is deleted, we may retain a minimal pseudonymized technical record confirming completion of the deletion request, the contents of which are described in detail in Section 13. The record does not include workout history, routines, measurements, preferences, name, or email address and is retained for no longer than three years after Account deletion, unless longer retention is necessary because of ongoing proceedings, a dispute, or a legal obligation.

Technical and security logs are generally retained for 90 days. Specific logs may be retained longer where necessary to investigate a failure or security incident, prevent abuse, or establish, pursue, or defend legal claims.

We retain technical Premium information, including subscription status, transaction identifier, product type, and access start, renewal, or expiration dates, for the duration of the Account and subscription, and afterward for as long as necessary to handle complaints and refunds, prevent abuse, and resolve claims.

We retain accounting, tax, or settlement documents only where Steelz is legally required to keep them, for the period required by applicable law. Steelz does not retain complete payment card details or complete details of any other user payment instrument.

Data stored only locally on the device, particularly body measurements, local body-weight measurement history, and daily check-offs in Daily Essentials, remains on the device until the user deletes it, deletes the app, or clears the app's data. Steelz does not determine the retention period for this data and cannot access its contents. This does not apply to a body-weight value stored as part of a workout after the body-weight volume feature is enabled.

13. Deleting Your Account and Data

You may delete your Account in the app settings or by sending a request to the email address listed in Section 20. Account deletion includes removing profile data, tokens, workout history - including body weight stored with workouts - custom routines, preferences, and personal records from active systems, except for data that we are required or permitted to retain by law.

After Account deletion, we may retain a minimal pseudonymized technical record confirming completion of the operation. This record may include the technical identifier of the deleted Account, the dates the deletion was requested and completed, the source of the request, Premium status at the time of deletion, a hashed identifier of the sign-in provider, and the Account creation date. The record does not contain the user's name, email address, workout history, routines, or preferences and is not used for marketing or to reconstruct the user's history. The record is retained for no longer than three years after Account deletion, unless longer retention is necessary because of ongoing proceedings, a dispute, or a legal obligation.

14. Your Rights

Subject to the GDPR, you have:

• the right to access your data and receive a copy;
• the right to correct inaccurate data or complete incomplete data;
• the right to deletion of data;
• the right to restrict processing;
• the right to data portability for data processed automatically on the basis of consent or a contract;
• the right to object, on grounds relating to your particular situation, to processing based on legitimate interests;
• the right to withdraw consent at any time where processing is based on consent;

You have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) or with another competent supervisory authority, in particular in the EU/EEA Member State of your habitual residence, place of work or place of the alleged infringement.

To exercise your rights, contact us using the address listed in Section 20. We may request information needed to verify your identity and protect the data from disclosure to an unauthorized person.

Rights relating to data stored only locally may be exercised directly through the app's features or device settings because Steelz does not hold a server-side copy of that data.

15. Voluntary and Required Provision of Data

Providing data required to create an Account and use online features is voluntary, but it is necessary to enter into and perform the contract. Without this data, we cannot create an Account, sign the user in, synchronize workouts, administer Premium, or provide selected app features.

Providing data in optional fields, using Daily Essentials, and entering body metrics is voluntary. Not providing this data should not prevent the use of Steelz's basic features that do not require it. Unless the body-weight volume feature is enabled, body weight will not be transmitted when a workout is saved and volume for selected exercises will not include it.

16. Automated Decision-Making

We do not make decisions about users that produce legal effects or similarly significantly affect them solely through automated processing, including profiling within the meaning of Article 22 of the GDPR. Workout statistics and summaries only present data saved by the user and do not constitute an automated health assessment.

17. Website, Cookies, and Similar Technologies

The Steelz website may use cookies and similar technologies necessary for its operation, security, session maintenance, and remembering basic settings. Strictly necessary technologies may be used without separate consent to the extent permitted by law.

As of the date of the last update, we do not use analytics or advertising cookies or profiling technologies on the website. If we introduce them, we will implement an appropriate consent-management mechanism before activation and update this Policy.

18. Children and Minors

Steelz is not directed to children. Under the Terms and Conditions, the Service is intended for adults. A minor may use the app only with the consent and under the supervision of a parent or legal guardian, where permitted by law and the rules of the applicable Store.

If we learn that a minor's Account was created without the required consent or other legal basis, we may request confirmation of authorization to use the Service, restrict the Account, or delete data to the extent required by law.

19. Changes to This Privacy Policy

We may update this Policy if the law, the operation of the app, the scope of data, service providers, or security measures change. The current version will be available in the app and on the Steelz website.

We will provide reasonable advance notice of material changes affecting how data of Account holders is processed, including by email or an in-app notice. If a change requires consent, we will request it before beginning the relevant processing.

20. Contact

For matters relating to the processing of personal data, email us at: rozenekdev@gmail.com. Please include only the information necessary to identify the matter and handle your request.