Ironbeast – Privacy Policy

Effective date: 10 July 2026  |  Terms of Service

This Privacy Policy describes what information Ironbeast collects, why it is collected, how it is used, and what rights you have over it. It applies to the Ironbeast mobile application (bundle ID com.jgabara.gymtrack) available on iOS and Android.

Data controller: Jaroslaw Gabara, Spain
Contact: jarofu93@gmail.com

1. How Your Experience Differs Based on Sign-In

Signing in is entirely optional:

• Guests (no sign-in): All workout data is stored locally on your device using AsyncStorage. No personal information is sent to our servers.
• Signed-in users: By choosing to sign in with Google or Apple, you activate cloud sync. The data described in Section 3 is then stored on our backend so you can access it across your own devices.

2. What We Do Not Do

• We do not collect or store passwords. Authentication is handled entirely by Google or Apple.
• We do not show advertisements and use no ad SDKs.
• We do not sell, rent, or trade your personal data to any third party.

3. Information We Collect

3.1 Account Data (signed-in users only)

When you sign in with Google or Apple, we receive and store:

• Email address — provided by Google or Apple during the OAuth flow.
• User ID — a unique identifier we generate internally to link your data to your account.

This data is stored on our backend servers (hosted on Fly.io) and used solely to identify your account and sync your data across your devices.

3.2 Synced Workout Data (signed-in users only)

Once signed in, the following is synced to our backend:

• Workout routines and custom exercises you create
• Full training history (exercises, sets, reps, weights, dates, durations)
• App preferences (bodyweight value, weight unit kg/lbs, set-view mode)

This data is tied to your user ID so it can be accessed on any of your devices. If you never sign in, this data never leaves your device.

3.3 Crash Reports

If the app crashes, anonymised technical data (device model, OS version, app version, error logs) is automatically sent to Firebase Crashlytics to help us identify and fix bugs. This data is not linked to your workout content or account.

3.4 Usage Analytics

We use Firebase Analytics to collect aggregated, anonymised data about which app features are used (e.g., screen views, button taps). This helps us understand how to improve the app. This data does not identify individual users and is not linked to your workout content.

3.5 App Update Checks

Ironbeast may use Expo's update service to deliver over-the-air app updates. This transmits non-personal technical data (app version, installation ID) to Expo's servers to check for available updates.

4. Third-Party Services

Each provider has its own privacy policy. We recommend reviewing those policies for full details of how they handle data.

5. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), UK, or Switzerland, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR) — processing your email, user ID, and workout data is necessary to provide the cloud sync service you opted into when you signed in.
• Legitimate interests (Art. 6(1)(f) GDPR) — crash reporting and usage analytics allow us to maintain and improve the app. These interests are not outweighed by your privacy rights; the data is anonymised and not used for profiling or targeted advertising.

You can opt out of cloud sync at any time by signing out or deleting your account. To object to analytics or crash reporting processing, contact us at jarofu93@gmail.com.

6. Data Retention

• Account and workout data: Retained for as long as your account is active. Upon account deletion, all data is permanently deleted within 30 days.
• Crash reports: Retained by Firebase Crashlytics according to their own retention policy (typically 90 days). Not linked to your account.
• Analytics data: Retained by Firebase Analytics according to their configured retention period. Not linked to your account.
• Local data (guest users): Stored only on your device and deleted when you uninstall the app.

7. Your Rights Under GDPR

If you are located in the EEA, UK, or Switzerland, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your account and all associated data.
• Data portability — request your workout data in a machine-readable format.
• Restriction of processing — request that we limit how we use your data in certain circumstances.
• Objection — object to processing based on our legitimate interests.
• Lodge a complaint — you may lodge a complaint with the Spanish supervisory authority: Agencia Española de Protección de Datos (AEPD), www.aepd.es.

To exercise any of these rights, email jarofu93@gmail.com. We will respond within 30 days.

8. Account Deletion

To delete your account and all associated data, email jarofu93@gmail.com with the subject line "Account Deletion Request". We will permanently delete your account and data within 30 days.

In-app account deletion is planned for a future update.

9. International Data Transfers

Our backend is hosted on Fly.io and we use Firebase (Google) for analytics and crash reporting. These services may process data in the United States or other countries outside the EEA. Where such transfers occur, they are made under appropriate safeguards, including the European Commission's Standard Contractual Clauses, as required by GDPR Chapter V.

10. Children's Privacy

Ironbeast is not directed at children under 13 years of age (or 16 in jurisdictions where that higher age applies, including EU member states under the GDPR). We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us at jarofu93@gmail.com and we will delete it without delay.

11. Data Security

Data transmitted between the app and our backend is encrypted using TLS. Account data stored on our servers is accessible only to authorized systems. While we take reasonable precautions, no internet-based service is completely secure, and we cannot guarantee absolute security of your data.

12. Changes to This Policy

We may update this policy when we add new features or when legal requirements change. When we do, we will update the effective date at the top of this page. Significant changes will also be noted in the app's release notes. Continued use of the app after an update constitutes acceptance of the revised policy.

13. Contact

For any privacy-related questions or requests:

Jaroslaw Gabara
jarofu93@gmail.com