Rivality Privacy Policy
Rivality Fit ("we", "us") is a mobile app that lets two friends train as rivals. This policy explains what data the app collects, why, who helps us process it, and the choices you have. We keep it short and plain on purpose.
What we collect
| Data | Why we need it |
|---|---|
| Email address | To sign you in with a one-time magic link. We never ask for a password. |
| Profile name (handle) | So your rival can see who they're up against. |
| Workout data: plans, sessions, sets, reps, weights, personal records | The core of the app: logging your training and scoring your weekly challenge. |
| Duo and challenge data | To link you to your rival and keep the weekly score. |
| Push notification token and time zone | To notify you when your rival trains and to close each week at the right local time. |
| Crash reports and basic device info (model, OS version, app version) | To find and fix bugs. Sign-in tokens are removed before a report is sent. |
| App usage events (for example, screens opened, workout logged) | To understand which features work and improve the app. |
| Email (website waitlist) | Only to tell you when the app launches; delete on request. Stored in Cloudflare. |
We do not collect your location, contacts, photos or payment information, and we do not use your data for advertising.
Who can see your data
Your rival (the one person in your duo) can see your handle, your logged workouts, records and challenge score. Nobody else in the app can. We do not sell or rent your personal data to anyone.
Service providers we use
We rely on a small number of providers to run the app. They process data only on our behalf:
- Supabase: database, sign-in and storage.
- Resend: sends the sign-in email.
- Expo, Google Firebase Cloud Messaging and Apple Push Notification service: deliver push notifications.
- Cloudflare: runs the background jobs that send notifications and close weekly challenges.
- Sentry: crash reporting and performance monitoring.
- PostHog: product analytics.
Some of these providers store data outside Canada, including in the United States. By using the app you understand your data may be processed there.
How long we keep it
We keep your account data for as long as your account exists. When you delete your account, we delete your personal data within 30 days, except where we must keep something to meet a legal obligation. Crash reports and analytics events are kept for the retention period set by those providers and are not used to identify you.
Your rights and choices
- Access or correct your data: most of it is visible and editable in the app. For anything else, contact us.
- Delete your account and data: see Delete your account.
- Notifications: you can turn push notifications off at any time in your phone settings.
- If you live in Québec or elsewhere in Canada, you also have rights under Québec's privacy law (Law 25) and PIPEDA, including the right to withdraw consent and to file a complaint with the relevant privacy commissioner.
Children
Rivality Fit is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.
Security
Data is encrypted in transit. Access to your data in our database is restricted by row-level security, so each account can only read what it is allowed to see. No system is perfectly secure, but we work to protect your information.
Changes to this policy
If we change this policy in a meaningful way, we will update the date above and let you know in the app.
Contact
Questions or requests: support@rivalityfit.app. The person responsible for protecting personal information at Rivality Fit can be reached at the same address.