Privacy Policy

1. Who this policy applies to

This policy applies to everyone who downloads and uses the Cubex Fitness App on Android or iOS, with or without a cloud account. It also serves as the App's terms of use: use the App only as intended and in compliance with applicable law; the App is provided "as is", without warranties, to the extent permitted by law.

2. Two ways to use the App

• Without an account (default). The App works fully offline. Everything you enter is stored only on your device in the App's private storage, and none of it is transmitted to us. Reading from your health platform (section 5) also works in this mode, and that data likewise stays on your device.
• With a free cloud account (optional). If you sign up, the fitness data you create in the App is additionally stored on our servers so it can be backed up and synchronized across your devices — including the heart-rate summaries that are part of your saved workouts (section 5). Sections 6–10 describe exactly what that involves.

3. Information stored on your device

The App lets you create and track fitness information. The following is saved locally on your device and is fully under your control:

• Profile information you choose to enter — for example name (or nickname), gender, age, height, and weight.
• Fitness and health data — workout logs, exercises, programs, completed sessions, calorie estimates, goals, charts, and progress notes.
• Activity and heart-rate data read from your health platform, if you connect one (section 5).
• App preferences — such as theme, units (metric/imperial), and other settings.
• Photos you choose to add (e.g. a profile or progress photo), if you use that feature.

If you never create an account, this information does not leave your device except where you explicitly choose to export or share it using your device's own features (for example, sharing a screenshot).

4. Device permissions

The App may ask your permission to use certain device features. Permissions are requested only when needed for a feature you use:

• Apple Health / Health Connect — with your explicit permission, to read activity and heart-rate data (section 5). Optional; the App works without it.
• Camera / Photo Library — to let you add a profile or progress photo.
• Notifications — to show workout, rest-timer, or reminder notifications. These are generated locally on your device.
• Other permissions (such as motion/activity or storage), where applicable, are used solely to provide in-app functionality.

You can review, grant, or revoke any permission at any time in your device's system settings.

5. Health data (Apple Health / Health Connect)

With your explicit permission, the App can connect to your device's health platform — Apple Health (HealthKit) on iOS or Health Connect on Android — to READ the following data types:

• Steps
• Walking / running distance
• Active energy (calories) burned
• Heart rate (including during an active workout, when a paired watch or fitness band provides it)

How this data is used:

• Solely to provide the App's health and fitness features to you: your daily activity (steps, distance, calories), your heart rate and its recent history, live heart rate during a workout, your adaptive step goal and activity streak, and a heart-rate summary attached to your saved workout log.
• The App only READS from the health platform — it never writes any data back to Apple Health or Health Connect.

Where this data goes:

• Values read from the health platform are displayed in the App and, where they are part of a saved workout (for example the workout's heart-rate curve and averages), stored in the App's private local storage together with your workout journal.
• If — and only if — you have a cloud account, those workout-attached heart-rate summaries are synced to our servers as part of your workout journal, so your workouts (with their heart-rate data) are backed up and available on your other devices. This transfer happens with your consent, only to our own processors acting on our instructions (section 8), never to iCloud, and only to provide the backup/sync feature you asked for. If you use the App without an account, this data never leaves your device.

Storage, retention, and deletion:

• On your device, this data is deleted when you delete the related workout log, clear the App's data in system settings, or uninstall the App.
• Any synced copy on our servers is removed when you delete the related workout log (the deletion propagates on the next sync) or when you delete your account (section 10).

Your choices and control:

• Connecting a health platform is optional. Every App feature that can work without health data continues to work if you decline.
• You can revoke access at any time: on iOS in the Health app under Sharing → Apps → Cubex Fitness; on Android in the Health Connect settings. After revocation the App can no longer read health data.

What we never do with your health data:

• We never use it for advertising, marketing, or any form of ad targeting.
• We never sell it, and we never share it with data brokers or information resellers.
• We never use it to assess eligibility for credit, insurance, employment, or benefits, or for any purpose unrelated to the App's health and fitness features.
• We never store it in iCloud, and we never share it with any third party for that party's own purposes — the only place it is ever sent is our own secure infrastructure, to provide the sync you requested.

Health Connect (Android): Cubex Fitness's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements; any transfer of Health Connect data to our servers is done only to provide the cloud backup/sync feature you enabled, with your consent, and never for advertising or data mining.

Apple Health (iOS): Cubex Fitness's use of HealthKit data complies with Apple's App Store Review Guidelines on health data (section 5.1.3): HealthKit information is used only to provide the App's health and fitness services, is never used for advertising, marketing, or data mining, and is never stored in iCloud. For signed-in users, heart-rate data saved with a workout is stored on our own secure servers (never iCloud) solely to back up and sync your workout journal, with your consent, and is never disclosed to any other third party.

6. Information we collect when you create a cloud account

If — and only if — you create an account, we collect and store:

• Account data: your email address and authentication identifiers. If you sign in with Google or Apple, we receive the basic identifier your provider shares (Apple's "Hide My Email" private-relay addresses are fully supported).
• Profile data you entered in the App: nickname, gender, age, height, weight, fitness goals, units, theme, and preferred language.
• Fitness content you created: workout programs, workouts, exercise logs (including heart-rate curves and averages derived from your health platform and saved with a workout — section 5), custom exercises, notes (including photos you attached to them), charts, and goals. Fitness and health information is sensitive — we treat all of it as private to you, and it is never used for advertising or profiling.
• Device and session information: a device name/model and platform (Android/iOS) for each signed-in device, and session timestamps. This exists so you can see and sign out your devices, and because accounts are limited to a fixed number of active devices.
• Service email events: delivery status of the emails we must send you (confirmation, password reset).

We do NOT collect: precise location, contacts, advertising identifiers, browsing history, or any data from other apps. The App currently contains no advertising and no third-party analytics SDKs. We do not read any health-platform data beyond the types listed in section 5.

7. Why we process this data (and the legal bases)

• To provide the service you asked for — account sign-in, backup, and cross-device sync of your fitness data, including the health-derived heart-rate summaries in your workouts (performance of a contract).
• To secure your account — session management, device limits, abuse prevention (legitimate interest).
• To send strictly transactional emails — address confirmation and password reset (performance of a contract). We do not send marketing emails.
• With your explicit consent, which you give when you connect a health platform (section 5) and when you create an account after being shown what will be stored. This explicit consent is the basis for processing your health-related data — including the health-platform data and heart-rate summaries — which enjoys stricter protection in some jurisdictions (e.g. GDPR Article 9). You can withdraw consent at any time by disconnecting the health platform in your system settings and/or deleting your account (section 10).

8. Where your data is stored and who processes it

Your synced data is stored by our hosting providers ("processors"), who act on our instructions:

• Supabase (Supabase Inc.) — database, authentication, and file storage. Data is hosted on AWS in the us-east-2 region (Ohio, United States).
• Cloudflare, Inc. — network proxy/CDN in front of our servers; traffic passes through Cloudflare's global edge network.
• Resend (Plus Five Five, Inc.) — sends our transactional emails (region: United States).
• Google LLC / Apple Inc. — only if you choose "Sign in with Google/Apple", governed by their own privacy policies.

If you are in the EU/EEA, UK, or a similar jurisdiction: your data is transferred to and stored in the United States. We rely on standard contractual safeguards offered by the processors above.

We do not sell, rent, or share your personal data with any third party for their own purposes.

9. Sync on/off, signing out

• Signing out of your account on a device keeps your local data on that device; it only stops syncing.
• Data you create while signed out stays local until you sign in again on that device.
• Removing the App from a device deletes the local copy on that device; your cloud copy (if you have an account) remains until you delete the account.

10. Data retention and deletion

• Your synced data is retained for as long as your account exists.
• You can delete your account at any time, in either of two ways:
• In the App: Profile → Account → Delete account.
• On the web: https://account.cubexfitness.com/delete-account (works even if the App is uninstalled).
• Deleting your account permanently removes your synced data — profile, fitness content (including workout heart-rate summaries), photos, device/session records — and your login itself. Residual copies in our encrypted backups are purged automatically within 30 days.
• Deleting a single workout log removes it (and its heart-rate summary) from your device and, on the next sync, from our servers.
• Deletion is irreversible. The local data on your device is not touched by account deletion; you remain in control of it (delete it by clearing the App's data or uninstalling).
• If you never create an account, we hold nothing to delete: remove the App or clear its data and everything is gone.

11. Your rights

Wherever you live — and specifically if GDPR-style rights apply to you — you can:

• Access the data we hold about you (most of it is directly visible and editable in the App).
• Rectify it — edit your profile and content in the App; changes sync to the server.
• Delete it — see section 10.
• Export it — contact us and we will provide a copy of your synced data in a common machine-readable format.
• Complain to your local data-protection authority.

To exercise any right, email us at support@cubexfitness.com from the address associated with your account.

12. Platform services (Apple and Google)

The App uses standard operating-system features that are governed by the platform providers' own privacy policies, not ours:

• In-app rating prompt — handled by Apple's App Store (SKStoreReview) or Google Play In-App Review. We do not receive the content of your rating or review.
• Distribution through the Apple App Store and Google Play is subject to Apple's and Google's respective privacy policies.

13. Children's privacy

The App is not directed at children. Do not create a cloud account or connect a health platform if you are under 13 (or under the higher minimum age your jurisdiction requires for consenting to data processing). We do not knowingly collect personal data from children; if you believe a child has created an account, contact us and we will delete it.

14. Data security

• In transit: all traffic between the App and our servers is encrypted with TLS (HTTPS).
• On our servers: your data is protected by per-user access rules (row-level security) — one account can never read another account's rows — and by short-lived, rotating session tokens.
• On your device: data is stored in the App's private, sandboxed storage, protected by your device's operating-system security and any device-level protections you enable (passcode, biometrics).

No method of transmission or storage is 100% secure, but we restrict access to the minimum needed to run the service.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide notice within the App or on the store listing. Continued use of the App after an update constitutes acceptance of the revised policy.

16. Contact us

If you have questions about this Privacy Policy or the App, contact us at:

• Cubex Fitness Group
• Email: support@cubexfitness.com
• Website: www.cubexfitness.com