Privacy Policy of the Barbell Application

Last updated: 2026-10-13 Document version: 1.4

1. Data Controller

The controller of your personal data is:

Cezary Ciosek sole proprietorship ul. Jana Kazimierza 66/122 01-248 Warsaw, Poland Tax ID (NIP): 573 281 54 19

Contact for data protection matters: e-mail: support@barbell.cloud

The controller has not appointed a Data Protection Officer — please address all data protection matters directly to the e-mail above.

The controller is neither a "covered entity" nor a "business associate" within the meaning of the U.S. HIPAA Act. Health data provided through the Application are not protected under HIPAA and are protected solely under this Privacy Policy and the GDPR.

2. Scope

This Privacy Policy describes how personal data of users of the Barbell mobile application ("Application"), the website at barbell.cloud ("Website"), and the administrative panel are processed.

The Application enables users to log workouts, track exercise progress, monitor body measurements, and use community features tied to athletic activity.

By using the Application and the Website, you accept the rules set out in this Privacy Policy and in the Terms of Service available at barbell.cloud/terms ("Terms"). If you do not agree to this Privacy Policy or the Terms, please do not use our services.

3. Categories of Personal Data Processed

Depending on how you use the Application, we process the following categories of personal data:

3.1. Registration data

• e-mail address,
• username,
• password (stored only in hashed form, never in plain text),
• preferred interface language.

3.2. Third-party authentication data (OAuth)

When you register or sign in via external accounts, we receive from identity providers:

• Google account identifier (google_id) — when signing in with Google,
• Apple account identifier (apple_id) — when signing in with Apple ID,
• first and last name (if provided by the provider),
• e-mail address linked to the external account.

3.3. Profile data

• first and last name,
• gender,
• date of birth,
• address (if provided),
• profile picture.

3.4. Health data (special category — Article 9 GDPR)

For the body-measurements feature we process:

• body weight,
• body height,
• body circumferences (chest, waist, hips, arm, thigh, calf),
• body fat percentage,
• other body composition metrics entered manually by the user.

These data fall within the special category of personal data under Article 9(1) GDPR and we process them solely based on your explicit, separate consent (Art. 9(2)(a) GDPR), provided when activating the body measurements feature.

You may withdraw this consent at any time, which results in immediate cessation of processing and deletion of the body-measurement data.

The above concerns measurements you enter manually in the Application. Health data read from Health Connect on Android and from Apple Health on iOS never reaches our servers and is processed exclusively on your device — see sections 4 and 5.

3.5. Training data

• exercise results (sets, repetitions, weight, time, intensity),
• Workout-of-the-Day (WOD) results — time, repetitions, completion status, Rx type,
• text notes about training (up to 1000 characters per entry),
• training dates and times.

Training data are not a special category under GDPR but we apply the same security standards. The Application is not a medical or diagnostic tool. Content in the Application (training programmes, calculations, suggestions) is informational only and does not replace medical advice.

3.6. Technical data

• device token (device_token) used to deliver push notifications,
• device identifier (device_id),
• platform type (iOS / Android),
• IP address recorded in server logs (kept only as long as necessary for security),
• crash reports (Firebase Crashlytics).

3.7. Subscription and payment data

For premium subscription handling we process:

• subscription validity (subscription_validity),
• transaction identifiers from the store (App Store / Google Play / RevenueCat),
• subscription status (active, cancelled, in trial).

We do not process payment card data or other financial information — payments are handled exclusively by the Apple App Store (iOS), Google Play (Android), and RevenueCat under their own privacy policies.

3.8. Account verification data

On registration we generate a 6-digit verification code and store its hash (never plain text) along with an expiry timestamp (15 minutes). These data are deleted upon successful e-mail verification.

4. Health Connect (Android)

The Android version of Barbell integrates with Health Connect, the system-level store for health and fitness data on Android devices. The integration is entirely optional: it only becomes active once you grant Barbell permissions in Health Connect, and you can revoke them at any time.

4.1. Data read from Health Connect

With your permission, we read the following data types:

• heart rate variability (HRV),
• resting heart rate,
• heart rate,
• sleep,
• steps,
• active calories,
• basal (resting) energy — BMR,
• exercise minutes and workout sessions,
• distance,
• floors climbed,
• body weight,
• body fat,
• lean body mass,
• nutrition,
• VO2 max,
• blood oxygen saturation (SpO₂),
• respiratory rate,
• hydration,
• exercise routes (GPS location recorded with a workout by another app, e.g. a sports watch) — read only after your consent, which Health Connect grants separately for each workout.

The scope is limited to the permissions you actually grant — you may decline any of them, and the Application will continue to work without the corresponding feature.

4.2. Data written to Health Connect

With your permission, we write only the following to Health Connect:

• sleep,
• hydration,
• body weight,
• height.

We write only values that you yourself enter in Barbell, so that they are available to the other health apps on your device.

4.3. Purpose

Health Connect data are used solely to display your own data back to you inside the Application — on the Recovery, Sleep, Hydration and Health metrics screens, and in the daily summary on the Dashboard — and for local sleep notifications: the morning report (a summary of your sleep, recovery and recommended strain) and the evening wind-down reminder — as well as on the workout details screen (statistics, heart rate and heart rate zones, heart rate recovery, splits, route map) and for a local post-workout notification summarising the workout. You can turn the notification off in Barbell: Settings → Training. We use them for no other purpose.

4.4. Background access

With your permission, Barbell may also read data from Health Connect in the background, while the app is closed: sleep, heart rate variability (HRV), resting heart rate, heart rate, active energy, distance and workout sessions. It does so only to prepare local notifications: the morning summary of your night, recovery and recommended strain, the evening wind-down reminder, and the summary after a finished workout. Data read in the background, like all other Health Connect data, never leaves your device and is not sent to our servers. You can revoke background access at any time in Health Connect (App permissions → Barbell), turn the morning report off in Barbell: Settings → Sleep, and the post-workout notification: Settings → Training.

4.5. Local-only processing

Data read from Health Connect are processed exclusively locally on your device. Specifically, they:

• never leave your device — they are not sent to our servers (api.barbell.cloud) or anywhere else (subject to 4.6 — downloading the map background),
• are not shared with any third party,
• are not used for advertising, marketing, profiling, scoring, health assessment, or any other automated evaluation,
• are not sold or otherwise transferred for value,
• are not used to train machine learning models.

Reading, computation, and presentation of these data happen entirely in the device's memory.

4.6. Maps

We display the workout route map using Google Maps Platform (Google Ireland Limited) in the Android app and Apple Maps in the iOS app. Route coordinates are not sent to our servers or to Google or Apple — the route line is drawn on your device. To show the map background, your device downloads map tiles of the area being viewed from the map provider; in doing so, the provider receives technical data (including your IP address and the extent of the displayed area) and processes it in accordance with its own privacy policy: Google — https://policies.google.com/privacy, Apple — https://www.apple.com/legal/privacy/.

4.7. What does reach our servers

For clarity — the only data sent to api.barbell.cloud are:

• account data (e-mail address, first and last name, profile picture),
• data you enter manually in the Application (training results, body measurements),
• your device identifier and push notification token.

Body weight and height reach our servers if and only if you type them into Barbell yourself. Barbell writes those values to Health Connect (see 4.2); it does not read them from it. Body weight, body fat, or lean body mass values read from Health Connect are used only for display on your device and are never transmitted anywhere.

4.8. Storage and deletion

• We do not store Health Connect data on our side — it stays in Health Connect on your device.
• Uninstalling Barbell removes all data obtained from Health Connect from your device.
• You may revoke permissions at any time under Health Connect → App permissions → Barbell. The same screen lets you delete the entries Barbell has written (see 4.2).
• Your Barbell account data (those listed in 4.7) are deleted by deleting your account — in the Application ("Settings → Delete account") or via barbell.cloud/delete-account. Deleting your Barbell account does not erase anything inside Health Connect itself, as that data is not ours to hold.

Barbell's use of Health Connect is additionally subject to Google's requirements for health and fitness data (the Health Connect Permissions policy), and we process such data in accordance with them.

5. Apple Health (HealthKit) on iOS and Apple Watch

5.1. Optional integration

The iOS and Apple Watch versions of Barbell integrate with the Health app (Apple HealthKit). The integration is entirely optional: it only becomes active once you grant Barbell permissions in Apple Health, and you can revoke them at any time: Settings → Health → Data Access & Devices → Barbell.

5.2. Data read from Apple Health

If you grant permission, we may read data from the following categories:

• activity — active and resting calories, steps, exercise minutes, flights climbed, walking speed, physical effort (MET),
• workouts — workout sessions, workout routes (GPS location), workout effort score (iOS 18 or later) and workout distances (walking and running, swimming, cycling, downhill skiing and snowboarding, cross-country skiing, rowing, paddling and SUP, skating),
• workout metrics — cycling power, cadence, speed and FTP; running power and speed; step length, vertical oscillation, ground contact time; swimming strokes,
• sleep and time in daylight,
• heart — heart rate, resting heart rate, heart rate variability (HRV), heart rate recovery, VO2 max,
• respiratory — respiratory rate, blood oxygen saturation (SpO₂),
• body measurements — height, body weight, body fat percentage, lean body mass, waist circumference,
• vitals — blood glucose, body temperature, sleeping wrist temperature,
• environmental noise,
• nutrition — calories, protein, carbohydrates, fibre, fats (including saturated, monounsaturated and polyunsaturated), sugar, cholesterol, caffeine, water, vitamins and minerals,
• date of birth — used solely to calculate maximum heart rate and heart rate zones.

The scope is limited to the permissions you actually grant — you may decline any of them, and the Application will continue to work without the corresponding feature.

5.3. Data written to Apple Health

With your permission, we write only the following to Apple Health:

• body measurements you yourself enter in Barbell (body weight, height, body fat, lean body mass, waist circumference),
• water logged in the hydration tracker (including servings added on Apple Watch),
• manually entered sleep entries,
• workouts recorded on Apple Watch — together with the heart rate and calories collected during them and the workout name.

5.4. Purpose

Apple Health data are used solely to:

• display your own data back to you inside the Application — on the Dashboard, in your Profile (including the Activity, Vitals, Nutrition and Nutrients (sugar, fats and other, vitamins, minerals) sections, shown only when the corresponding data exist in Apple Health), on the Sleep screen, and in workout history and workout details (including the route map),
• perform calculations locally on your device (recovery score, recommended strain, calorie balance, heart rate zones),
• deliver local notifications (see 5.5).

We use them for no other purpose.

5.5. Background access

With your permission, Barbell may read sleep data (for the morning report) and workout data (for the notification summarising a finished workout) from Apple Health in the background, while the app is closed. Background access is used solely to prepare local notifications. You can revoke permission at any time in iOS (Settings → Health → Data Access & Devices → Barbell), turn the morning report off in Barbell: Settings → Sleep, and the post-workout notification: Settings → Training ("Workout summary" section).

5.6. Apple Watch

During a workout, Apple Watch collects heart rate and active calories (a HealthKit workout session), saves the workout to Apple Health, and sends live heart rate and the workout summary only to your paired iPhone (WatchConnectivity) — not to our servers.

For its own statistics view, Apple Watch reads the following from Apple Health: resting heart rate, HRV, calories, steps, sleep, VO2 max, walking heart rate average, respiratory rate, exercise minutes, stand hours, distance, flights climbed, activity rings, and workouts. These data are displayed on the watch and are not sent to our servers.

5.7. Local-only processing

Data read from Apple Health are processed exclusively locally on your device. Specifically, they:

• never leave your device — they are not sent to our servers (api.barbell.cloud) or anywhere else (subject to 4.6 — downloading the map background),
• are not shared with any third party, including Firebase (Crashlytics) and RevenueCat,
• are not used for advertising, marketing, or profiling,
• are not sold or otherwise transferred for value,
• are not used to train machine learning models,
• are not synced via iCloud.

Body measurements reach our servers only if you type them into Barbell yourself — data flows from Barbell to Apple Health (see 5.3), not the other way round. Values read from Apple Health are never transmitted anywhere.

5.8. Storage and deletion

• We do not store Apple Health data on our side — it stays in Apple Health.
• The Application stores daily recovery summaries locally on your device (HRV, resting heart rate, sleep, SpO₂, respiratory rate, calories, protein, time in daylight, recovery score). Uninstalling Barbell removes them from your device.
• You may revoke permissions at any time under Settings → Health → Data Access & Devices → Barbell. Entries written by Barbell (see 5.3) can be deleted in the Health app.
• Deleting your Barbell account does not erase anything inside Apple Health, as that data is not ours to hold.

Barbell's use of HealthKit is additionally subject to Apple's requirements (App Store Review Guidelines, section 5.1.3 — Health and Health Research, and the HealthKit terms), and we process such data in accordance with them.

6. Purposes and Legal Bases

7. Retention Periods

• User account data — for the duration of account activity. Upon account deletion (the "Delete account" feature in the Application), data are anonymised — identifying fields (name, e-mail, username, OAuth identifiers) are replaced with random values in the format deleted_USERID_RANDOM@barbell.com. The account is marked inactive and all sessions are removed.
• Training data and body measurements — anonymised together with the account. Once anonymised, the data are no longer attributable to a natural person and fall outside the scope of GDPR.
• Health Connect data (Android) — not stored on our side; it remains in Health Connect on your device and is removed when you uninstall the Application (see 4.8).
• Apple Health data (iOS) — not stored on our side; it remains in Apple Health, and local recovery summaries are removed when you uninstall the Application (see 5.8).
• Server logs (IP, requests) — up to 90 days, after which they are overwritten.
• Crash reports (Firebase Crashlytics) — per Firebase default policy, up to 90 days.
• Subscription data — for the period required by tax law (5 years from the end of the financial year of the transaction).
• Verification codes — deleted upon use or after 15 minutes, whichever occurs first.

8. Recipients of Data

We engage the following processors under Article 28 GDPR:

7.1. Hosting and infrastructure

• OVH SAS (registered office: 2 rue Kellermann, 59100 Roubaix, France) — application server hosting and database. Data are processed within the European Union.

7.2. Transactional e-mail

• Resend, Inc. (registered office: 2261 Market Street #5039, San Francisco, CA 94114, USA) — delivery of transactional e-mails (verification codes, important account notifications). Data transfer outside the European Economic Area — see section 9.

7.3. Third-party authentication (OAuth)

• Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) — Google Sign-In. Transfer outside the EEA — see section 9.
• Apple Inc. (One Apple Park Way, Cupertino, CA 95014, USA) — Apple ID Sign-In. Transfer outside the EEA — see section 9.

7.4. Push notifications and diagnostics

• Google LLC (Firebase Cloud Messaging, Firebase Crashlytics) — push notification delivery and crash reporting. Transfer outside the EEA.

7.5. Subscriptions and payments

• Apple Inc. (App Store) — handling of premium subscription payments on iOS devices. Payment card data and billing details are processed exclusively by Apple under their privacy policy.
• Google LLC (Google Play) — handling of premium subscription payments on Android devices. Payment card data and billing details are processed exclusively by Google under their privacy policy. Transfer outside the EEA.
• RevenueCat, Inc. (575 Market Street, Suite 1675, San Francisco, CA 94105, USA) — subscription status aggregation. Transfer outside the EEA.

7.6. Other recipients

Data may be disclosed to:

• public authorities and courts — to the extent and on the terms set forth in applicable law,
• the Controller's professional advisors (lawyer, accountant) to the extent necessary for their services, under data processing agreements.

We do not sell your personal data to third parties. We do not share your data with third parties for marketing purposes.

We do not share your health data (including body measurements) for advertising or marketing purposes.

9. Transfers Outside the European Economic Area

Some of our processors (Resend, Google, Apple, RevenueCat — see section 8) are established in the United States. Your data may therefore be processed outside the European Economic Area (EEA).

These transfers take place on the basis of:

• adequacy decisions by the European Commission regarding the EU-US Data Privacy Framework (DPF) — for processors certified under DPF (including Google, Apple),
• Standard Contractual Clauses (SCC) under Commission Implementing Decision 2021/914 — for processors not certified under DPF,
• other appropriate safeguards under Article 46 GDPR.

You may request a copy of the safeguards in place by contacting: support@barbell.cloud.

10. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — to obtain information about, and a copy of, data we process about you.
• Right to rectification (Art. 16) — to correct inaccurate or incomplete data.
• Right to erasure (Art. 17, "right to be forgotten") — fulfilled in the Application by the "Delete account" function.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20) — to receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21) — to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)) — for health data (body measurements), without affecting the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint with the supervisory authority — President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl

To exercise your rights, contact us at: support@barbell.cloud. We respond within 30 days of receipt.

To verify your identity before fulfilling a request, we may ask you to confirm information we hold about you or to present an identity document. Any additional data provided for verification will be used for that purpose only.

11. Data Security

We apply technical and organisational measures appropriate to the risk of processing, including:

• TLS-encrypted data transmission (HTTPS),
• passwords stored only in hashed form (HMAC-SHA512 with a per-user salt),
• verification codes stored hashed (SHA-256 with salt),
• restricted database access — application processes only,
• regular database backups,
• automatic verification code invalidation after 5 incorrect attempts,
• e-mail verification required before first sign-in.

Despite these measures, no method of transmission or storage is 100% secure. Should we detect a personal data breach, we will notify the supervisory authority and affected data subjects without undue delay, in accordance with Articles 33 and 34 GDPR — within the time limit required by law, and no later than 72 hours after becoming aware of the breach (in the case of the supervisory authority).

12. Cookies and Local Storage

11.1. Mobile application

The mobile application stores locally on your device:

• authentication token (token) and refresh token (refreshToken) — required to maintain your session,
• pending verification e-mail (pendingVerificationEmail) — to resume verification after restarting the app.

These data are stored in the device's secure storage (Keychain on iOS, EncryptedSharedPreferences on Android) and are removed on sign-out or uninstallation.

11.2. Website and admin panel

The admin panel uses only session cookies essential for authenticating the administrator. We do not use analytics or marketing cookies.

13. Age of Users

Subject to the following, the Application may be used only by persons aged 16 and over. The Application's services are not directed at children under 13.

For users aged 13–16, use of the Application requires the consent of a parent or legal guardian (Art. 8 GDPR).

If we learn that an account has been created by a person under 13, or by a person aged 13–16 without their guardian's consent, we will promptly delete such an account along with all associated data.

To report such an account: support@barbell.cloud.

14. Automated Decision-Making and Profiling

Your personal data are not used for automated decision-making producing legal effects concerning you or similarly significantly affecting you, including profiling within the meaning of Article 22 GDPR.

15. Marketing

We currently do not carry out electronic marketing activities and do not send newsletters. Should we introduce such functionality in the future, we will require prior, freely given consent — separate from the consent to process data for other purposes.

Should we start marketing activities, you may opt out of marketing communications at any time by contacting us at: support@barbell.cloud. After opting out, we may still send you operational messages regarding your account or our services.

16. Changes to this Policy

We reserve the right to periodically update this Privacy Policy. We will inform you of material changes with reasonable advance notice through:

• a notification in the Application on the next launch after the change,
• an e-mail to the address associated with your account — for changes significant from the standpoint of your rights.

Continued use of the Application after the amended Privacy Policy takes effect constitutes acceptance of the changes. In the case of material changes to the categories of data processed, the purposes of processing, or the recipients of data, we will ask you to give your consent again.

The current version of the Privacy Policy is available at barbell.cloud/privacy and within the Application under "Settings → Privacy Policy".

17. Contact

For all questions, requests, and remarks regarding this Privacy Policy and the processing of your personal data, please contact:

Cezary Ciosek ul. Jana Kazimierza 66/122 01-248 Warsaw, Poland e-mail: support@barbell.cloud

This Privacy Policy is effective as of 2026-10-13.