Privacy policy

1. Legal information

Data controller: RyzeFit

Contact: support@ryzefit.app

Data Protection Officer (DPO): Not required at this stage under GDPR Article 37 (sole proprietorship <250 employees, no large-scale processing of sensitive data).

Legal framework: General Data Protection Regulation (GDPR) — EU Regulation 2016/679, French Data Protection Act (CNIL, France).

2. Data collected

RyzeFit collects only the data strictly necessary for the service.

Mandatory data (contract performance)

• Email address (account creation + authentication)
• Date of birth (minimum-age 16 check + program adaptation)
• Training data: sessions, performance, progression, loads used
• Unique user identifier (Supabase UUID)

Optional data (with your consent)

• Display name (personalization)
• Weight, height (personalized calibration)
• Equipment preferences
• Technical data (logs, crash reports)
• Usage data (analytics)
• Premium subscription status (via RevenueCat, if subscribed)

Data NOT collected

• GPS location
• Photos, videos, audio
• Contacts, calendar, messages
• Sensitive biometric data
• Browsing history outside the app

3. Purposes of processing

• Provide and personalize the RyzeFit service (adapted training, calibration, guidance)
• Verify the required minimum age (16, GDPR Article 8)
• Improve the user experience (with consent only)
• Ensure the security and stability of the app
• Manage your Premium subscription where applicable

4. Legal basis

In accordance with GDPR Article 6:

• Contract performance: use of the app, account management, Premium subscription
• Explicit consent: analytics, crash reports, behavioral tracking
• Legitimate interest: security, abuse prevention, service integrity
• Legal obligation: retention of subscription invoices (10 years, French Commercial Code)

5. Third-party services used

Supabase (backend & database)

Region: European Union (West EU Ireland, eu-west-1)
Purpose: user profile storage, training sessions, cross-device synchronization
DPA: signed European Standard Contractual Clauses
Policy: supabase.com/privacy

Firebase (analytics & crash reporting — Google LLC)

Region: United States (Google Cloud US)
Transfer outside the EU: governed by the European Commission's Standard Contractual Clauses (SCC) — Decision 2021/914
Purpose: service improvement (analytics) and stability (crash reports)
Activation: only with your explicit consent. Can be disabled at any time in Settings > Privacy
Policy: firebase.google.com/support/privacy

RevenueCat (subscription management)

Region: United States
Transfer outside the EU: governed by DPA + European SCC
Purpose: Premium subscription management only
Policy: revenuecat.com/privacy

Google Play (Android distribution)

Purpose: app distribution + in-app payments
Policy: play.google.com/about/privacy

Netlify (hosting of the ryzefit.app website)

Region: global CDN — main servers in the United States
Transfer outside the EU: governed by DPA + European SCC
Purpose: distribution of the ryzefit.app showcase site
Policy: netlify.com/privacy

No reselling of your data to commercial third parties.

6. Data transfers outside the EU

Some of our providers (Firebase, RevenueCat, Netlify) host data in the United States. In accordance with GDPR Articles 44-49 and the Schrems II ruling:

• Transfers are governed by the European Standard Contractual Clauses (SCC)
• Additional security measures: end-to-end HTTPS encryption, anonymization of identifiers
• You can refuse this processing at any time by disabling analytics + crash reports in Settings > Privacy

7. Retention period

Account deletion: immediate erasure of all your data from the app + Supabase backend. Firebase/Crashlytics logs purged within 90 days per the third-party policy.

8. Your rights (GDPR Articles 15 to 22)

• Access: view your data via Settings > Export my data
• Rectification: edit your information directly in the app (Settings)
• Erasure: permanently delete your account (Settings > Delete my account)
• Portability: export your data as JSON (Settings > Export my data)
• Objection: refuse analytics/crash reports (Settings > Privacy)
• Restriction: request restriction of processing
• Withdrawal of consent: at any time via Settings > Privacy

To exercise these rights: contact us at support@ryzefit.app. Response within 30 days in accordance with GDPR.

CNIL complaint: you can file a complaint with the CNIL (cnil.fr) if you believe the processing of your data does not comply with GDPR.

9. Security

RyzeFit implements appropriate technical and organizational measures (GDPR Article 32):

• HTTPS/TLS 1.3 encryption for all network communications
• At-rest encryption of the local database
• Secure storage of authentication tokens (FlutterSecureStorage with the native Android keystore)
• Strong Supabase Auth authentication with hashed passwords (bcrypt)
• Supabase Row Level Security (RLS) for strict isolation of user data
• Sentry / Crashlytics incident monitoring with consent
• Regular security updates (Flutter SDK + dependencies)

10. Health data and medical qualification

RyzeFit is NOT a medical device within the meaning of Directive 93/42/EEC / EU Regulation 2017/745.

The data collected (weight, sessions, performance) is used solely for fitness and wellness training purposes.

RyzeFit provides no medical advice. Before any training program, consult a doctor if you have health conditions, injuries or a relevant medical history. RyzeFit cannot be held liable for injuries resulting from improper use of the app.

11. Minimum age and protection of minors

RyzeFit is reserved for users aged 16 and over (GDPR Article 8, French transposition).

At signup, your date of birth is verified to ensure compliance with this limit. Accounts for minors under 16 are not permitted.

For users aged 16 and 17: in accordance with GDPR France, your consent is valid without parental approval.

If you are a parent and believe your child under 16 created an account without your authorization: contact support@ryzefit.app for immediate deletion.

12. Cookies and trackers (ryzefit.app website)

The ryzefit.app website is built privacy by design:

• No cookie is set before your consent. The site works fully without accepting cookies.
• Audience measurement: Google Analytics 4 — this tool sets cookies to measure site traffic (pages viewed, traffic source, device used). It is only activated after your explicit consent through the banner shown on your first visit.
• Prior consent and withdrawal — no measurement cookie is set until you accept. Google Consent Mode v2 keeps tracking disabled by default. You can change your choice at any time using the “Cookies” button at the bottom of the page. Your choice is stored for 6 months, then you are asked again.
• Anonymization — your IP address is anonymized before any processing (anonymize_ip).
• No advertising — Google's advertising features (ad_storage, ad_user_data, ad_personalization) are permanently disabled, including after acceptance. No ad profiling, no cross-site tracking, no data resale.
• Processor — Google Ireland Limited, under the EU Standard Contractual Clauses. Some data may be transferred outside the EU. You may refuse this processing with no impact on your browsing.
• No other measurement tool (Meta Pixel, TikTok Pixel, etc.) is active.
• A consent banner lets you accept or refuse audience measurement on your first visit. Refusing causes no limitation.
• Google Fonts loaded from fonts.googleapis.com for typography. No cookie is placed by this service; only a technical IP transfer on the CDN side, governed by Google's DPA.
• Lenis (smooth scroll) loaded from unpkg.com (open-source CDN) with Subresource Integrity for integrity verification.

In accordance with the ePrivacy Directive and CNIL recommendations, no audience-measurement cookie is set without your prior agreement, and refusing is as simple as accepting. No tracking tool will be added without a public change to this policy.

13. Changes to this policy

RyzeFit reserves the right to modify this policy. Any significant change will be notified via:

• In-app notification
• Email (if you have consented to receive our communications)
• An update of the "Updated" date at the top of this policy

Continued use of the service after a change constitutes acceptance.

14. Contact

For any question regarding this policy or your data:

• Email: support@ryzefit.app
• CNIL France: www.cnil.fr (supervisory authority for France)