Privacy Policy

1. Who is responsible?

David van den Pol is responsible for the personal data processed to provide Beat It. In this policy, “Beat It”, “we”, “us” and “our” refer to this service. Contact david@webwrk.nl for privacy questions or requests.

This policy explains data processing in the Beat It iOS app, related account services and communications with support. Apple, Google and other providers may also process data for their own services under their own policies.

2. Information we process and where it comes from

• Account and identity. When you use Sign in with Apple or Google, we receive a provider identifier and account information made available by that provider, such as an email address and name. Apple may supply a private relay email address. We also process your Beat It account ID, chosen display name or handle, authentication state and session credentials.
• Profile and preferences. Information you choose to enter can include date of birth, sex, height, body weight, preferred weight units, language and notification or analytics choices. Optional profile fields can be left blank or edited in Settings.
• Workouts and fitness data. We process exercises, custom exercise names, workout plans, sessions, sets, weights, repetitions, timestamps, rest intervals, reps in reserve, goals and related progress. This includes derived training estimates, plateau indicators and program state needed to show your training history and suggestions.
• Training feedback. The app can record workout difficulty and answers about pain associated with a set. This may reveal health-related information and can be sensitive. Only provide information you want processed for the relevant training feature. This policy is not itself a request for consent to health-data processing.
• Purchases and access. Apple and RevenueCat provide purchase and transaction identifiers, product information, subscription status, renewal or expiry information and entitlement results so we can provide paid access and restore purchases. We do not receive your full payment-card number from Apple.
• Optional analytics and diagnostics. Optional analytics starts only if you agree. Newer Beat It versions send app and screen activity, goal and training actions, subscription status and purchase-flow events, timestamps, app version, platform, session and installation identifiers, and an account identifier to ActivationPal. ActivationPal derives approximate country and city from the request IP address and stores them with events; its hosting may also retain technical IP logs. Older app versions used PostHog for optional analytics, and historical records may still exist there. These records can be linked to your account or device; they are not anonymous crash-only data.
• Optional advertising measurement (version 2.0.13 and later). If you allow Apple’s App Tracking Transparency request, AppsFlyer processes device and installation identifiers, the advertising identifier when available, app installs and opens, session timestamps, app version, operating-system and device information, and technical connection information such as the request IP address. IP information may be used to derive approximate location. This helps measure which advertising campaigns lead to installs. This integration does not send your Beat It account ID, name, email, workout history, health information, pain answers or purchase events to AppsFlyer. It does not initialize when tracking permission is denied, restricted or unknown.
• Support and service delivery. We process messages and contact details you send us. Requests to our hosting and service providers also involve technical connection information, such as IP addresses, request times and service or security logs. Do not include unnecessary sensitive information in support messages.

The current app does not request Apple Health access or import HealthKit records. Information is obtained from your entries, the app’s use of its services, your chosen sign-in provider and Apple/RevenueCat purchase records.

3. Why we use this information

• Create and secure your account, maintain sessions, and synchronize your data.
• Save your workouts, apply your preferences and calculate training statistics, Goal Path estimates and plateau guidance.
• Verify purchases, deliver paid features, restore access and handle purchase-related support.
• Schedule optional local reminders and display the system features you use.
• With your analytics choice, understand feature use, investigate errors and measure how the app and purchase experience perform.
• Answer support and privacy requests, prevent misuse and meet applicable legal obligations.

Training calculations are intended to help you understand your own records. They are not medical diagnoses and do not make decisions with legal or similarly significant effects about you.

4. Choices, permissions and consent

• Optional analytics: you can decline it and still use Free or Pro. Depending on the installed version, optional events go to ActivationPal (newer versions) or PostHog (older versions) only after your choice to opt in. Change the analytics switch in Settings → Account and data. Turning it off stops future optional collection and clears the app’s local analytics queue and identifiers, but does not erase events already stored by either provider. Contact us if you want those records removed. In-app account deletion alone does not automatically erase ActivationPal records.
• Advertising measurement: allow or deny the separate native iOS tracking request. The app asks after the initial sign-in and permission flow. Declining or restricting permission keeps AppsFlyer measurement off; there is no fingerprinting fallback. You can withdraw this permission in iPhone Settings → Privacy & Security → Tracking, or in the available tracking controls for Beat It. The app checks permission again when it becomes active and stops the SDK when permission is no longer granted. The in-app analytics switch controls ActivationPal/PostHog analytics, not this separate Apple tracking permission. Withdrawing permission prevents future authorized measurement but does not erase data already stored by AppsFlyer or advertising partners. Contact us for a provider-held data removal request.
• Notifications: allow or deny the iOS notification permission. Change it later in iPhone Settings for Beat It. Notifications are optional; disabling them does not cancel a trial or subscription.
• Optional profile details: skip these fields or update or clear them through the available profile controls. Contact us if you need help removing a field or a recorded item.
• Sharing: progress is not posted to a public feed by default. If you use a share action, you choose the destination. Copies held by recipients or other apps are not removed when you delete your Beat It account.
• Account services: declining optional analytics does not stop the processing needed for login, saving data, subscription verification or security.

Where GDPR applies, processing needed to provide the service you request is based on performance of a contract; optional analytics and optional advertising measurement are based on separate consent choices. Service security and appropriate support administration may rely on legitimate interests, subject to your rights. Records required by law are processed to comply with legal obligations. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

Health-related data may require an additional legal condition under applicable law, such as explicit consent. Acceptance of this policy or the Terms is not, by itself, that consent. Contact us with questions about processing or removing health-related training information.

5. Who receives data

• Supabase: account authentication, database storage and server functions for your profile, workouts, plans, goals and account administration. Supabase privacy information.
• Apple: Sign in with Apple if you choose it, App Store distribution, purchase processing and subscription management. Apple retains its own purchase and account records. Apple privacy information.
• Google: Google sign-in if you choose that provider. Google privacy information.
• RevenueCat: purchase validation, account-linked paid entitlements, restoration and subscription support. It receives the Beat It account identifier and purchase-related information. If you opt in to analytics, the account identifier can also be associated with analytics attribution. RevenueCat privacy information.
• ActivationPal: optional account-linked app, training, goal and purchase-flow analytics in newer versions. It stores approximate country and city derived from the request IP address. Its event database is in the United States. ActivationPal privacy and security information.
• PostHog: optional analytics from older app versions; historical records may still exist there. PostHog privacy information.
• AppsFlyer and advertising partners: optional, device-level install and app-open attribution in version 2.0.13 and later, after iOS tracking permission. AppsFlyer may share limited install/session measurement with the advertising network associated with a campaign, such as X, when that partner integration is enabled. The current app integration does not send account identifiers, workout/health data or purchase events, and does not enable audience sharing. AppsFlyer services privacy information and X privacy information.
• Hosting, email and necessary professional support: technical requests, support correspondence or records needed to operate the service, handle a request or comply with the law.

We expect service providers to use personal data only for the stated purposes and to meet applicable data-protection requirements. A provider’s own privacy page does not replace our responsibilities. ActivationPal currently states that it does not offer a GDPR/UK GDPR data-processing agreement; this contractual issue remains unresolved. We may also disclose information when required by law or necessary to protect legal rights, with appropriate limits.

Providers may process data outside your country, including outside the European Economic Area. ActivationPal says its primary event database is in Northern California, United States, and its API functions run in Washington, D.C.; requests may also pass through its global hosting network. Its complete backup, log and onward-provider locations are not confirmed. International transfers may require an adequacy decision or appropriate safeguards, such as standard contractual clauses. Contact us for the destinations and safeguards applicable to your data; we cannot promise EU-only processing.

6. Retention, security and deletion

Account, profile and workout records are kept while you maintain your account so that history and synchronization continue to work, unless you remove a record or request deletion. The 90-day Free history view is a viewing limit, not a promise that older stored data is deleted.

Account-linked analytics is used to understand product use and resolve faults. ActivationPal says it has no automatic age-based deletion or configurable retention period for events, device identifiers and stored approximate location; these can remain until explicitly deleted. Provider logs and backups may have separate, unconfirmed retention periods. We do not have a guaranteed vendor deletion deadline. Contact us to request removal of provider-held data; we will seek confirmation of the scope and timing from the provider rather than promise instant erasure. For other records, support correspondence is retained for necessary follow-up or disputes, security records for misuse prevention, and legally required records for the applicable period.

Advertising-measurement records held by AppsFlyer and the attributed advertising partner have separate retention and deletion processes from your Beat It account. We use these records to assess campaign installs and app opens. The applicable vendor account settings, contract, legal requirements and privacy-request handling determine how long provider-held records remain. We have not independently confirmed all AppsFlyer/X retention and deletion timeframes for this rollout and do not promise instant erasure. Contact us for the records, destinations and timeframes applicable to your request. AppsFlyer and advertising partners may process data outside your country; we must use the applicable contractual and international-transfer safeguards before this processing is released.

You can start account deletion directly in the app. Successful deletion removes the active Beat It account and its associated profile and workout data. The workflow revokes linked Apple authorization where applicable, removes the RevenueCat customer record and requests deletion of linked older PostHog data where configured. It also stops ActivationPal collection and clears local analytics state, but it does not automatically delete events already held by ActivationPal. For those events, contact david@webwrk.nl so we can coordinate a separate provider request; the provider confirms the scope and timing case by case. External deletion jobs and backups can remain after the app confirms account deletion.

Deleting your Beat It account does not automatically erase device-level advertising measurement already held by AppsFlyer/X or change Apple’s device-level tracking permission. Withdraw that separate permission in iPhone Settings to stop future authorized measurement and contact david@webwrk.nl if you also want existing advertising-measurement records removed. We will verify your request, determine the relevant provider records and coordinate removal. Do not send your password or one-time sign-in code. We will not claim that provider-held advertising records are erased until that removal is confirmed.

Active-system deletion is different from removal of provider-held analytics, expiry of backup copies or records a provider is legally required to retain. Where records remain, we will tell you what we know about the exception and timing, and say plainly when the provider has not confirmed a deadline. Apple purchase records and copies you shared outside Beat It are not deleted from those independent systems by deleting your Beat It account.

Connections use HTTPS and app session credentials use iOS Keychain storage. Access controls are used to restrict account data. These measures reduce risk but cannot guarantee that every system or transmission is completely secure.

7. Your requests and rights

Depending on the law that applies, you may request access to your data, correction, deletion, restriction of processing, portability of eligible data, or object to processing based on legitimate interests. You may withdraw consent for optional processing. These rights can be subject to legal exceptions.

Email david@webwrk.nl to make a request. We may ask for proportionate information to verify account ownership. We will not ask for your password or one-time sign-in code. There is no in-app full-data export button in the current release; use this contact route to request a copy.

For GDPR requests, we respond without undue delay and normally within one month. If a lawful extension is necessary, we will explain it within that first month. You may complain to the data-protection authority where you live or work, or where you believe an infringement occurred. In the Netherlands, this is the Autoriteit Persoonsgegevens.

8. Website, children and policy updates

The Beat It page content does not embed advertising pixels, external fonts, videos or analytics scripts. Website hosting and WordPress features can separately involve connection logs or cookies. Any additional optional website tracking requires its own accurate disclosure and consent where required; the app analytics switch does not control website plugins.

Beat It is not directed to children who cannot lawfully provide the consent or agreement required for its services. If you believe a child has supplied personal information without the required authorization, contact us so we can investigate and remove it where appropriate. The App Store age rating is not a substitute for applicable privacy or contractual age requirements.

We may update this policy as the service or applicable requirements change. The date at the top identifies this version. We will provide an appropriate notice of material changes and obtain a new consent where required before using data for a new consent-based purpose.