Privacy Policy

Last updated: 31 October 2026

This Privacy Policy explains how MyBodyWeight handles your personal data when you use the MyBodyWeight mobile app (the "App") and our website my-bodyweight.com (the "Website"): what we collect, why, who we share it with, how long we keep it, and your rights. It applies to everyone, with or without an account.

1. Who we are

The App and Website are operated by MyBodyWeight VOF, a Dutch general partnership (vennootschap onder firma), Van 't Hoffstraat 83, 6706 KJ Wageningen, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 42154909, VAT number NL869956206B01 ("MyBodyWeight", "we", "us"). We are the controller of the personal data described in this policy.

Privacy contact: mybodyweight@outlook.com (subject "Privacy"). We have not appointed a data protection officer because the law does not require one for us; privacy questions are handled by the founders directly.

2. The short version

  • We collect only what the App and Website need to work. The App shows no ads, we do not sell your personal data, and the App contains no third-party analytics or advertising trackers.
  • Your body measurements (age, height, weight, BMI) are stored only on your device.
  • Location is used on your device to show parks near you. It is stored on our servers only if you choose to be visible to nearby athletes, and then only rounded to about 100 meters.
  • You can delete your account and its data at any time, in the App or on our website.

3. What data we process and why

For each category we state the purpose and the legal basis under the EU General Data Protection Regulation (GDPR).

3.1 Account data

Username, email address and password (stored only as a salted hash by our authentication provider; we never see your password), account identifiers, and the date you created your account.

Purpose: creating and securing your account, signing in, password resets, account and service messages. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

3.2 Profile and preference data

Gender, fitness level, equipment you have access to, weekly goals, messaging preference (for example "same gender only"), visibility setting, notification settings and similar App preferences.

Purpose: selecting the right decks and exercises, applying your chat and visibility preferences, and personalizing the App. Gender is stored in your account because other users' chat and visibility settings depend on it. Legal basis: performance of contract (Art. 6(1)(b)).

3.3 Body measurements (health-related data)

Age, height, weight and the BMI-style value calculated from them, used to estimate calories burned and tailor workout difficulty.

This data is stored only on your device and is not sent to us. It is optional; leaving it out only makes calorie estimates less personal. If we ever offer to sync or back it up to your account, we will ask for your explicit consent first (Art. 9(2)(a) GDPR), and you can withdraw that consent at any time.

3.4 Workout and activity data

Workouts you complete: deck, cards and exercises, reps, hold times, duration, estimated calories, streaks, weekly challenges, achievements and Train Together results. For guests this stays on the device. For account holders, workout history and lifetime statistics are stored in your account so they survive reinstalls and device changes.

Purpose: showing your history and progress, streaks, achievements, challenges and multiplayer sessions. Legal basis: performance of contract (Art. 6(1)(b)). It records exercise, not symptoms or medical conditions, and is never used for advertising or profiling.

3.5 Location

  • On your device: when you allow location access, the App uses your device location to center the map and show calisthenics parks near you. For this purpose it is processed on your device and not stored by us.
  • Nearby Athletes (opt-in, off by default): only if you turn on "Visible to nearby athletes" do we store your location in your account, rounded to about 100 meters, with your last-active time. Other users then see your username and approximate distance, never your exact position. You can turn this off at any time in your Profile; turning it off erases the stored location.
  • Place search: place names you type into the map search are sent to the OpenStreetMap Foundation's geocoding service.
  • Map tiles: to draw the map, your device downloads map images from our map-tile provider, which therefore receives your IP address and the map area being viewed.

Legal basis: your consent, given through the device location permission and, for Nearby Athletes, through the visibility switch (Art. 6(1)(a) GDPR and Art. 11.7a of the Dutch Telecommunications Act). You can withdraw consent at any time in your device settings or with the in-app switch. The App does not access your location in the background.

3.6 Social features: chat, friends, Train Together and reports

Messages you send and receive, friend and invitation requests, Train Together session data, and users you block or report (including the reason you give).

Purpose: delivering messages and multiplayer sessions and keeping the community safe. Legal basis: performance of contract (Art. 6(1)(b)); our legitimate interest in preventing abuse and enforcing our Terms of Service (Art. 6(1)(f)) for blocks and reports. Chats are not end-to-end encrypted. We do not read them routinely, but we may review the relevant messages when a user reports them or when the law requires it.

3.7 Parks and photos you contribute

Park listings (name, location, equipment) and photos you submit, taken with your camera or picked from your gallery. The App opens the camera or gallery only when you choose to add a photo. Approved parks and their photos are visible to all App users. You can add parks without an account; we then create an anonymous technical identifier so the submission can be stored and moderated.

Purpose: building the community park map and moderating submissions. Legal basis: performance of contract (Art. 6(1)(b)) and our legitimate interest in moderation (Art. 6(1)(f)). Please do not include people's faces or other personal details in park photos.

3.8 Subscriptions and purchases

Subscription status, plan, trial and renewal dates, and an anonymous purchase identifier, received from Google Play or the Apple App Store through our subscription provider RevenueCat. We never receive your card or bank details; payments are handled entirely by Google or Apple. We may link your account to a Founding Member waitlist entry with the same email address so we can honor that offer.

Purpose: unlocking paid features, restoring purchases and honoring promotions. Legal basis: performance of contract (Art. 6(1)(b)); keeping records required by tax law (Art. 6(1)(c)).

3.9 Technical and security data

When the App or Website communicates with our servers, our hosting providers record technical data such as IP address, request time, device and operating-system type and error information in server logs. Google Play and Apple may give us aggregated, anonymized crash and performance statistics. The App saves basic state (settings, offline progress) in local storage on your device; this is strictly necessary for the App to work and is not used for tracking.

Purpose: operating, securing and fixing the App and Website. Legal basis: legitimate interest in a secure, working service (Art. 6(1)(f)).

3.10 Website, cookies and waitlist

Our Website provides information about the App and does not sell products. It is hosted by Shopify, which processes device and usage data when you visit and sets cookies needed for the site to work; optional analytics or marketing cookies are only used if you accept them in the cookie banner, and you can change your choice at any time. If you join our Founding Member waitlist, we store your email address, sign-up date and waitlist position and send you a confirmation email.

For certain features Shopify acts as an independent controller; see the Shopify Consumer Privacy Policy and the Shopify Privacy Portal. Legal basis: consent for optional cookies and the waitlist (Art. 6(1)(a)); legitimate interest for site security (Art. 6(1)(f)).

3.11 Communications and notifications

If you email us, we keep the conversation so we can help you. We send service emails such as account confirmations, password resets and important changes. We send marketing emails only if you asked for them (for example by joining the waitlist), and every marketing email has an unsubscribe link. If you allow notifications, the App shows reminders that it generates on your device; you can turn them off in your Profile or device settings. Legal basis: performance of contract for service emails; consent for marketing and notifications (Art. 6(1)(a)).

3.12 What we do not do

  • We do not sell or rent personal data, and we do not share App data for advertising.
  • We do not use your data for automated decision-making with legal or similarly significant effects (Art. 22 GDPR).
  • The App does not collect contacts, call logs, SMS or your device's advertising ID.

If we add a feature that uses personal data in a new way, we will update this policy before launching it and, where required, ask your permission in the App first.

4. Who we share data with

We share personal data only with service providers that process it on our behalf under a data processing agreement, and only as far as needed:

  • Supabase Inc. (servers in the EU, Paris region): App database, authentication, file storage, realtime messaging, server functions and waitlist. Data: account, profile, activity, location (if opted in), chat, park and photo data, waitlist email, technical logs.
  • RevenueCat Inc.: subscription management. Data: anonymous purchase identifier, subscription status.
  • Google (Google Play) and Apple (App Store): app distribution, payment processing, crash statistics. Data: purchase and payment data under their own privacy policies; we receive no payment details.
  • Shopify: website hosting. Data: website visit data and cookies.
  • Map providers (Stadia Maps and/or the OpenStreetMap Foundation): map images and place search. Data: IP address, map area viewed, search text.
  • Email delivery provider (currently Resend) and Microsoft (Outlook mailbox): sending service and waitlist emails, and receiving your emails. Data: email address, message content.

Providers may change over time; any replacement is bound by equivalent obligations and this list will be updated.

Other users see what you choose to show them: your username, your approximate distance (only if you are visible to nearby athletes), your messages, your Train Together activity, and parks and photos you contributed once approved.

We may also disclose data when required by law or a binding order from an authority; to protect the safety, rights or property of users, the public or MyBodyWeight (for example when acting on a report of illegal content); or to a successor if MyBodyWeight is reorganized, merged or sold, in which case this policy continues to protect your data.

5. International transfers

Our main App database is in the European Union. Some providers (for example RevenueCat, Resend, Shopify, Microsoft and Supabase's support and sub-processors) are based in, or may access data from, countries outside the European Economic Area, including the United States. We then rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework for certified companies) or on the European Commission's Standard Contractual Clauses with appropriate safeguards. You can ask us for a copy of these safeguards.

6. How long we keep data

  • Account, profile, workout history, chats, friends, Train Together and reports: until you delete your account. Inactive accounts (no sign-in for 24 months) may be deleted after we email you a warning.
  • Location for Nearby Athletes: overwritten with each update; erased when you turn visibility off or delete your account.
  • A chat thread: until either participant deletes their account, which removes the whole thread for both people.
  • Approved parks: kept as community listings; the link to you is removed when you delete your account.
  • Park photos you uploaded: until you delete your account, or until removed in moderation.
  • Waitlist entry: until you unsubscribe or delete your account; after launch, at most 12 months if you never create an account.
  • Server logs: up to 90 days.
  • Database backups: up to 30 days, after which deleted data is gone from backups too.
  • Purchase and tax records: 7 years, as required by Dutch tax law.
  • Emails with us: up to 2 years after the matter is resolved.
  • Data on your device: until you delete the account in the App, clear the App's data, or uninstall it.

7. Deleting your account

You can permanently delete your account and associated data at any time:

Deletion removes your account, profile, workout history, location, chats, friends, Train Together data, blocks and reports, park photos and any waitlist entry from our live systems immediately; deleted data disappears from backups within 30 days. We keep only what Section 6 says must stay (purchase and tax records, and parks no longer linked to you). Data on your device is wiped when you delete in the App; if you delete on the website, uninstall the App or clear its data to remove the local copy too. If you added parks as a guest, email us to have those contributions removed.

Deleting your account does not cancel a subscription. Cancel it first in Google Play or the App Store (see our Subscription Terms).

8. Your rights

Under the GDPR you have the right to: access your personal data and get a copy; have inaccurate data corrected; have your data erased; restrict processing; data portability (receive the data you gave us in a machine-readable format); object to processing based on our legitimate interests, and to direct marketing at any time; and withdraw consent at any time, without affecting earlier processing.

Most settings can be changed in the App itself. For anything else, email mybodyweight@outlook.com. We respond within one month and may ask you to confirm your identity first. Exercising your rights is free.

You may also complain to a data protection authority: in the Netherlands the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority where you live or work. We would appreciate the chance to solve the problem first.

Wherever you live, we extend these rights to you. If your local privacy law (for example the UK GDPR or US state privacy laws) gives you additional rights, you can exercise them through the same contact. We do not "sell" or "share" personal information as those laws define those terms.

9. Age requirement

The App is intended only for people aged 16 and over and is not directed at children. We do not knowingly collect personal data from anyone under 16. If we learn that a user is under 16, we delete their account. If you believe a child has given us personal data, contact us.

10. Security

We protect your data with measures appropriate to the risk, including encryption in transit (HTTPS/TLS) and at rest at our database provider, row-level access rules so users can only reach their own data, hashed passwords, access limited to the founders who need it with strong authentication, and coarsening of shared locations. No system is perfectly secure; if a personal data breach is likely to put you at high risk, we will notify you and the authorities as the law requires.

11. App permissions

  • Location (while using the App): map and Nearby Athletes.
  • Camera and photos: adding park photos, only when you choose to.
  • Notifications: reminders.
  • Internet: syncing and online features.

Every permission except internet is optional and can be granted or revoked at any time in your device settings (Android: Settings → Apps → MyBodyWeight → Permissions; iOS: Settings → MyBodyWeight). Refusing a permission disables only the feature that needs it.

12. Changes to this policy

We may update this policy when the App, the Website, the law or our providers change. The "Last updated" date shows the latest version. For material changes we will notify you in the App or by email before they take effect and, where a change requires your consent, ask for it.

13. Contact

MyBodyWeight VOF
Van 't Hoffstraat 83, 6706 KJ Wageningen, the Netherlands
KvK: 42154909 · VAT: NL869956206B01
Email: mybodyweight@outlook.com
Website: my-bodyweight.com

Related: Terms of Service · Subscription Terms · Delete your account