Privacy Policy

1. Data controller

Privacy-rights requests can be submitted through the Privacy Request page. Account deletion can be initiated in the app or through the Delete Account page.

2. Data we process

• Account data: authentication identifier and email address.
• Profile data: age, height, training goals, availability, training history, equipment and preferences.
• Fitness data: workouts, sets, reps, loads, holds, skills, progression state, plans, XP, streaks and leaderboard-related data.
• Health/readiness data: weight, sleep, fatigue, stress, pain, injury history, movement limitations, clinician restrictions and daily readiness check-ins.
• Technical/security data: service and security logs necessary to operate, troubleshoot and protect the service.
• First-party product analytics: limited event names such as app open, onboarding completion and workout start/complete. Health values and free-text pain/injury fields are blocked from analytics.

3. Purposes

• provide and secure the account;
• generate and adapt training plans;
• save workout history and progression;
• apply readiness and safety rules;
• measure beta quality and retention using limited first-party analytics;
• prevent abuse and troubleshoot failures.

4. Health/readiness consent

Health/readiness data is processed separately from ordinary account and fitness data. ChaosControl asks for explicit, versioned consent (health-v1) before storing or using this category for readiness personalization or safety rules.

Consent can be withdrawn in Account & Privacy. Withdrawal removes daily readiness records, pain/injury screening records, health-derived workout-generation decisions and stored health baseline fields. Core workout history, XP and the account remain unless the account is deleted.

5. Legal bases

Ordinary account and fitness processing is carried out to provide the requested service and, where applicable, for legitimate service-security interests. Special-category health/readiness processing is based on explicit consent.

6. Advertising and sale

ChaosControl does not sell health or fitness data to data brokers and does not use health/readiness data for targeted advertising, insurance eligibility, employment eligibility, credit decisions or unauthorized social sharing.

7. Infrastructure

ChaosControl uses Supabase infrastructure for authentication, database, storage and server-side functions. Service providers process data only to provide the technical service.

8. Retention and deletion

Account-linked data is generally retained while the account is active and as necessary to provide the service. Health/readiness data can be removed by withdrawing consent. Account deletion removes the Auth account, associated application records and user-owned storage objects, except where retention is legally required.

9. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to certain processing. You may withdraw health-data consent at any time without affecting processing carried out before withdrawal. Submit a request through Privacy Request.

10. Security

ChaosControl uses authenticated access, Row Level Security, server-side validation, least-privilege permissions and controlled server functions. No system can guarantee absolute security.

11. Age

The current beta is intended for users aged 18+.

12. Changes

Material changes to this policy or health-data processing will use an updated policy version and, where required, a new consent choice.