Privacy Policy

XPGym · Last updated 19 June 2026

This Privacy Policy explains how Nullset Studio ("we", "us") collects, uses, and shares personal data when you use XPGym (the "App"). We are the data controller for the processing described here. The App is local-first: it works without an account, and cloud features (sign-in, sync, social) only process data once you opt in by signing in.

1. Data we collect

Account data: email address and authentication identifiers (including via Google Sign-In). Passwords are handled by our authentication provider and stored hashed — we never see them.
Profile and body data you provide: alias, sex, age, height, weight, target weight, activity level, experience, goal, equipment access, units, language, and (for Bio-Scan) body-fat and tape measurements.
Fitness activity: workouts, exercises, sets, reps, weights, XP, streaks, personal records, and quests.
Social data (if you use the Guild features): your handle, friend code, follow connections, activity-feed events, likes, and comments.
Subscription data: your plan and entitlement status, provided via the app store and our subscription provider. We do not receive your full payment-card details.
AI feature data: when you use the AI Coach, relevant profile and goal data is sent to our AI provider to generate a workout.
Technical data: device and OS type, app version, and — if you enable them — a push-notification token. We may collect limited diagnostic data to keep the App working.

2. How we use your data

To provide core features: tracking workouts, computing XP/stats, and showing your progress.
To sync your data across your devices when you are signed in.
To operate social features you choose to use.
To process subscriptions and unlock paid features.
To generate AI workout suggestions when you request them.
To send the notifications you enable (training reminders and progress nudges).
To maintain security, prevent abuse, debug, and comply with legal obligations.

3. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of our contract with you (to provide the App and account); your consent (e.g. notifications, optional body metrics, AI features — which you can withdraw at any time); our legitimate interests (security, abuse prevention, improving the App); and compliance with legal obligations.

4. How we share data

We do not sell your personal data. We share it only with service providers that help us run the App, acting on our instructions:

Supabase — database, authentication, and hosting (data storage and account management).
Our subscription provider (RevenueCat) and the Apple App Store / Google Play — to verify and manage subscriptions and process payments.
Google — for optional Google Sign-In, and for the AI service that powers AI Coach workouts.
A public image CDN (GitHub) that serves exercise photos; loading an image discloses your device’s IP address to that host, as with any web image.

We may also disclose data if required by law, to protect rights and safety, or in connection with a business transfer.

5. International transfers

Our providers may process data in countries outside your own, including the United States. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

6. Data retention

We keep your data while your account is active. When you delete your account, we delete or anonymize your associated cloud data within a reasonable period, except where we must retain it to meet legal obligations. Data stored only on your device is removed when you reset the app or uninstall it.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, export (portability), restrict, or object to the processing of your personal data, and to withdraw consent. You can:

Delete your account and associated cloud data directly in Settings → Account.
Reset all local data in Settings.
Email hello+privacy@notifications.nullset.studio to make any data request, including access or export.

EEA/UK users may lodge a complaint with their local data-protection authority. California residents have rights under the CCPA/CPRA to know, delete, and opt out of the "sale" or "sharing" of personal information (we do not sell or share it for cross-context advertising), and not to be discriminated against for exercising these rights.

8. Security

We use encryption in transit and access controls (including per-user row-level security) to protect your data. No method of transmission or storage is completely secure, but we work to protect your information.

9. Children’s privacy

The App is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.

10. Changes

We may update this Policy. We will revise the "last updated" date and, for material changes, notify you in the App.

11. Contact

For privacy questions or requests, contact hello+privacy@notifications.nullset.studio.

This document is provided in English; the English version governs. Questions: hello+privacy@notifications.nullset.studio