Privacy policy

Before launch: replace the highlighted placeholders with your company details and have this policy reviewed by a qualified adviser.

Who we are

GluteMaxx is operated by [company name, registered address, company number], the data controller for the personal data described here. Contact: [privacy contact email].

What we collect

• Account: email address and an encrypted password (handled by our authentication provider; we never see or store your password).
• Your answers: goals, experience, equipment, schedule, age, height, optional weight, movement limitations you tell us about, activity level and nutrition preferences.
• Training: programmes, workouts, sets, weights, reps, effort and recovery ratings, notes and milestones.
• Nutrition: foods you log, quantities, saved foods and meals.
• Body data (optional): body weight, hip and waist measurements and progress photos.
• Subscription: plan, status and renewal dates from our billing provider. Card details are handled by the payment processor; we never receive them.

Measurements, photos and some training details can be health data, a special category under UK GDPR. We process them only with your explicit consent, given when you create an account. You can withdraw consent at any time by deleting the data or your account.

Why we use it

• To provide the app: building and adapting your programme, suggesting weights, calculating your Glute Growth Score, tracking food and progress (contract, and explicit consent for health data).
• To run subscriptions and prevent fraud (contract and legal obligation).
• To keep the service secure and working (legitimate interests).

We do not sell your data, use it for advertising, or train AI models on it.

Demo Mode

Anything entered in Demo Mode stays in your browser's memory and is discarded when you leave or reload. It is never sent to our servers.

Who processes it for us

• Supabase (database, authentication and private photo storage).
• Cloudflare (hosting and content delivery). Requests pass through its network; it does not store your training data.
• RevenueCat and its payment processor (subscriptions and billing).
• Open Food Facts receives the text of food searches and barcodes, never your identity.

Some providers may process data outside the UK; where they do, transfers rely on UK adequacy regulations or the International Data Transfer Addendum. [Confirm the regions you configure.]

Photos

Progress photos are resized and re-encoded on your device (which removes location metadata), then stored in a private storage bucket that only your account can access, and shown through short-lived links. Delete any photo at any time.

How long we keep it

Until you delete it or your account. Deleting your account removes your data from our live systems immediately and from backups within [30] days. Our billing provider keeps transaction records as tax law requires.

Your rights

You can access, correct, export (Settings → Download a backup), and delete your data (Settings → Delete account and data), withdraw consent, object to or restrict processing, and complain to the Information Commissioner's Office (ico.org.uk).

Age

GluteMaxx is for adults aged 18 and over.

Storage on your device

If you have an account, the app keeps a copy of your data on your device (IndexedDB) so it works offline, and stores your sign-in session and display preferences. These are necessary for the service; there are no advertising or analytics cookies.