Privacy policy

1. Introduction

This Privacy policy describes how the Arestis application ("the Application"), published by Enrique Rizabaev ("the Publisher"), collects and processes your personal data, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act ("Informatique et Libertés").

It covers every way of accessing the Application: the iOS and Android mobile applications, and access from a web browser. The data processing, the data controller and the processor are the same whatever the platform used; operating differences specific to a platform are indicated where relevant.

2. Data controller

The data controller is Enrique Rizabaev. For any question about your data: contact@arestis.com.

3. Data collected

Account data: email address. The password is managed by the authentication provider (Supabase) and is never accessible in plain text to the Publisher.

Public identifier: a unique username that you choose and can change once a year. It is meant to identify you to other users and should therefore be considered public: do not include any information you do not want to be visible.

Profile data: first name or nickname, date of birth, gender, height, training goal and target number of sessions per week.

Body tracking data: weight and its history, body fat, muscle mass, and the body measurements you choose to enter (neck, shoulders, chest, waist, hips, arms, forearms, thighs, calves).

Activity data: programs, workouts (including drafts in progress), exercises, sets, weights, repetitions, durations, distances, notes and rest times.

Preferences: theme and accent color, language, units of measurement, rest alarm sound, notification settings, tutorials already viewed.

Technical data: session information strictly necessary for signing in, and local storage on your device or in your browser. The Application collects no advertising identifier, no location data and no data from your address book.

4. Permissions requested on your device

Notifications: requested at your first rest period, only to tell you when it has ended. These notifications are entirely local, scheduled on your device: no notification token is created, no server is informed and the Publisher has no way of sending you a notification. You can turn them off at any time in the Application or in your phone settings.

Sound: the Application plays an alarm at the end of your rest time and keeps audio playback running during that rest, so that it can ring on time even when the screen is locked. The Application never accesses the microphone and records no sound.

The Application does not request access to your camera, your photos, your location, your contacts or your phone's health apps.

5. Origin of the data

The data is provided directly by you when signing up and using the Application. No data is bought or collected from third parties. The Application collects no data for advertising purposes and uses no third-party tracker, no audience measurement tool and no behavioral analytics tool.

6. Purposes of processing

Your data is processed to: provide and operate workout tracking; back up and sync your data across your devices; calculate your statistics and records; notify you when your rest time ends; manage your account and keep the service secure.

Your body tracking data is used exclusively to calculate your own statistics. It is not shared, not used for advertising, and not passed on to an insurer, an employer or a health professional.

7. Legal bases

Processing is based on: performance of the contract (the Terms) for providing the service; your consent, collected at sign-up, which you can withdraw at any time; the Publisher's legitimate interest regarding the security and proper operation of the Application.

8. No automated decision-making

Your data is not subject to any automated decision producing legal effects concerning you, nor to any profiling. The statistics, charts and records shown in the Application are simple calculations based on what you logged, for your information only.

9. Recipients of the data

Your data is intended solely for the Publisher. It is processed by Supabase, Inc., as a processor, solely for hosting and operating the service. No data is sold or disclosed to third parties for commercial purposes.

When you share a workout as an image, the image is generated locally on your device. In the mobile applications, it is then passed to the app of your choice through your phone's share menu; from a web browser, it is saved as a downloaded file on your device. In both cases, no copy is sent to the Publisher and the shared content is entirely up to you.

10. Hosting and transfers

Your data is hosted by Supabase, Inc. The Publisher ensures that hosting takes place within the European Union or, failing that, is covered by appropriate safeguards (standard contractual clauses of the European Commission) in case of transfer outside the European Union.

11. Retention period

Your data is kept for as long as your account is active.

When you request the deletion of your account, from Settings → Account, it is immediately deactivated and your data is kept for 30 days. During this period, you can restore everything by signing in again: the Application then explicitly asks whether you want to cancel the deletion or let it proceed. After 30 days, your account and all your data are permanently and automatically erased. Full details are on the Delete my account page.

Data needed to comply with legal obligations may be kept for the period required by law.

12. Security

The Publisher implements appropriate technical measures: encryption of exchanges (HTTPS/TLS); authentication and password management by the provider Supabase, the password never being accessible in plain text to the Publisher; strict isolation (row-level security rules) ensuring that each user only accesses their own data.

13. Your rights

Under the GDPR, you have the rights of access, rectification, erasure ("right to be forgotten"), restriction, portability and objection, as well as the right to withdraw your consent and to set instructions regarding what happens to your data after your death.

You can exercise several of these rights directly in the Application: edit your profile and measurements, export all your data as JSON or CSV, delete your account and all your data. Deletion comes with a 30-day withdrawal period (see article 11). For any other request, write to contact@arestis.com. The Publisher undertakes to reply within one month.

14. Local storage and cookies

The Application keeps a copy of your data on your device (in the app's storage on mobile, in your browser's local storage on the web) so that it remains usable offline: you can log a workout without a connection, and it will sync once you are back online. This local storage is also used to keep you signed in and to store your display preferences. It is erased when you sign out or uninstall the Application.

The Application uses no advertising cookies and no trackers requiring consent.

15. Minors

The Application is intended for people aged at least 15, the age of digital consent in France. Below that age, creating an account and processing the data require the prior consent of a holder of parental authority.

16. Changes to this policy

This policy may be updated. Its last update date and version number appear at the top of the document. In case of substantial change, you will be informed in the Application.

17. Complaint to the CNIL

If you believe that the processing of your data does not comply with the regulations, you can lodge a complaint with the CNIL (the French data protection authority): Commission Nationale de l'Informatique et des Libertés, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. Website: www.cnil.fr.

18. Contact

For any question about your personal data: contact@arestis.com.