Privacy Policy

1. Who controls your data

BeeStrong App is operated by Dariusz Sztejnagiel, an individual based in the United Kingdom, who acts as the data controller for the purposes of UK GDPR. For privacy questions or requests, contact support@beestrongapp.com.

2. Data we collect

Depending on the features you use, BeeStrong App may collect or process the following information.

3. How we use your data

We use your data to:

• Create and maintain your account
• Authenticate users
• Provide offline and cloud-based app functionality
• Save and synchronize workouts and programs
• Generate progress charts and statistics
• Provide body measurement and progress photo features
• Support friend, messaging, challenge, and sharing features
• Provide Coach Mode
• Generate AI Coach responses when requested
• Deliver push notifications
• Verify purchases and manage access to paid features
• Prevent fraud, abuse, and unauthorized access
• Maintain security and reliability
• Respond to support, privacy, and deletion requests
• Meet legal, accounting, and regulatory obligations

We do not sell your personal data.

4. Legal bases for processing

• Contract: to provide the BeeStrong service and features requested by you.
• Legitimate interests: to secure the service, prevent abuse, maintain reliability, and improve app performance.
• Consent: for optional features such as notifications, progress photos, AI Coach, and voluntary sharing where consent is required.
• Legal obligation: to retain records or respond to lawful requests where required by law.

Where body measurements or progress photos are treated as special category health data, we rely on your explicit consent where required by law. You may withdraw consent by stopping use of the relevant feature, deleting the relevant data, disabling sharing or notifications, or contacting us. Withdrawal does not affect processing that was lawful before consent was withdrawn.

5. Cloud storage and synchronization

If you create an account or use cloud features, selected information may be stored and synchronized through Supabase. BeeStrong uses Supabase for authentication, database storage, file storage, cloud synchronization, realtime features, and Edge Functions. BeeStrong Supabase infrastructure is hosted in the European Union, in Frankfurt, Germany. Data is encrypted in transit using HTTPS/TLS. Some information may remain only on your device unless you enable or use a feature that uploads it.

6. Sharing with coaches and other users

If you accept a coach invitation, the coach may be able to access workout data, measurements, assigned programs, progress information, and other information required to provide coaching services. Only accept invitations from coaches you trust. Messages, shared templates, challenges, and other information you send to another user will be accessible to the intended recipient. BeeStrong is not responsible for how another independent user uses information that you intentionally share outside the functions and permissions provided by the service.

7. Service providers

• Supabase Inc. — authentication, database, file storage, synchronization, realtime services, and Edge Functions.
• Groq, Inc. — optional AI Coach inference.
• Google LLC / Google Play — Android distribution, purchases, subscriptions, purchase verification, and Firebase Cloud Messaging.
• Cloudflare, Inc. — website hosting, delivery, security, and privacy-friendly website analytics.

These providers process information only for the relevant services and according to their contractual obligations and privacy terms.

8. International data transfers

BeeStrong account and workout data is primarily processed in the European Union through Supabase infrastructure in Frankfurt and may also be accessed or administered from the United Kingdom. Some service providers may process information outside the United Kingdom or European Economic Area. Where required, international transfers are protected using appropriate safeguards, such as UK or EU adequacy regulations, Standard Contractual Clauses, the UK International Data Transfer Addendum, or other safeguards permitted by applicable law.

9. Cookies and local storage

BeeStrong uses local storage and similar device storage for essential app functions, including offline functionality, authentication sessions, preferences, cached files, and locally saved workout data. The BeeStrong website does not use advertising cookies or cross-site behavioural tracking. Cloudflare may process necessary technical information to provide security, content delivery, and analytics.

10. Biometric authentication

On supported Android devices, BeeStrong may allow you to protect access using device biometrics. Biometric authentication is performed locally by the Android operating system. BeeStrong does not receive or store your fingerprint, facial image, biometric template, or other raw biometric data. BeeStrong stores only a local preference indicating whether biometric protection has been enabled.

11. Data retention

• Account information: until the account is deleted.
• Workout, template, program, and measurement data: until deleted by you or until the account is deleted.
• Progress photos: until deleted by you or until the account is deleted.
• Friend and coach relationships: while the relationship or account remains active, or until deletion is requested.
• Messages, coaching notes, check-ins, challenges, and reviews: while required to provide the relevant feature, until deleted where deletion is available, or until the associated account is deleted.
• Push notification tokens: until notifications are disabled, the token becomes invalid, or the account is deleted.
• AI Coach conversation history: retained in the active app session or locally when you choose to save it. Requests processed by Groq are subject to Groq's applicable retention terms.
• Purchase and subscription records: retained as long as required to provide paid access, prevent fraud, resolve disputes, and meet tax or accounting obligations. Certain financial records may be retained for up to six years where required under UK law.
• Security and technical logs: only for as long as necessary for security, diagnostics, and abuse prevention.
• Website analytics: according to Cloudflare's applicable retention settings and policies.

Backups may retain deleted information for a limited period before being securely overwritten.

12. Account and data deletion

You can request deletion from within BeeStrong through: Profile > Delete account and data > Delete account and cloud data. You can also request deletion without using the app at beestrongapp.com/en/delete-account/ or by contacting support@beestrongapp.com. We may ask you to verify ownership of the account before processing an external deletion request. Deleting your account removes or anonymises personal information associated with the account, except information that must be retained for legal, accounting, fraud prevention, dispute resolution, or security purposes. Requests will be handled without undue delay and normally within 30 days. Deleting the app from your device does not automatically delete your cloud account.

13. Your rights

Subject to applicable law, you have the right to:

• Access your personal data
• Receive a copy of your data
• Correct inaccurate information
• Request deletion
• Restrict processing
• Object to processing based on legitimate interests
• Withdraw consent
• Request data portability
• Lodge a complaint with a data protection authority

To exercise these rights, contact support@beestrongapp.com. We may need to verify your identity before completing a request. We normally respond within one month, subject to extensions permitted by law. In the United Kingdom, you may complain to the Information Commissioner's Office: https://ico.org.uk/

14. Children

BeeStrong is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe that a child has created an account or provided personal information, contact us and we will take appropriate steps.

15. Security

• HTTPS/TLS encryption in transit
• Authentication and access controls
• Supabase Row Level Security
• Purchase verification through Google Play
• Restricted backend service credentials
• Content Security Policy
• Account deletion controls

No online service can guarantee absolute security. You are responsible for using a strong, unique password and protecting access to your device and email account.

16. Data breaches

If a personal data breach is likely to create a risk to your rights and freedoms, we will notify the relevant supervisory authority within the period required by applicable law. Where a breach is likely to result in a high risk to you, we will notify you without undue delay where required.

17. Changes to this policy

We may update this Privacy Policy when BeeStrong features, service providers, or legal requirements change. The latest version will be published with an updated revision date. Where appropriate, we may notify you of material changes through the app or by email.

Contact

For privacy questions, account deletion, or requests concerning your personal data, contact support@beestrongapp.com.