Privacy Policy
Introduction
WRKD (“we”, “us”, “our”) operates the WRKD mobile application (the “App”). This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.
By using the App, you agree to the collection and use of information as described in this policy. See also our Terms of Use.
Legal Basis for Processing (GDPR)
If you are in the European Economic Area (EEA), we process your data under the following legal bases:
- Contract performance — account data, workout logs, and training plans are necessary to provide the service you signed up for
- Legitimate interest — aggregated usage analysis to improve plan generation quality
- Consent — optional data like physical attributes, which you can withdraw at any time through profile settings
Data We Collect
Account Information
When you create an account, we collect:
- Email address — used for authentication and account recovery
- Full name — optional, used for display within the App
- Authentication credentials — managed securely through our authentication provider
If you sign in with Google, we receive your name and email address from Google. We do not receive or store your Google password.
Profile & Preferences
During onboarding and through profile settings, we collect:
- Training preferences — disciplines you train (e.g., BJJ, strength, running), experience levels, training frequency, and goals
- Physical attributes — optional data like bodyweight, used for exercise programming
- App preferences — theme settings and notification preferences
This data is stored as structured profile data associated with your account.
Workout Data
When you use the App, we collect:
- Training plans — AI-generated weekly plans based on your preferences
- Workout logs — exercises performed, sets, reps, weights, and session duration
- Completion timestamps — when you complete workouts
Subscription Data
If you subscribe to WRKD Pro, we collect:
- Subscription status — whether you have an active subscription
- Subscription expiration date
- Transaction records — event type, product identifier, price, and currency
Payment processing is handled by Apple (App Store) and Google (Google Play). We never receive or store your credit card number, bank account, or other payment instrument details.
Automatically Collected Data
We do not use third-party analytics SDKs, advertising trackers, or location services. Note that our infrastructure providers (Supabase, Cloudflare) may log IP addresses and basic request metadata as part of standard operations.
How We Use Your Data
We use your data to:
- Provide the service — generate personalized training plans, store your workout logs, and manage your account
- Process subscriptions — verify your subscription status and manage Pro features
- Improve the App — understand usage patterns to improve plan generation (aggregated, not individual)
We do not use your data for advertising, sell it to third parties, or share it with data brokers.
Data Storage & Security
Your data is stored in a PostgreSQL database hosted by Supabase (supabase.com), with infrastructure on Amazon Web Services (AWS). Data is:
- Encrypted in transit (TLS)
- Encrypted at rest
- Protected by Row Level Security — you can only access your own data
- Hosted in a SOC 2 Type II compliant environment
Our website is hosted on Cloudflare Pages. Cloudflare may process standard web request metadata (IP address, user agent) as part of serving the site.
Third-Party Services
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Authentication, database | Email, profile, workout data |
| Google Sign-In | OAuth authentication | Email, name (from Google to us) |
| RevenueCat | Subscription management | User ID, subscription events, device metadata, app version |
| Apple App Store | Payment processing | Managed entirely by Apple |
| Google Play Store | Payment processing | Managed entirely by Google |
| Google (Gemini API) | Training plan generation | Training preferences, disciplines, schedule (no personally identifiable information) |
Each third-party service has its own privacy policy. We encourage you to review them.
Data Retention
We retain your data for as long as your account is active.
Account Deletion
You can delete your account at any time from the App’s profile settings. When you delete your account:
- All workout logs are permanently deleted
- All training plans are permanently deleted
- Your profile data is permanently deleted
- Your authentication record is permanently deleted
Deletion from active systems is immediate and irreversible. Residual copies in automated database backups are overwritten within 7 days and are not used to restore individual accounts.
Your Rights
Depending on your jurisdiction, you may have the right to:
- Access your personal data
- Correct inaccurate data
- Delete your account and all associated data
- Export your data
- Object to certain processing
To exercise these rights, contact us at the email below.
International Data Transfers
Your data is stored on servers in the United States (AWS via Supabase). If you are located outside the US, your data is transferred internationally. We rely on our providers’ compliance frameworks (including SOC 2 and standard contractual clauses where applicable) to protect transferred data.
Data Breach Notification
In the event of a data breach that affects your personal data, we will notify affected users by email within 72 hours of becoming aware of the breach, as required by applicable law.
Children’s Privacy
WRKD is intended for users aged 18 and older. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has provided us data, contact us and we will delete it.
Changes to This Policy
We may update this policy from time to time. We will notify you of material changes through the App or by updating the “Last updated” date above.
Contact
If you have questions about this Privacy Policy, contact us at:
Email: neilo.abanga@gmail.com