Privacy Policy

1. Introduction

Oxide is a workout tracking application provided by [TODO: legal entity name and registered address — likely a sole trader / autónomo in Barcelona, Spain]. This policy explains what personal data Oxide processes, why, on what legal basis, and what choices you have.

For any privacy question, contact privacy@oxide.fit.

2. Data we collect

Oxide only collects data needed to run the app. The following categories apply:

• Account information. [TODO: legal text — email address, hashed password, account creation date, sign-in provider if applicable.]
• Workout data. [TODO: legal text — sets, reps, weight, RPE/RIR, programs, phases, personal records you log in the app.]
• Body metrics. [TODO: legal text — bodyweight, height, age, sex, training experience, and other inputs you enter for program generation. This is health data under GDPR Art. 9 and is processed only with explicit consent.]
• Payment metadata from Apple. [TODO: legal text — Apple transmits subscription status, product identifier, and transaction identifiers. Oxide does not see or store your payment card.]
• Device information. [TODO: legal text — device model, OS version, app version, language, and a per-install identifier used for sync and crash diagnostics.]
• Analytics. [TODO: legal text — privacy-respecting product analytics covering feature usage and crash reports. No advertising identifiers, no cross-app tracking.]

3. How we use the data

Oxide uses the data above for the following purposes:

• Provide the service. [TODO: legal text — store your training log locally on your device and on our servers when sync is enabled.]
• Multi-device sync. [TODO: legal text — back up your training log and keep it consistent across your iPhone, iPad, and future devices.]
• AI program generation. [TODO: legal text — when you use the personalized program feature, your goal, experience, schedule, equipment, and body metrics are sent to our generation backend, which in turn calls an AI model provider under contract. The model provider does not retain the data for training.]
• Service operations. [TODO: legal text — fraud prevention, debugging crashes, enforcing the Terms of Service, and complying with legal obligations.]
• Product analytics. [TODO: legal text — aggregated, non-identifying analytics used to improve Oxide.]

4. Legal basis

Under the EU General Data Protection Regulation, Oxide relies on the following legal bases (GDPR Art. 6 and, for health data, Art. 9):

• Performance of a contract (Art. 6(1)(b)). [TODO: legal text — account data, workout data, sync, and subscription processing are necessary to deliver the service you signed up for.]
• Consent (Art. 6(1)(a) and Art. 9(2)(a) for health data). [TODO: legal text — body metrics and AI program generation rely on explicit consent you grant in-app. You can withdraw consent at any time.]
• Legitimate interest (Art. 6(1)(f)). [TODO: legal text — securing the service, preventing abuse, and improving product quality through aggregated analytics. Balanced against your rights.]
• Legal obligation (Art. 6(1)(c)). [TODO: legal text — tax, accounting, and responding to lawful requests from authorities.]

5. Third parties

Oxide uses a small set of vendors to deliver the service. They process data on our behalf under written data processing agreements:

• Apple Inc. [TODO: legal text — App Store distribution and subscription processing.]
• AI model provider (Anthropic). [TODO: legal text — processes your inputs to generate personalized programs. Does not retain prompts for model training.]
• Hosting and infrastructure (AWS, Vercel). [TODO: legal text — EU-region hosting for the Oxide sync server and marketing site.]
• Product analytics. [TODO: legal text — privacy-respecting analytics provider; list specific vendor here.]

Oxide does not sell personal data and does not share it with advertisers.

6. International transfers

[TODO: legal text — at launch, Oxideservers are located in the European Union (AWS eu-central-1, Frankfurt). Where a vendor processes data outside the EU, the transfer is covered by the European Commission's Standard Contractual Clauses or another approved transfer mechanism.]

7. Data retention

• Active accounts. [TODO: legal text — Oxide retains your data for as long as your account is active.]
• After cancellation of the Coach subscription. [TODO: legal text — your training log stays accessible on the free tier indefinitely until you delete the account.]
• After account deletion. [TODO: legal text — personal data is deleted within 30 days from primary storage and within 90 days from encrypted backups. Records required for legal compliance (invoicing, fraud) are retained for the statutory period.]

8. Your rights

Under GDPR (Art. 15 to 22) you have the following rights with respect to your personal data:

• Right of access — obtain a copy of the data Oxide holds about you.
• Right to rectification — correct inaccurate data.
• Right to erasure — request deletion of your account and data.
• Right to portability — export your training data in a machine-readable format.Oxide provides in-app export at any time.
• Right to restrict processing — limit how Oxide uses your data while a dispute is resolved.
• Right to object — object to processing based on legitimate interest.
• Right to withdraw consent — withdraw any consent you have given, without affecting the lawfulness of past processing.

To exercise these rights, email privacy@oxide.fit. You also have the right to lodge a complaint with your local supervisory authority. In Spain that is the Agencia Española de Protección de Datos (AEPD).

9. Children

Oxide is not directed at children under 16 and does not knowingly process data from anyone under that age. [TODO: legal text — if Oxide learns that a user is under 16, the account is deleted and any associated data removed.]

10. Changes to this policy

[TODO: legal text — Oxidemay update this policy as the service evolves or the law changes. Material changes will be communicated in-app and by email before they take effect. The "Last updated" date at the top of this page always reflects the current version.]

11. Contact

Privacy questions, rights requests, and complaints: privacy@oxide.fit.

Postal address: [TODO: legal text — registered business address in Barcelona, Spain].