Privacy Policy

1. Data we collect

When you create an account, we store your email address and a securely hashed password via Supabase Auth. When you log workouts, we store the session data you enter (date, distance, duration, split, stroke rate, heart rate, RPE, notes).

In demo mode (no account), all data stays in your browser's local storage and is never sent to our servers.

1a. Workout Scan (photo-to-log)

When you use Scan workout to log a session from a photo of your rowing-machine monitor, the photo is processed entirely on your device by your web browser. The image is not uploaded to our servers, transmitted to any third party, or retained anywhere. Only the workout numbers you confirm and save (distance, duration, split, stroke rate, etc.) are sent to your account.

For internal feature analytics we may store a short label of which monitor model the scan came from (for example, "pm5") alongside the saved record. This label contains no personal or biometric information.

2. How we use your data

• Provide and personalize our training features (pace zones, programs, history).
• Send transactional emails (password resets, account confirmations).
• Monitor service health and fix errors (aggregated, non-personal metrics).

We do not sell or share your personal data with third parties for advertising.

3. Data storage & security

Your data is stored in a Supabase-managed PostgreSQL database with row-level security (RLS) enabled. All connections use TLS encryption. Passwords are hashed using bcrypt and never stored in plain text.

4. Cookies & local storage

We use Supabase auth tokens stored in local storage to keep you signed in. We do not use third-party tracking cookies. In demo mode, workout data is stored in local storage under the key erg-coach-demo-state.

5. Your rights

You may at any time:

• Access your data by viewing your profile and workout history in the app.
• Export: Pro subscribers can export their workout history as CSV from the History tab. Anyone can request a copy of their data by emailing privacy@ergbuddy.com.
• Delete workoutsyou logged in the app, one at a time. Workouts imported from Concept2 are read-only in ErgBuddy and can't be deleted individually. They're removed when you delete your account, or email us if you need a specific one removed.
• Delete your account at any time in the app: Profile → Delete account → Delete my account. Deletion happens immediately. If you can't sign in, email privacy@ergbuddy.com from the address on your account and we'll delete it within 30 days.

If you are in the EU/EEA, you have rights under the GDPR including data portability, rectification, and the right to lodge a complaint with your local data protection authority. California residents have similar rights under the CCPA.

6. Data retention

We keep your data for as long as your account is active. When you delete your account, we immediately and permanently deleteyour account, profile, workouts (including Concept2 imports), training programs and progress, Concept2 connection tokens, and any feedback you've sent us. Deleting your account cancels any active subscription immediately; payments already made are not refunded.

Some records are kept because the law or our payment processor requires it. Stripe keeps billing records (customer, invoices, payment history) as required for tax and accounting, under Stripe's own privacy policy; we remove our link to your account. We keep a pseudonymous billing reference (a Stripe customer ID linked to a random account ID, with no name or email) so we can recognize and ignore late payment notifications about a deleted account.

Our database provider's Free plan does not include automatic backups. We do not restore deleted accounts from backups. Our hosting and authentication provider keeps request and sign-in logs, which can include your email address and IP address, for about 1 day. We don't store an authentication audit log in our database. We may keep anonymized, aggregated metrics that can't identify you.

7. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or an in-app notice. Continued use after changes constitutes acceptance.

8. Contact

For questions about this policy or to exercise your data rights, email us at privacy@ergbuddy.com.