Privacy Policy

Last updated: April 24, 2026

Welcome to IronHex. This Privacy Policy explains how we collect, use, and protect your personal data when you use our app.

Who we are

IronHex is a fitness tracking app that helps you build and follow workout routines. We are the data controller for the personal data you provide to us. For any privacy-related matters, you can contact us at studio.apps.team@gmail.com.

What data we collect

We collect the following categories of data:

Account data — your email address, used to create and authenticate your account.

Profile data — gender, date of birth, experience level, and training goal. This is used to personalise your experience and, in the future, to tailor exercise recommendations to you.

Health & fitness data — your body weight log, workout history, exercise sets and repetitions, and session durations. This data is stored privately and is only accessible to you.

App usage analytics — aggregated, anonymised data about how features are used. This is never linked to your identity and is used solely to improve the app.

Device data — Android Advertising ID (GAID) and device information, collected by Google AdMob for advertising purposes. You can reset or opt out of personalised ads at any time in your Android device settings.

Legal basis for processing

We process your personal data on the following legal bases under GDPR Article 6:

• Contract performance — account and profile data necessary to provide the IronHex service
• Legitimate interests — aggregated analytics used to improve the app, where your rights and interests do not override ours
• Consent — marketing notifications (discount alerts and price change notifications), which you may withdraw at any time from the app settings

How we use your data

• To provide and operate the IronHex service
• To personalise your training experience
• To sync your data across your devices (via our secure cloud backend)
• To send you important service notifications (e.g. account security)
• To display relevant advertising to free tier users (via Google AdMob)
• If you have opted in: to send you discount alerts and price change notifications

We do not sell your data to third parties.

Data storage and security

Your data is stored in a secure cloud database (Supabase, hosted on AWS). All data in transit is encrypted using TLS. Your health and fitness data is protected by strict access controls — only you can read your own data.

International data transfers

Some of our third-party service providers (Supabase/AWS, RevenueCat, Google AdMob, and Sentry) may process your data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, to protect your personal data.

Your rights

Under the General Data Protection Regulation (GDPR) and applicable privacy laws, you have the right to:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your account and all associated data
• Portability — receive your data in a machine-readable format
• Objection — object to processing for marketing purposes
• Withdraw consent — at any time, without affecting prior processing

Under GDPR Article 20, you can exercise your right to data portability directly from the app: go to Profile → My Data & Privacy → Export my data. You can choose which data categories to include in your export. The file will be downloaded as a JSON file to your device.

To exercise any of these rights, contact us at studio.apps.team@gmail.com.

You also have the right to lodge a complaint with your national data protection authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD): aepd.es.

Account deletion

You can delete your account at any time from the "My Data & Privacy" screen inside the app. Deletion is permanent and irreversible. All your personal data, workout history, and profile information will be removed within 30 days.

Data retention

We retain your data for as long as your account is active. If you delete your account, all data is deleted within 30 days. Anonymised analytics data (not linked to you) may be retained indefinitely.

App permissions

IronHex may request the following permissions on your Android device:

• Notifications — to send you training reminders and service alerts (optional, can be revoked at any time)
• Microphone (RECORD_AUDIO) — this permission is included in the app's manifest as a side effect of a third-party audio library dependency. IronHex does not use the microphone, does not record audio, and does not access or process any audio data from your device at any time.

Third-party services

We use the following third-party services to operate IronHex:

• Supabase — database and authentication (supabase.com/privacy)
• RevenueCat — subscription management (revenuecat.com/privacy)
• Google AdMob — in-app advertising for free tier users (policies.google.com/privacy)
• Google Sign-In — authentication via your Google account (policies.google.com/privacy)
• Sentry — crash reporting and error monitoring (sentry.io/privacy)

Each of these services has its own privacy policy and processes data under their own terms. We have Data Processing Agreements (DPAs) in place with our data processors where required by GDPR.

Children

IronHex is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at studio.apps.team@gmail.com and we will delete it.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will notify you in the app. Continued use of IronHex after a policy update constitutes acceptance of the revised policy.

Contact

For any privacy-related questions or requests:

Email: studio.apps.team@gmail.com

We aim to respond within 30 days.