Privacy Policy

This Privacy Policy explains how SyzUp ("we", "us", "our", "the app") collects, uses, stores, and protects your personal data. SyzUp is operated by Syzygy Axon LLC, a company incorporated in Wyoming, USA, and serves users worldwide. This policy applies regardless of where you access the app from.

By using SyzUp, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the app.

1. Data Controller

For GDPR purposes, the data controller is Syzygy Axon LLC, contactable at the email above.

2. Information We Collect

2.1 Account Information

• Email address and, if you sign in with a password, the password (stored only by Firebase Authentication in hashed form; we never see it)
• Account identifier generated by us
• Display name (nickname), motto and profile avatar (if uploaded)
• Identity confirmation and email address released by Google Sign-In or Sign in with Apple
• Account creation and last sign-in dates

2.2 Fitness & Health-Related Data

• Workout sessions (exercises, sets, reps, weight lifted)
• Training plans and preferences, including body areas you ask plans to work around
• Personal records (PRs)
• Height, year of birth, sex and self-declared experience level
• Body weight history
• Exercise progress, XP, and level data
• Workout statistics and history
• Muscle recovery estimates
• Custom exercises you create

Workouts, plans, custom exercises and body weight entries are backed up to our servers so they survive a reinstall or a new phone.

2.3 Device, Diagnostics & Analytics

• Device model, operating system version, app version and build number
• Country, city, interface language and time zone (entered in your profile or taken from device settings)
• Push notification token (one per device)
• Crash reports and performance diagnostics (Firebase Crashlytics) — collected on the basis of our legitimate interest, without a separate consent
• Product analytics (Firebase Analytics and Amplitude): screens opened, features used, session and device metadata, and profile properties such as level, rank, experience level, subscription status and language. These events are linked to your account identifier, so they are not anonymous. They are sent only while analytics are switched on (consent screen, or Settings → Usage statistics)
• Approximate location (country, region, city) derived by Google and Amplitude from the IP address your device connects from. The app never asks for location permission and collects no GPS data

2.4 Media & User-Generated Content

• Profile photos (camera or photo library)
• Personal record videos for the Arena (optional)
• Social feed posts and comments
• Messages between users, if the chat feature is enabled in your version of the app

2.5 Social Data

• Follow/follower relationships and blocked users
• Public profile interactions (likes, comments)

2.6 Moderation & Safety Data

To keep the service safe, we process moderation data on the basis of our legitimate interest (GDPR Art. 6(1)(f)):

• Reports you submit about content or other users, and reports concerning your content
• Moderation decisions about your account or content (warnings, Arena bans)
• Security logs used to detect and prevent abuse, including IP address and device user agent

2.7 Purchases, Referrals & Trainer Panel

• Purchases: subscription status, one-time purchases (cosmetic items, Athena Shield charges) and store transaction identifiers. Payment details are handled by Google Play; we never see them.
• Referral programme: the referral code you redeemed, the date and what was granted, and, for partners, commission records. To stop the free month being claimed repeatedly from one phone, we store a SHA-256 hash of a device identifier; the raw identifier never leaves your device.
• Trainer panel: if you accept a trainer's invitation, the trainer sees your workout history and your weight, height, year of birth, sex and experience level, and can record measurements (including body-fat estimates, circumferences and photos), goals, check-ins, session records and notes about you. The invitation screen lists this before you accept. You can end the connection at any time; everything the trainer recorded about you is then deleted immediately.

2.8 Website

syzup.app measures page views, clicks on its buttons (including how long after opening the page a store button was clicked), how far a page is scrolled, which FAQ questions are opened and language changes. These are anonymous counters: no IP address, device identifier or any other information that could identify you is stored, and the measurement sets no cookies. A browser that sends the Global Privacy Control signal is not measured at all.

The site stores one cookie, syzup-lang, which remembers the language you picked for one year and contains nothing but the language code. If you have not picked a language, the site chooses one from your browser's language setting or, failing that, from the country your request comes from; the country is used for that single decision and is not stored.

3. Legal Basis for Processing

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process data under GDPR:

For users outside the EEA, we process data as described in this policy and in accordance with applicable local laws.

4. How We Use Your Information

4.1 Aggregated Statistics

We compute aggregated statistics across users — for example ranking positions and percentiles, or average performance by exercise. Published statistics never identify you beyond what the rankings already show to signed-in users.

SyzUp contains no advertising. We do not use your fitness data, workout history, or body measurements for advertising purposes, we share no data with advertising networks, and the app does not use the device advertising identifier.

5. User-Generated Content

When you upload personal record videos or other media to SyzUp, you grant us the license described in our Terms of Service, solely to display your content within the app. We do not use your videos, photos or posts to train machine learning models.

We will never use your identifiable videos, images, or media in marketing materials, sell them to third parties, or make them available outside of SyzUp without your explicit, separate consent.

6. Third-Party Services

Each provider below processes data on our instructions under a data processing agreement, and all of them process data in the United States.

Google and Apple act on their own account when you sign in with them and when you buy through their stores, under their own privacy policies. The website is hosted by Cloudflare.

7. Data Storage & Security

Primary data storage: Google Cloud, United States (Firestore nam5, Cloud Storage US, Cloud Functions us-central1).

• Firebase Security Rules — access restricted to data owners
• Firebase App Check — prevents unauthorized API access
• AES-encrypted local storage (Hive with platform keychain keys)
• Server-side rate limiting and security logging
• HTTPS/TLS for all network communication
• No plaintext password storage

International Transfers

All providers in Section 6 process data in the United States. For users in the EEA, UK and Switzerland, these transfers rely on the European Commission's Standard Contractual Clauses included in each provider's data processing agreement (with the UK addendum and Swiss adaptation where applicable) and, where a provider is certified, on the EU–US Data Privacy Framework. Data is encrypted in transit and at rest, and each provider receives only what Section 6 lists. A copy of the safeguards is available on request.

8. Data Retention

9. Data Sharing

We do not sell your personal data. We do not share your personal data with third parties for their own marketing purposes.

• Other users: your nickname, avatar, rank, country, sex, approved Arena records with their videos, posts and comments are visible to every signed-in user. Rankings include all users and participation cannot be turned off; the lite privacy mode hides your detailed training statistics.
• Your trainer: only if you accept a trainer's invitation, and only the data listed in Section 2.7.
• Service providers: the processors in Section 6, solely to deliver the service, under data processing agreements.
• Legal: if required by law, regulation, legal process, or governmental request.

10. Your Rights

10.1 All Users

Regardless of where you live, you can:

• Access and review your personal data within the app
• Download a copy of your account data (Settings → Export data; the link arrives by email). The file covers your profile, posts, comments, likes, follows, blocks, Arena records, reports and subscription history; your workouts, plans and body weight history are available in the app and, on request, by email
• Correct your profile information at any time
• Delete your account and all associated data (Settings → Delete account)
• Switch analytics off (Settings → Usage statistics) and opt out of push notifications via settings
• Hide your detailed statistics with the lite privacy mode
• Contact us with any data-related request

10.2 European Economic Area, UK & Switzerland (GDPR)

You additionally have the right to:

• Access (Art. 15): Request a full copy of your personal data.
• Rectification (Art. 16): Correct inaccurate data.
• Erasure (Art. 17): Request complete deletion.
• Restriction (Art. 18): Limit processing in certain cases.
• Portability (Art. 20): Receive data in a machine-readable format.
• Object (Art. 21): Object to processing based on legitimate interest.
• Withdraw consent (Art. 7(3)): At any time, without affecting lawfulness of prior processing.

10.3 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know: What personal information we collect, use, and disclose.
• Right to delete: Request deletion of your personal information.
• Right to opt out of sale: We do not sell your personal information. We do not share personal information for cross-context behavioral advertising.
• Right to non-discrimination: We will not discriminate against you for exercising your rights.
• Right to correct: Correct inaccurate personal information.
• Right to limit use of sensitive personal information: You may limit use of health-related fitness data to what is necessary for the service.

To exercise these rights, contact us at the email in Section 1. We will verify your identity and respond within 45 days.

Categories of personal information collected (per CCPA §1798.110): identifiers (email, nickname, account identifier, device hash), health-related information (fitness data, body weight, height), commercial information (purchases), internet/electronic activity (usage analytics, crash data), approximate geolocation (country, region and city derived from IP address, and country and city you enter), and audio/visual information (profile photos, PR videos, trainer measurement photos).

10.4 Other Jurisdictions

If you reside in a jurisdiction with data protection laws (including but not limited to Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act, Japan's APPI, South Korea's PIPA), we will honor your applicable rights upon request. Contact us at the email in Section 1.

11. Account Deletion

• In-app: Settings → Delete account (at the bottom of the screen)
• By email: Subject "Account Deletion Request"

Deletion in the app takes effect immediately; requests by email are handled within 30 days. Your profile, workouts, plans, records, videos, posts, comments, messages, trainer connections and push tokens are removed. The records listed in Section 8 as kept after deletion stay for the periods stated there.

Analytics data already held by Google and Amplitude, and crash reports, expire under the retention periods in Section 8; we do not send those providers separate deletion requests. Your RevenueCat customer record is disconnected from the app and kept for accounting. Deleting your account does not cancel a subscription — cancel it in Google Play.

12. Children's Privacy

SyzUp is not intended for children under 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect data from children. If we learn a child has provided personal data, we will delete it promptly. Parents may contact us to request deletion.

13. Do Not Track

SyzUp is a mobile application and does not respond to browser "Do Not Track" signals. You control data collection in the app through the settings described in this policy (analytics, push notifications, privacy mode).

14. Changes to This Policy

When we make material changes, the app asks you to review and accept the new version before you continue using SyzUp, and the policy shows the date it was last updated. If you do not accept the new version, you can stop using SyzUp and delete your account.

15. Contact

We aim to respond to all requests within 30 days (45 days for CCPA requests).