Privacy Policy

1. Who we are

YOURROX is an AI-driven training application for functional fitness races. We process your personal data in accordance with the General Data Protection Regulation (GDPR).

Contact: hello@yourrox.com

2. What data we collect

When creating an account and using the app, we process:

• Account data: email address, name, password (hashed)
• Profile data: age, gender, weight, height, training level, injuries
• Training data: goals, race date, sessions, RPE scores, logs, feedback
• Coach conversations: messages you send to the AI coach
• Payment data: processed by Stripe — we only see subscription status, no card details
• Technical data: IP address, browser type, timestamps (essential for auth and security)

3. What we use your data for

• Personalising your training plan and coach messages
• Processing subscriptions and payments
• Sending essential emails (welcome mail, password reset, weekly summary)
• Improving the app based on anonymised usage trends
• Complying with legal obligations

4. Legal basis for processing

We process your data on the basis of:

• Contract performance: delivering the training service you subscribe to
• Consent: for push notifications, marketing attribution and other non-essential processing
• Legitimate interest: fraud prevention and app security

5. Processors / third parties

To make the app work we share minimal data with the following processors, which are bound by data processing agreements:

• Supabase: (database hosting, EU region) — account + training data
• Vercel: (hosting) — technical data (IP, request logs)
• Stripe: (payment processing, USA — DPF-certified) — subscription and payment data
• Resend: (transactional mail, EU) — email address for essential messages
• Anthropic (Claude): (AI processing, USA — DPF-certified) — profile + coach messages for plan generation and coach responses
• Meta (Facebook Ireland Ltd): (ad attribution, EU headquarters Dublin) — only with marketing consent: hashed identifiers (email, IP, click ID) to measure conversions from Instagram/Facebook ads

We do not sell data. Marketing cookies are only set with explicit consent — you can withdraw consent anytime via cookie settings.

6. Retention period

We keep active accounts as long as you use the app. When you delete your account, all associated data (profile, training data, coach conversations) is deleted immediately. We retain financial data for 7 years due to statutory tax retention obligations.

7. Security

Passwords are stored hashed. All connections use HTTPS. Database access is secured via Row-Level Security (RLS). We never see payment details — they are processed directly by Stripe (PCI-DSS Level 1).

8. Cookies

YOURROX uses two types of cookies:

**Essential cookies** (always active): authentication (Supabase session cookie) and payment processing (Stripe checkout session). Required for the app to function.

**Marketing cookies** (only with consent): Meta Pixel cookies (_fbp, _fbc) to measure ad effectiveness. We only set these if you chose "Accept all" in the cookie banner. Your consent is stored for 6 months, then re-requested. If you decline, we fully respect that — no Pixel script, no server-side tracking events.

Withdraw consent: via Profile → Privacy → Marketing cookies off.

9. Your rights

Under the GDPR you have the right to:

• Access: request which data we process about you (via Profile → Privacy → Export)
• Rectification: have inaccurate data corrected
• Erasure: delete your account and all data (Profile → Delete account)
• Restriction: temporarily stop processing
• Portability: download your data in a structured format (JSON)
• Objection: object to processing based on legitimate interest
• Complaint: file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl)

Contact for privacy questions: hello@yourrox.com

10. Changes to this policy

We may update this privacy policy if the app or legislation requires it. In the event of material changes, you will receive a notification via the app or by email.

We use essential cookies for login and payments. Marketing cookies help us show you relevant Meta ads. You can change this anytime in Profile → Privacy.