WodBoss Privacy Policy
Last updated: 11 July 2026
This Privacy Policy explains how the personal data of users of the WodBoss mobile application (“the App”) is collected, used and protected, in accordance with Regulation (EU) 2016/679 (GDPR) and the applicable Spanish data protection law (Organic Law 3/2018, LOPDGDD).
1. Data controller
The App is developed and operated by an independent developer (a natural person):
- Controller: Javier Gutiérrez Bravo
- Contact email: support@wodboss.app
- Country: Spain
You may use the contact email for any privacy enquiry or to exercise your rights. The controller’s postal address will be provided to the competent supervisory authority where legally required.
2. Who this applies to
This policy applies to all users of the App, whether they act as athletes (free use) or as coaches (who may purchase the WodBoss Pro subscription).
3. Data we process
| Category | Data | Source |
|---|---|---|
| Account | Email address, password (stored encrypted), account verification status | You, on sign-up |
| Profile | Name, profile picture (avatar), role (coach/athlete), gender —for athletes, for sports rankings—, box name (coaches) | You |
| Physical data (athletes, optional) | Basic physical data (e.g. height or weight) | You |
| Training data | Sessions, programs, results, records, metrics and units of measurement | You and, where applicable, your coach |
| Subscription (coaches only) | WodBoss Pro status, purchase and customer identifiers, product and renewal date | Apple/Google and RevenueCat |
| Technical, usage and diagnostic | Installation identifier, push notification token, device model and operating system version, App version, language, preferences (theme, language), App usage and analytics data, crash and diagnostic reports, and IP address (transiently, for security purposes) | Your device |
The App is not designed to process health data for medical purposes. Training data (for example, weights, times or repetitions) and basic physical data are processed for sports purposes, with the sole aim of providing the service. Do not enter medical or clinical information into the App (diagnoses, conditions, etc.).
Visibility to other users. Some data may be visible to other people within the App according to its purpose: your coach can see your profile and your results; in shared rankings (leaderboards), your name and your records may be visible to other athletes of the same coach. You can turn off your appearance in leaderboards from the App settings.
Device permissions. The App may ask you for system permissions: push notifications (optional, for service notices) and camera or photo library, only if you choose to add or change your profile picture. You can revoke these permissions at any time from your device settings. The App does not request access to your location or your contacts.
4. Purposes and legal bases (Art. 6 GDPR)
- To provide the service (create and manage your account, display programming, record results and connect athletes with coaches) — performance of a contract (Art. 6(1)(b)).
- To manage the WodBoss Pro subscription and verify the right to access paid features — performance of a contract (Art. 6(1)(b)).
- To send push notifications and emails related to the service (for example, invitations or notices about your account) — performance of a contract and/or legitimate interest (Art. 6(1)(f)).
- To analyse App usage and improve the App through analytics tools — based on your consent where required by applicable law, and otherwise on our legitimate interest in improving the App (Art. 6(1)(a) / 6(1)(f)).
- To ensure security and prevent fraud and abuse — legitimate interest (Art. 6(1)(f)).
- To improve the App’s stability through crash and diagnostic reports — legitimate interest (Art. 6(1)(f)).
- To comply with legal obligations, including tax obligations arising from subscriptions — legal obligation (Art. 6(1)(c)).
We do not carry out automated decision-making with legal effects or profiling within the meaning of Art. 22 GDPR.
5. Recipients and processors
Data is shared only with the providers necessary to deliver the service, which act as processors on behalf of the controller or, in respect of their own services, as independent controllers:
- Supabase — database hosting, authentication, file storage (e.g. avatars) and backend.
- RevenueCat — subscription management and validation.
- Apple (App Store) and Google (Google Play) — distribution of the App and processing of the subscription payments (acting as sellers/payment intermediaries).
- Google Firebase (Google Ireland Ltd.) — push notifications (Cloud Messaging), usage analytics (Analytics), crash and diagnostic reports (Crashlytics) and remote configuration (Remote Config).
With the providers acting as processors we have entered into the corresponding data processing agreements (Art. 28 GDPR), and we require them to protect your data to a standard at least equivalent to the one set out in this policy. In addition, we may disclose data to the competent authorities where there is a legal obligation to do so.
We do not sell your personal data, we do not share it with advertising networks, and we do not track your activity across third-party apps or websites. We do not use your data to show you advertising.
6. International data transfers
The main database (Supabase) is hosted in a data centre in the European Union (Ireland region). However, some providers (in particular RevenueCat, Google/Firebase and Apple) may process data outside the European Economic Area (EEA), mainly in the United States. In those cases, transfers rely on appropriate safeguards under the GDPR: adequacy decisions (such as the EU–U.S. Data Privacy Framework, where the provider is certified) and/or the European Commission’s Standard Contractual Clauses.
7. Retention
We keep your data for as long as your account is active. If you delete your account, your data is deleted or anonymised, except for data we must retain to comply with legal obligations (for example, tax records of subscriptions) for the legally established periods. Encrypted backups are deleted on a rolling basis within a limited period after erasure, and technical and diagnostic logs are kept only for as long as necessary for their purpose.
8. Your rights
You may exercise at any time the rights of access, rectification, erasure, objection, restriction of processing and portability, as well as withdraw your consent where processing is based on it. To do so, write to support@wodboss.app. We will respond within the time limits provided by the GDPR.
If you believe that the processing of your data does not comply with the law, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es) or with the supervisory authority of your country of residence in the EU.
9. Account deletion
You can delete your account and the associated data at any time:
- From the App: in the profile/settings section, using the “Delete account” option.
- Without the App: by following the instructions on the Account deletion page or by writing to support@wodboss.app from the email address you registered with.
Deletion is irreversible. We will process the request without undue delay and, in any case, within a maximum of 30 days, subject to the retention exceptions set out in section 7. If you have an active WodBoss Pro subscription, remember to cancel its renewal in the App Store or Google Play: deleting your account does not automatically cancel the subscription or generate refunds, which are governed by Apple’s and Google’s policies.
10. Security
We apply technical and organisational measures to protect your data: encryption in transit, row-level access control (RLS) in the database and secure storage of credentials. No system is completely infallible, but we work to minimise risks.
11. Minors
The App is not directed to children under 16 years of age, and we do not knowingly collect their data without the consent of the holder of parental responsibility or guardianship. If you are a parent or guardian and believe a minor has provided us with data, please contact us so we can delete it.
12. Coaches using the App professionally
When a coach uses WodBoss to manage their athletes (programming, results tracking or payment recording), the coach acts as an independent controller in respect of the data they process about those athletes. It is the coach’s responsibility to inform their athletes and to have a valid legal basis for that processing. WodBoss merely provides the tool.
13. Changes to this policy
We may update this policy. We will publish the current version with its date and, if the changes are material, we will inform you through the means available in the App. This policy is published in Spanish and in English; in the event of any discrepancy, the Spanish version will prevail.
14. Contact
For any privacy enquiry or to exercise your rights: support@wodboss.app.