Privacy Policy

We collect only what the app needs to work. There is no advertising SDK, no analytics SDK, and no third-party tracker in RIVL.

Account

Your email address, a password (stored only as a salted hash by our authentication provider — we never see or store the plaintext), and the handle you choose.

Training data

Workouts you complete: exercise, sets, reps, weight, date and time, session duration, and any notes you add.

Programs

Training programs, workouts, and exercises you create or customise, including your default working weights and weekly schedule.

Progress

Derived values calculated from your training: personal records, XP, level, rank, lifetime workout count, and the date of your last workout.

Body metrics

If you choose to record them, body-weight entries and any notes attached to them. This is optional — the app is fully usable without it.

Preferences

Your weight unit (lb or kg) and which program is currently active.

Social

The rivals you add, and emoji reactions on workout sessions.

We do not collect your location, contacts, photos, health-app data, advertising identifiers, or browsing activity on other sites.

This is the part worth reading carefully. When another user adds you as a rival, they can see your handle, level, rank, XP, lifetime workout count, the date of your last workout, your weekly workout and volume totals, and the names of workouts you complete in their activity feed.

They cannot see your email address, your body-weight entries, your notes, or the individual sets and weights inside a session.

Your handle is searchable by other signed-in users, which is how rivals find each other. If you would rather not be found, choose a handle that does not identify you.

To provide the service you signed up for: authenticating you, storing your training history, calculating progress and personal records, and showing rival comparisons you opted into by adding a rival. We process this data to perform our contract with you. We do not sell your data, and we do not use it for advertising or profiling.

We use a small number of processors, each of which only handles what it needs to:

Supabase

Hosts our database and handles authentication. All account and training data is stored here.

Cloudflare

Serves the RIVL website and handles the network requests to it.

Apple

Distributes the iOS app. Apple receives download and, where applicable, purchase information under its own privacy policy — not from us.

Google Fonts

The RIVL website loads two typefaces from Google's font CDN, which discloses your IP address to Google. The mobile app bundles the same fonts locally and makes no such request.

We disclose data to authorities only where legally required. We do not share your data with advertisers or data brokers.

Your data is stored on our provider's servers and may be processed in a different country from the one you live in. Where data leaves the UK or EEA, it is transferred under the safeguards our providers maintain, such as Standard Contractual Clauses.

We keep your data for as long as your account exists. When you delete your account it is removed immediately and permanently, as described below. Backups are retained on a rolling basis for a short period before being overwritten.

You can delete your account at any time, from inside either app, without contacting us:

Profile → Settings → Danger zone → Delete my account

This permanently erases your account, workout history, logged sets, personal records, progress, custom programs, rival connections, reactions, and any body-weight entries. It is immediate and cannot be undone — we cannot restore a deleted account, so export anything you want to keep first.

If you can no longer sign in, or want to delete only part of your data, see rivl.life/delete-account.

Depending on where you live, you may have the right to access, correct, export, or erase your personal data, to object to or restrict processing, and to complain to your data protection authority. Most of this is available directly in the app: your data is visible in History and Profile, your handle and unit preference are editable in Settings, and deletion is one tap away. For anything else, email us and we will respond within one month.

RIVL is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

Data is encrypted in transit. Access to your rows is enforced at the database level by row-level security policies, so one user's account cannot read another's training data. Passwords are stored only as salted hashes. No system is perfectly secure, but we will notify affected users of any breach that puts their data at risk.

If we change this policy we will update the date at the top of this page, and tell you in the app if the change is significant.

Questions about this policy or your data: hello@rivl.life