# Privacy Policy for Your Whey Fitness Version ID: `privacy-policy-v6` Effective date: 2026-11-04 Your Whey Fitness ("YWF," "we," "us," or "our") is a local-first fitness application. This policy explains how the app handles information on your device and how the optional Shared Account handles server data. A Shared Account is not required to use the app's local-first fitness features. Contact: `support@bigbwain.com` ## 1. Local-first app data Your workouts, Sessions, History, notes, routes, personal Locations, Gallery media and Premium Backup file stay on your device unless you export or share them yourself. Creating a Shared Account does not upload, merge or mirror them. The one exception is linking a Your Whey Fitness Watch, which passes a small, short-lived workout summary between your phone and your watch; see section 9. The Check-In you record while tracking is local in the same way. It is a different thing from checking in at a managed Location, which is an attendance record sent to and kept by that Location — see section 3. The app reads local file timestamps, system boot time, disk space and user defaults for its own storage and session bookkeeping. These are declared in the iOS privacy manifest and never leave the device. ## 2. Optional identity and Shared Profile A Shared Account is optional; the app is fully usable without one. Sign-in is handled by a Microsoft Entra External ID (CIAM) tenant and offers email passcode, Google and Apple. When you connect one, the following are collected and linked to you, all for app functionality and none of it for tracking or advertising: - Name — your display name on shared surfaces. - Email address — your sign-in identity, and how invitations reach you. - User ID — a stable account identifier. - Fitness — only what a shared feature requires; see section 3. - Other user content — notes and text you enter on shared surfaces. - Purchase history — entitlement state for paid capabilities. This list matches the privacy manifest shipped in the app and the data-safety disclosures filed with the app stores. ## 3. Organizations, Teams, and managed Locations When you join or are added to a Team, an organization, or a managed Location: - Your display name, account identifier and participation state are visible to the people who administer that Team or Location. - Fitness data is shared only where a feature you use requires it — for example a coach-assigned programme, an attendance check-in, or a result you submit. Your local training history is not transmitted wholesale. - Administrators act under an authorization model in which a server operation performed by a signed-in account rechecks that account's authority as it runs, rather than trusting an earlier grant. An invitation or a dashboard does not by itself make its holder an administrator. - A few steps are deliberately reachable without signing in: confirming or declining a co-present youth assignment, finalizing or revoking a waiver at a Location, and viewing a Location's public dashboard. Each is authorized by a single-purpose link that expires, and holding that link is what authorizes that one step — so treat such a link as you would a key. - Leaving a Team or Location ends forward sharing. Records already produced under it — attendance, submitted results, ledger entries — are retained per section 7 because they are the other party's operating record too. ## 4. Guardian-managed dependents and supervised participants The app supports guardian-managed dependents and supervised under-18 participants. - A guardian may operate a dependent's participation and consents on their behalf. - Supervised participation is bounded: shared fitness surfaces stay closed for supervised minors unless the applicable guardian authority is present. ## 5. Consent, withdrawal, and deletion Connecting a Shared Account is a separate, explicit action from using the app. You may disconnect at any time; the local app continues to work unchanged. Account deletion removes your shared identity and the shared records that belong solely to you. It does not delete another party's operating records that reference your participation, your local device data, or any backup or exported file you have saved or shared elsewhere. Those copies remain where you put them until you remove them. Deletion is refused while you are the sole owner of an active organization, Team or managed Location. Close or transfer what you own first, then delete. This is so a group is never left without an owner by someone leaving. ## 6. Purchases, support, and device permissions Purchases are processed by the platform store; the app receives entitlement state, never payment details. The Support page opens your email application with a draft addressed to `support@bigbwain.com`. We receive a support message only if you choose to send it, together with whatever you put in it. Location permission is requested only for route and distance tracking, and only while the app is in use. Motion access is requested only for step and movement tracking. Camera, microphone and photo access are requested only when you capture or attach media, and photo selection goes through the system picker, so the app does not request broad media-library permissions. ## 7. Retention Local data remains on your device until you delete it in the app, clear app data, uninstall the app, or replace it through restore, subject to operating-system behavior. Shared records are kept for different periods depending on what they are: - Records that form an organization's compliance evidence are retained for a configured period, currently seven years from the event. - Operational records with a shorter working life are purged automatically — for example the receipt for an aggregate reporting query is discarded after 30 days, and a cached aggregate after 35 days. - Other shared records — attendance, submitted results, ledger entries — persist while they remain the operating record of the Team, organization or managed Location that produced them, as described in section 3. These can outlive your Shared Profile. Data that passes between a linked watch and your phone is kept only briefly; the limits are in section 9. A longer or shorter period applies where one is required by law or is necessary for a documented security or legal purpose. ## 8. Rights, changes, and health notice Two controls are built into the app and need no request. On the Shared Account page, Export downloads a file containing your shared account data, and Delete removes your Shared Profile after two confirmations, subject to the ownership condition in section 5. Depending on where you live, you may have additional access, correction, deletion, restriction, portability, objection, or appeal rights. For anything the in-app controls do not cover, contact us to submit a request. We may need to verify the request before acting. Your Whey Fitness is a fitness tool, not a medical device, and nothing it shows is a clinical assessment. Training-impact credit is a bounded per-completion figure derived from local reference data. This version replaces `privacy-policy-v5`. It corrects section 9 now that the Apple Watch app comes with Your Whey Fitness. Nothing changes in what data is collected or how it is used, so no new acceptance is needed. `privacy-policy-v5` added Your Whey Fitness Watch (section 9) and matching notes in sections 1 and 7. `privacy-policy-v4` replaced `privacy-policy-v1`, which described managed Locations, cross-user Teams and shared fitness features as not live. Changes are published as a new numbered version with a new digest and, where the change is material, a re-acceptance prompt. Earlier acceptance evidence is retained rather than rewritten. ## 9. Your Whey Fitness Watch Your Whey Fitness Watch is an optional app for Apple Watch and Wear OS watches. On Apple Watch it comes with Your Whey Fitness and can also be installed on the watch alone. It is free; optional tips unlock nothing. **Without an account.** Every feature of the watch app works without an account. Your watch Sessions (exercises, sets, reps, weights and times), your watch settings and your Spot Check bests stay on the watch. **Heart rate and Health.** With your permission, the watch app reads your heart rate and active energy during a workout to show them on screen and in the Session summary. On Apple Watch it uses Apple HealthKit; on Wear OS it uses Health Services. If you turn on Save to Health, the finished workout and its energy are saved to Apple Health, or to Health Connect where your watch offers it. Heart rate, energy and other Health data are never sent to us, never used for advertising and never shared with anyone else. A Session's average and highest heart rate and its calories are kept with that Session on the watch. You can turn Heart Rate and Save to Health off in the watch's Settings, and withdraw access in Apple Health or your watch's permission settings at any time. **Linking a watch (optional).** If you link the watch to your Shared Account, by approving a code in the Your Whey Fitness phone app, these pass through our server so your phone and watch can exchange them: - From your phone to your linked watches: today's planned workout (its name, exercises and planned sets), a summary of your last five Sessions (name, date, duration, set count and volume), your personal bests for those exercises and your unit setting. Each update replaces the previous one. We delete it 30 days after the last update, when you unlink your last watch, or when you delete your Shared Account. - From your watch to your phone: each finished watch Session (its name, exercises, sets, reps, weights, times and rest), so your phone can add it to History. We delete it as soon as your phone has added it, or after 30 days if your phone never collects it. Heart rate and other Health data are not included. - About each linked watch: the name the watch reports (for example "Earl's Apple Watch"), its platform, its app version, when it was linked and last used, and sign-in tokens, which we store only in hashed form. We use these only to run the link between your phone and your watch, never for tracking or advertising, and we never keep your History on our server. **Unlinking and deletion.** You can unlink a watch in the watch's Settings or under Link a Watch in the phone app. The watch stops exchanging data at once, and its Sessions stay on the watch. Deleting your Shared Account unlinks every watch and deletes the data above. A watch that is not used for 180 days is unlinked automatically. **Tips.** On Apple Watch, tips are in-app purchases processed by Apple. On Wear OS, the tip page opens on your phone and the payment is processed by Stripe. We never receive payment details. A tip unlocks nothing. **Permissions.** The watch app asks for heart rate (Health) access when you start your first workout, and for notifications only to tell you that rest is over while the app is not on screen. It does not use your location, contacts, microphone or camera.