Privacy Policy

Who we are

Leveling (“the app”, “we”) is a hybrid-training app for iOS and Android with an account portal at pwrbld.com. Data controller: [COMPANY NAME & ADDRESS — pending registration], contact: [support email].

What we collect

We only collect what the training engine and your account need:

• Account: email address, display name (optional), sign-in identity (email/password, Google, or Apple).
• Profile: birth date, gender, height, body weight, preferred language, training preferences (days, mode, session length).
• Training data: benchmarks (e.g. lift maxes, run tests), generated plans, logged workouts, sets, ratings, and progress levels.
• Health-related data you choose to provide: injuries and mobility limitations (used to exclude unsafe exercises), and — only if you explicitly enable it — menstrual-cycle tracking used to adjust training. This is special-category data under Art. 9 GDPR; we process it solely with your explicit consent, and you can turn it off or delete it in the app at any time.
• Supplements: your supplement plan and intake log, if you use that feature.
• Support: messages you send us via the support form.

We do not collect your precise location, contacts, photos, or advertising identifiers.

Why we process it (legal bases)

• Providing the service (Art. 6(1)(b) GDPR): generating and adapting your training plan, tracking progress, account management.
• Explicit consent (Art. 9(2)(a) GDPR): injury, mobility, and cycle data.
• Legitimate interest (Art. 6(1)(f) GDPR): service security and abuse prevention.

Where your data lives

All app data is stored with our hosting processor Supabase on AWS infrastructure in the European Union (Ireland, eu-west-1). Processors we use:

• Supabase — database, authentication, and backend hosting (EU region).
• Google / Apple — only if you choose their sign-in; we receive your email and a sign-in token, nothing else.
• Strato AG (Germany) — transactional email delivery (e.g. password reset).

We show no ads, use no third-party analytics or tracking, and never sell your data.

How long we keep it

For as long as your account exists. Deleting your account permanently and irreversibly removes all of your data (profile, workouts, benchmarks, health-related data, supplements, support tickets) — see Delete account.

Your rights

You have the right to access, rectify, erase, and export your data, to restrict or object to processing, and to withdraw consent at any time (Art. 15–21 GDPR). Contact [support email]. You may also lodge a complaint with a supervisory authority — for us that is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg).

Changes

We will update this policy as the product evolves (e.g. when subscriptions launch) and note the date above.