VERTEX Privacy Policy

VERTEX ("the app") is a workout tracker with a social feed, operated by Max Vanstry (contact: support@vertexstrengthlab.com). This policy explains what data the app handles, who can see it, who else processes it, and what your rights are.

Data we collect

Account data: your email address, display name, and chosen username. We also record which version of the Terms of Use you accepted, and when. How you sign in adds the following:

• Email and password: your password is stored as a hash by our authentication provider; we never see it.
• Sign in with Apple (iPhone): Apple sends us an identifier for your Apple account and your email address, which is a private relay address if you chose to hide your email. The first time only, Apple also sends your name, which we use as your display name if you have not set one.
• Sign in with Google: Google sends us an identifier for your Google account, your email address and your name.

We never receive your Apple or Google password.

Fitness data you enter: workouts (exercises, sets, weights, reps, duration), custom exercises you create, routines, optional body stats (bodyweight, height, birth date, sex), and personal records. This data is stored on your device and synced to your account so it survives switching phones. Birth date and sex are optional and refine on-device calorie estimates. Birth date is never visible to other users. Sex additionally places you on the optional men's/women's leaderboards and is visible to other users only while you have gym leaderboards turned on (see below); otherwise it stays private.

Settings that follow you across devices: your weight unit, weekly goal, training goal, reminder and tip schedules, privacy choices, and whether you have seen the in-app tutorial.

Content you share: if you choose to share a workout, its title, caption, any photos you attach, and training partners you tag are uploaded to our servers. Vertex Athletes can also publish text posts. Comments you post, and likes on comments, are stored the same way. If you post a routine on your profile, its name, exercise list, and starting sets are uploaded so other users can view it and add it to their own routines.

Social data: who you follow and who follows you, follow requests, kudos you give, athletes you block, and reports you file. When you finish a session from a routine you saved from somebody's post, we record that you trained it (see "Routine credit" below).

Gyms: your home gym, and the star ratings you give clubs. Other users only ever see a club's average rating and number of ratings, never your own rating.

Vertex Athlete applications: if you apply, we receive your application note together with your name, username, when you joined, and counts such as your followers and shared posts, so we can review it.

Profile photo: optional. If you set one, it is uploaded to our servers and shown to other users next to your name (feed, search, leaderboards).

Push notification token: if you enable notifications on a device, that device's push token (a random identifier issued by the notification service, not your location or contacts) is stored on our servers so we can notify you about social activity. It is removed when you turn social notifications off on that device and when your account is deleted.

Location: the gym finder can use your device's location to show nearby gyms and sort clubs by distance. This is optional (the app asks first), happens on your device only, and your location is never uploaded to our servers or shared with other users. The map itself is loaded from OpenStreetMap (see "Who else processes your data").

Crash reports: if the app hits an error while you are signed in, technical details about it (the error message, app version, platform, and OS version) are stored in our backend so we can fix the bug. They contain no account or fitness data, and they are not sent to any third-party crash-reporting service.

Security logs: like any online service, our hosting provider keeps technical logs of requests and sign-ins, including IP addresses, to keep the service running and secure.

Kept on your device only: your app language, your training analysis and coach recommendations (worked out on your device from your synced workouts), lift targets you set, which recommendations you dismissed, the weekly recap setting, and Lock Screen and home-screen widgets. Share images are made on your device; a photo you pick as a share image's background is never uploaded.

We do not collect advertising identifiers or contacts, and we do not use third-party tracking for advertising or analytics.

What other users can see

• Your display name, username, profile photo, achievement badges, Vertex Athlete badge, and whether your account is private are visible to signed-in users (search, feed, follower lists, athlete pages). This is true for private accounts too: a private account hides your content, not you.
• Workouts are private until you share them. Sharing is a choice you make each time you finish a session. Workouts you do not share are never visible to anyone else.
• Accounts are public by default. For a public account, your shared workouts and posts (including their exercises, sets, captions, photos, and tagged partners), the comments on them, your follower and following lists, your posted routines, and your custom exercises are visible to any signed-in user, including people who do not follow you, for example in the Discover feed.
• Private accounts. If you turn on Private account in Settings, all of the above is visible only to followers you have approved, and following you becomes a request you can accept or decline.
• Blocking hides your content and the other athlete's content from each other, in both directions, whatever your account type.
• Kudos you give are visible to other signed-in users. Comments you post are visible to the people who can see the post they are on. People you tag as training partners, or mention in a comment, see their name on it and are notified.
• Gym leaderboards are opt-in. If you turn on "Show me on gym leaderboards", your home gym, your best lifts from shared workouts and, if you've set it, your sex (so the men's and women's boards can place you) are visible to other signed-in users, including people you don't follow and whether or not your account is private. Turning it off removes all of it, including your sex.
• Weekly board. The people who follow you can see how many sessions you shared this week, ranked against the others they follow. It counts only sessions they could already see. It is on by default for a public account and off for a private one; change it with "Show me on my followers' weekly board".
• Routines you post on your profile are visible to signed-in users who can see your account (everyone except athletes you've blocked or who blocked you, or only your approved followers if you are private). They can add a copy to their own routines; the number of times a routine was added is shown publicly. Removing a posted routine takes it off your profile, but copies other athletes already added remain theirs.
• Routine credit. When you finish a session from a routine you took from somebody's post, its author is notified that you trained it, and their post shows how many athletes have trained it (a number, with no names). Separately, you can choose, per post, to credit them on your own shared workout, which shows their username; credit is only ever shown for public accounts. An author who turns off "Credit for your routines" is neither notified nor credited.
• Your email, bodyweight, height, birth date, weekly and training goals, reminder settings, gym ratings, block list, and reports are never visible to other users. Your home gym and sex are visible only in the opt-in gym-leaderboard case above.

Automated content screening

To keep the app usable we automatically screen the text you make visible to other users (display name, username, workout titles and captions, comments, routine names and custom exercise names) against a list of prohibited terms. Matches are masked before anyone else can see them, and a username containing one is refused. This check runs automatically on our servers as your content is saved; no person reads your content as part of it, and it stores nothing beyond the content itself.

Who else processes your data

We use these service providers to run the app. They process your data on our behalf and only for the purpose described:

• Supabase (supabase.com): hosts our database, sign-in, file storage and server functions. Access to your data is enforced with row-level security: other users can only read what the rules above allow.
• Resend (resend.com): sends account emails, such as sign-up confirmation and password reset.
• Expo (expo.dev): delivers push notifications to Apple's and Google's notification services, and delivers app updates. A notification carries its message, for example the name of the athlete who followed you.
• Apple and Google: sign you in if you choose Sign in with Apple or Google, and deliver notifications to your device. When you delete an account that signs in with Apple, we ask Apple to revoke the app's access to your Apple account.
• Telegram (telegram.org): moderation reports and Vertex Athlete applications reach us as messages in a private Telegram chat. A report message contains the name and username of the person reporting and of the person reported, the reason given, and the reported post's caption and photo. An application message contains the details listed under "Vertex Athlete applications".
• OpenStreetMap (openstreetmap.org): supplies the map tiles in the gym finder. Your device requests them directly, which shares your IP address and the map area on screen with OpenStreetMap's tile servers. Your location itself is not sent.

Why we use your data

• To provide the app you signed up for: your account, syncing your training across devices, and the social features you choose to use.
• With your consent: optional body stats, device location for the gym finder, and notifications. You can withdraw consent at any time by removing the data or turning off the permission or setting.
• To keep the service safe (our legitimate interest): automated content screening, handling reports, fixing crashes, and security logs.
• To meet legal obligations: answering data requests and keeping what the law requires.

Data retention and deletion

We keep your data for as long as you have an account.

You can delete your account at any time in Settings → Danger zone → Delete account. This permanently deletes your account, profile, workouts, routines, photos, follows, kudos, comments, push tokens, blocks, and the reports you filed about other users from our servers, and removes the local copy from the device you delete from. Any other device you are signed in on is signed out, but the copy already on it stays until the app is reinstalled or its data is cleared.

What is kept: a report another user filed about you stays in our moderation records, because deleting it would erase the basis of a decision made about somebody else. Anonymous, aggregated records that cannot be traced back to you may also remain, and we keep the minimum any applicable law requires.

If you cannot reach the app, you can request deletion by email instead. See Delete your account, which also sets out in full what is removed and what is kept. Email requests are actioned within 30 days.

If you start signing up with an email address but never confirm it, that unfinished account is deleted automatically after about three days.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive the data you gave us in a portable format. Much of this you can do yourself in the app; for the rest, email support@vertexstrengthlab.com and we will answer within 30 days. You also have the right to complain to the data protection authority in the country where you live.

Notifications

Workout reminders, training tips and the weekly recap are scheduled locally on your device. Your reminder and tip schedules are synced to your account so they follow you to a new device; the notifications themselves are created on the device. Social push notifications (new followers and follow requests, kudos, comments, replies, mentions and comment likes, training-partner tags, routine credit, and Vertex Athlete decisions) use the device push token described above; you can turn them off per device in Settings.

Children

VERTEX is not directed at children under 13, they may not create an account, and we do not knowingly collect personal data from them. Where local law sets a higher minimum age for consenting to data processing, that age applies. If you believe a child below the required age is using VERTEX, contact us at the address below and we will delete the account and its data.

Changes

If this policy changes materially, we will update this document, change the date at the top, and note it in the app's release notes.

Contact

Questions or data requests: support@vertexstrengthlab.com