Privacy Policy for The PWR App

1. Introduction

Welcome to the PWR App. Your privacy is a top priority for us. This Privacy Policy explains how ASVAL ALPHA TECHNOLOGY S.R.L. ("we," "us," or "our") collects, uses, shares, and protects your information when you use our mobile application ("App"), our website at https://www.thepwrapp.com ("Website"), and all related services (collectively, the "Service").

You must be at least 16 years old, or any higher minimum age required by applicable law where you live, to create a PWR account or use the PWR App.

This Privacy Policy is a notice about our data practices. It is not a request for blanket consent to all processing described below. Where applicable law requires your consent for a particular activity, we will request it separately.

2. Who Is Responsible for Your Data?

The data controller responsible for your personal information is:

ASVAL ALPHA TECHNOLOGY S.R.L.

Calea Zarandului, Bl. M10, Sc. 1, Et. 10, Ap. 30, CP 330182

Deva, Romania

Email: hello@thepwrapp.com

Phone: +40 726 504 728

We do not currently have a designated Data Protection Officer. Questions about this Privacy Policy or your privacy rights may be sent to the email address above.

3. What Information We Collect and How

PWR is designed as a local-first application. Your core workout information is stored locally on your device by default.

Some information is nevertheless transmitted from your device where necessary to provide features you request, operate your account or subscription, analyze and improve the Service, diagnose technical problems, or integrate with third-party services.

Depending on how you use the Service, we may process account information, workout or template information you choose to share, product interactions, app and device identifiers, device and connection information, diagnostic and performance information, approximate location, subscription and purchase information, and communications you send to us.

Information obtained through Apple Health or Google Health Connect is processed locally as described in Section 3.10 and is not uploaded to PWR's servers as part of those health integrations.

3.1. Workout Data Stored Locally

Your primary workout information is stored locally in the App's database on your device.

This may include:

• Workout and template details;

• Workout schedules;

• Exercises;

• Sets and repetitions;

• Weights and durations;

• RPE/RIR values;

• Workout and exercise notes;

• Body weight; and

• Other fitness information you create or enter in the App.

We do not ordinarily receive the contents of this locally stored information ("Workout Data").

Workout Data may leave your device when you intentionally use a feature that requires transmission, including when you:

• Share a workout, template, blueprint, or similar item;

• Create an external backup or export;

• Synchronize supported information with Apple Health or Google Health Connect; or

• Use another feature that expressly requires data to be transmitted.

Analytics and diagnostic systems may record that you interacted with a workout-related feature, such as opening a screen or performing an action, without intentionally transmitting workout names, entered weights, workout notes, or similar Workout Data.

3.2. Account Information

When you create or access an account using Google or Apple Sign-In, we receive information made available by that provider, which may include:

• Your name;

• Email address;

• A unique account identifier; and

• Profile picture, where provided by the authentication service.

We use this information to create, authenticate, secure, and manage your PWR account.

We may also process information associated with your account, such as subscription status and account-creation or account-deletion events.

3.3. Shared Blueprints, Folders, and Custom Exercises

If you use PWR's sharing functionality to share a blueprint, folder, custom exercise, or similar item, a portable copy of the information required to reproduce that item is uploaded to PWR's backend.

The uploaded information may include the structure of the shared item and user-created information contained in it.

When you share an item, PWR creates a unique share code and associated URL. Anyone who obtains a valid URL may be able to access the shared item.

A shared URL may also be:

• Copied or reshared;

• Accessed by someone other than your intended recipient;

• Cached by third-party systems; or

• Potentially indexed or discovered by search engines or similar services.

PWR does not guarantee that a shared URL will remain private.

You should not include information in Shared Content that you do not want people who obtain the URL to access.

Shared URLs automatically expire seven days after creation. You may delete an active share code before it expires through Settings > Data Management > Manage Shared Codes in the App.

After a code expires or is deleted, the associated PWR URL should no longer provide access to the item. Copies already downloaded, copied, cached, indexed, or redistributed outside PWR's systems may remain outside our control.

3.4. Backups and Exports

The App may allow you to create backups or exports to storage locations or third-party services that you select, including:

• Device storage;

• Google Drive; and

• iCloud.

When you use one of these options, the information is transferred at your direction to the selected location or service.

Copies stored in your Google Drive, iCloud account, device storage, or another service you control are governed by the applicable provider's terms and privacy practices.

Deleting your PWR account does not automatically delete copies stored in those locations.

3.5. Analytics and Product Usage Information

We use analytics technologies to understand how the Website and App are used, evaluate features, troubleshoot problems, measure performance, and improve the Service.

Website

The Website uses Google Analytics.

Depending on your consent choices, configuration, and applicable law, Google Analytics may process information such as:

• Pages viewed;

• Navigation activity;

• Website interactions and events;

• Session information;

• Browser and device information;

• Approximate geographic information; and

• Cookies or similar identifiers.

App

The App uses Google Analytics for Firebase and PostHog for product analytics.

These services may process information such as:

• App launches and sessions;

• Screens and features used;

• Actions and interactions within the App;

• Automatically collected analytics events;

• Custom analytics events configured by PWR;

• App version;

• Device type;

• Operating system;

• Language or locale;

• Approximate geographic information;

• Pseudonymous app, installation, device, or analytics identifiers; and

• Technical timing or performance information.

Google Analytics for Firebase may automatically collect certain events and technical properties in addition to events configured by PWR.

Analytics identifiers may allow activity from the same installation or device to be recognized over time. Analytics information should therefore be considered pseudonymous rather than necessarily anonymous.

We do not intentionally include your name, email address, information obtained through Apple Health or Google Health Connect, workout notes, entered weights, or similar sensitive Workout Data in general-purpose analytics events.

We currently use PostHog for product analytics. PostHog session replay is not currently enabled in the App.

3.6. Crash, Error, Diagnostic, and Performance Information

We use Sentry to identify crashes, errors, performance problems, and other technical issues.

Depending on the error or diagnostic event, Sentry may process information such as:

• App and device information;

• Operating-system information;

• Error messages;

• Stack traces;

• App route or screen information;

• Performance measurements;

• Technical events occurring before an error;

• Pseudonymous identifiers; and

• Other diagnostic context required to investigate the problem.

For certain error sessions, we may use Sentry session replay. Where enabled, we configure replay functionality to mask or restrict UI content to reduce the collection of user-entered or sensitive information.

We also use technologies associated with Expo in developing and operating the App. Limited technical information may be processed where relevant to the Expo services or tooling we use.

3.7. Device and Connection Information

We and our service providers may process technical information such as:

• Device model;

• Operating system;

• App or browser version;

• Language and locale;

• IP address or related network information;

• Approximate geographic information; and

• Device, installation, or application identifiers.

We use this information for purposes including security, analytics, diagnostics, compatibility, fraud prevention, and service optimization.

3.8. Cookies, SDKs, and Similar Technologies

The Website uses cookies and similar technologies for necessary functionality and analytics.

The App uses software development kits ("SDKs"), local storage, application identifiers, and similar technologies for purposes including:

• Authentication;

• App functionality;

• Analytics;

• Diagnostics;

• Subscription management; and

• Performance monitoring.

Where applicable law requires consent before using non-essential cookies, SDKs, identifiers, or similar technologies, we will request that consent and provide an appropriate means of withdrawing or changing your choice.

3.9. Payment and Subscription Information

Subscriptions and purchases are processed through third-party providers including Apple, Google, and RevenueCat.

We do not receive or store your full credit- or debit-card information.

We may receive information required to provide and manage your purchase or subscription, such as:

• Transaction or purchase identifiers;

• Subscription product or tier;

• Subscription status;

• Purchase date;

• Renewal date;

• Expiration information; and

• Cancellation information.

3.10. Apple Health and Google Health Connect

The App offers optional integrations with Apple Health (HealthKit) and Google Health Connect.

If you enable an integration, the App may access and/or write supported health and fitness information according to the permissions you grant.

Depending on the functionality and permissions granted, the App may read information such as heart rate and active energy and may write workout information to Apple Health or Google Health Connect.

On-Device Processing

Information obtained through Apple Health or Google Health Connect is processed locally on your device for the functionality you request.

We do not upload information obtained through these integrations to PWR's servers as part of the health integration.

We do not intentionally transmit information obtained through Apple Health or Google Health Connect to:

• Google Analytics;

• Google Analytics for Firebase;

• PostHog;

• Sentry; or

• General-purpose advertising or analytics providers.

Purpose Limitation

We use information obtained through Apple Health or Google Health Connect only to provide health and fitness functionality requested by you.

We do not:

• Sell information obtained through these integrations;

• Use it for advertising or marketing;

• Use it for unrelated analytics; or

• Disclose it to third parties except where necessary to provide a health or fitness service you requested and authorized, or where required by law.

User Control

Apple Health and Google Health Connect integrations are optional.

You decide which permissions to grant and may review or revoke them at any time through your device settings.

For more information, see Apple Health & Privacy and Google's Privacy Policy.

3.11. Communications

If you contact us, including at hello@thepwrapp.com, we receive your email address and any information you choose to provide in your communication.

We use this information to:

• Respond to you;

• Provide support;

• Investigate problems; and

• Maintain appropriate business records.

4. How and Why We Use Your Information

Where the GDPR, UK GDPR, or similar legislation applies, we process personal data only where we have an applicable legal basis.

Depending on the processing activity, our purposes and legal bases include:

• Creating, authenticating, and managing your account: account information; necessary to perform our contract with you.

• Providing core App and Website functionality: account and necessary technical information; necessary to perform our contract with you.

• Providing sharing, export, and backup functionality: information selected by you for the relevant feature; necessary to perform our contract or take action you request.

• Processing and managing subscriptions: account, transaction, and subscription information; necessary to perform our contract and, where applicable, comply with legal obligations.

• Providing Apple Health or Google Health Connect functionality: health and fitness information you authorize the App to access; based on your explicit consent where required, including the applicable condition for processing health data under Article 9 GDPR.

• Providing technical support: communications and contact information; based on contractual necessity, steps requested by you, or our legitimate interests in supporting users.

• Detecting security problems, fraud, crashes, and technical failures: account, device, connection, and diagnostic information; based on our legitimate interests in securing and maintaining the Service.

• Measuring and improving the Service: product interactions, pseudonymous identifiers, device information, and performance information; based on your consent where required by law and otherwise, where permitted, our legitimate interests in understanding and improving the Service.

• Website analytics: cookie, device, session, and interaction information; based on your consent where required by applicable cookie or ePrivacy law.

• Complying with law and protecting legal rights: information relevant to the applicable obligation or claim; based on legal obligations or our legitimate interests in establishing, exercising, or defending legal claims.

Where we rely on consent, you may withdraw it at any time without affecting processing that lawfully occurred before withdrawal.

Where we rely on legitimate interests, we consider the nature of the information, your reasonable expectations, and the potential effect on your rights and freedoms.

5. Who We Disclose Information To

We disclose information only where necessary for the purposes described in this Privacy Policy, where you direct us to do so, or where permitted or required by law.

5.1. Service Providers

Our principal categories of service providers include:

• Authentication: Google and Apple;

• Payments and subscriptions: Apple, Google, and RevenueCat;

• Analytics: Google Analytics, Google Analytics for Firebase, and PostHog;

• Error and performance monitoring: Sentry;

• App development and infrastructure: Expo, where applicable;

• App distribution and platform services: Apple and Google;

• Cloud hosting: Hetzner, including infrastructure located in the European Union; and

• Website hosting: Squarespace.

Depending on the service provided, these providers may process personal information, pseudonymous identifiers, technical information, usage information, transaction information, or other information described in this Privacy Policy.

Pseudonymous information is not necessarily anonymous and may constitute personal data or personal information under applicable law.

5.2. Sharing at Your Direction

When you generate a share code or otherwise use a feature that shares information with another person or service, we disclose the information necessary to perform that action at your direction.

Anyone who obtains a valid, non-expired shared URL may be able to retrieve the information associated with it.

5.3. Legal and Safety Disclosures

We may disclose information where reasonably necessary to:

Comply with applicable law, legal process, or binding governmental requests;

Protect the rights, property, or safety of PWR, our users, or others;

Investigate fraud, abuse, or security incidents; or

Establish, exercise, or defend legal claims.

5.4. Corporate Transactions

If PWR is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar corporate transaction, information may be disclosed as part of that transaction, subject to applicable law and appropriate protections.

5.5. Sale and Advertising

We do not sell your personal information.

We do not use information obtained through Apple Health or Google Health Connect for advertising.

We do not use or disclose personal information collected through the Service for cross-context behavioral advertising.

If these practices materially change, we will update this Privacy Policy and provide any choices or opt-out mechanisms required by applicable law before using information for those purposes.

6. Data Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including:

• Providing the Service;

• Meeting legal and accounting requirements;

• Maintaining security;

• Preventing fraud;

• Resolving disputes; and

• Establishing or defending legal claims.

Different categories of information have different retention requirements.

6.1. Account Information

We retain active account information while your account remains open.

When you use PWR's account-deletion functionality, we delete your active PWR account information, subject to limited retention where necessary for:

• Legal compliance;

• Transaction or accounting records;

• Fraud prevention;

• Security;

• Backups; or

• Legal claims.

Deleting your account does not necessarily cause every record independently held by a third-party service provider to be deleted immediately.

6.2. Local Workout Data

Workout Data stored in PWR's local database remains on your device until it is removed through applicable App functionality, account deletion where applicable, clearing the App's data, or uninstalling the App.

Using PWR's in-app account-deletion process also removes PWR's local App data from the device on which the deletion is performed.

This does not automatically delete copies you previously exported, backed up, shared, or synchronized to another service.

6.3. Shared Workouts, Templates, and Blueprints

Shared workout, template, or blueprint artifacts are retained for up to seven days after the relevant shared URL is created, unless you delete the share code earlier through Settings > Data Management > Manage Shared Codes.

After seven days, or after you delete the code, the associated PWR URL should no longer provide access to the shared item.

Expiration or deletion cannot remove copies already:

• Downloaded;

• Copied;

• Reshared;

• Cached;

• Indexed; or

• Otherwise stored outside PWR's systems.

Temporary technical copies, backups, logs, or caches may remain for a limited period where necessary for security, reliability, legal compliance, or disaster recovery.

You may contact hello@thepwrapp.com regarding deletion of shared information associated with you.

6.4. Analytics and Diagnostic Information

Analytics, error, performance, and diagnostic information is retained according to our configured retention periods and the operational requirements of the applicable provider.

We periodically review retention settings and seek to avoid retaining identifiable or pseudonymous information longer than reasonably necessary for analytics, security, troubleshooting, and product improvement.

Aggregated information that can no longer reasonably be associated with an identifiable individual may be retained for longer periods.

6.5. Subscription and Transaction Records

Subscription and transaction information may be retained for as long as necessary to:

• Administer subscriptions;

• Resolve billing issues;

• Prevent fraud;

• Comply with tax, accounting, and legal obligations; and

• Establish or defend legal claims.

Apple, Google, and RevenueCat may retain their own records under their applicable terms and legal obligations.

6.6. User-Controlled Backups and Health Platforms

Deleting your PWR account does not automatically delete:

• Backups or exports stored in Google Drive;

• Backups or exports stored in iCloud;

• Copies stored in device storage or another service you control;

• Information previously written to Apple Health; or

• Information previously written to Google Health Connect.

You can manage that information through the applicable device or third-party service.

6.7. Communications

We retain support and other communications for as long as reasonably necessary to respond to your request, maintain appropriate support history, protect our legal rights, and comply with applicable legal obligations.

You may request deletion of Communications Data by contacting hello@thepwrapp.com.

Upon receipt of a verified deletion request, we will take all reasonable steps to delete the data associated with your email address; however, complete deletion across all backup systems may take up to ninety (90) days.

Some copies may remain temporarily in restricted backup systems or where continued retention is legally required.

To initiate the deletion process for your App data, including your Workout Data and any Account and linked data, please refer to the Your Account & App Data Deletion instructions.

7. Security of Your Information

We use reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

Depending on the relevant system, these measures may include:

• Encryption of information in transit;

• Encryption of server-side information and systems where appropriate;

• Device or platform security protections for locally stored App data;

• Access controls;

• Restricted access to production systems; and

• Security and diagnostic monitoring.

No method of electronic transmission or storage is completely secure. We therefore cannot guarantee absolute security.

8. Data Protection and Privacy

8.1 General Data Protection Regulation (GDPR)

If you are a citizen of a European Union member state, you have rights concerning your personal data. We are committed to facilitating them.

• The Right to Access: You can request a copy of the personal account information we hold about you.

• The Right to Rectification: Your basic account data (such as name, email, and picture) is sourced from Google/Apple. To correct this information, you must update your details directly with those services and then sign in to our app again. We will then update our records with the rectified information upon your next sign-in. For workout data stored locally on your device, you can edit or correct specific entries directly within the app's workout log or editing features.

• The Right to Erasure: You have the right to delete your account and associated server data at any time. When you choose to delete your account, your account data on our servers is deleted permanently. To initiate the process of deletion of your account and data, please refer to the Your Account & App Data Deletion instructions. Your workout data (stored locally) will be deleted upon uninstalling the app from your device. Uninstalling will not remove your server-side account data.

• The Right to Data Portability: Please note that workout data is stored and processed solely on your device. You have the right to access your encrypted backup file to move as you see fit. You can request a copy of your basic account information (as sourced from Google/Apple) by contacting us at hello@thepwrapp.com.

• The Right to Restrict Processing & The Right to Object: You have the right to object to our processing of your data for our legitimate interests.

• The Right to Withdraw Consent: Where we rely on your consent (e.g., for marketing emails), you can withdraw it at any time.

Withdrawal of consent does not affect the lawfulness of processing performed before consent was withdrawn.

Because some Workout Data exists only locally on your device, PWR may not possess a server-side copy that we can access, correct, provide, or delete. You can manage such information directly through the App.

You may exercise applicable rights by contacting hello@thepwrapp.com.

We may request information reasonably necessary to verify your identity before completing a request.

The Romanian data protection supervisory authority is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).

8.2 California Consumer Privacy Act (CCPA)

If you are a California resident and the California Consumer Privacy Act ("CCPA") applies to our processing of your information, you may have rights including, subject to applicable exceptions:

• The right to know or access personal information;

• The right to request deletion;

• The right to request correction;

• The right to opt out of sale or sharing where applicable;

• The right to limit certain uses of sensitive personal information where applicable; and

• The right not to receive discriminatory treatment for exercising applicable privacy rights.

• As described above, we do not sell personal information or use or disclose it for cross-context behavioral advertising.

You may submit an applicable privacy request at hello@thepwrapp.com.

9. International Data Transfers

PWR is established in Romania and uses infrastructure located in the European Union for parts of the Service.

Some service providers may process information in countries outside Romania or the European Economic Area.

Where applicable data-protection law requires safeguards for an international transfer, we use or rely on an appropriate transfer mechanism, which may include:

An adequacy decision issued by the European Commission;

The European Commission's Standard Contractual Clauses;

An applicable data-privacy framework or certification mechanism; or

Another mechanism permitted by applicable law.

You may contact us for further information about safeguards applicable to international transfers of your personal data.

10. Age Requirement and Minors

10.1. Minimum Age

You must be at least 16 years old, or any higher minimum age required by applicable law where you live, to create a PWR account or use the PWR App.

Paid PWR subscriptions are available only to users who are legally permitted to make or use the purchase. If you are under the age of legal majority where you live, a purchase or subscription must be authorized by a parent or legal guardian where required by applicable law.

We may ask you to confirm that you meet the applicable minimum-age or eligibility requirements. We do not ordinarily require you to provide your exact date of birth solely for this purpose.

10.2. Information Relating to People Under 16

The App and account-based Service are not directed to children under 16 or any higher minimum age required by applicable law where you live, and people under 16 or any higher minimum age required by applicable law where you live are not permitted to create or maintain a PWR account.

The public Website may be accessible without an account, but it is not directed to children under 16 or any higher minimum age required by applicable law where you live.

If we learn that a person under 16, or any higher minimum age required by applicable law, has created a PWR account or provided personal information to us, we may suspend or delete the account and take reasonable steps to delete the associated personal information where required by applicable law.

If you believe that a person under 16, or any higher minimum age required by applicable law, has created a PWR account or provided personal information to us, please contact hello@thepwrapp.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy when our Service, technologies, service providers, or legal obligations change.

When we make changes, we will update the "Last Updated" date above.

Where a change is material or applicable law requires additional notice, we may also notify you through:

• The App;

• The Website;

• Email; or

• Another appropriate method.

If a change requires your consent under applicable law, we will request that consent separately.

12. Contact Us

For questions, concerns, privacy requests, or complaints regarding this Privacy Policy or our privacy practices, contact:

ASVAL ALPHA TECHNOLOGY S.R.L.

Calea Zarandului, Bl. M10, Sc. 1, Et. 10, Ap. 30, CP 330182

Deva, Romania

Email: hello@thepwrapp.com

Phone: +40 726 504 728

Website: https://thepwrapp.com