Privacy Policy of the “GymPad” Application

Last update: 27.04.2025

Account deletion instructions: gympad/delete-account.html.

This document sets out the rules for processing personal data by MatCode Mateusz Arczyński (ul. Portowa 10, 86-200 Chełmno, Poland, NIP 875-156-25-99, REGON 383604557, e-mail: matcode.help@gmail.com) - hereinafter referred to as the “Administrator”. This document has been prepared in accordance with Regulation (EU) 2016/679 (“GDPR”).

1. Glossary

User - a natural person installing or using the “GymPad” mobile application (hereinafter: the “Application”).

Service - functionalities of the Application, including creating and storing a training log, statistics, and access to the GymPad Premium subscription.

2. Scope and purposes of data processing

• GymPad Account (e-mail, Firebase ID) - purpose: login and backup; basis: Art. 6(1)(b) GDPR.
• Training log (exercises, notes) - basis: Art. 6(1)(b).
• Analytics data (in-app events, device ID) - basis: Art. 6(1)(f) (legitimate interest).
• Advertising identifiers (Freemium only) - basis: Art. 6(1)(a) (consent).
• Crash logs (Crashlytics) - basis: Art. 6(1)(f).
• Payment data (transaction token, subscription ID, payer country, currency, status, Google Play / Apple account metadata) - purpose: in-app purchases, payment verification, tax settlements; basis: • Art. 6(1)(b) (contract performance), • Art. 6(1)(c) (accounting obligations), • Art. 6(1)(f) (fraud prevention).

3. Data recipients

The Application uses third-party services:

• Google Play Services , Firebase (Auth, Realtime Database, Crashlytics, Analytics)
• Google AdMob (Freemium version only)
• Google Play Billing Library - Android payments
• Apple In-App Purchase - iOS payments

These providers may process data in the USA or other countries outside the EEA. Transfers are based on Standard Contractual Clauses (SCC) and additional safeguards.

4. Retention period

• Account data - until account deletion or 3 years from last activity.
• Technical logs - 24 months.
• Advertising identifiers - until consent is withdrawn or ID is reset.
• Database backups - max. 30 days.
• Accounting documentation (payment data) - 5 years from the end of the calendar year in which the tax payment deadline expired (Art. 70 § 1 of the Tax Ordinance in connection with Art. 74(2) of the Accounting Act).

5. User rights

You have, among others, the right to access, rectify, delete, restrict, transfer, object, and withdraw consent (without affecting the lawfulness of prior processing). Send requests to matcode.help@gmail.com. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO).

6. Tracking mechanisms / device identifiers

The Application does not store traditional “cookies”, but SDKs may use device or advertising identifiers. You can disable them in Android/iOS settings.

7. Data security

We use TLS 1.2+ encryption, password hashing, access control, and backups. We will inform you of any breaches in accordance with Art. 33 GDPR.

8. Children’s privacy

The Service is not intended for persons under 13 years of age. If a child has provided us with data, please write to matcode.help@gmail.com; we will delete it.

9. Policy changes

New versions are published in the Application and at https://gympad-282d8.web.app/gympad/policy-en.html. We notify of significant changes via push or e-mail.

10. Contact

Send questions to matcode.help@gmail.com or by post to the Administrator’s address.