Privacy Policy

Data we collect

We collect the following categories of data when you provide it or choose to use the relevant feature: (1) Account data, such as your email address, username, password authentication data, account settings, language, and profile details. (2) Workout and fitness data you enter or save, such as exercises, sets, reps, weights, duration, distance, personal records, plans, templates, bodyweight, measurements, notes, and progress photos. (3) Social content and safety data, such as public or limited-visibility workouts, posts, comments, reactions, follows, close friends, messages, blocks, and reports you submit. (4) Authentication data from Google Sign-In or Apple Sign-In when you use those login methods, such as the account identifier, name, and email made available by the provider. (5) Notification tokens and delivery metadata needed to send push notifications you request. (6) Import data from files or connected device sources that you choose to import. (7) Diagnostic data, such as crash reports, error logs, stack traces, app version, device type, operating system version, request metadata, and an internal user identifier for debugging and security.

Data we do not intentionally collect

VIRTUX does not intentionally collect government identification numbers, payment card numbers, precise location, contacts, SMS, call history, browser history, or advertising identifiers for tracking. We do not sell personal data and we do not use your data for third-party advertising or cross-app tracking.

How we use your data

We use your data to operate VIRTUX, sync your account, save your workouts, personalize statistics and achievements, show content according to your visibility settings, deliver push notifications you opt into, provide support, prevent abuse, secure accounts, investigate reports, and debug crashes or performance issues. We do not use your personal data for third-party advertising, sale, or cross-app tracking.

Permissions and optional data

Most of VIRTUX works without any device permission. Certain features are only enabled if you grant the corresponding permission, and you can revoke them at any time from your operating system settings: (1) Notifications, used to send push notifications you opt into. (2) Photos and media library, used only when you choose to attach an image to a post, comment, or progress photo. (3) Camera, used only when you choose to capture a new photo in the app. (4) Health Connect on Android or HealthKit on iOS, used only when you explicitly connect the service to import workout data. (5) Internet access, required to sync your account and load online content. VIRTUX does not request or use precise location, contacts, microphone, SMS, call history, Bluetooth, or background device sensors. We never collect data through a permission we have not described above.

Data sharing and third-party processors

We do not sell your personal data. We use trusted service providers only to run the app and provide features: cloud hosting, database, and storage providers to host the service and store user content; Sentry for crash and error reporting; Google Sign-In and Apple Sign-In for authentication when you choose those options; Firebase Cloud Messaging and Apple Push Notification service for push notification delivery; and transactional email providers to send verification, security, password reset, and account notices. These providers process data only for the service purposes we disclose and are expected to protect user data consistently with this policy and applicable law.

Health and fitness data (Health Connect and HealthKit)

Connecting Health Connect on Android or Apple Health through HealthKit on iOS is optional. You choose which read permissions to grant. VIRTUX uses the available data to preview completed running and cycling activities and let you import them into your training history without entering their details manually. Workout records provide the activity type, date, start and end times, duration, and source app. Distance helps you review how far you trained, and heart-rate averages and time in heart-rate zones help you review workout intensity. Heart-rate access is optional; importing an activity does not require you to grant it. No workout is saved to VIRTUX unless you choose to import it. VIRTUX does not write data to Health Connect or HealthKit.

On Android, after you connect Health Connect and grant the corresponding read permissions, VIRTUX reads ExerciseSession records to detect completed running and cycling activities from the last 30 days, Distance records to show and save each activity's distance, and HeartRate records only if you also grant that separate permission, to show heart-rate summaries and zones. VIRTUX checks for recent sessions when the app opens or returns to the foreground, and checks the records available for a selected date when you view it in the training calendar. We do not request read permissions for steps, step cadence, speed, or total calories burned. The Android exercise read permission also covers cycling pedaling cadence, but VIRTUX does not read or use cycling pedaling cadence records. We do not request permission or schedule health-data reads in the background.

On iOS, VIRTUX requests read access to HealthKit workout records, walking/running distance, cycling distance, and heart rate. It identifies completed running and cycling workouts, including treadmill running and stationary cycling, and uses their recorded distance or associated distance samples. When available and authorized, associated heart-rate samples are used to calculate the average and time in heart-rate zones. Recent-activity checks cover the last 30 days; you can also view activities available for a selected date in the training calendar. A HealthKit workout record may also contain energy burned, which the adapter reads as part of that record. VIRTUX does not request separate active-energy or total-calories permissions, and the current import flow does not save that energy value in the imported workout. It does not request steps, cadence, speed, or workout routes.

Heart-rate samples are processed temporarily in memory to calculate summaries; VIRTUX does not upload the complete sample series to our servers. If you import an activity, the saved workout includes its training details, distance when applicable, average heart rate when available, and a summary of time in heart-rate zones when available. The app also keeps a local record of activities you have imported or ignored, including the provider, activity identifier, source, title, date, and import status, to avoid repeatedly offering the same activity.

If you choose to save an imported activity as a VIRTUX workout, it may sync to our servers so the app works across devices. New workouts imported from Health Connect or HealthKit use the default workout visibility you have configured in VIRTUX. Depending on that setting, the selected audience may see the imported workout, including its distance, average heart rate, and heart-rate zones, from the moment you save it. A private workout is visible only to you; other settings allow close friends, followers, or the public to see it. You can change your default workout visibility in settings before importing, or change an individual workout's visibility after importing. We do not use connected health data for advertising or sell it. Service providers needed to operate VIRTUX may process saved health data as described in this policy.

You can revoke Android permissions in Health Connect settings and iOS access in the Health app or iOS settings at any time. Revoking access prevents further reads of the affected data; it does not delete workouts you already chose to import. You can delete those workouts in VIRTUX or request account deletion as described below.

Temporary diagnostic and support data

When you report a bug, contact support, or when the app crashes, we may temporarily process diagnostic information needed to understand and fix the incident. This can include logs, stack traces, device and app version, timestamps, internal account identifiers, and limited request metadata. We avoid collecting raw workout content, photos, passwords, or health details in diagnostics unless you intentionally include them in a support request. Diagnostic data is kept only as long as reasonably needed to investigate, fix, secure, and verify the issue, and is then deleted or anonymized according to our retention practices and our processor retention settings.

Security

We use safeguards designed to protect your data, including HTTPS/TLS encryption in transit and HTTP Strict Transport Security (HSTS) in production, which forces browsers to communicate with VIRTUX over HTTPS and prevents downgrade attacks. We also apply access controls, authentication protections, logging restrictions, and operational security reviews. Sensitive authentication secrets are stored using appropriate secure storage mechanisms. Some data may also be stored locally on your device so the app can work quickly and offline; your device security settings help protect that local data. No method of transmission or storage is 100% secure; we will notify you of any breach that materially affects your data as required by applicable law.

Data retention

We retain your account data and user content for as long as your account is active or as needed to provide the service. You can request account deletion in the app or from the authenticated web settings page. When you delete your account, access tokens are revoked immediately and the account enters a 14-day recovery period. After that period, we permanently delete or anonymize account data and user content from active systems, generally no later than 30 days from the deletion request, except where we must retain limited information for security, fraud prevention, legal compliance, dispute resolution, or backup integrity. Diagnostic data is retained only as long as needed for debugging and security, subject to our service provider retention settings.

Your rights

Depending on your country of residence, you may have the right to: access the personal data we hold about you; correct inaccurate data; request erasure of your data; restrict or object to certain processing; revoke optional permissions; withdraw optional consents; and receive a copy of your data in a portable format. You can manage many settings in the app, revoke device permissions in your operating system settings, or request account deletion from the app. To exercise privacy rights, contact us at [email protected] or use the in-app support channel. You also have the right to lodge a complaint with your local data protection authority.

Children's privacy

VIRTUX is not directed at children. The minimum age to use VIRTUX is 16, or higher where required by local law (for example, 16 in Spain and most EU member states, 13 in the United States under COPPA). We do not knowingly collect personal data from users below the minimum age. If we learn that a user below the minimum age has created an account, we will delete the account and the associated data as soon as possible. If you believe a user below the minimum age has created an account, please contact us immediately at [email protected].

Changes to policy

We may update this privacy policy from time to time. If we make material changes, we will notify you through the app or via email. Continued use after changes means you accept the updated policy.

Contact us

Questions about this privacy policy? Contact us via the in-app support channel or at [email protected].