Privacy Policy

Data we collect

We collect the following categories of data when you provide it or choose to use the relevant feature: (1) Account data, such as your email address, username, password authentication data, account settings, language, and profile details. (2) Workout and fitness data you enter or save, such as exercises, sets, reps, weights, duration, distance, personal records, plans, templates, bodyweight, measurements, notes, and progress photos. (3) Social content and safety data, such as public or limited-visibility workouts, posts, comments, reactions, follows, close friends, messages, blocks, and reports you submit. (4) Authentication data from Google Sign-In or Apple Sign-In when you use those login methods, such as the account identifier, name, and email made available by the provider. (5) Notification tokens and delivery metadata needed to send push notifications you request. (6) Import data from files or connected device sources that you choose to import. (7) Diagnostic data, such as crash reports, error logs, stack traces, app version, device type, operating system version, request metadata, and an internal user identifier for debugging and security.

Data we do not intentionally collect

VIRTUX does not intentionally collect government identification numbers, payment card numbers, precise location, contacts, SMS, call history, browser history, or advertising identifiers for tracking. We do not sell personal data and we do not use your data for third-party advertising or cross-app tracking.

How we use your data

We use your data to operate VIRTUX, sync your account, save your workouts, personalize statistics and achievements, show content according to your visibility settings, deliver push notifications you opt into, provide support, prevent abuse, secure accounts, investigate reports, and debug crashes or performance issues. We do not use your personal data for third-party advertising, sale, or cross-app tracking.

Permissions and optional data

Most of VIRTUX works without any device permission. Certain features are only enabled if you grant the corresponding permission, and you can revoke them at any time from your operating system settings: (1) Notifications, used to send push notifications you opt into. (2) Photos and media library, used only when you choose to attach an image to a post, comment, or progress photo. (3) Camera, used only when you choose to capture a new photo in the app. (4) Health Connect on Android, used only when you explicitly connect it to import workout data. (5) Internet access, required to sync your account and load online content. VIRTUX does not request or use precise location, contacts, microphone, SMS, call history, Bluetooth, or background device sensors. We never collect data through a permission we have not described above.

Data sharing and third-party processors

We do not sell your personal data. We use trusted service providers only to run the app and provide features: cloud hosting, database, and storage providers to host the service and store user content; Sentry for crash and error reporting; Google Sign-In and Apple Sign-In for authentication when you choose those options; Firebase Cloud Messaging and Apple Push Notification service for push notification delivery; and transactional email providers to send verification, security, password reset, and account notices. These providers process data only for the service purposes we disclose and are expected to protect user data consistently with this policy and applicable law.

Health and fitness data (Android Health Connect)

On Android, you may optionally connect VIRTUX to Health Connect to import workout sessions and related metrics such as heart rate, steps, distance, speed, and calories burned. This feature requires your explicit permission. Health Connect data is accessed only for the import/sync feature you request. If you save an imported activity as a VIRTUX workout, that saved workout is treated like other workout data in your account and may sync to our servers so the app works across devices. We do not use Health Connect data for advertising, sell it, or share it with third parties except service providers needed to operate VIRTUX. You can revoke Health Connect permissions at any time from Android settings.

Temporary diagnostic and support data

When you report a bug, contact support, or when the app crashes, we may temporarily process diagnostic information needed to understand and fix the incident. This can include logs, stack traces, device and app version, timestamps, internal account identifiers, and limited request metadata. We avoid collecting raw workout content, photos, passwords, or health details in diagnostics unless you intentionally include them in a support request. Diagnostic data is kept only as long as reasonably needed to investigate, fix, secure, and verify the issue, and is then deleted or anonymized according to our retention practices and our processor retention settings.

Security

We use safeguards designed to protect your data, including HTTPS/TLS encryption in transit and HTTP Strict Transport Security (HSTS) in production, which forces browsers to communicate with VIRTUX over HTTPS and prevents downgrade attacks. We also apply access controls, authentication protections, logging restrictions, and operational security reviews. Sensitive authentication secrets are stored using appropriate secure storage mechanisms. Some data may also be stored locally on your device so the app can work quickly and offline; your device security settings help protect that local data. No method of transmission or storage is 100% secure; we will notify you of any breach that materially affects your data as required by applicable law.

Data retention

We retain your account data and user content for as long as your account is active or as needed to provide the service. You can request account deletion in the app or from the authenticated web settings page. When you delete your account, access tokens are revoked immediately and the account enters a 14-day recovery period. After that period, we permanently delete or anonymize account data and user content from active systems, generally no later than 30 days from the deletion request, except where we must retain limited information for security, fraud prevention, legal compliance, dispute resolution, or backup integrity. Diagnostic data is retained only as long as needed for debugging and security, subject to our service provider retention settings.

Your rights

Depending on your country of residence, you may have the right to: access the personal data we hold about you; correct inaccurate data; request erasure of your data; restrict or object to certain processing; revoke optional permissions; withdraw optional consents; and receive a copy of your data in a portable format. You can manage many settings in the app, revoke device permissions in your operating system settings, or request account deletion from the app. To exercise privacy rights, contact us at [email protected] or use the in-app support channel. You also have the right to lodge a complaint with your local data protection authority.

Children's privacy

VIRTUX is not directed at children. The minimum age to use VIRTUX is 16, or higher where required by local law (for example, 16 in Spain and most EU member states, 13 in the United States under COPPA). We do not knowingly collect personal data from users below the minimum age. If we learn that a user below the minimum age has created an account, we will delete the account and the associated data as soon as possible. If you believe a user below the minimum age has created an account, please contact us immediately at [email protected].

Changes to policy

We may update this privacy policy from time to time. If we make material changes, we will notify you through the app or via email. Continued use after changes means you accept the updated policy.

Contact us

Questions about this privacy policy? Contact us via the in-app support channel or at [email protected].