Privacy Policy

Welcome to MAXSTATS ("we," "our," "us," or "the App"). MAXSTATS is an advanced gamified fitness and athletic performance tracking platform accessible via mobile applications (iOS and Android) and web services at maxstats.app. We are dedicated to maintaining the trust of our athletes by ensuring complete transparency regarding how your data is collected, processed, stored, and protected.

This Privacy Policy sets forth our practices under global privacy regulations, including the European Union General Data Protection Regulation (GDPR), the UK Data Protection Act, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and applicable United States state privacy statutes.

1. Categories of Personal Data We Collect

We collect information directly from you, automatically through your device sensors, and through third-party authentication providers:

• Account & Athlete Profile Data: Full name, display name, username, email address, profile avatar, biography, birthdate, gender, unit preferences (lbs/kg, mi/km), and encrypted credentials.
• Physical & Health Metrics: Body weight, height, body fat percentage, 1RM personal records, target fitness goals, and historical measurement logs.
• Workout & Athletic Activity Records: Strength training logs (exercises, sets, repetitions, weight, volume, RPE, rest timers) and outdoor endurance activities (running, walking, cycling, hiking, rowing, swimming).
• Precise Geolocation & GPS Data: Continuous background and foreground GPS coordinates, route polylines, split paces, speed, elevation gain, and elapsed time during outdoor sessions.
• Physique Photos for AI Analysis: Optional physique photos submitted specifically for automated AI Body Fat visual estimation.
• Social & Squad Communications: Squad chats, comments, workout likes, props, community feed posts, and user support inquiries.
• Device & Technical Telemetry: Device model, operating system version, unique device identifiers, IP address, network carrier, and crash/diagnostic logs.

2. Lawful Bases for Processing (GDPR Compliance)

We process your personal data under the following lawful bases pursuant to Article 6 and Article 9 of the GDPR:

• Contractual Performance: To deliver workout tracking, compute XP and athlete level progression, manage leaderboards, and operate squad features.
• Explicit Consent: For processing health-related data (body weight, body fat %, workout intensity) and analyzing physique photos via AI.
• Legitimate Interests: To prevent cheating and GPS spoofing on competitive leaderboards, ensure network security, and enhance app stability.
• Legal Obligations: To comply with statutory accounting, tax, regulatory, or law enforcement mandates.

3. Device Permissions & Exact Operational Use

• Location (Foreground & Background): Required during active outdoor workouts to accurately plot route maps, track distance, and calculate real-time split paces while your screen is locked.
• Camera & Photo Library: Accessed strictly when you choose to take or upload profile avatars, attach workout photos, or submit images for AI body composition analysis.
• Foreground Service & Health Sensors: Maintains continuous workout timer integrity and sensor connectivity during high-intensity training.
• Push Notifications: Delivers rest timer completions, squad activity alerts, and milestone achievements.

4. Artificial Intelligence (Google Gemini API) Safeguards

MAXSTATS incorporates machine learning technologies powered by the Google Gemini API (via Google Cloud / Vertex AI):

• AI Body Fat Visual Estimation: Submitted physique photos and physical parameters (height, weight, gender) are transmitted securely to Google Gemini for transient visual analysis. Images are processed ephemerally and are NEVER used to create biometric templates, facial recognition profiles, or advertising profiles.
• Coaching Insights & Squad Recaps: Aggregated volume and frequency data are processed to generate weekly recovery tips and monthly squad summaries.
• Zero Model Training: User private photos and health metrics are not used to train third-party foundation models without your explicit opt-in consent.

5. Third-Party Sub-processors & Data Sharing

We do not sell, rent, or trade your personal or health data to data brokers or third-party advertisers. We share data strictly with trusted service providers:

• Google Firebase & Google Cloud Platform: Identity Authentication, Cloud Firestore database, Firebase Storage (media), and Cloud Functions.
• Google Gemini API / Vertex AI: Multimodal artificial intelligence inference.
• Apple, Google & Meta: Third-party federated identity authentication.
• Map Tile Providers: Cartographic map layers for GPS workout route visualization.

6. Privacy Visibility Controls & Sharing Levels

You have granular control over who can view your activities:

• Everyone (Public): Workouts, route paths, badges, and PRs are visible to the public feed and community leaderboards.
• Followers Only: Your workout logs and stats are restricted exclusively to athletes you approve.
• Private: Your workouts, routes, and statistics are visible solely to you.

7. Data Security, Retention & Permanent Deletion

• Security Standards: All data in transit is encrypted using industry-standard TLS 1.3/HTTPS, and data at rest is encrypted with AES-256 encryption.
• Retention Schedule: We retain your data only for as long as your account remains active.
• Right to Permanent Deletion: You can delete your account and all associated workout history, route polylines, physique photos, and social posts directly in the app under Profile > Settings > Delete Account. Data is permanently purged from active databases within 30 days.

8. Your Global Privacy Rights (GDPR & CCPA/CPRA)

Regardless of your location, you have enforceable privacy rights:

• Right to Access & Portability: Request a complete machine-readable copy of your personal and fitness data.
• Right to Rectification: Correct inaccurate personal details or workout logs.
• Right to Erasure ("Right to be Forgotten"): Request immediate, permanent deletion of all stored personal records.
• California Privacy Rights (CCPA/CPRA): California residents have the right to know what personal information is collected, request deletion, opt-out of sharing, and receive non-discriminatory service. We do not "sell" or "share" personal data as defined under the CCPA.

9. Children's Privacy Protection (COPPA)

MAXSTATS is strictly restricted to individuals aged 13 and older (or 16 and older in the European Union and UK). We do not knowingly collect personal information from children. If we learn that a minor under the minimum age has registered, we will promptly delete their account and records.

10. International Data Transfers

Personal data collected by MAXSTATS is processed and stored on secure Google Cloud servers located in the United States. Where cross-border data transfers from the EU, UK, or Switzerland occur, we implement European Commission Standard Contractual Clauses (SCCs) to guarantee equivalent data protection.

11. Contact Us

For questions, privacy requests, or data protection inquiries, contact our Data Protection Team:

• App Name: MAXSTATS
• Website: https://maxstats.app
• Privacy & Support Email: hello@maxstats.app
• In-App Support: Profile > Settings > Support & Feedback