Privacy Policy

Welcome to MAXSTATS! This Privacy Policy is issued by MAXSTATS Fitness Inc. ("MAXSTATS," "Company," "we," "our," or "us"), a corporation incorporated under the federal laws of Canada with its registered corporate office at Office 924, 145 1/2 Church Street, Unit 5, Toronto, Ontario, M5B 1Y4, Canada. MAXSTATS is an advanced gamified fitness and athletic performance tracking platform accessible via mobile applications (iOS and Android) and web services at maxstats.app. We are dedicated to maintaining the trust of our athletes by ensuring complete transparency regarding how your data is collected, processed, stored, and protected.

This Privacy Policy sets forth our practices across global privacy and data protection frameworks, including Canada (PIPEDA, Ontario standards, BC PIPA, Alberta PIPA, Quebec Law 25, CASL), the European Union and United Kingdom (GDPR, UK Data Protection Act 2018), the United States (CCPA/CPRA, Illinois BIPA, Washington MHMDA, Nevada SB 370), Australia (Privacy Act 1988 & APPs), and Brazil (LGPD - Lei nº 13.709/2018).

1. Categories of Personal & Consumer Health Data We Collect

We collect information directly from you, automatically through your device sensors, and through third-party authentication providers:

• Account & Athlete Profile Data: Full name, display name, username, email address, profile avatar, biography, birthdate, gender, unit preferences (lbs/kg, mi/km), and encrypted credentials.
• Physical & Consumer Health Metrics: Body weight, height, body fat percentage, 1RM personal records, target fitness goals, and historical measurement logs. This data is collected strictly to calculate your athletic progression, gamified XP, and workout performance analytics.
• Workout & Athletic Activity Records: Strength training logs (exercises, sets, repetitions, weight, volume, RPE, rest timers) and outdoor endurance activities (running, walking, cycling, hiking, rowing, swimming).
• Precise Geolocation & GPS Data: Continuous background and foreground GPS coordinates, route polylines, split paces, speed, elevation gain, and elapsed time during outdoor sessions.
• Physique Photos for AI Analysis: Optional physique photos submitted specifically for automated AI Body Fat visual estimation.
• Social & Squad Communications: Squad chats, comments, workout likes, props, community feed posts, and user support inquiries.
• Device & Technical Telemetry: Device model, operating system version, unique device identifiers, IP address, network carrier, and crash/diagnostic logs.

2. Lawful Bases for Processing (GDPR & Health Directives)

We process your personal data under the following lawful bases pursuant to Article 6 and Article 9 of the GDPR:

• Contractual Performance: To deliver workout tracking, compute XP and athlete level progression, manage leaderboards, and operate squad features.
• Explicit Consent: For processing health-related data (body weight, body fat %, workout intensity) and analyzing physique photos via AI.
• Legitimate Interests: To prevent cheating and GPS spoofing on competitive leaderboards, ensure network security, and enhance app stability.
• Legal Obligations: To comply with statutory accounting, tax, regulatory, or law enforcement mandates.

3. Device Permissions & Exact Operational Use

• Location (Foreground & Background): Required during active outdoor workouts to accurately plot route maps, track distance, and calculate real-time split paces while your screen is locked.
• Camera & Photo Library: Accessed strictly when you choose to take or upload profile avatars, attach workout photos, or submit images for AI body composition analysis.
• Foreground Service & Health Sensors: Maintains continuous workout timer integrity and sensor connectivity during high-intensity training.
• Push Notifications: Delivers rest timer completions, squad activity alerts, and milestone achievements.

4. Artificial Intelligence & Illinois BIPA Biometric Safe Harbor

MAXSTATS incorporates machine learning technologies powered by the Google Gemini API (via Google Cloud / Vertex AI):

• AI Body Fat Visual Estimation: Submitted physique photos and physical parameters (height, weight, gender) are transmitted securely to Google Gemini for transient visual analysis. Images are processed ephemerally and are NEVER used to create biometric templates, facial recognition profiles, or advertising profiles.
• Illinois BIPA & State Biometric Law Notice: MAXSTATS does not collect, capture, purchase, receive, or store "biometric identifiers" or "biometric information" (such as retina scans, fingerprints, voiceprints, or scans of hand or facial geometry) as defined under the Illinois Biometric Information Privacy Act (740 ILCS 14/1 et seq.), Texas CUBI, or similar statutes. Physique photos uploaded for AI Body Fat Estimation are analyzed ephemerally in volatile memory (RAM) via computer vision algorithms and discarded immediately following analysis without extracting biometric templates or unique biological identifiers.
• Coaching Insights & Squad Recaps: Aggregated volume and frequency data are processed to generate weekly recovery tips and monthly squad summaries.
• Zero Model Training: User private photos and health metrics are not used to train third-party foundation models without your explicit opt-in consent.

5. Third-Party Sub-processors & No-Sale Covenant

We strictly do not sell, rent, lease, or trade your personal data or consumer health data to data brokers, ad networks, or third-party advertisers. We share data strictly with trusted service providers:

• Google Firebase & Google Cloud Platform: Identity Authentication, Cloud Firestore database, Firebase Storage (media), and Cloud Functions.
• Google Gemini API / Vertex AI: Multimodal artificial intelligence inference.
• Apple, Google & Meta: Third-party federated identity authentication.
• Map Tile Providers: Cartographic map layers for GPS workout route visualization.

6. Privacy Visibility Controls & Sharing Levels

You have granular control over who can view your activities:

• Everyone (Public): Workouts, route paths, badges, and PRs are visible to the public feed and community leaderboards.
• Followers Only: Your workout logs and stats are restricted exclusively to athletes you approve.
• Private: Your workouts, routes, and statistics are visible solely to you.

7. Data Security, Local Storage & Permanent Deletion

• Security Standards: All data in transit is encrypted using industry-standard TLS 1.3/HTTPS, and data at rest is encrypted with AES-256 encryption.
• Local Storage, Offline Caching & GPC Signals: We do not use third-party advertising tracking cookies. We utilize device local storage (IndexedDB, SharedPreferences, Keychain) solely to maintain authenticated sessions and enable offline workout tracking. We do not track users across third-party websites, and our web services honor Global Privacy Control (GPC) opt-out preference signals.
• Retention Schedule: We retain your data only for as long as your account remains active.
• Right to Permanent Deletion: You can delete your account and all associated workout history, route polylines, physique photos, and social posts directly in the app under Profile > Settings > Delete Account & Data, or via our public web portal at Request Account & Data Deletion. In-app deletions are executed immediately in real-time, and web-submitted requests are verified and processed within 30 days.

8. Regional & International Privacy Rights

Regardless of your location, you have enforceable privacy rights:

• Canadian Privacy Rights (PIPEDA, BC PIPA, Alberta PIPA & Quebec Law 25): Access, correction, consent withdrawal, and data portability rights under PIPEDA and Quebec Law 25. Submit requests to our Chief Privacy Officer at hello@maxstats.app.
• Canada's Anti-Spam Legislation (CASL): Express opt-in consent for commercial messages, sender identification with our Toronto registered address, and an immediate 10-business-day unsubscribe guarantee.
• European Union & United Kingdom (GDPR / UK GDPR): Rights under Articles 15–22 of the GDPR (access, rectification, erasure, restriction, portability, objection, and complaints to local Data Protection Authorities or the UK ICO).
• Australia Privacy Rights (Privacy Act 1988 & APPs): Rights to access and correct personal records under the Australian Privacy Principles, and complaints to the OAIC.
• Brazil LGPD Rights (Lei nº 13.709/2018): Confirmation, access, correction, anonymization, portability, deletion, and right to petition the Brazilian National Data Protection Authority (ANPD).
• United States (CCPA/CPRA & Consumer Health Statutes): California rights to know, delete, and opt-out of data sharing (no sale of personal data), and Washington MHMDA / Nevada SB 370 health data rights.

9. Children's Privacy Protection (COPPA & International Age Thresholds)

You must be at least 13 years of age, or the minimum age of digital consent required in your country of residence (such as 16 in certain EU member states), to create an account or use the Services. We do not knowingly collect personal data from children under these age thresholds.

10. International & Cross-Border Data Transfers

MAXSTATS Fitness Inc. is incorporated in Canada. However, our primary databases and AI services are hosted on secure servers located in the United States. By creating an account, athletes in Canada, Europe, Australia, and internationally acknowledge and consent to cross-border data transfer, storage, and processing in the United States, where data may be accessible to lawful authorities under foreign laws (including the US CLOUD Act). Where European transfers occur, we implement European Commission Standard Contractual Clauses (SCCs).

11. Contact Us, Designated Chief Privacy Officer & Policy Changes

We reserve the right to modify this Privacy Policy. If we make material changes, we will update the "Effective Date" and notify you via an in-app notice or registered email. For questions, privacy requests, or to contact our designated Chief Privacy Officer pursuant to Canadian PIPEDA and Quebec Law 25:

• Corporate Entity: MAXSTATS Fitness Inc.
• Attention: Chief Privacy Officer / Privacy Compliance
• Registered Corporate Address: Office 924, 145 1/2 Church Street, Unit 5, Toronto, Ontario, M5B 1Y4, Canada
• Website: https://maxstats.app
• Privacy & Support Email: hello@maxstats.app
• In-App Support: Profile > Settings > Support & Feedback

Language / Langue: The parties confirm that this Privacy Policy and all related notices are drafted and agreed to in the English language. / Les parties confirment que cette politique de confidentialité et tous les avis connexes sont rédigés et convenus en langue anglaise.