Privacy policy

1. Controller and contact

Daystrong is operated by Artur Ferreira Cruz in Switzerland. He is the controller for personal data processed through the Daystrong website and service. Privacy and data-rights requests can be sent to support@ferreiracruz.com.

2. Information we process

• Account details such as name, email address, profile information and authentication records
• Training information you choose to record, including routines, workouts, exercises, notes and body measurements
• Social activity and visibility choices, including follows, reactions, comments, public profile content and reports you submit about public content
• Subscription state, Stripe customer and transaction references, but not complete payment-card numbers
• Device, security, diagnostic, request-log and support information

3. Purposes and legal bases

We process account and training information to provide the service and perform our contract with you. We process payment references to manage a subscription and meet accounting obligations. We process security, diagnostic and limited usage information where necessary for our legitimate interests in protecting, maintaining and improving Daystrong. Where the law requires consent, including for optional sensitive information or non-essential device storage, we ask for it before that processing and you may withdraw it for the future.

4. Sensitive training information

Body measurements, injury notes and similar entries may reveal health-related information. Adding these fields is optional. Do not add information you do not want Daystrong to process, and do not publish sensitive information in social content. Where such data is legally treated as sensitive or a special category, we rely on your explicit choice and consent to store it for the features you request.

5. Providers and recipients

Appwrite provides authentication, database, storage, functions and site infrastructure. Stripe processes subscription checkout, billing and the customer portal. Cloudflare may provide DNS, email routing, delivery and security services. These providers receive only the information required for their role and act under their contractual and legal obligations. We may also disclose information where required by law, to protect the service or in connection with a lawful business transfer.

6. Public content

Profile and workout information is shown to other people only according to the visibility controls you select. Content marked public may be seen, copied or shared beyond your follower list. Private training records are not turned into public posts without your action.

7. International transfers

Daystrong is configured to use Appwrite's Frankfurt region. Some providers or support operations may nevertheless process information in other countries. Where a destination does not provide recognized adequate protection, we use an available legal safeguard such as approved standard contractual clauses and supplementary measures where appropriate.

8. Retention

Account and training information is retained while your account is active. Content reports, security logs and support records are kept only as long as reasonably needed for moderation, security, troubleshooting and legal claims. Billing records may be kept for statutory accounting periods. Account deletion removes or anonymizes personal data unless continued retention is legally required or necessary to establish, exercise or defend legal claims.

9. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or an objection to processing, and you may withdraw consent. You may also complain to the Swiss Federal Data Protection and Information Commissioner or the competent supervisory authority where you live. We may need to verify your identity before completing a request.

10. Security, children and changes

We use technical and organizational safeguards designed to protect personal information, but no service can promise absolute security. Daystrong is not intended for children under 16. Users below the age of legal majority must have permission from a parent or legal guardian where required. We may update this policy and will communicate material changes through the service or by email where appropriate.