Valens — Privacy Policy

Last updated: 21 June 2026

This Privacy Policy explains how the Valens mobile application ("Valens", "the app", "we", "us") collects, uses, and protects your information. Valens is operated by Matija Veličković. If you do not agree with this policy, please do not use the app.

Questions or requests: valens.gym.app@gmail.com

1. Information we collect

We collect only the data needed to provide the app's features:

Account data — your email address and a username you choose. Authentication and password handling are provided by our backend provider (Supabase); we never store your password in plain text.
Profile data — optional profile photo (avatar), privacy settings, and an optional bodyweight you may log.
Fitness data you create — workouts (exercises, sets, reps, weights, drop sets and notes), routines, personal records, weight logs, and achievements.
Social data — your friends list, friend requests, and any users you block or report.
Device & technical data — a push-notification token, plus your device locale and time zone, used to deliver reminders and notifications.
Purchase data — a record of which premium routines you own (entitlements). Payments are processed by Google Play; we do not receive or store your payment-card details.

2. How we use your information

To create and secure your account and sign you in.
To store, sync and display your training data across your sessions.
To power social features (friends, leaderboard, viewing a friend's activity) according to your privacy settings.
To send notifications and reminders you have enabled.
To grant access to premium routines you have purchased.
To keep the service safe (handling blocks and abuse reports).

3. Legal basis (EU/EEA users)

Where the GDPR applies, we process your data to perform our contract with you (providing the app), on the basis of your consent (e.g. notifications), and for our legitimate interest in keeping the service secure.

4. Sharing & service providers

We do not sell your personal data and we do not share it with third parties for their own marketing. We use the following processors strictly to operate the app:

Supabase — database, authentication, and file storage hosting (servers located in the European Union / Frankfurt).
Google — Google Sign-In (if you choose it), Firebase Cloud Messaging (push notifications), and Google Play Billing (purchases).

These providers process data on our behalf under their own security and privacy terms.

5. Data retention

We keep your data for as long as your account exists. When you delete your account, your personal data and training content are removed from our systems.

6. Your rights & deleting your data

You can access and edit most of your data directly in the app. You can delete your account at any time from Profile → Settings → Delete account, which permanently removes your personal data. You may also email us to request access, correction, or deletion. EU/EEA users have the right to access, rectify, erase, restrict, and port their data, and to lodge a complaint with a supervisory authority.

7. Security

Data is encrypted in transit (HTTPS/TLS). Access to your data is restricted by row-level security rules so that other users can only see what your privacy settings allow.

8. Children

Valens is intended for users aged 18 and over and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

9. International transfers

Your data is stored on servers in the European Union. Some service providers (e.g. Google) may process limited data in other countries under appropriate safeguards.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated "Last updated" date on this page.

11. Contact

Matija Veličković — valens.gym.app@gmail.com