Privacy Policy — Workomp

Privacy Policy

Version 1.1 — last updated 2026-09-21

Workomp (the "app") is published by David Calonne, France ("we"). This policy explains what data we process, why, and what your rights are, in accordance with the EU General Data Protection Regulation (GDPR).

1. Data controller

David Calonne — contact: contact@davidcalonne.fr.

2. Data we process

Account: email address (encrypted on our servers), Apple or Google identifier (sign-in is only available through those services), time zone, language, unit system.

Companion and progress: your companion's name and colour, experience, level, streak, virtual coins, owned cosmetics, active boosts.

Training: planned days, sessions (dates, status, declared duration and intensity), exercises and sets you enter (reps, weights, distances, durations), computed personal records.

Purchases: if you buy a subscription or coins, Apple processes the payment; we receive from RevenueCat a transaction identifier, the product purchased and validity dates. We never receive your payment details.

Technical data: API logs (date, route, response code, IP address used temporarily for rate limiting), session tokens, and — if you enable them — a push notification token.

Apple Health (optional): if you enable the integration in the settings, the app writes your checked-in sessions as workouts to Apple Health and reads your active energy during a session to pre-fill a form. This Health data stays on your device: it is never sent to our servers or to third parties, and you can revoke access at any time in Settings → Health. Only the calorie value you confirm in the form is saved with your session, like a manual entry.

We collect no location data and no contacts, and we use no advertising trackers.

3. Purposes and legal bases

  • Providing the service (performance of the contract): account, plan, sessions, companion, statistics, shop.
  • Securing the service (legitimate interest): authentication, rate limiting, technical logs.
  • Purchases and subscriptions (performance of the contract): applying the benefits you bought.
  • Notifications (consent, revocable in your phone settings).

4. Recipients and processors

  • Railway Corporation (serveurs en Union européenne, région Pays-Bas): hosting of the API and database.
  • Apple: app distribution, Sign in with Apple, payments.
  • RevenueCat: in-app purchase and subscription management.
  • Google: only if you choose "Sign in with Google".

We never sell or rent your data. No transfer outside the European Union takes place except as implied by Apple, RevenueCat and Google services, which are covered by their own safeguards (standard contractual clauses).

5. Retention

Your data is kept as long as your account exists. When you delete your account from the app (Profile → Delete my account), all of your data (account, companion, sessions, exercises, purchase records held by us) is deleted immediately and permanently. Technical logs are kept for at most 30 days. Purchase receipts remain with Apple under its own rules.

6. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection. You can exercise them directly in the app (profile edits, account deletion) or by writing to contact@davidcalonne.fr. You may also lodge a complaint with your data protection authority (in France, the CNIL — www.cnil.fr).

7. Security

Encrypted transport (HTTPS), email addresses encrypted at rest (AES-256-GCM), short-lived and revocable session tokens, restricted database access.

8. Minors

The app is intended for people aged 16 and over.

9. Changes

We may update this policy; the current version, with its date, is always available in the app. We will inform you in the app of any significant change.