Privacy Policy — Workomp

Privacy Policy

Version 1.12 — last updated 2026-11-06

Workomp (the "app") is published by David Calonne, France ("we"). This policy explains what data we process, why, and what your rights are, in accordance with the EU General Data Protection Regulation (GDPR).

1. Data controller

David Calonne — contact: contact@workomp.app.

2. Data we process

Account: email address (encrypted on our servers), Apple or Google identifier (sign-in is only available through those services), time zone, language, unit system.

Friends (optional): a random friend code is attached to your account; it never changes and you can share it. When you invite someone, the invited person sees your mascot (name, colour, stage, level, streak, health, outfit); you only see theirs if they accept. Once you are friends, each of you also sees how many sessions the other has done and planned in the current week. If you turn on “Share my schedule” (off by default), your friends also see your sessions for the last 7 days and the next 2 weeks: day, sport, duration and status (planned, done, missed…); you can turn it off at any time. If you also turn on “Include my exercises” (off by default), they also see the exercises of those sessions: sets, reps, weights, durations and distances done, or your plan’s targets for upcoming sessions — never your notes or the reasons you failed a set. Your friends never see your email or your detailed statistics. A friend can send you a cheer (“your session is waiting”), at most one per day: we keep who sent it, to whom and on which day for 7 days, to enforce this limit; you can refuse cheers on the Friends screen. You can decline an invitation, cancel yours or remove a friend at any time. You can also report or block a friend or the sender of an invitation: for moderation, we keep the chosen reason (offensive name, harassment, spam, other — never free text), the date, who reported and who is concerned; a block records who blocked whom, to prevent any new invitation. The blocked person is not told.

Companion and progress: your companion's name and colour, experience, level, streak, virtual coins, owned cosmetics, active boosts, weekly challenges (type, answer, outcome).

Training: planned days, sessions (dates, status, declared duration and intensity), exercises and sets you enter (reps, weights, distances, durations, set type and, if you turn it on, perceived effort), computed personal records and, if you create any (Premium), your goals (exercise, target record, date reached). Coach Worki's suggestions are computed from this data, without collecting anything new.

Purchases: if you buy a subscription or coins, Apple processes the payment; we receive from RevenueCat a transaction identifier, the product purchased and validity dates. We never receive your payment details.

Technical data: API logs (date, route, response code, IP address), used for security and rate limiting, and session tokens. Reminders are local notifications scheduled on your phone. If you allow notifications, we also store your device's notification token (provided by Expo) to tell you about friend invitations and cheers; it is deleted when you sign out or delete your account.

Apple Health (optional): if you enable the integration in the settings, the app writes your checked-in sessions as workouts to Apple Health and reads your active energy during a session to pre-fill a form. This Health data stays on your device: it is never sent to our servers or to third parties (the only exception is the step tier described below, if you turn it on), and you can revoke access at any time in Settings → Health. Only the calorie value you confirm in the form is saved with your session, like a manual entry.

Steps and walking rewards (optional): if you turn on "Steps and walking rewards", the app reads your steps and active energy from Apple Health to display them (home, statistics); these values stay on your device. To credit your coins, it only sends us the tier you reached (5,000, 10,000 or 15,000 steps) and the date — never your exact step count, times or calories. We keep this daily tier with your account. You can turn this off at any time in Profile → Apple Health.

In-app feedback: if you use "Report a bug or an idea", we receive your message, its type, the app and iOS versions and your language, linked to your account so we can reply.

Crash and performance reports: if the app crashes, a technical report is sent to Sentry (device model, iOS and app version, error trace, your user identifier) so that we can fix the problem; on a small share of sessions (10%), performance measurements (screen and request loading times) are sent to it as well. It contains neither your email, nor your IP address, nor your session data; it is kept for 90 days.

workomp.app website: we measure the website's audience (legitimate interest) with GoatCounter, hosted in the European Union (Finland and Germany), without cookies or any storage in your browser: pages viewed, referring site, browser and device type, country, language, and clicks on the download buttons. Your IP address is not kept and nothing allows you to be identified or tracked across sites.

We collect no location data and no contacts, and we use no advertising trackers; the app uses no analytics tools.

3. Purposes and legal bases

  • Providing the service (performance of the contract): account, plan, sessions, companion, challenges, statistics, shop, replies to your feedback.
  • Securing the service (legitimate interest): authentication, rate limiting, technical logs.
  • Purchases and subscriptions (performance of the contract): applying the benefits you bought.
  • Friends (performance of the contract, at your request): invitations, showing progress between friends, cheers and, if you turn it on, sharing your schedule and exercises.
  • Reports, blocks and the filter on names visible to your friends (legitimate interest: protecting users from objectionable content and abuse).
  • Notifications (consent, revocable in your phone settings): local reminders and, if you allow them, friend invitations and cheers.
  • Walking rewards (explicit consent, given by turning on "Steps and walking rewards" and revocable in the same place): daily step tier.

4. Recipients and processors

  • Railway Corporation (serveurs en Union européenne, région Pays-Bas): hosting of the API and database.
  • Apple: app distribution, Sign in with Apple, payments.
  • RevenueCat: in-app purchase and subscription management.
  • Google: only if you choose "Sign in with Google".
  • Sentry (Functional Software, Inc.): receipt of crash and performance reports.
  • Expo (650 Industries, Inc.): delivery of friend notifications (invitations, cheers) to your device (through Apple), if you allow them.

We never sell or rent your data. No transfer outside the European Union takes place except as implied by Apple, RevenueCat, Google, Sentry and Expo services, which are covered by their own safeguards (standard contractual clauses).

5. Retention

Your data is kept as long as your account exists. When you delete your account from the app (Profile → Delete my account), all of your data (account, companion, sessions, exercises, goals, challenges, step tiers, friends, invitations and cheers, reports sent or received and blocks, notification tokens, feedback sent, purchase records held by us) is deleted immediately and permanently. Technical logs are kept for at most 30 days. Purchase receipts remain with Apple under its own rules.

6. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection. You can exercise them directly in the app (profile edits, Profile → Export my data to receive all your data as JSON, account deletion) or by writing to contact@workomp.app. You may also lodge a complaint with your data protection authority (in France, the CNIL — www.cnil.fr).

7. Security

Encrypted transport (HTTPS). Encrypted at rest (AES-256-GCM): email address, exercise comments and failure reasons, messages sent from “Report a bug or an idea”, notification tokens and purchase receipts. Passwords hashed (argon2id), session tokens hashed, short-lived and revocable, restricted database access.

8. Minors

The app is intended for people aged 16 and over.

9. Changes

We may update this policy; the current version, with its date, is always available in the app. We will inform you in the app of any significant change.