Privacy Policy

Last updated: March 27, 2026

APEX Training ("we", "us", "our") operates the APEX: CrossFit & HYROX Training mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Full name
• Email address
• Password (stored in hashed form by Firebase Authentication; we never have access to your plaintext password)

1.2 Profile and Training Data

During onboarding and app use, we collect information to generate your personalized training plan:

• Demographics: Gender, age bracket, height
• Sport preferences: Sport focus (CrossFit, HYROX, or Hybrid), race format, target event and date
• Training profile: Ambition level, available training days, equipment access
• Health information: Injuries or physical limitations you choose to disclose (optional free-text field)
• Performance data: 5K run time, HYROX station times or CrossFit benchmark scores, previous race finish times, goal times

1.3 Workout and Activity Data

When you use the App to train, we collect:

• Workout completion status and timestamps
• Exercise performance (sets, reps, weight, duration)
• Rate of Perceived Exertion (RPE) scores
• Personal notes you add to workouts

1.4 Subscription Information

We collect subscription status (active, expired, trial, or cancelled), plan type, and expiration date. Actual payment processing is handled entirely by Apple through the App Store. We do not collect or store your payment card details.

1.5 Attribution Data

We optionally collect how you discovered our App (e.g., social media, friend referral, App Store) and any referral codes you enter.

1.6 Information We Do NOT Collect

• Precise location or GPS data
• Contacts or address book
• Photos, camera, or microphone access
• Device advertising identifier (IDFA)
• Data from Apple Health or HealthKit
• Browsing history

We do not use analytics tracking SDKs. Firebase Analytics is explicitly disabled in our configuration.

2. How We Use Your Information

3. How We Share Your Information

We share your data with the following third-party service providers, solely to operate the App:

We do not sell your personal information to third parties. We do not share data for advertising purposes.

4. AI-Generated Training Plans

We use Anthropic's Claude AI to generate your personalized training plan. When a plan is created, your profile data (sport focus, demographics, performance baselines, injuries/limitations, goals, and available equipment) is sent to Anthropic's API over an encrypted connection. This data is used solely to generate your plan and is subject to Anthropic's Privacy Policy. The AI does not retain your personal data between plan generation requests.

5. Data Storage and Security

• Storage location: Your data is stored in Google Cloud Firestore servers in the Europe (eur3) region.
• Encryption: All data is encrypted in transit (TLS/HTTPS) and at rest (Google Cloud encryption).
• Access control: Firestore security rules ensure you can only access your own data. No other user can read or modify your profile, workouts, or training plans.
• Passwords: Stored using Firebase Authentication's secure hashing. We never have access to plaintext passwords.

6. Data Retention

• Active accounts: Your data is retained for as long as your account is active.
• Workout history: Retained for the lifetime of your account to provide progress tracking.
• Account deletion: When you delete your account, your authentication credentials are immediately removed. Associated Firestore data (profile, plans, workouts) will be deleted within 30 days.
• Subscription records: RevenueCat may retain transaction records as required by Apple and applicable tax regulations.

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update or correct inaccurate personal data.
• Deletion: Request deletion of your personal data and account.
• Portability: Request your data in a machine-readable format.
• Objection: Object to certain processing of your data.
• Restriction: Request that we limit how we use your data.

To exercise any of these rights, contact us at the email below.

7.1 European Economic Area (GDPR)

If you are in the EEA, our legal bases for processing your data are: (a) performance of contract (providing the App and training plans), (b) your consent (optional data like injuries), and (c) legitimate interest (improving the App). Your data is transferred to the United States for processing by Anthropic and RevenueCat. These transfers are protected by standard contractual clauses.

7.2 California (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell personal information.

8. Children's Privacy

The App is not intended for children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected data from a child under 16, please contact us and we will promptly delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the App and updating the "Last updated" date above. Your continued use of the App after changes constitutes acceptance of the updated policy.

10. Contact Us