ARZA Privacy Policy

1. Information we collect

1.1 Information you provide to us

• Account data: name, email address, profile photo, and sign-in provider (Apple, Google) when you create your account through our authentication provider.
• Training data: routines, training sessions, completed exercises, reps, sets, rest times, progression evaluations, ARZA Score ratings (Front Lever, Planche, Handstand, Pull, Push), and personal notes.
• Profile data: experience level, training goals, language preferences, and app settings.
• Communications: any message, comment, or inquiry you send us directly.

1.2 Information collected automatically

• Device data: device type, operating system and version, unique device identifiers, system language, and time zone.
• Usage data: pages and features used within the app, time spent, access dates and times, app events, and notification interactions.
• Technical data: IP address, performance data, error logs, and crash diagnostics to keep the service stable.
• Notification tokens: Apple Push Notification Service (APNs) or Firebase Cloud Messaging (FCM) identifiers to send you push notifications.

1.3 Health data (Apple Health)

If you choose to connect Apple Health from the Progress tab, ARZA only reads your daily step count (read-only). This data is processed and stays exclusively on your device: it is never sent to our servers, never shared with third parties, and never used for advertising. ARZA never writes any data to Apple Health. You can revoke access at any time from your iPhone’s Health app → Sharing → Apps → ARZA, without affecting the rest of the app.

1.4 Third-party information

• Payment providers: when you make an in-app purchase, we receive information about your subscription status (active, cancelled, trial) through RevenueCat. The Apple App Store and Google Play process payment data directly; ARZA never receives or stores credit card information or banking credentials.
• Affiliated athletes: if you sign up through an ARZA affiliated athlete’s link, we receive the athlete’s identifier to personalize your initial experience.

2. How we use your information

We use the information we collect to:

• Provide, maintain, and improve the Services.
• Generate personalized training routines through our artificial intelligence engines (Creator and Evolver).
• Calculate and update your ARZA Score based on your progress.
• Adapt routines to your historical performance (longitudinal memory).
• Send push notifications related to your training, reminders, and product updates.
• Process subscriptions, renewals, and cancellations.
• Communicate with you about service changes, technical support, and inquiries.
• Send marketing communications with your consent (which you can withdraw at any time).
• Detect, prevent, and address fraud, abuse, or technical issues.
• Comply with legal obligations and protect our rights.

We do not use automated decision-making that produces legal effects on you.

3. How we share your information

3.1 Service providers

We share strictly necessary information with the following providers, which act under our instructions and are bound by contractual confidentiality and security obligations:

• Clerk (authentication and account management) — United States
• Convex (database and backend) — United States
• RevenueCat (subscription management) — United States
• Apple Inc. / Google LLC (in-app payment processing and push notifications)
• Loops (transactional and marketing email delivery) — United States
• Amazon Web Services / Resend (email infrastructure) — United States
• Vercel (website hosting) — United States
• Cloudflare (content delivery network and mail routing) — United States
• Sentry (error and performance monitoring, if enabled) — United States

3.2 Athletes and community

If you choose to voluntarily share your ARZA Card or your progress, the data shown in that view (score, level, profile photo) will be visible to the recipients you choose. We do not automatically share personal information with affiliated athletes or other users without your explicit consent.

3.3 Legal compliance

We may disclose information when we are legally required to do so, for example in response to a court order, subpoena, tax authority request, or fraud investigation.

3.4 Corporate changes

In the event of a merger, acquisition, or sale of assets, personal information may be transferred to the successor, who will remain bound by this same Privacy Policy or will notify you in advance of any changes.

We do not sell your personal information to third parties under any circumstances.

4. Health and physical activity data

ARZA is a fitness and training app. Data related to your physical activity (routines, exercises, performance metrics) is used exclusively to personalize your training experience within the app.

Important: ARZA is not a medical service and does not provide medical advice. Data generated by ARZA is not shared with healthcare professionals, insurers, or other parties related to medical services. We recommend consulting a healthcare professional before starting any training program.

ARZA offers an optional integration with Apple Health to read your daily step count, which you can enable from the Progress tab. As detailed in section 1.3, that data is processed and stays exclusively on your device, is never sent to our servers, and ARZA never writes data to Apple Health. We do not currently integrate with Google Fit; if we enable that or other integrations in the future, we will ask for your explicit consent before any data exchange.

5. Your rights

Depending on your jurisdiction, you may have the following rights over your personal data:

5.1 Access

You can request a copy of the personal data we hold about you.

5.2 Rectification

You can request correction of inaccurate or incomplete data.

5.3 Deletion

You can request that we delete your personal data. You can request account deletion through the form at /account-deletion, publicly available without needing to sign in. Once deletion is confirmed, your data will be kept for a maximum of 30 days for recovery purposes, then permanently deleted, except where the law requires us to retain it.

5.4 Portability

You can request a copy of your data in a structured, machine-readable format.

5.5 Objection and restriction

You can object to the processing of your data or request its restriction under certain circumstances.

5.6 Withdrawal of consent

Where processing is based on your consent (for example, marketing), you can withdraw it at any time without affecting the lawfulness of prior processing.

5.7 Specific jurisdictions

• European Union (GDPR): you have the rights described above under the General Data Protection Regulation. You can file a complaint with your local data protection authority.
• California (CCPA/CPRA): you have the right to know what personal information we collect, to delete it, to correct it, and not to be discriminated against for exercising your rights. We do not sell or share personal information as defined by the CCPA/CPRA.
• Chile (Law 19.628 and Law 21.719): you have the right of access, rectification, cancellation, and objection under Chilean personal data protection legislation.
• Brazil (LGPD): you have the rights guaranteed by Brazil’s General Data Protection Law.

5.8 How to exercise your rights

Send an email to admin@arzacalisthenics.com stating your request and the email address associated with your ARZA account. We will respond within the applicable legal timeframes (typically 30 days).

6. Security

We implement technical and organizational measures to protect your information:

• Encryption in transit: all communications between the app, the website, and our servers use HTTPS/TLS.
• Encryption at rest: data stored in our databases is encrypted.
• Authentication: we use leading authentication providers (Clerk) with modern security practices, including passwordless sign-in and optional multi-factor authentication.
• Restricted access: only authorized personnel have access to personal data, and only when necessary.
• Monitoring: we continuously monitor our systems to detect suspicious activity or vulnerabilities.

No internet transmission or electronic storage system is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Data retention

We retain your personal information for as long as your account is active or as needed to provide you the Services. When you delete your account:

• Identifiable data is deleted within 30 days of deletion confirmation.
• Aggregated, anonymized data may be retained for statistical purposes.
• We retain information when necessary to comply with legal obligations (for example, accounting records, tax requirements) under applicable legal timeframes.

8. Children’s privacy

ARZA is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13 without verified parental consent, we will delete that information as soon as possible.

Users between 13 and 17 years old must use ARZA with the consent of a parent or legal guardian.

If you believe a child under 13 has provided us with personal information, contact us at admin@arzacalisthenics.com.

9. International data transfers

ARZA operates from Chile and uses providers located primarily in the United States. By using the Services, you consent to the transfer of your information to these countries, which may have different data protection laws than your country of residence.

For transfers from the European Union, we rely on the Standard Contractual Clauses approved by the European Commission or other valid legal mechanisms.

10. Cookies and similar technologies

The ARZA mobile app does not use cookies, since it is a native app.

Our website arzacalisthenics.com may use cookies strictly necessary for the site to function (for example, session management). We do not use advertising or cross-site tracking cookies.

11. Changes to this policy

We may update this Privacy Policy periodically. When we make significant changes, we will notify you through the app, by email, or by posting a prominent notice on arzacalisthenics.com before the changes take effect. The “Last updated” date at the top of this policy reflects the current version.

We recommend reviewing this policy periodically.

12. Contact us

If you have questions, comments, or requests about this Privacy Policy or about the processing of your personal data, contact us: