Privacy Policy

1. Who We Are

Therox ("we," "us," or "our") operates the Therox mobile application and the website at therox.app (together, the "Service"). The data controller responsible for your personal data is Anirban Das and Vinícius Ferreira Bandeira do Nascimento, joint data controllers operating Therox as individuals resident in Poland, reachable at [email protected].

By creating an account or using Therox, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Website & Waitlist

When you join our waitlist at therox.app, we collect your email address and your confirmation that you are 18 or older, so we can email you about early access and launch. We use this only to contact you about Therox; you can ask us to remove it at any time.

If you choose to tell us where you heard about Therox (optional), we store that answer with your email address, only to learn which channels bring people to the waitlist.

To confirm you own the address, we send a confirmation email and only add you to the list once you click the link in it. To keep the waitlist secure and prevent abuse, we also process limited technical data such as your IP address, retained only as long as necessary for that purpose. We do not use this data for any other reason, and we do not store your location.

2.2 Account Information

• Email address (required for sign-in)
• Password, if you sign up with email, stored as a cryptographic hash. We never store or see your actual password
• If you sign in with Google or Facebook: the email address and basic profile details (such as your name) that the provider shares with us. The provider also learns that you use Therox
• Your first and last name. Challenge members see only your first name and last initial (Section 2.5)
• Profile choices: avatar emblem and colour, units of measurement, and your subscription tier

2.3 Fitness Data You Create

• Exercise folders and video links (your Vault), with any notes you add
• Workout logs (date, duration, muscle groups, exercises, sets, reps and weights, the folder used, optional notes)
• Workout plans and schedules
• AI Form Tracker results (rep counts, scores, per-rep check results and timings)
• Progress: XP and level, achievements, streaks and streak freezes
• Body weight entries and a goal weight, only with your explicit consent, which the app asks for before your first entry. You can withdraw it at any time in Profile › Privacy & data, which deletes every entry and your goal at once

2.4 Camera Data (AI Form Tracker)

When you use the AI Form Tracker, your device camera captures frames that are processed entirely on your device using TensorFlow Lite (MoveNet). No images, video frames, or camera data are ever uploaded or transmitted to us or any third party.

Your video stays on this phone. Keep it to replay for a week, or save it to your gallery. A video you do not keep is deleted from the app when you save the set, and a kept one is deleted from the app after 7 days. A copy you save to your gallery is yours, and Therox never deletes it. From the camera, only the resulting numbers (rep counts, form scores, joint-angle check results) are saved to your account.

2.5 Challenge Data (Gym Rat)

When you join a challenge, limited data is visible to co-members:

• Shared: your first name and last initial (e.g. "Ana S."), avatar and level; your points and activity totals on the leaderboard; and, for each workout during the challenge, its date, duration, muscle groups, optional note and Vault folder name
• Only if you turn on "Share my numbers": the exercises, weights and volume of those workouts. It is off until you choose; the app asks once, the first time you create or join a challenge, and you can change it in your profile
• Never shared: email, AI Form Tracker results, Vault videos, workout plans, body weight, or any other profile data

This boundary is enforced server-side; our API is architecturally unable to return more than these fields to other users.

2.6 Technical Data

• Standard request logs on our servers (such as IP address and user agent), for security and troubleshooting
• If you send feedback from the app, the email is prefilled with your app version, device model and OS version. You can edit it before sending
• Anonymous, aggregated usage events on the website, only if you consent to analytics (see Section 6). The app has no analytics or crash reporting

2.7 What We Do NOT Collect

• Location data (no GPS, no check-ins)
• Health data from wearables or HealthKit/Health Connect
• Biometric identifiers (pose estimation produces geometry, not biometrics)
• Photos, camera frames, or workout video (they stay on your phone; see Section 2.4)
• Contacts, the content of your social accounts, or card details (the App Store or Google Play handles payment)

3. How We Use Your Information

We use your information solely to:

• Provide and maintain the Service
• Email you about early access and launch, if you joined the waitlist
• Learn which channels bring people to the waitlist, if you told us
• Show your stats, history, and streaks on your dashboard
• Show your limited challenge data to co-members (Section 2.5)
• Manage your Pro subscription, billed by the App Store or Google Play and tracked through RevenueCat
• Send essential emails (sign-in and password reset)
• Improve the website through anonymous analytics (with consent)

We do not serve targeted ads, build ad profiles, sell or rent your data, or make automated decisions that affect you.

4. Legal Bases (EU/EEA, GDPR)

• Consent: waitlist signup, account creation, challenge participation, "Share my numbers", analytics
• Explicit consent (Article 9): body weight entries and your goal weight
• Contract: providing the Service you signed up for
• Legitimate interest: essential security and fraud-prevention

You may withdraw consent at any time (Section 8).

5. Third-Party Services

We do not share your data with advertising networks, data brokers, or social media companies.

6. Cookies & Analytics

The website sets no cookies of its own today. Our network provider, Cloudflare, may set a short-lived security cookie, which needs no consent, and counts visits without cookies. Optional analytics (PostHog) are off until you explicitly accept them via our cookie banner, can be declined with no loss of functionality, and can be withdrawn at any time from the footer's Cookie settings. See our Cookie Policy for every cookie by name. We never use advertising cookies.

7. Data Retention & Erasure

We keep your data while your account is active. When you delete your account, in the app (Profile › Delete account) or by emailing us, we erase your personal data within 7 days: the strictest global standard, applied to everyone regardless of location, except where law requires us to retain specific records. Signing back in to the app before then cancels the deletion.

Your challenge entries are erased with your account, so you no longer appear on other members' leaderboards, and a challenge you created is deleted for every member. If you withdraw consent, we erase the data that depends on it within 7 days; withdrawing body weight consent deletes those entries at once.

8. Your Rights

8.1 Everyone

• Access: a copy of the data we hold about you
• Correction: fix inaccurate data
• Deletion: delete your account and associated data, in the app or by email
• Export: your data in a machine-readable format
• Withdraw: leave any challenge or withdraw consent

To exercise any right, email [email protected]. We action deletion requests within 7 days.

8.2 EU/EEA (GDPR)

You also have the right to restrict or object to processing, to data portability, and to lodge a complaint with your local supervisory authority (for us, the Polish Personal Data Protection Office (UODO)).

8.3 California (CCPA/CPRA)

You have the right to know, delete, correct, and to non-discrimination for exercising your rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and never have.

8.4 India (DPDPA 2023)

• Right to access a summary of your personal data and how it is processed
• Right to correction, completion, and erasure
• Right to withdraw consent as easily as it was given; on withdrawal we erase associated data within 7 days
• Right to nominate another person to exercise your rights
• Right of grievance redressal: contact our grievance point at [email protected] before approaching the Data Protection Board of India

9. Age Requirement

Therox is intended only for adults 18 years of age or older. We do not knowingly collect personal data from anyone under 18. If we learn we have, we delete it promptly. If you believe a minor has provided us data, contact [email protected].

10. International Transfers

Your data may be processed in countries other than your own, including the United States, via our infrastructure providers. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses. Our establishment for governing-law purposes is in Poland.

11. Security

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access is restricted by Row Level Security so each user can reach only their own data. Passwords are hashed with bcrypt. No system is perfectly secure, but we apply industry-standard measures and maintain a breach-response plan (notification within 72 hours where required).

12. Changes

We may update this policy. We will post changes here and update the "Last updated" date; material changes will be notified in-app. Continued use after changes constitutes acceptance.

13. Contact

Questions? Email [email protected].