Splitmaxx Privacy Policy
Last updated: October 2, 2026 Effective date: September 25, 2026
Splitmaxx is developed by Max Thienel, an individual developer ("we," "us," "the developer"). This Privacy Policy explains what information Splitmaxx ("the app," "Splitmaxx") collects, how it's used, who it's shared with, and the choices you have.
This policy applies to the Splitmaxx iOS app (bundle ID com.splitmaxx.app) and splitmaxx.com.
1. Information We Collect
| Data | How it's collected | Where it's stored | Why we collect it |
|---|---|---|---|
| Email address | You provide it at sign-up (email/password, Sign in with Apple, or Sign in with Google) | Supabase Auth | Creating your account, logging you in, password resets |
| Password | You provide it, only if you sign up with email/password | Supabase Auth, stored hashed. We never see or store your plaintext password | Logging you in |
| Display name | You enter it, or we pull it from your Apple/Google profile at sign-up | Supabase (profiles table) | Shown to other users if you join a callout |
| Workout data (exercises, sets, reps, weight, dates) | You enter it in the app | Primarily stored only on your device; if you enable cloud backup, an encrypted-in-transit copy is stored in Supabase Storage | The core function of the app: logging and tracking your workouts. Cloud backup lets you recover your data if you switch devices |
| Callout data (which callouts you're in, your standings, results and head-to-head records) | Calculated automatically from your workout data when you join a callout | Supabase, visible only to other members of that same callout | Powers callouts (friend competitions on a lift) |
| Push notification token | Generated by your device if you allow notifications and are signed in | Supabase (push_tokens table) | Sending you callout alerts (when you're called out, and Overtakes when someone passes you). Removed when you sign out or delete your account. |
| Share cards | Created when you choose Share on a workout, a callout result, or a rival moment | A PNG image in a public Supabase Storage bucket, plus a database record of the stats shown on it (exercise, weight, reps, streak, callout standings) | Letting you share an image or link outside the app. Anyone who has the link or image URL can view it, without an account. |
| Step count and motion activity | Your device's motion sensor and Apple Health, only if you grant the permission | Stays on your device. We do not transmit or receive this data | Showing your step count and alerting you when you reach your daily step goal |
| Apple Health data (steps, sleep, heart rate, resting heart rate, heart rate variability) | Read from Apple HealthKit, only if you grant the permission | Stays on your device. It is processed on the device, is not included in cloud backups, and is never uploaded to us or any provider | Showing your step count and the Recovery, Sleep and Heart Rate Zones widgets |
| Subscription and purchase information (which plan you bought, purchase and renewal dates, free-trial, cancellation and refund status) | Automatically, when you subscribe to Splitmaxx Premium through Apple In-App Purchase | Apple; RevenueCat (our subscription service); and Supabase, which keeps your current subscription status (plan, status, renewal date, whether it's a test purchase) and a log of subscription event types and dates | Unlocking Premium features, keeping your access in sync across devices, and restoring purchases |
| Analytics events (which screens and features you use, including viewing the Premium screen and starting, completing or cancelling a purchase) | Automatically, and when you take certain actions in the app | PostHog (analytics provider, U.S. region) | Understanding how the app is used so we can improve it. We send PostHog only an internal, app-generated ID, never your name or email. |
| Crash, error and performance reports | Automatically, if the app crashes or hits an error, and timing data for a sample of app sessions | Sentry (crash-reporting provider), tagged with your internal, app-generated ID | Finding and fixing bugs and slow screens. Stack traces occasionally contain incidental technical values from the app's code; we don't deliberately log personal information to Sentry. |
| Transactional emails (account confirmation, password reset) | Sent automatically when you take an action that requires one | Delivered via Resend, which sees only the recipient email address and the email's content | Sending you the emails you'd expect from an account (confirmations, password resets) |
| IP address (share links and callout invites) | Automatically, when a share-card link or callout invite is opened | Supabase, not linked to your account | Limiting repeated requests to prevent abuse. Not used for anything else |
We do not collect or store your payment card details. Subscriptions are paid through Apple In-App Purchase. Apple handles all payment processing, and neither we nor RevenueCat ever receive your card number or billing address.
We never use your Apple Health data for advertising or marketing, never share it with data brokers or advertisers, and never send it off your device.
2. Permissions the App Requests
- Motion & Fitness: "Allow Splitmaxx to read your step count and motion activity." Used only to show your step count in the app. This data is not transmitted anywhere.
- Health: Used to read steps, sleep, heart rate, resting heart rate and heart rate variability from the Health app (including data synced from Apple Watch or other apps) to show your step count and the Recovery, Sleep and Heart Rate Zones widgets. Splitmaxx only reads this data; it does not write to Health. The data is processed on your device and never leaves it.
- Notifications: Used to tell you when you reach your daily step goal, and to deliver callout alerts (when you're called out, and Overtakes when another member passes you).
Your rest timer can also appear on the Lock Screen and in the Dynamic Island (a Live Activity). It runs on your device and sends no data anywhere.
You can decline or later revoke any of these permissions in your iOS Settings; the step-count display, the Health widgets, step-goal alerts and callout alerts won't work without them.
3. Who We Share Data With
We use a small number of service providers to run the app. We do not sell your personal information, and we do not share it with data brokers or advertisers.
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Authentication, database, and file storage | Your email (hashed password), display name, cloud-backed-up workout data, callout data, push notification token, share-card images and records, and your current subscription status |
| RevenueCat | Managing subscriptions and verifying purchases | Your internal, app-generated ID; your purchase and subscription history from Apple (plan, dates, trial, renewal, cancellation and refund status); and standard device and network information sent by its software (such as IP address, device model, iOS version and App Store country). No name, email or payment card details. |
| PostHog (U.S. region) | Product analytics | An internal user ID and the events you trigger, including Premium screen and purchase events. No name or email |
| Sentry | Crash, error and performance reporting | An internal user ID and automatically captured crash, error and performance data |
| Resend | Sending transactional emails | The recipient email address and the email template content |
| Expo (push notification service), delivering through Apple's push service | Delivering push notifications to your device | Your device's push token and the notification text (for example, "Took back the top spot on Bench Press"). Notification text can include the name of another callout member. |
| Apple (Sign in with Apple) | Authentication | We receive your name and email address (or Apple's private relay email, if you choose to hide your email) to create and log you into your account. We do not request any other Apple account data. |
| Apple (In-App Purchase) | Processing subscription payments | Apple handles all payment processing and card details directly. We receive (through RevenueCat) your subscription status and transaction history, never your card number or billing address. |
| Apple (HealthKit) | Reading fitness data you authorize | Nothing is sent. Health data you grant access to is read and processed on your device only. |
| Google (Google Sign-In) | Authentication | We receive your name, email address, and profile picture to create and log you into your account. We do not request access to any other Google account data (e.g. Drive, Contacts, Calendar), and we do not use this data for advertising. |
Splitmaxx's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Sign-In only to authenticate you. We do not use the data it provides for any other purpose, and we do not transfer it to any third party except the service providers listed above, solely to operate the Service.
Each of these providers may process data on servers located outside your country of residence, including in the United States. Where required by law (for example, for users in the EEA/UK), we rely on appropriate safeguards, such as our providers' standard contractual clauses, for these transfers.
We may also disclose information if required by law, to protect the rights and safety of Splitmaxx or its users, or in connection with a merger, acquisition, or sale of assets (in which case we'll notify you).
4. Your Rights and Choices
Access and export. You can export your workout data as a manual backup file or CSV at any time from within the app.
Deletion. You can delete your account at any time from within the app. Doing so permanently deletes your Supabase authentication record, your cloud-backed-up workout files, your display name, your callout memberships and standings, your push notification tokens, any share-card images you created, and the subscription status and subscription event log we keep. If you created a callout that other people are still in, the callout itself (its name and settings) is passed to another member instead of being deleted, but nothing tying it to you is kept. RevenueCat may keep the purchase records it holds for your account under its own retention policy; email support@splitmaxx.com and we'll ask RevenueCat to delete them.
Deleting your account does not cancel your subscription. Apple keeps billing until you cancel it (see below). The app reminds you of this before you delete your account.
Managing your subscription. You can view, manage, or cancel your subscription at any time in your iOS device's Settings app under [your name] > Subscriptions. We do not process billing or refunds directly. Those are handled by Apple, and refund requests go through Apple (reportaproblem.apple.com).
Share cards. A share card is a public image. Callout cards can show the display names and results of other members of that callout, so only share them if you're comfortable with that. Share cards are kept until you delete your account, at which point the images are deleted. If someone has already saved or reposted a card, we can't remove their copy.
Other rights. Depending on where you live, you may have additional rights over your personal information, such as the right to know what we collect, the right to correct inaccurate data, or the right to object to certain processing (for example, under the EU/UK GDPR or the California Consumer Privacy Act, as amended by the CPRA). To exercise any of these rights, including if you can't sign in to delete your account yourself, contact us at support@splitmaxx.com. We will respond within the timeframe required by applicable law.
We do not sell or "share" (as defined by the CCPA/CPRA) personal information, and we do not use it for cross-context behavioral advertising.
5. Data Retention
We retain your account, workout and subscription data for as long as your account is active. If you delete your account, we delete the data described in Section 4 above. We may retain limited information as required for legal, security, or fraud-prevention purposes.
6. Children's Privacy
Splitmaxx is not directed to children. You must be at least 13 years old to use Splitmaxx if you are in the United States, and at least 16 years old if you are in the European Economic Area or United Kingdom (or the applicable minimum age of digital consent in your EEA country, if different). We do not knowingly collect personal information from anyone younger than these ages. If you believe a child has provided us with personal information, contact us at support@splitmaxx.com and we will delete it.
7. Data Security
We use reasonable technical and organizational measures, including relying on providers like Supabase for authentication and encryption in transit, to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, provide additional notice (such as an in-app notice).
9. Contact Us
Questions, requests, or concerns about this policy or your data? Email support@splitmaxx.com.