Splitmaxxsplitmaxx Privacy Policy
Last updated: September 13, 2026 Effective date: September 14, 2026
splitmaxx is developed by Max Thienel, an individual developer ("we," "us," "the developer"). This Privacy Policy explains what information splitmaxx ("the app," "splitmaxx") collects, how it's used, who it's shared with, and the choices you have.
This policy applies to the splitmaxx iOS app (bundle ID com.splitmaxx.app) and splitmaxx.com.
1. Information We Collect
| Data | How it's collected | Where it's stored | Why we collect it |
|---|---|---|---|
| Email address | You provide it at sign-up (email/password, Sign in with Apple, or Sign in with Google) | Supabase Auth | Creating your account, logging you in, password resets |
| Password | You provide it, only if you sign up with email/password | Supabase Auth, stored hashed; we never see or store your plaintext password | Logging you in |
| Display name | You enter it, or we pull it from your Apple/Google profile at sign-up | Supabase (profiles table) | Shown to other users if you join a shared ladder |
| Workout data (exercises, sets, reps, weight, dates) | You enter it in the app | Primarily stored only on your device; if you enable cloud backup, an encrypted-in-transit copy is stored in Supabase Storage | The core function of the app: logging and tracking your workouts; cloud backup lets you recover your data if you switch devices |
| Ladder data (which ladder you're in, your standings) | Calculated automatically from your workout data when you join a ladder | Supabase, visible only to other members of that same ladder | Powers the friend leaderboard ("ladder") feature |
| Motion / step count | Your device's motion sensor, only if you grant the permission | Stays on your device; we do not transmit or receive this data | Displaying your step count in the app |
| Analytics events (which screens and features you use) | Automatically, and when you take certain actions in the app | PostHog (analytics provider, U.S. region) | Understanding how the app is used so we can improve it. We send PostHog only an internal, app-generated ID, never your name or email. |
| Crash and error reports | Automatically, if the app crashes or hits an error | Sentry (crash-reporting provider) | Finding and fixing bugs. Stack traces occasionally contain incidental technical values from the app's code; we don't deliberately log personal information to Sentry. |
| Transactional emails (account confirmation, password reset) | Sent automatically when you take an action that requires one | Delivered via Resend, which sees only the recipient email address and the email's content | Sending you the emails you'd expect from an account (confirmations, password resets) |
We do not collect payment information. splitmaxx is currently a free beta with no in-app purchases or subscriptions.
2. Permissions the App Requests
- Motion & Fitness: "Allow splitmaxx to read your step count and motion activity." Used only to show your step count in the app. This data is not transmitted anywhere.
- Notifications: Used to alert you when a rest timer finishes while the app is in the background.
You can decline or later revoke either permission in your iOS Settings; the app's step-count display and background rest-timer alerts won't work without them.
3. Who We Share Data With
We use a small number of service providers to run the app. We do not sell your personal information, and we do not share it with data brokers or advertisers.
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Authentication, database, and file storage | Your email (hashed password), display name, cloud-backed-up workout data, ladder data |
| PostHog (U.S. region) | Product analytics | An internal user ID and the events you trigger (no name or email) |
| Sentry | Crash and error reporting | Automatically-captured crash/error data |
| Resend | Sending transactional emails | The recipient email address and the email template content |
| Apple (Sign in with Apple) | Authentication | Handled per Apple's own privacy terms |
| Google (Google Sign-In) | Authentication | Handled per Google's own privacy terms |
Each of these providers may process data on servers located outside your country of residence, including in the United States. Where required by law (for example, for users in the EEA/UK), we rely on appropriate safeguards, such as our providers' standard contractual clauses, for these transfers.
We may also disclose information if required by law, to protect the rights and safety of splitmaxx or its users, or in connection with a merger, acquisition, or sale of assets (in which case we'll notify you).
4. Your Rights and Choices
Access and export. You can export your workout data as a manual backup file or CSV at any time from within the app.
Deletion. You can delete your account at any time from within the app. Doing so permanently deletes your Supabase authentication record and your cloud-backed-up workout files.
Known limitation (please read): if you have ever joined a ladder, deleting your account does not yet automatically remove your ladder membership, standings, or display-name records from our systems (ladders, ladder_members, ladder_entries, and your profiles display-name row). This data may remain visible to other members of ladders you were part of after you delete your account. We are working to close this gap. If you want this ladder-related data removed immediately, email support@splitmaxx.com and we will manually remove it.
Other rights. Depending on where you live, you may have additional rights over your personal information, such as the right to know what we collect, the right to correct inaccurate data, or the right to object to certain processing (for example, under the EU/UK GDPR or the California Consumer Privacy Act, as amended by the CPRA). To exercise any of these rights, contact us at support@splitmaxx.com. We will respond within the timeframe required by applicable law.
We do not sell or "share" (as defined by the CCPA/CPRA) personal information, and we do not use it for cross-context behavioral advertising.
5. Data Retention
We retain your account and workout data for as long as your account is active. If you delete your account, we delete the data described in Section 4 above (subject to the known limitation described there). We may retain limited information as required for legal, security, or fraud-prevention purposes.
6. Children's Privacy
splitmaxx is not directed to children. You must be at least 13 years old to use splitmaxx if you are in the United States, and at least 16 years old if you are in the European Economic Area or United Kingdom (or the applicable minimum age of digital consent in your EEA country, if different). We do not knowingly collect personal information from anyone younger than these ages. If you believe a child has provided us with personal information, contact us at support@splitmaxx.com and we will delete it.
7. Data Security
We use reasonable technical and organizational measures (including relying on providers like Supabase for authentication and encryption in transit) to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, provide additional notice (such as an in-app notice).
9. Contact Us
Questions, requests, or concerns about this policy or your data? Email support@splitmaxx.com.
This policy does not yet cover Apple Watch/HealthKit data or paid subscriptions, because splitmaxx does not currently offer either. This policy will be revised before either feature launches.