Strive Up logo
Strive Up

Privacy Policy

Information on how your personal data is processed.

This English version is provided for your convenience only. In the event of any discrepancy, the German version is the legally binding one.

Privacy policy for the “Strive Up” app

1. Controller

David Marquardt
Schmidt-Barrien-Weg 15
28307 Bremen
Germany
Email: david.marquardt@outlook.de

2. General information

The “Strive Up” app works without a user account by default: training data is initially stored exclusively on your device. In addition, there are optional features that require processing on my server — in particular a user account, synchronisation of training data across devices and paid subscriptions (Premium). If you do not use these features, your data never leaves your device. Processing is limited to what is technically necessary.

3. Access to photos

The app allows users to:

  • take or select photos
  • store them locally on the device
  • add an overlay to photos
  • share photos via social media apps

Important:

  • Photos are stored exclusively on your device.
  • They are never transmitted to the provider.
  • The provider has no access to photos or other content.
  • There is no automatic sharing of any kind.
  • When sharing via social media, the privacy policy of the respective provider applies.

4. User account

An account is required for cloud synchronisation and subscriptions. In that case I process:

  • email address
  • password (only as a cryptographic hash, never in plain text)
  • optionally a display name of your choosing
  • with “Sign in with Apple” or “Sign in with Google”: the user identifier and email address transmitted by that provider
  • technical session data (login token, time of last use)

The legal basis is Art. 6(1)(b) GDPR (performance of the usage contract). To protect against automated login attempts, your IP address is processed briefly in memory and is not stored permanently (Art. 6(1)(f) GDPR).

I send emails to the address on file to confirm the address and to reset your password. No other emails, in particular no advertising, are sent.

These emails are sent using Resend (Resend, Inc., USA). The recipient address and the content of the message are transmitted for this purpose, and technical log data is generated for delivery. Sending is configured so that processing takes place in the European Union (Ireland region). As the company is based in the USA, a transfer to the USA may occur; it is made on the basis of standard contractual clauses (Art. 46(2)(c) GDPR). The legal basis is Art. 6(1)(b) GDPR. Further information: resend.com/legal/privacy-policy.

5. Cloud synchronisation of training data

If you use synchronisation, the content you record in the app is stored on my server so that it is available across several devices. This includes workouts and sessions, exercises and sets, training plans and templates, skills and their progress, as well as app settings. Without active synchronisation this data stays on your device.

The server is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The data is processed in Germany. The legal basis is Art. 6(1)(b) GDPR.

6. Subscriptions and payments

Purchases are handled exclusively through the Apple App Store or Google Play. I never receive payment data such as credit card numbers.

I use RevenueCat to manage subscriptions (RevenueCat, Inc., 900 Kearny St, San Francisco, CA 94133, USA). Transmitted to RevenueCat are a randomly generated user identifier, the account email address, information about purchase and subscription status (such as the product purchased, term and platform) and technical device information. RevenueCat reports subscription status changes back to my server so that premium features can be unlocked.

The legal basis is Art. 6(1)(b) GDPR. Processing takes place in the USA; the transfer is based on standard contractual clauses (Art. 46(2)(c) GDPR). Further information: revenuecat.com/privacy.

7. Usage analytics (with your consent only)

To understand which features of the app are actually used and where people get stuck, I use the analytics service PostHog (PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA). Collection happens only after your explicit consent. As long as you have not agreed, no analytics client is started and no analytics data leaves your device.

With your consent, the following is recorded:

  • which areas of the app you open, and in what order
  • actions in the form of predefined events (e.g. „workout started“, „onboarding completed“, „language changed“)
  • app launch, backgrounding and updates, along with the app version
  • operating system and its version, and the device language setting
  • a randomly generated identifier used to recognise the device across sessions; for signed-in users additionally the internal account number

Explicitly not recorded:

  • your training content — no exercises, sets, repetitions, weights, skills or progress values
  • text you enter yourself, such as custom exercise or template names; events contain only predefined labels, numbers and identifiers
  • your name and email address
  • your IP address: the app instructs PostHog to discard it ($ip: null), and IP-based location lookup is disabled
  • device model, device name, manufacturer and time zone — these are stripped before sending
  • screen recordings or screenshots (session replay is disabled)

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, in the app under Settings → Privacy → Anonymous usage statistics. On withdrawal, collection stops immediately and the identifier stored on your device is deleted. The lawfulness of processing carried out until then remains unaffected.

Processing takes place on servers in the European Union (Frankfurt am Main, „PostHog Cloud EU“). As PostHog is based in the USA, access from the USA cannot be ruled out in the course of maintenance and support; such access is covered by a data processing agreement and standard contractual clauses (Art. 46(2)(c) GDPR). Further information: posthog.com/privacy. Analytics data is deleted automatically once the retention period configured in PostHog expires.

8. No advertising

Independently of the usage analytics described above, the app:

  • contains no advertising
  • creates no user profiles for advertising purposes
  • uses no advertising SDKs and no cross-app tracking
  • does not pass data to third parties for advertising purposes
  • uses no advertising identifier (IDFA / Advertising ID)

9. Platform-related data processing

When downloading via the Google Play Store or the Apple App Store, the respective platform operators may process technical data (e.g. IP address, device information). I have no influence over this processing. The privacy policy of the respective platform operator applies.

10. Retention and deletion

Without a user account, all content remains on your device until you delete it there.

I store account data and synchronised content for as long as the account exists. You can delete your account yourself in the app at any time; the associated data on the server is removed in the process. Data required to meet statutory retention obligations is not affected by this. Subscription data held by Apple, Google and RevenueCat is subject to those providers' own retention periods.

11. Your rights as a data subject

Under the GDPR you have the following rights:

  • access (Art. 15 GDPR)
  • rectification (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • lodging a complaint with a data protection supervisory authority

An informal message to the email address above is enough for any request. If you use the app without an account, these rights are limited to the content stored locally on your device, since I hold no data about you beyond that.

12. Version

Last updated: July 2026