Strive Up logo
Strive Up

Privacy Policy

Information on how your personal data is processed.

This English version is provided for your convenience only. In the event of any discrepancy, the German version is the legally binding one.

Privacy policy for the “Strive Up” app

1. Controller

David Marquardt
Schmidt-Barrien-Weg 15
28307 Bremen
Germany
Email: david.marquardt@outlook.de

2. General information

The “Strive Up” app works without a user account by default: training data is initially stored exclusively on your device. In addition, there are optional features that require processing on my server — in particular a user account, synchronisation of training data across devices and paid subscriptions (Premium). If you do not use these features, your data never leaves your device. Processing is limited to what is technically necessary.

3. Access to photos

The app allows users to:

  • take or select photos
  • store them locally on the device
  • add an overlay to photos
  • share photos via social media apps

Important:

  • Photos are stored exclusively on your device.
  • They are never transmitted to the provider.
  • The provider has no access to photos or other content.
  • There is no automatic sharing of any kind.
  • When sharing via social media, the privacy policy of the respective provider applies.

4. User account

An account is required for cloud synchronisation and subscriptions. In that case I process:

  • email address
  • password (only as a cryptographic hash, never in plain text)
  • optionally a display name of your choosing
  • with “Sign in with Apple” or “Sign in with Google”: the user identifier and email address transmitted by that provider
  • technical session data (login token, time of last use)

The legal basis is Art. 6(1)(b) GDPR (performance of the usage contract). To protect against automated login attempts, your IP address is processed briefly in memory and is not stored permanently (Art. 6(1)(f) GDPR).

I send emails to the address on file to confirm the address and to reset your password. No other emails, in particular no advertising, are sent.

These emails are sent using Resend (Resend, Inc., USA). The recipient address and the content of the message are transmitted for this purpose, and technical log data is generated for delivery. Sending is configured so that processing takes place in the European Union (Ireland region). As the company is based in the USA, a transfer to the USA may occur; it is made on the basis of standard contractual clauses (Art. 46(2)(c) GDPR). The legal basis is Art. 6(1)(b) GDPR. Further information: resend.com/legal/privacy-policy.

5. Cloud synchronisation of training data

If you use synchronisation, the content you record in the app is stored on my server so that it is available across several devices. This includes workouts and sessions, exercises and sets, training plans and templates, skills and their progress, as well as app settings. Without active synchronisation this data stays on your device.

The server is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The data is processed in Germany. The legal basis is Art. 6(1)(b) GDPR.

6. Community features (friends and feed)

With an account you can become friends with other users and share training data with them. For this I process:

  • your profile: username, display name and an optional short bio. The username is generated automatically from your name or email address when you sign up and can be changed at any time. Your email address itself is never visible to others.
  • friendships and friend requests (who asked whom, when, and whether it was accepted)
  • the content you share: a summary of your workouts (title, time, duration, exercises with set and rep counts and the weight used, muscle groups trained, new personal bests, the training location if you gave one), your records (best value, including added weight where applicable) and a training statistic
  • likes on your friends' workouts and who gave them when
  • who you trained with (only who and when, not where), if you and a friend trained at the same place at the same time or had arranged to meet
  • blocks and reports (see below)

Your workouts are visible to your friends by default; records and statistics are shared only if you switch them on. Each option can be switched off individually in the app under Profile → Public profile. Shared content is visible only to people you are friends with. You appear in search and in friend suggestions only if "Discoverable" is switched on; search works by username only, never by email address. When you switch a sharing option off, I delete the content shared under it from the server immediately.

You can block other users and report users who violate the terms of use. A report contains the usernames of the reported and the reporting user, the reason chosen and an optional message. It is stored on the server and forwarded to me by email for review; I use Resend for sending it (see section 4). The reported user is not told who reported them.

The data is stored on the same server as the synchronisation (Hetzner, Germany). The legal basis is Art. 6(1)(b) GDPR; for handling reports additionally Art. 6(1)(f) GDPR (legitimate interest in a safe community).

7. Location

The app only reads your location while you are using it, never in the background, and only once in each of these cases:

  • Training updates and meetups: when you tell friends you are on your way to or at training, or plan a training with them, you can include your location and a place name. The friends you choose can see it. When the update ends or the meetup is cancelled, I delete location, place name and message immediately; an update that is not ended expires after four hours at the latest.
  • Place leaderboards (only if you take part):when you start a training, the app stores your position once. For each training, the time, position, place name and, per exercise, the total reps and the best set are sent to the server. The server groups trainings within about 150 metres into one place. A place is only shown once at least two people have trained there. Others then see the place name, the leaderboard and, depending on your choice, your name or only "Anonymous". If you take part with your name, people on the leaderboard can send you a friend request. Nobody sees your exact location or individual trainings.
  • Places near you: to show leaderboards near you, the app sends your current location to the server. It is used only for this request and is not stored.

Place leaderboards are off by default. You can switch them off at any time in the app under Profile → Public profile → Place leaderboards; I then delete all trainings stored for them from the server immediately. The position stays stored with your trainings on your device. For the place name the app uses your operating system's location service (Apple or Google).

The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by switching on the feature and allowing location access in the operating system, and which you can withdraw at any time. The data is stored on the server in Germany (Hetzner).

8. Push notifications

If you allow notifications, I store a device token, the platform and your language setting to tell you about things like friend requests, likes, and your friends' training updates and meetups. The content of the notifications also appears in the app's notification list. They are delivered via the Apple Push Notification service (Apple Inc., USA) or Firebase Cloud Messaging (Google Ireland Ltd., Ireland; Google LLC, USA); Apple or Google receive the device token and the text of the notification.

You choose which notifications you get in the app under Settings → Notifications; you can turn them off completely in your system settings. When you log out or delete your account, I remove the device token. The legal basis is Art. 6(1)(b) GDPR. Transfers to the USA are based on the EU-US Data Privacy Framework or standard contractual clauses (Art. 45, Art. 46(2)(c) GDPR).

9. Subscriptions and payments

Purchases are handled exclusively through the Apple App Store or Google Play. I never receive payment data such as credit card numbers.

I use RevenueCat to manage subscriptions (RevenueCat, Inc., 900 Kearny St, San Francisco, CA 94133, USA). Transmitted to RevenueCat are a randomly generated user identifier, the account email address, information about purchase and subscription status (such as the product purchased, term and platform) and technical device information. RevenueCat reports subscription status changes back to my server so that premium features can be unlocked.

The legal basis is Art. 6(1)(b) GDPR. Processing takes place in the USA; the transfer is based on standard contractual clauses (Art. 46(2)(c) GDPR). Further information: revenuecat.com/privacy.

10. Usage analytics (with your consent only)

To understand which features of the app are actually used and where people get stuck, I use the analytics service PostHog (PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA). Collection happens only after your explicit consent. As long as you have not agreed, no analytics client is started and no analytics data leaves your device.

With your consent, the following is recorded:

  • which areas of the app you open, and in what order
  • actions in the form of predefined events (e.g. „workout started“, „onboarding completed“, „language changed“)
  • app launch, backgrounding and updates, along with the app version
  • operating system and its version, and the device language setting
  • a randomly generated identifier used to recognise the device across sessions; for signed-in users additionally the internal account number

Explicitly not recorded:

  • your training content — no exercises, sets, repetitions, weights, skills or progress values
  • text you enter yourself, such as custom exercise or template names; events contain only predefined labels, numbers and identifiers
  • your name and email address
  • your IP address: the app instructs PostHog to discard it ($ip: null), and IP-based location lookup is disabled
  • device model, device name, manufacturer and time zone — these are stripped before sending
  • screen recordings or screenshots (session replay is disabled)

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, in the app under Settings → Privacy → Anonymous usage statistics. On withdrawal, collection stops immediately and the identifier stored on your device is deleted. The lawfulness of processing carried out until then remains unaffected.

Processing takes place on servers in the European Union (Frankfurt am Main, „PostHog Cloud EU“). As PostHog is based in the USA, access from the USA cannot be ruled out in the course of maintenance and support; such access is covered by a data processing agreement and standard contractual clauses (Art. 46(2)(c) GDPR). Further information: posthog.com/privacy. Analytics data is deleted automatically once the retention period configured in PostHog expires.

11. No advertising

Independently of the usage analytics described above, the app:

  • contains no advertising
  • creates no user profiles for advertising purposes
  • uses no advertising SDKs and no cross-app tracking
  • does not pass data to third parties for advertising purposes
  • uses no advertising identifier (IDFA / Advertising ID)

12. Platform-related data processing

When downloading via the Google Play Store or the Apple App Store, the respective platform operators may process technical data (e.g. IP address, device information). I have no influence over this processing. The privacy policy of the respective platform operator applies.

13. Retention and deletion

Without a user account, all content remains on your device until you delete it there.

I store account data, synchronised content and the data of the community features (profile, friendships, shared content, likes, place leaderboards, blocks and reports) for as long as the account exists. You can delete your account yourself in the app at any time; the associated data on the server is removed in the process. Data required to meet statutory retention obligations is not affected by this. Subscription data held by Apple, Google and RevenueCat is subject to those providers' own retention periods.

14. Your rights as a data subject

Under the GDPR you have the following rights:

  • access (Art. 15 GDPR)
  • rectification (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • lodging a complaint with a data protection supervisory authority

An informal message to the email address above is enough for any request. If you use the app without an account, these rights are limited to the content stored locally on your device, since I hold no data about you beyond that.

15. Version

Last updated: October 2026