Privacy Policy
What we collect
Account data. If you sign in with Apple or Google we receive an account identifier and, where you allow it, your email address. You can use the app as a guest without signing in.
Training profile. Your race target (date, city and race type), division, goal finish time, how many days a week you train, the equipment you have, and your training background. This includes your age, gender, your weekly running volume, and recent times you enter such as a 5K or a previous HYROX result. Some of this counts as health and fitness data.
Training activity. Which workouts you started and completed, and when.
Subscription status. Whether you have an active ROXER Pro entitlement, and the purchase events Apple sends us through RevenueCat. We never see your card details.
Notifications. If you opt into workout reminders, a push token for your device.
Crash reports. ROXER contains no third-party analytics or crash-reporting SDK. If you have turned on Share With App Developers in iOS Settings → Privacy & Security → Analytics & Improvements, Apple sends us aggregated crash and performance reports. That is controlled by you in iOS, not by us.
This website. Separate from the app — see The website below.
We do not sell your data, and we do not use it for third-party advertising.
Why we use it
- To generate and adjust your training plan.
- To keep your plan and progress across devices when you have an account.
- To unlock and restore your subscription.
- To send workout reminders you have opted into.
- To fix crashes and keep the app working.
Who processes it for us
- Supabase — database, authentication and the server functions that build your plan.
- Apple — sign-in, subscription purchases, and the crash reports you have opted into sharing.
- Google — sign-in, if you choose to sign in with Google.
- RevenueCat — subscription entitlement management. Receives your account identifier and Apple’s purchase events.
- Cloudflare — hosting and analytics for this website.
- OpenAI — writes the personalised wording on your plan. What we send is listed below.
What we send to OpenAI
Your plan’s structure — the weeks, the sessions and the exercises — is built by our own code from a curated training library. One bounded request then asks a model to write the plan title, the summary, and coaching notes for the first four weeks. That request contains:
- Your division, goal, race intent, running tier, station familiarity, and the weakness you selected.
- The shape of the plan: its mode, its total length in weeks, and how many days a week you train.
- Your race city, target date and race type.
- The first four weeks of the plan: week and session titles, exercise names, planned dates and target effort.
It does not contain your name, your email address, your account identifier, your age, your gender, or any body metrics. The request is sent with storage disabled, so OpenAI does not retain it and does not use it to train models.
Keeping it
We keep your data for as long as your account exists.
When you delete your account, a server-side function removes your profile, training profile, race targets, every plan, week, phase, scheduled workout and prescription, your session history, your notification preferences and push tokens, and your subscription records — immediately and permanently. It is not a soft delete, there is nothing to restore, and we do not keep scheduled database backups from which it could be recovered.
Apple keeps its own record of your purchase, and RevenueCat may retain aggregate, de-identified subscription events. Neither is linked back to a deleted account.
Your rights
Depending on where you live you can request access to your data, correction, deletion, or export. Canadian users have these rights under PIPEDA; users in the UK and EEA have them under the UK GDPR and GDPR. Email support@getroxer.com and we will respond within 30 days.
You can delete everything yourself from inside the app — see Delete your account.
Children
ROXER is not intended for anyone under 16. We do not knowingly collect data from children.
The website
This site sets no cookies and does not track you across other sites.
- Cloudflare Web Analytics gives us aggregate page-view counts. It is cookieless, does not fingerprint you, and does not build a profile of you — which is why there is no consent banner.
- Google Fonts serves the site’s typeface, which means Google receives your IP address when a page loads. We are moving this to self-hosted fonts.
Contact
Tymur Levtsun, 608 - 30 Roehampton Ave, Ontario, Canada — support@getroxer.com.