App Privacy Policy.
Last updated: November 8, 2026. This policy explains how personal data are processed when you use the BroCracy training service through a web browser, as an installed progressive web app (PWA), or through the BroCracy app for iOS. It covers your BroCracy account and fitness-tracking features. Our separate Website Privacy Policy applies to the public BroCracy website and its inquiry forms.
1. Controller and privacy contact
Dr. Eduard Anton
BroCracy
Georg-Schmitt-Weg 20
96106 Ebern
Germany
Email: hellobro@brocracy.com
Please use this address for questions about processing, requests to access or delete data, or to exercise your privacy rights.
2. Data we process
2.1 Accounts and authentication
When you create or use an account, we process your email address, account identifier, account creation and verification status, authentication and recovery information, and technical security information needed for sign-in. Authentication credentials are handled by Supabase Auth; the app does not store your password in plain text as a workout or profile record. We use your email to verify your account, facilitate password recovery and communicate about account-related matters.
2.2 Training and exercise information
We process the exercises and training sessions you record, including training dates and times, equipment, exercise names, muscle-group assignments, sets, loads, repetitions, repetitions in reserve (RIR), notes and related performance measurements. We also maintain an exercise library; exercises you create or customize are associated with your account.
2.3 Body, cardio and profile information
Depending on what you choose to enter, this may include your date of birth, height, sex as selected for calculation purposes, bodyweight, nutrition or calorie entries, step counts, activity level, running or other cardio activities, distance, duration, heart rate, elevation, power, cadence, perceived effort and related notes. We use these entries to calculate and display progress, training volume, estimated strength, trends and estimated energy expenditure. Estimates are not medical assessments.
2.4 Preferences and device information
We process settings such as preferred measurement units and other profile preferences. Some display preferences and Bro HQ selections can also be held on your device using browser storage or equivalent local app storage. Technical information such as IP address, time of access, device/browser characteristics, request information and security events may be processed by our hosting and authentication providers to operate and protect the service.
2.5 Optional Bro League sharing
Bro Leagues are optional, invitation-based groups with up to 20 members per league. Creating or joining a league requires an affirmative selection of a separate league-sharing checkbox, which is initially unchecked when the form loads. Other current members of the league you join can then see your league nickname, eligible performance results for supported standardized exercises (exercise name, recorded load, repetitions and training date, and an estimated one-repetition maximum where relevant), and recent eligible workout activity from the last 14 days, including eligible lifts and personal-record indicators. If attendance sharing is enabled, they can also see your total number of completed workout days in the rolling previous 30 days. League members can post high fives and preset friendly roast reactions, visible with their league nicknames. These records are shown within the joined league, not on a public website leaderboard. Full workout logs, personal training notes, bodyweight, calorie entries, cardio and other body measurements are not shared through the league. Invite links may be forwarded, but joining the league is required to access its member information.
You can stop sharing your 30-day attendance count independently at any time using Stop Sharing Attendance in the league's Commissioner Desk; eligible strength results and recent activity remain visible while you are still a member. To stop sharing those other league results with that league, use Leave League (or Delete League if you are its commissioner). A commissioner can also remove a member. These actions stop further access through the league feature, but cannot reverse information other members have already seen, copied or saved. If you cannot access these controls, contact us using the privacy address in section 1.
3. Why we process data and our legal bases
We process account details, training entries, profile information and service settings to provide and maintain your BroCracy account and requested tracking functions (Article 6(1)(b) GDPR, performance of a contract or steps requested before entering one). We process necessary technical logs, protect accounts, prevent abuse and investigate security incidents based on our legitimate interests in a reliable and secure service (Article 6(1)(f) GDPR). Where processing is legally required, Article 6(1)(c) GDPR may apply. Privacy and support inquiries are handled to respond to your request under Article 6(1)(b), (c) or (f), depending on the circumstances.
Health-related information and consent: Body measurements, heart-rate information and related entries can constitute data concerning health under Article 9 GDPR, depending on their nature and context. As fitness tracking is the core BroCracy service, creating an account requires a separate, initially unchecked checkbox providing explicit consent under Article 9(2)(a) GDPR for the health-related fitness and body information you choose to record for tracking and personal statistics. This is separate from accepting any terms or acknowledging this Privacy Policy. If you do not consent, an account cannot be created. We record the consent-text version, consent status, and timestamp of the affirmative choice to document it. You may withdraw consent at any time through Account & Privacy or by contacting us. Withdrawal does not affect processing lawfully carried out beforehand.
Voluntary league sharing: Participation in a Bro League is optional and subject to a separate affirmative sharing choice under Article 6(1)(a) GDPR. To the extent shared training performance or activity reveals health-related information, we rely on your explicit consent under Article 9(2)(a) GDPR. The separate league choice does not replace the consent for your private training account. You may withdraw league sharing for the future using the controls explained in section 2.5 or by contacting us. Withdrawal does not affect the lawfulness of earlier processing.
4. Who processes the information
Supabase: We use Supabase for account authentication and the database that stores app information. Personal account data are protected using account-scoped access controls. Supabase's data processing information describes its contractual framework.
Vercel: We use Vercel to host and operate the web/PWA service and its backend functions. Vercel processes technical request, performance and security information. See the Vercel Data Processing Addendum.
Resend and email infrastructure: Account verification, password recovery and other essential transactional messages are delivered using Supabase Auth and our configured email-delivery service, Resend. The services process recipient addresses and delivery information needed to send these messages. See Resend's data processing information.
Zoho Mail: If you contact us directly about support or privacy, we use Zoho Mail to receive and answer correspondence, including your email address and the information in your message. See Zoho's privacy information.
Apple and iOS: If you obtain or use the iOS app through Apple's services, Apple may process information about your App Store activity, downloads, payments or device operations independently under its own privacy terms. BroCracy does not receive your Apple account password. Device permissions, when a feature requires them, are controlled through iOS settings. This notice does not represent that BroCracy accesses Apple Health, precise location, contacts, camera or microphone as part of ordinary training logging.
5. Processing locations and international transfers
Our service providers may use infrastructure, support personnel and subprocessors within and outside the European Economic Area, including in the United States. The geographic location of an application database does not mean all associated authentication, email, hosting, support or backup processing remains in that region. Where required, international transfers are subject to applicable safeguards such as adequacy decisions or the European Commission's Standard Contractual Clauses, as described in the providers' data processing documentation. You can request further information about relevant safeguards using the contact details above.
6. Cookies, sessions and local storage
BroCracy uses technically necessary session and authentication mechanisms to keep you signed in and prevent unauthorized access. Web and PWA versions may use cookies and browser-local storage for this purpose and for your selected settings. An installed iOS app may use equivalent device storage to retain authentication state and preferences. We do not use app activity or training records for third-party advertising or behavioral advertising cookies. The web app's service worker does not intentionally store personal workout pages or API responses for offline access. You can clear local website data in your browser; iOS provides device-level controls for app permissions and storage.
7. Account security and access
Personal records are associated with your account. Database row-level security and authenticated application endpoints restrict access to account information, while HTTPS protects information during transmission. We apply technical and organizational measures appropriate to the service, but no digital system can offer absolute security. Do not share your password, and sign out on shared devices.
8. Retention and account deletion
BroCracy processes the fitness data you choose to record while your account remains active. Since processing this information is essential to the fitness-tracking service, withdrawing fitness-data consent and closing your account are offered together in Account & Privacy. The action explains the consequence and requires a separate explicit confirmation and current-password verification before any deletion is initiated. When account deletion is completed, your authentication account, exercise library, recorded workouts and sets, body and cardio entries, personal profile measurements and associated application records are removed from the active system. This action cannot be undone. You may download an export of your account data beforehand. Alternatively, you may request withdrawal and account closure at hellobro@brocracy.com. Some residual records may be retained where legally required or temporarily in provider backups, as described below.
Technical access records, security events, support correspondence and copies retained in provider backups may follow different retention cycles, based on security, operational and legal requirements. Backup copies may not be erased immediately but are subject to the providers' retention and restoration practices. Please contact us for information on the retention criteria relevant to your request.
9. Viewing, correcting and exporting your data
You can review and edit many of your training, body, cardio and profile records in your account. The Account & Privacy section offers a download of your account-related fitness information in JSON format. You can also request access, correction or erasure by email using the contact information in section 1.
10. Your rights under data protection law
Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20) and objection where applicable (Article 21). Where we rely on consent, you may withdraw it at any time with effect for the future (Article 7(3)). You also have the right to lodge a complaint with a competent supervisory authority (Article 77), including the Bavarian Data Protection Authority for the Private Sector where competent.
11. Automated calculations and medical information
BroCracy calculates and visualizes fitness trends and estimates based on your recorded entries. These calculations do not constitute medical advice, diagnoses or treatment. We do not use your training records for solely automated decisions producing legal or similarly significant effects within the meaning of Article 22 GDPR. Independent Bro HQ services are separate from the fitness-tracking account.
12. Providing information and updates
An email address and authentication details are needed to register and secure an account. Other fitness and body measurements are optional in the sense that you choose which tracking functions to use; some calculations cannot be provided without the corresponding entries. There is no general statutory obligation to supply workout or body measurements to BroCracy. We update this policy when our processing activities or service providers materially change; the latest version is available from the app and website. For material changes affecting your rights, we provide additional notice where required.