Legal
Privacy policy
Last updated 17 September 2026. This describes what StatBlockFit stores, why, where it is kept and what you can do about it. It is written from the actual database schema rather than from a template, so it says what the app really does.
1. Who is responsible
The controller of your personal data is:
John Dieter JöhrIm Lägi 2
8700 Küsnacht ZH
Switzerland
privacy@statblockfit.com
StatBlockFit is operated from Switzerland and is subject to the Swiss Federal Act on Data Protection (revFADP). Where you are in the European Economic Area or the United Kingdom, the GDPR and UK GDPR also apply to the processing described here, and the rights in section 7 are available to you under both.
2. What is stored
| Category | What it is | Why |
|---|---|---|
| Account | Email address, a password hash held by our authentication provider, your handle, display name, optional avatar and bio | To let you sign in and to identify you to people you choose to be visible to |
| Date of birth | Stored once and not changeable | Legally required age gating. Under 13 is refused; 13 to 17 runs with restrictions (see section 6) |
| Health and fitness | Workouts, sets, weights, activities, steps, sleep, body weight, girth measurements, food and water logs | This is the product. It is what the app exists to record and show back to you |
| Derived progress | Experience, stat levels, streaks, quests, items, ratings | Only present if you use StatBlockRPG. It is computed from the logs above |
| Social | Posts, comments, likes, friendships, blocks, direct messages, reports | Only if you use those features. Posts default to friends only and the global feed is off until you turn it on |
| Photographs | Proof images and post images you upload | Only if you choose to attach one. Images are re-encoded on your device before upload, which removes EXIF metadata including location |
| Device | A push notification token, the device name and platform | Only if you allow notifications. Used to deliver them and nothing else |
Health and fitness data is special category data. It is never used for advertising, never sold, and never shared with anyone for their own purposes.
3. What is not stored
- No advertising identifiers, and no advertising of any kind.
- No third-party analytics or tracking SDKs. The app contains none.
- No payment card details. There are no purchases at present.
- No precise location. The app never requests location permission.
4. Where it is kept
Data is stored with Supabase, which hosts the database, authentication, file storage and the server functions. The project is being moved to Supabase's Zurich, Switzerland region, so that health data stays in Switzerland. Until that migration completes the project runs in Supabase's EU region (Ireland), which remains within the EEA and is covered by the same protections.
The only other processor is Expo's push notification service, which receives a device token and the text of a notification in order to deliver it. It receives no health data.
5. Health Connect (Android)
If you connect Android Health Connect, StatBlockFit reads three record types, and only when you press the button that asks for them:
| Record type | What is done with it |
|---|---|
| Steps | Read for today only, written to your own activity log, shown to you on your dashboard |
| Sleep | Read for today only, written to your own activity log, shown to you on your dashboard |
| Active calories | Read for today only, used to show your energy expenditure |
This data is never written back to Health Connect, never shared with any third party, never used for advertising, and is deleted along with the rest of your account. You can disconnect at any time: revoke access in the Health Connect app, or turn the integration off in StatBlockFit's own settings. The rest of the app continues to work without it.
6. Accounts for 13 to 17 year olds
Age is derived from your date of birth on the server, not from a setting you can change. Accounts under 18 cannot:
- make their profile public, or upload an avatar;
- post publicly, or attach a photograph to a post;
- submit a photograph as proof, or review anyone else's;
- send or receive direct messages, in either direction;
- appear on any public leaderboard.
Accounts under 13 are refused at sign up.
7. Your rights
Two of these are buttons in the app rather than requests you have to make:
- Export. Settings gives you everything the account holds as a single JSON file. It includes your posts, messages you sent, logs, measurements and progress. It deliberately excludes your push token, which is a capability rather than a fact about you.
- Deletion. Settings deletes your account and everything attached to it. It is immediate and cannot be undone. A record that a deletion happened is kept, containing the date and nothing about you.
You also have the right to access, correct or restrict processing, to object to it, and to data portability. Write to privacy@statblockfit.com. If you are in Switzerland you may complain to the Federal Data Protection and Information Commissioner (FDPIC); in the EEA or UK, to your local supervisory authority.
8. How long it is kept
- Account and health data: until you delete your account.
- Proof photographs: deleted 30 days after the review that used them resolves.
- Moderation reports: kept while the report is open and for a reasonable period after, so a pattern of abuse can be recognised.
- Deletion audit records: 24 months, and they contain no personal data.
9. Content you post, and moderation
Posts, comments, direct messages and proof photographs can be reported from inside the app, and every report is reviewed. A removed message stops being visible immediately. You can also block another account at any time, which hides you from each other in both directions.
10. Changes
If what the app collects changes, this page changes with it. The version in the app's source repository is the source of what is published here, so the two cannot drift.