Legal

Privacy Policy

Last updated: July 22, 2026

1. Data Controller

The data controller responsible for your personal data is:

Aritz Tellitu
Spain
privacy@traqalabs.com

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the TRAQA application ("the App"), in accordance with the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 on Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

2. Information We Collect

We collect and process the following categories of personal data:

Account data: Email address, display name, and authentication credentials (password stored as a hash — we never store plaintext passwords).

Profile data: Body weight, preferred units, timezone, preferences, and settings.

Workout data: Workout logs, set logs (weight, reps, RPE, rest time), workout duration, volume calculations, personal records, body weight history, training analysis and recommendations, skip reasons, and user comments.

Subscription data: Subscription status, entitlement, product identifier, store (Apple), and billing periods. Processed via RevenueCat — we do not store payment card details.

Usage and analytics data (optional): In-app interaction events, performance metrics, device type, operating system version, app version, and masked session recordings. This data is collected and processed by PostHog (product analytics and session replay, EU-hosted) only if you choose to share usage data. You are asked during onboarding, nothing is collected before you agree, and you can change your choice at any time in Settings > Privacy > Share usage data. Session recordings mask all text inputs and images.

Diagnostics data: Crash reports and performance diagnostics processed by Sentry (EU-hosted) to keep the App stable. Crash diagnostics remain active to maintain stability and are configured without default personal identifiers.

What we do NOT collect:

Apple HealthKit or Health app data
Location data or GPS coordinates
Contacts or address book information
Advertising identifiers (IDFA)
Advertising networks or cross-app tracking
Browsing history or data from other apps

3. Legal Basis for Processing

We process your personal data under the following legal bases as defined in Article 6 of the GDPR:

Contract performance (Art. 6(1)(b)): Processing of account data, profile data, workout data, and subscription data is necessary for the performance of the contract between you and TRAQA — i.e., providing the fitness tracking service you subscribed to.

Legitimate interest (Art. 6(1)(f)): Processing of crash and performance diagnostics to maintain, secure, and improve the App.

Consent (Art. 6(1)(a)): Processing of product analytics and masked session recordings (you are asked during onboarding and can withdraw at any time in Settings > Privacy > Share usage data). Consent can be withheld or withdrawn at any time without affecting the core service.

4. How We Use Your Data

We use your personal data for the following purposes:

Service delivery: Storing and displaying your workout history, tracking progress, detecting personal records, and providing the core fitness tracking functionality
Training analysis: Generating progression recommendations based on your training data
Subscription processing: Managing your subscription status, verifying entitlements, and coordinating with Apple and RevenueCat for billing
Diagnostics: Identifying and resolving crashes, performance issues, and bugs using device information
Product analytics (optional): Understanding how features are used and improving the App via PostHog product analytics and masked session replay, only if you have chosen to share usage data (Settings > Privacy > Share usage data)

5. Data Sharing and Third Parties

We share your data with the following third-party service providers, solely for the purposes described:

Supabase (database and authentication): Your account data and workout data are stored in Supabase's infrastructure. Supabase acts as a data processor under our instructions.

RevenueCat (subscription management): Your subscription status, Apple transaction identifiers, and entitlement data are processed by RevenueCat to manage subscriptions.

Apple (payment processing and App Store): Apple processes all payments and manages your subscription billing. Apple's privacy practices are governed by their own privacy policy.

PostHog (product analytics and session replay): In-app interaction events and masked session recordings are processed by PostHog, hosted in the European Union, to analyze usage and improve the App. Events are keyed to a random app-scoped identifier; TRAQA does not send your name, email, or account ID to PostHog. Nothing is sent to PostHog unless you choose to share usage data; you are asked during onboarding and can change your choice at any time in Settings > Privacy > Share usage data. Session recordings mask all text inputs and images, and we do not enable cross-app tracking.

Sentry (crash and performance diagnostics): Crash reports and performance data are processed by Sentry, hosted in the European Union, to keep the App stable. Sentry is configured without default personal identifiers.

The current list of our specific sub-processors and their applicable data handling terms is available on request from privacy@traqalabs.com. We will respond within 30 days, in line with GDPR Art. 15.

We do NOT sell, rent, or trade your personal data to any third party. We do not share your data with advertisers. We do not monetize your data in any way beyond providing the service you pay for.

We may disclose your information if required by law, in response to valid legal process, or to protect the rights, property, or safety of TRAQA, our users, or the public.

6. International Data Transfers

Your personal data may be transferred to and processed in the United States by our service providers. These transfers are protected by:

Standard Contractual Clauses (SCCs): Our US-based processors have executed EU Standard Contractual Clauses approved by the European Commission, providing appropriate safeguards for international data transfers
EU-US Data Privacy Framework: Where applicable, our processors participate in the EU-US Data Privacy Framework, which has been granted an adequacy decision by the European Commission

7. Data Retention

We retain your personal data for as long as your account is active and as necessary to provide you with the service.

Active account: All your data is retained for the duration of your account to provide the service
Account deletion: When you delete your account (Settings > Delete Account), your account, profile, workout, and onboarding data are permanently deleted from TRAQA's systems without undue delay. This action cannot be undone. Data already held by our service providers (RevenueCat, PostHog, Sentry) is retained or deleted according to each provider's own retention policy and legal obligations; you can contact privacy@traqalabs.com to request deletion from these providers.
Subscription data: RevenueCat may retain transaction records independently in accordance with their own data retention policy and legal obligations

8. Your Rights

Under the GDPR (Articles 15–22) and the LOPDGDD, you have the following rights regarding your personal data:

Right of access (Art. 15): Request a copy of the personal data we hold about you
Right to rectification (Art. 16): Request correction of inaccurate or incomplete personal data
Right to erasure (Art. 17): Request deletion of your personal data (also available directly in the App via Settings > Delete Account)
Right to restriction of processing (Art. 18): Request that we limit how we process your data in certain circumstances
Right to data portability (Art. 20): Request your data in a structured, commonly used, machine-readable format
Right to object (Art. 21): Object to processing based on legitimate interest
Right to withdraw consent (Art. 7(3)): Withdraw consent for optional processing (e.g., usage analytics) at any time, without affecting the lawfulness of processing based on consent before its withdrawal

To exercise any of these rights, contact us at privacy@traqalabs.com. We will respond to your request within 30 days.

Right to lodge a complaint: If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD) at www.aepd.es, or with the supervisory authority in your EU member state of residence.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

Encryption in transit: All data transmitted between the App and our servers is encrypted using TLS (Transport Layer Security)
Access isolation: Database-level security ensures you can only access your own data. No user can view, modify, or delete another user's data
Secure token storage: Authentication tokens are stored in encrypted device storage, not in plain text
No payment card storage: We never receive or store your payment card information — all payments are processed by Apple
Password security: Passwords are hashed and never stored in plaintext

10. Children's Privacy

TRAQA is not intended for users under 14 years of age, in accordance with the LOPDGDD (Art. 7), which sets the age of digital consent at 14 in Spain. We do not knowingly collect personal data from children under 14. If we discover that we have collected data from a child under 14, we will promptly delete that data. If you believe a child under 14 has provided us with personal data, please contact us at privacy@traqalabs.com.

11. Cookies and Local Storage

Website: The TRAQA website (traqalabs.com) does not use cookies or any tracking technologies.

App: The App uses local device storage to persist workout drafts and preferences locally on your device. Authentication tokens are stored in encrypted device storage. The App uses the PostHog SDK for product analytics and session replay (with all text inputs and images masked), which is activated only if you choose to share usage data, and the Sentry SDK for crash diagnostics; these are first-party improvement tools, not advertising or cross-app trackers. The App uses no advertising cookies and no cross-app tracking.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes through the App. The "Last updated" date at the top of this page indicates when the policy was last revised. Your continued use of the App after notification of changes constitutes acceptance of the updated policy.

13. Contact

For privacy-related questions, data requests, or to exercise your rights under the GDPR, contact us at:

privacy@traqalabs.com

Supervisory authority: Agencia Española de Protección de Datos (AEPD) — www.aepd.es