Privacy Policy

Eduardo Ribeiro de Abreu operates Rumo and is the data controller for everything described here. Contact details:

• Eduardo Ribeiro de Abreu
• Rua Alberto Sousa 325, RCC, 4900-576 Viana do Castelo, Portugal
• Tax number 214317552
• edu.r.abreu@gmail.com

Rumo can be offered under a coach's own brand. The branding changes; the controller does not. This one policy covers every branded version of the service.

There are two kinds of account: coaches, who create training and nutrition plans, and students, who follow them. This policy applies to both, but most of the health data described below belongs to students.

Account and profile data, which you give us:

• Name, email address, and password (stored only as a cryptographic hash — we never see it).
• Optionally: phone number, date of birth, profile photo, time zone, language, and your preferred units.

Training data, created as you use the service:

• Plans assigned to you, the workouts in them, and the sets you log (weight, repetitions, duration, distance).
• How a session felt: a rating, perceived exertion, mood, energy, and any note you write.
• Exercises you skipped and the reason you gave.
• Meal plans your coach prescribes and any notes attached to them.

Health data, described separately in the next section.

Technical data: we keep server logs needed to run and secure the service. We do not use analytics, advertising, or tracking of any kind.

Some of what a coaching app needs is special category data under Article 9 of the GDPR. In our case that means:

• Medical conditions and medication you choose to declare.
• Injuries: the area, the severity, and notes about them.
• Body measurements: weight, body fat, and circumferences.
• Periodic check-ins: measurements, sleep, energy, stress, pain, and adherence.
• Progress photographs of your body.
• Health notes written by you or by your coach.
• Goals expressed as body weight or body fat.

We process this only with your explicit consent, which we ask for separately from the Terms of Service. You can refuse it, and refusing costs you nothing but the features that depend on it — you can still train, follow your plan, and log your sessions.

You can withdraw that consent at any time, from your settings, as easily as you gave it. Withdrawing deletes your health record, injuries, measurements, check-ins and progress photographs. Your training history stays, because it is not health data and it is the record of work you did.

Two honest caveats. Free-text fields — a session note, a skip reason, a message to your coach — are not scanned, so anything about your health you write in one stays there until you delete it. And withdrawal does not reach into your coach’s own professional notes about you, which are subject to the same rights but handled by contacting us.

• To provide the service you signed up for — your account, your plans, your training log. Legal basis: performance of a contract (Art. 6(1)(b)).
• To let your coach adapt your training to your body and your health. Legal basis: your explicit consent (Art. 9(2)(a)).
• To send you the emails the service needs to work — verification, invitations. Legal basis: performance of a contract.
• To keep the service secure and to meet legal obligations. Legal basis: legitimate interests and legal obligation.

We do not sell your data, we do not profile you for advertising, and we make no automated decisions with legal or similarly significant effects.

• Your coach sees your profile, your plans, your training log and — if you consented — your health data. That is the point of the service.
• If your coach belongs to a brand, other coaches in that brand may see you, so that someone can cover for them.
• Nobody else on the platform can see you. Access is enforced in the database itself, not only in the app.
• We disclose data to authorities only where the law requires it.

We use a small number of service providers, each bound by a data processing agreement:

• Supabase — database, authentication and file storage. Hosted in Ireland (eu-west-1).
• Vercel — application hosting.
• Resend — transactional email (verification and invitations).
• Upstash — rate limiting, to protect the service from abuse.

Your data is stored in the European Economic Area — specifically in Ireland. Some of our providers operate globally; where any processing happens outside the EEA, it is covered by the European Commission’s standard contractual clauses.

Two details worth knowing. Progress photographs are kept in private storage that is not reachable without an authorised session, and every photograph is re-encoded in your browser before it is uploaded — which removes all embedded metadata, including GPS location. And when you train offline, the app stores your sets on your own device until it can send them; that copy lives in your browser and nowhere else.

We keep your data for as long as your account exists. Deleting your account deletes it, including your photographs; withdrawing health consent deletes the health data described above without touching the rest.

We have not yet fixed specific retention periods for each category of data. When we do, we will publish them here rather than apply them quietly.

You have the right to:

• Access the data we hold about you, and get a copy of it.
• Correct it if it is wrong.
• Have it erased.
• Restrict or object to how we process it.
• Receive it in a portable, machine-readable format.
• Withdraw your consent to health data processing at any time, without having to explain why.

Account deletion and health-consent withdrawal are buttons in your settings. Everything else is a message to edu.r.abreu@gmail.com — we will answer within one month.

If you think we have got this wrong, you can complain to the Comissão Nacional de Proteção de Dados (CNPD) at https://www.cnpd.pt.

• Access rules are enforced inside the database, so a bug in the app cannot expose another person’s data.
• Passwords are stored only as cryptographic hashes.
• Progress photographs live in private storage, reachable only through a signed, expiring link.
• All traffic is encrypted in transit.

No system is perfect. If a breach ever puts you at risk, we will tell you and the supervisory authority, as the law requires.

We use cookies only to keep you signed in and to remember your language. There is no analytics, no advertising, and no third-party tracking anywhere in this application — which is why you are not being asked to accept cookies.

The app also stores data in your browser so that a workout keeps working when you lose signal. That stays on your device and is sent to us only as the training data described above.

Rumo is not intended for people under 16. If you are under 16, a parent or guardian must set up and supervise your account. If we learn that we hold data about a child without that, we will delete it.

If we change this policy, the date at the top changes and we will tell you in the app. If a change affects what we do with your health data, we will ask for your consent again rather than assume it.

Questions, requests, or complaints: edu.r.abreu@gmail.com.