Your training data is yours.

Effective 13 July 2026

This policy explains how DueCue processes personal data when you use Workout Waves. DueCue, operated by the independent developer of Workout Waves in Sweden, is the controller for processing described here. Questions and privacy requests can be sent to support@duecue.dev.

Information we process

• Account and profile: email, username, name, age-verification date of birth, units, profile details, and avatar.
• Training and wellness: workouts, exercises, performance, goals, body measurements, progress photos, and health records you choose to connect.
• Running and location: route, GPS, sensor, and activity-file data when you use enabled running features. Precise routes are private by default and privacy-zone controls are applied where offered.
• Social content: friends, posts, comments, waves, challenges, chat messages, and in-app workout or exercise shares.
• Device and diagnostics: push tokens, platform/app version, permission state, crash diagnostics, performance data, and limited product analytics.
• Purchases: subscription and entitlement status from the app store and RevenueCat. DueCue does not receive your full payment-card number.

Where information comes from

Most information comes directly from you or from your use of the app. With your permission, information may also come from your device, sensors, app store, health platform, wearable, connected fitness provider, authentication provider, or another integration you enable. Information received from another service remains subject to the controls and limitations of that service.

Why we process information

• To provide the service: authenticate accounts, save and sync training, calculate statistics, enable social features, verify entitlements, and provide requested support. This processing is generally necessary to perform our agreement with you.
• With your consent: process optional health records, precise location, notifications, connected services, and other permission-based features. Where consent is the legal basis, you may withdraw it through the app, device, or connected service. Withdrawal does not affect earlier lawful processing.
• For legitimate interests: secure Workout Waves, prevent fraud and abuse, diagnose failures, understand reliability, enforce our Terms, and improve the service. These interests are balanced against your rights and expectations.
• For legal reasons: meet accounting, tax, consumer, data-protection, safety, and other legal duties; respond to valid legal requests; and establish, exercise, or defend legal claims.

Optional and required information

Account credentials and core training information are needed for the related account and cloud features. Health, precise location, progress photos, social publishing, notifications, and connected integrations are optional. If you do not provide optional information, the related feature may not work, but unrelated features should remain available where technically possible.

Health and location data

Health records and precise location can be sensitive. Workout Waves processes them only when you enable the relevant feature and a lawful basis is available, such as explicit consent where required. You can disconnect a health or location source, but copies already incorporated into workouts, statistics, backups, safety records, or lawful retention may not disappear immediately.

Service providers

Workout Waves relies on providers including Supabase for authentication and cloud data, RevenueCat and app stores for subscriptions, Firebase for push delivery and product analytics, and Sentry for diagnostics. Optional integrations may include Apple Health, Health Connect, maps, weather, wearables, and connected fitness providers. Providers process information under their own terms or on DueCue's behalf, depending on the service.

Sharing and visibility

DueCue does not sell personal data. Information may be shared with service providers that operate Workout Waves; with app stores and integrations you choose; with other users according to your publishing and visibility choices; during a reorganisation, financing, sale, or transfer of Workout Waves subject to appropriate safeguards; or when reasonably necessary to comply with law, enforce rights, investigate abuse, prevent fraud, or protect a person from harm.

You are responsible for choosing what to post or share. Information made visible to other users can be copied, saved, reshared, or retained by them outside DueCue's control. Privacy settings reduce intended visibility but cannot guarantee that another person will not capture or disclose content they can access.

International processing

Providers may process information in countries outside Sweden or the European Economic Area. Where data-protection law requires it, transfers rely on a recognised safeguard, such as an adequacy decision or approved contractual protections. Availability and location of provider infrastructure may change over time.

Retention

Account and cloud training data is generally kept while your account is active. Information may be deleted earlier through app controls or retained longer when reasonably necessary for backups, security, fraud prevention, subscription disputes, accounting, legal obligations, enforcement, or legal claims. Backup deletion occurs through normal rotation rather than immediate removal from every copy.

Retention depends on the type of information, why it was collected, sensitivity, legal requirements, and operational risk. Aggregated or irreversibly anonymised information may be retained because it no longer identifies you. Third parties such as app stores keep their own records under their policies.

Security and service limits

DueCue uses measures such as access controls, row-level security, encrypted transport, and platform secure storage where appropriate. No service, device, transmission, or storage system is completely secure. You are responsible for protecting your device and credentials, installing updates, and avoiding information you do not want stored or shared. DueCue cannot guarantee that data will never be lost, corrupted, intercepted, or accessed without authorisation.

Your choices and rights

You can change profile visibility, notification categories, health connections, permissions, and other preferences in the app or device settings. Depending on applicable law and the circumstances, you may request access, correction, deletion, restriction, portability, or object to certain processing. You may withdraw consent where processing is based on consent.

These rights are not absolute. DueCue may need to verify your identity and may retain or withhold information where law permits, including to protect another person, comply with legal duties, prevent abuse, or establish and defend legal claims. Delete your account in Settings or follow the account deletion instructions.

Automated decisions

Workout Waves may automatically calculate statistics, records, trends, recommendations, and feature eligibility. DueCue does not use these calculations to make decisions that produce legal or similarly significant effects about you solely through automated processing.

Children

Workout Waves is intended for adults aged 18 and over. We do not knowingly provide accounts to children.

Changes to this policy

DueCue may update this policy when Workout Waves, its providers, or legal requirements change. The current version and effective date will be published here. Material changes will be communicated through the app or another reasonable channel where required by law.

Complaints

Please contact DueCue first so we can try to resolve your concern. You also have the right to complain to the Swedish Authority for Privacy Protection (IMY) or another competent supervisory authority.

Contact

Privacy requests can be sent to support@duecue.dev. Include the email associated with your account and enough information to understand the request, but never send passwords, recovery tokens, precise routes, progress photos, or full health exports by email.