Privacy Policy

1. Introduction

NABE-Gym ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App").

By using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the App.

2. Information We Collect

We collect the following types of information:

2.1 Personal Information

• Name and email address (via Google Sign-In or Apple Sign-In)
• Profile picture (from your authentication provider)
• Username and display name
• Fitness level, weight, height, and other health-related profile data you choose to provide

2.2 Fitness & Activity Data

• Workout history (exercises, sets, reps, weights, duration)
• Gym check-in records (location and timestamp)
• Challenge participation and progress
• XP (experience points), level, badges, and achievements
• Streak data and activity metrics

2.3 Social & Community Data

• Rivals and squad memberships
• Posts and interactions within the community
• Leaderboard rankings

2.4 Device & Usage Data

• Device information (model, OS version, unique device identifiers)
• App usage analytics and crash reports
• Push notification tokens
• Wearable device data (if you connect a wearable)

2.5 Location Data

• GPS location is accessed when you perform a gym check-in
• Location data is used solely to verify you are at the gym
• Location data is not stored permanently and is not used for tracking
• Location access is only active while the check-in screen is open

2.6 Camera & Photos

• Camera access is requested only when you choose to take a profile photo
• Photo library access is requested when you choose to upload a profile photo, progress photo, or weight log photo
• Photos are stored securely on Google Cloud Storage
• You can remove any photo at any time

2.7 Health & Fitness Data (Health Connect)

• If you connect Health Connect, we read: active calories, exercise sessions, heart rate, steps, distance, weight, and body fat percentage
• Health data is used to automatically log workouts and track your fitness progress
• We never write data to Health Connect — only read access is requested
• Health data is never shared with third parties or advertisers
• You can disconnect Health Connect at any time from your device settings

3. How We Use Your Information

We use the collected information for:

• Creating and managing your account
• Tracking your workouts, check-ins, and fitness progress
• Calculating XP, levels, streaks, and awarding badges
• Enabling social features (rivals, squads, leaderboards)
• Sending push notifications (workout reminders, streak warnings, challenge updates, motivational messages)
• Providing challenge participation and progress tracking
• Improving the App through analytics and crash reporting
• Communicating important updates about the App

4. Data Sharing & Disclosure

We do not sell your personal information. We may share your data:

• With other users: Your profile (username, avatar, level, badges, XP) and workout activity are visible to other NABE-Gym users as part of the community features. You control what profile information is visible through your privacy settings.
• Service providers: We use Google Cloud Platform (Firebase, Cloud SQL) to store and process data. These providers are contractually bound to protect your data.
• Legal compliance: We may disclose information if required by law or to protect our rights.

5. Data Storage & Security

Your data is stored on Google Cloud Platform (GCP) infrastructure located in Indonesia. We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (TLS) and at rest
• Secure authentication via OAuth 2.0 (Google and Apple Sign-In)
• Rate limiting to prevent abuse
• Regular security reviews and updates

While we strive to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the App's services. If you delete your account, we will delete or anonymize your data within 30 days, except where retention is required by law.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data
• Restrict or object to data processing
• Data portability (receive your data in a structured format)
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, please contact us at privacy@nabenyabali.fit.

8. Third-Party Services

The App integrates with the following third-party services:

• Google Sign-In: Authentication service. See Google's Privacy Policy.
• Sign in with Apple: Authentication service. See Apple's Privacy Policy.
• Firebase Cloud Messaging: Push notification delivery. See Firebase Privacy Policy.

9. Children's Privacy

The App is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete it immediately. If you believe we may have collected information from a child under 13, please contact us.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes. Continued use of the App after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

12. Governing Law

This Privacy Policy is governed by the laws of Indonesia. Any disputes arising from this policy shall be resolved in the courts of Indonesia. If you are located in the European Economic Area (EEA), you have additional rights under the GDPR, and we comply with those requirements.