Privacy Policy
What data Onbars collects, why, and the rights you have over it.
This policy explains what personal data Onbars ("the app", "we") collects, why, for how long, and your rights under the GDPR (EU 2016/679) and French data protection law.
1. Data controller
At pre-launch, the controller is the individual publisher of Onbars. This section will be updated upon incorporation.
Privacy contact: [email protected] — Support: [email protected]
2. Data we collect
You provide: account (email, PBKDF2-hashed password, or Google identity); profile (username, name, photo, bio); performance profile (optional, with consent): gender, date of birth, bodyweight, max pull-ups/dips/push-ups; certification videos (optional); content (routines, sessions, parks, ratings, reports, posts, comments).
Collected automatically: location (with OS permission, for nearby parks & check-ins); session data and security logs; push token (if notifications enabled).
3. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Create & manage account | email, password, profile | Contract |
| Score / leaderboard | maxes, gender, age, contributions | Contract |
| Performance profile (weight, gender) | weight, gender | Consent |
| Certification videos (peer review) | videos | Explicit consent |
| Map & check-ins | location | Consent (OS permission) |
| Weekly AI analysis | aggregated non-identifying stats | Consent |
| Push notifications | push token | Consent |
| Moderation & security | contributions, logs | Legitimate interest |
| Minimum-age verification | date of birth | Legal obligation |
You may withdraw consent anytime (Settings → Data & Privacy) without affecting prior lawful processing.
4. Automated decision-making
Your Onbars score and tier are computed deterministically by our code, have no legal effect, and the coaching AI only writes narrative text from statistics — it decides nothing. No Article 22 automated decision-making applies.
5. Processors & international transfers
| Processor | Role | Data location |
|---|---|---|
| Supabase | Database, storage, auth | European Union (selected region) |
| Maps & Google sign-in | USA (SCCs / Data Privacy Framework) | |
| Groq | Weekly AI analysis text generation | USA (SCCs) — only non-identifying statistics sent; never your email, name or videos |
We never sell your data and share it with no advertisers.
6. Retention
Account & related data: until deletion. Rejected certification video: deleted within 30 days. Approved video: while account active (re-verification after 180 days). Location check-ins: 13 months. Sessions: max 30 days. Security audit logs: 2 years (separate from profile data). On account deletion, all data is erased (cascading DB delete + storage purge).
7. Your rights
Access, rectification, erasure, portability, restriction, objection:
- Access & portability: Settings → "Download my data" (JSON export).
- Rectification: Settings → edit profile.
- Erasure: Settings → "Delete account".
- Objection / withdraw consent: Settings → Data & Privacy.
Contact [email protected] (reply within 1 month). You may complain to the CNIL (www.cnil.fr).
8. Security
HTTPS in transit, encryption at rest (Supabase PostgreSQL), PBKDF2-hashed passwords, certification videos in a private bucket served via short-lived signed URLs, server-side PII isolation, anti-bruteforce rate limiting. Data breaches with risk are notified to the CNIL within 72h and to affected users where required.
9. Minors
Onbars is for users 15 and older. We do not knowingly collect data from children under 15 without parental consent (GDPR Art. 8).
10. Cookies
The mobile app uses only a strictly necessary session token (no consent required). No advertising cookies or third-party trackers. Any future analytics will load only after explicit consent.
11. Changes
We may update this policy. Material changes are notified in-app, with updated date and version above.