Privacy Policy and Data Protection Notice

1. Controller and scope

Motion Arc Fit is the data controller for the Motion Arc Fit web, PWA, iOS and Android services. Contact: to be configured before release. Notice version: 2026-07-21. Consent choices are presented separately from this notice.

2. Data we process

• Account and identity data: email, account ID, sign-in provider, display name, Arc ID, approved profile image and legal-version records.
• Activity and profile data: workout type, duration, sets, repetitions, weight, distance, pace, progress, badges, preferences and optional notes.
• Optional sensitive data: body measurements, birth year, heart-rate information and health information entered by the user, processed only after a separate consent where required.
• Location: saved venue coordinates and foreground location used to calculate outdoor distance/pace only after permission and a separate choice. Raw route points are not stored on the server and there is no background tracking.
• Community data: posts, comments, follows, reactions, notifications, reports and blocks.
• Technical and security data: IP address, user agent, session/device information, error and security logs. Non-essential advertising or analytics trackers are not enabled by default.

3. Purposes and legal bases

• Providing accounts, workouts, progress, community and support: performance of the user contract.
• Security, abuse prevention and service reliability: legitimate interests that do not override user rights, and legal obligations where applicable.
• Regulatory, consumer and legal claims records: legal obligation and the establishment, exercise or defence of legal claims.
• Optional health data, precise saved-location features, public leaderboard participation and marketing: separate consent or permission, where required.

4. Visibility and automated calculations

Personal workout records are not community posts unless the user chooses to share them. Public leaderboard participation is off by default. Level, points and badges may be calculated automatically, but these calculations do not make legal or similarly significant decisions.

5. Processors and international transfers

Data may be processed, only as necessary, by Supabase (authentication, database and storage), Cloudflare (asset storage/delivery and security), hosting and email providers, Apple or Google for the selected sign-in method, professional advisers and lawful authorities.

Replicate is used by administrators to generate public editorial artwork; user accounts, private community content, health data and location data are not sent to it. International transfers are made only where a lawful transfer mechanism and required safeguards are in place.

6. Retention, deletion and security

Account and activity data is kept while the account is active or until earlier deletion. Community content remains until deletion, account closure or moderation. Limited legal, consent and security records may be retained for the applicable limitation or statutory period. Deleted data leaves backups within the configured backup cycle.

Security measures include HTTPS, access controls, row-level policies, server-only privileged credentials, protected session storage, rate limits and incident records.

Use the account deletion page to delete an account.

7. Your rights and choices

Depending on applicable law, you may request access, correction, deletion, restriction, portability, information about recipients, objection and withdrawal of consent. Submit a verifiable privacy request to the privacy request address configured by the publisher. You may also complain to the competent data-protection authority. Withdrawing consent does not affect earlier lawful processing.

8. Changes

Material changes to purposes, categories, recipients or legal bases are notified through an appropriate channel. A new consent is requested where the change cannot be covered by the existing choice.