The short version
Roll4Gains stores what you log so it can show it back to you. Your health and fitness data is never used for advertising, never sold, and never shared with anyone for their own purposes. There is no advertising in the app and no third-party analytics. You can export everything or delete your account, from inside the app, without asking us.
What we store, and why
Everything below is stored because a feature you use needs it. Nothing is collected speculatively, and there is no category of data gathered only for analysis.
| What | Why | Lawful basis |
|---|---|---|
| Account Email address, password (hashed, never stored in plain text), a handle you choose |
To create your account, sign you in, and let friends find you | Performance of a contract |
| Date of birth | To confirm you are old enough, and to apply the under-18 restrictions described below. It is never shown on your profile | Legal obligation |
| Health and fitness data Body weight, height, measurements, workouts and sets, food and drink you log, steps, sleep, and activities such as walking, cycling or meditation |
This is the product. It is what the tracker shows you and what the game uses to work out your progress | Your explicit consent |
| Game data Stat levels, experience, items, quests, battles, ranking |
To run the game layer and keep your progress between sessions | Performance of a contract |
| Social data Display name, avatar, bio, friends, people you have blocked, notifications |
Only if you use the social features. Your profile is public only if you choose | Performance of a contract |
| Proof submissions | If you log something unusually large, other adult users may be asked to confirm it is plausible. They see a short description generated by us, never anything you have typed, and never your name | Legitimate interest in preventing cheating |
| Notification token | Only if you turn notifications on. It identifies your device so a message can reach it | Your consent |
| Security records Timestamps, rate-limit counters, an audit entry when an account is deleted |
To stop abuse and to prove that a deletion happened | Legitimate interest in securing the service |
Special category data
Health data receives extra protection under the UK and EU GDPR. We process it only with your explicit consent, only to provide features you are using, and never for advertising, profiling or any automated decision that has a legal or similarly significant effect on you. Withdrawing that consent means deleting your account, because the app has no function without it.
What we never do
- We do not sell your data, and we do not share it for anyone else's marketing.
- There is no advertising in the app and no advertising identifiers.
- There is no third-party analytics or tracking software in the app.
- We do not use your health data to train machine-learning models.
- We do not read your location, contacts, photos or microphone.
Who else processes it
We use two service providers. They act on our instructions and may not use your data for their own purposes.
- Supabase hosts the database, authentication and file storage. Everything described above lives there. Data is stored in the region shown as Ireland.
- Expo delivers push notifications. It receives your notification token and the title and body of each message, and nothing else. It receives nothing at all if you leave notifications off.
Where data is transferred outside the UK or EEA, that transfer relies on the European Commission's standard contractual clauses.
If you are under 18
You must be at least 13 to use Roll4Gains. Accounts belonging to 13 to 17 year olds run with reduced features, enforced by our servers rather than by a setting anyone can switch off:
- No public profile.
- No appearance on any leaderboard.
- No avatar upload.
- No submitting or reviewing photo proof.
If you believe a child under 13 has created an account, write to info@roll4gains.com and we will delete it.
How long we keep it
- While your account exists, we keep what you have logged, because that is the history the app exists to show you.
- When you delete your account, your personal data is removed immediately and permanently. It is not held in a recoverable state and there is no grace period.
- Proof images, if you submit any, are deleted 30 days after the review that used them finishes.
- A deletion record stating that an account was deleted, and when, is kept for 24 months. It contains no health data and nothing you logged. We keep it so we can show a deletion was carried out.
Your rights
Two of these are built into the app, so you do not have to ask us or wait for us:
- Export. Settings, then Your data. It produces a machine-readable file containing everything your account holds.
- Deletion. Settings, then Your data. It is immediate and cannot be undone.
You also have the right to correct inaccurate data, to object to or restrict processing, and to withdraw consent. Write to info@roll4gains.com for any of those. If you are unhappy with how we have handled a request you can complain to your national data protection authority.
Security
Data is encrypted in transit and at rest. Access is enforced per row in the database, so one account cannot read another's data even if the app asked it to. Sign-in errors deliberately do not reveal whether an email address is registered.
Food data
The bundled food catalogue comes from the U.S. Department of Agriculture, Agricultural Research Service, FoodData Central, and is in the public domain. It ships inside the app and is not a service that sees anything you search for or log.
Ingredient exclusions in the meal planner are a preference filter worked out from food names and categories. They are not allergy safety and must not be relied on as such, because the public-domain data has no allergen labelling in it.
Changes
If we change what we collect or who processes it, we will update this page and change the date at the top. If the change is significant we will tell you in the app before it takes effect.
Contact
info@roll4gains.com
Küsnacht ZH
This policy is governed by the law of Switzerland.