Privacy policy

1. Controller

The controller under the GDPR is Gernot Zuegg, operating under the name Blueflare, 39010 Tscherms, Gampenstraße 71, Italy. Contact: support@riseformore.com; phone: +39 0473 550 521; certified email (PEC): gernot.zuegg@pec.it.

2. Scope

This policy applies to the RiseForMore app for iOS and Android, its related online services and the public website www.riseformore.com. It covers processing for accounts, training, nutrition, recovery, AI features, subscriptions, security and support.

3. Data we process

Depending on use, we process account and sign-in data (email, password hash and Apple or Google identifiers), profile and fitness details, goals, experience, age, gender, body measurements, equipment, preferences and scheduling.

We may also process information about injuries or body areas to be protected, as well as sleep, energy, stress, focus and recovery information, workout and nutrition logs, photos for body or meal analysis, feedback, progress, subscription status and technical usage, diagnostic and security data. Free text and images are processed only when the relevant feature is used.

4. Purposes and legal bases

We process data to provide the account and app, generate personal plans and insights, synchronize content, assign purchases to your account, provide support and detect misuse or technical faults. The primary legal basis is performance of a contract under Article 6(1)(b) GDPR.

For optional inputs and features involving health-related data, photos or certain AI analyses, processing is based, where required, on your consent under Articles 6(1)(a) and 9(2)(a) GDPR. Security, stability and product improvement measures are based on our legitimate interests under Article 6(1)(f) GDPR; processing required by law is based on Article 6(1)(c) GDPR. Consent may be withdrawn at any time with effect for the future.

5. Guest mode and local storage

Profiles, workout drafts, history, settings and consent decisions are stored in SQLite on the device or localStorage in the web app. These stores support sign-in, offline use, synchronization and your preferences, not advertising tracking. Sign-in data uses the respective protected authentication and storage mechanisms.

Local content remains until deleted in the app, local storage is reset or the app is removed; the operating system and backups may affect its lifetime. Uninstalling does not delete server-side data. Selected features send pseudonymous identifiers and requests to our servers.

6. Recipients and services

We use hosting, database, storage and email providers. OpenAI processes inputs for AI features you expressly choose; sharing health information is explained and requested separately. RevenueCat processes identifiers and purchase/subscription information. Apple and Google process data for sign-in, store purchases and authorized operating-system features.

Outdoor maps load content from OpenFreeMap using OpenStreetMap/OpenMapTiles data. The map server receives your IP address and information about requested map areas. Barcode searches may send product identifiers via our server to Open Food Facts.

When error reporting is configured in the distributed build, Sentry receives redacted error reports and technical device/version information. Screenshots, session replays and performance profiles are disabled. Diagnostics support security and stability and are separate from optional product analytics. Optional voice input uses the device/browser microphone and speech service; its provider may process speech data depending on device and language. Recognized text may reach our server and OpenAI when you select an AI feature.

7. Transfers to third countries

Some providers may process data outside the European Economic Area, particularly in the United States. Transfers take place only in accordance with Articles 44 et seq. GDPR, for example under an adequacy decision or appropriate safeguards such as the EU Standard Contractual Clauses.

8. Website, beta list and audience measurement

When the website is accessed, the server may process technically required data such as IP address, time, requested page, referrer, browser and operating system to provide secure and stable operation under Article 6(1)(f) GDPR.

If you register for launch updates or for the beta test, we process your email address and optional information about platform, age group, training goal and training frequency. The purpose is to provide information about RiseForMore and, if selected, to organize the beta test. The legal basis is your consent under Article 6(1)(a) GDPR. Consent can be withdrawn at any time by sending a message to support@riseformore.com.

To improve the landing page, we record only first-party technical events without cookies, such as page views, section views or successful form submissions, together with language, device class, referrer domain and, where applicable, UTM campaign parameters. These events contain neither email addresses nor full IP addresses and are not sent to external analytics services. External app store content is only loaded when you click a store link.

Secure form submission uses a technically necessary antiforgery session cookie (HttpOnly, SameSite=Strict) to prevent forged requests. Audience measurement does not set analytics cookies.

9. Retention

We keep beta/launch registrations until the related communication ends or consent is withdrawn. Landing page events are removed from the event file after twelve months at the latest. Account and app content are generally retained until that content or account is deleted.

Consent records document purposes, text version, displayed text or checksum, language, decision and timestamp, including subsequent withdrawals. They remain associated until account deletion. Withdrawal stops future processing for that purpose but does not automatically delete existing content. Export, deletion and support remain available.

Security logs, billing evidence and backups follow purpose-specific or statutory periods. The operating policy specifies up to 30 days for SQL backups, 14 days for deployment rollback copies and 365 days for completed deletion receipts detached from the account. Such receipts contain no workout, health or image content.

10. Export and deletion

If you are signed in, you can request an export of your account, training, nutrition, recovery and AI-usage data in the account settings and delete your account. Deletion removes the account and associated data from the active system unless statutory retention obligations apply. A subscription purchased through Apple or Google is not canceled automatically. Data stored in Apple Health or Health Connect is not deleted by RiseForMore. You may also contact support@riseformore.com.

11. Your rights

Subject to the GDPR, you have rights of access, correction, deletion, restriction of processing, data portability and objection. Where processing is based on consent, you may withdraw it at any time with effect for the future. Contact support@riseformore.com to exercise your rights.

Right to object under Article 21 GDPR: where we process data on the basis of our legitimate interest (Article 6(1)(f) GDPR), in particular for the usage statistics described in section 17, you may object to this processing at any time on grounds relating to your particular situation. For usage statistics, simply turn off “Usage statistics” in your profile or write to support@riseformore.com; no reason is required.

You may also lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority), Piazza Venezia 11, 00187 Rome, Italy, or another competent supervisory authority.

• Garante per la protezione dei dati personali

12. Security, medical notice and changes

We use appropriate technical and organizational measures to protect data against loss, misuse and unauthorized access, although completely risk-free transmission cannot be guaranteed.

RiseForMore is not a medical device and is not intended to diagnose, treat or prevent any disease. It does not replace medical, physical therapy or other professional healthcare advice. Stop exercising and seek professional guidance for pain, injury, acute symptoms or health concerns.

We update this policy when features, providers or legal requirements change. The current version is available through the website and app.

13. AI features and automated insights

Optional AI features include coach guidance, equipment recognition, meal estimates and body analysis. Depending on the feature, the text you enter, selected profile and workout information, or the photos you provide are sent to OpenAI and processed there to generate the requested output.

AI results are labeled in the app and may be inaccurate; you must review them. RiseForMore does not use these features to make solely automated decisions that produce legal effects concerning you or similarly significantly affect you. The features do not provide medical diagnoses.

Photos and AI results are stored locally or associated with your account depending on the selected feature. Account content is generally retained until you delete it or your account is deleted; statutory retention obligations remain unaffected.

• AI transparency

14. Apple Health and Health Connect

Connecting is optional. Only after you confirm does RiseForMore request read access to body weight and write access for completed workouts. Outdoor workouts also include distance and estimated active calories; Health Connect requests separate optional write permissions for these. During synchronization, the app reads weight measurements from the previous 30 days, imports new values into the RiseForMore profile and, for signed-in accounts, synchronizes them with our servers. Completed workouts are written to Apple Health or Health Connect.

The data is used for weight trends, the training profile and workout records, not for advertising, marketing, credit assessment or sale to data brokers. If you later explicitly invoke an optional AI feature, selected profile information including current body weight may be sent to OpenAI as described in section 13.

Permissions can be revoked individually in the device's system settings. Disconnecting stops future synchronization but does not delete values already imported into RiseForMore or workouts stored in Apple Health or Health Connect. RiseForMore data can be deleted in the app; data in the health service must be managed in that service's settings.

• Apple privacy
• Google privacy

15. Location and outdoor workouts

Starting an outdoor workout with device permission records precise locations, timestamps, route, distance and speed. Recording may continue in the background during an active workout. The data supports your recording, route map and workout history.

Routes are stored on the device and, when signed in, with the workout on our server. Location is not required for other workout types. End recording or revoke permission in system settings to stop future collection. Stored routes can be deleted with the workout or account.

16. Health-data consent

Before personal health and fitness features are used, we explicitly ask for consent to process body measurements, workouts, nutrition, recovery, pain/injury information and, where provided, photos and workout routes. Optional sharing with OpenAI requires a separate choice and is not needed for other personal features.

You can change or withdraw choices under Privacy & Data. Without consent, the affected personal features are unavailable; account management, export and deletion remain available. Location, microphone, camera and Apple Health/Health Connect permissions are additionally requested for the selected feature.

17. Usage statistics and right to object

To improve the app, we analyze existing account and business records: registration, plan creation times, counts and times of completed workouts, trials and purchases. Symptoms, body measurements, training content, photos and free text are excluded. The basis is our legitimate interest under Article 6(1)(f) GDPR. You can object at any time by turning off “Usage statistics” in your profile; accounts with this setting off are excluded from these reports. Account, training and billing functions remain available.

In app versions enabled for this purpose, we count onboarding step views before account sign-in. The app uses a random session identifier in memory only and discards it when you leave the app. It sends only the step identifier, app version, platform and broad language. No account, installation or advertising ID is sent; IP addresses are not stored in this collection path. The server keeps short-lived duplicate protection in memory and stores only daily sums for up to 365 days. Earlier anonymous sums cannot be linked to an account.

We may compare advertising cost reports by country and day with aggregate first-payer counts from existing purchase records. Country comes from the purchase service, without GPS or IP geolocation. This comparison does not attribute an ad to an individual account or send workout or purchase events to advertising platforms. Previously anonymized sums cannot be reconstructed as personal records following an objection.

The purpose is to identify obstacles and drop-offs in onboarding, training and purchasing and to improve the app. The reports are calculated from records we already store; no additional per-user event trail is created, and the data is not shared with advertising platforms or other third parties, apart from our hosting provider acting as processor. The retention periods of the underlying account, workout and billing records apply; aggregate totals without personal reference may be kept longer. Our legitimate-interest assessment is available on request at support@riseformore.com.