Privacy Policy

1. Introduction

This Privacy Policy explains how ErgManiac collects, uses, shares, and protects your personal data when you use our website, iOS app, and Android app (together, the "Service"). ErgManiac is a rowing erg tracker and AI coaching app for Concept2 and other ergometers.

The Service is operated by PinkyFish d.o.o., a company registered in Croatia ("we", "us", or "our"). We are the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR). When we say "you" or "your", we mean you as a user of the Service.

For any privacy-related questions or requests, contact us at info@ergmaniac.com or via our contact form.

2. Data We Collect

2.1 Account Information

When you create an account, we collect your email address and name. If you register with an email and password, we store your password as a salted hash - never in plain text. Alternatively, you can sign in with:

• Google Sign-In - we receive your Google account ID, name, email, and profile picture.
• Sign in with Apple - we receive your Apple account identifier, name, and email. If you use Apple's Hide My Email feature, we only receive an Apple private-relay email address, and we support this fully.

2.2 Profile Information

You may optionally provide your birth year, gender, weight, height, maximum heart rate, and resting heart rate. This data is used to personalize your training plans and workout analysis.

2.3 Fitness & Workout Data

We store your rowing workout data, including distance, time, split times, stroke rate, heart rate, calories, drag factor, and interval details, as well as your personal bests and training plans. This data may come from:

• Manual entry
• A direct Bluetooth connection to your ergometer (see 2.4)
• Concept2 Logbook sync (if you connect your C2 account)
• Screen photo scans of your PM5 monitor

2.4 Device Sensors & Permissions

On our mobile apps, some features require access to device hardware. We only request these permissions when you use the related feature, and you can decline or revoke them in your device settings at any time:

• Bluetooth - to connect to your Concept2 PM5 (or compatible) ergometer and read live rowing data such as distance, pace, stroke rate, and heart rate.
• Camera - to photograph your PM5 workout screen so we can extract the results, and to capture technique videos.
• Photo library - to let you select an existing photo of your PM5 screen to scan.
• Selected media - Android uses the system picker to access only photos or videos you select, without broad access to your library. The Android app does not request microphone access.

2.5 Scan Images & Media

When you scan your PM5 screen, the uploaded images are stored in AWS S3 (EU region) for processing. Images and any videos you upload are associated with your account and used solely for workout data extraction and technique analysis.

2.6 Payment Information

Web subscriptions are processed by Stripe. Android in-app subscriptions are processed by Google Play and managed through RevenueCat. We do not store your card number or CVV. We store the payment provider's subscription identifiers, product, and expiration date to manage your plan.

2.7 AI Interaction Data

When you use AI features (training plans, workout analysis, Ask Coach), relevant workout data and profile information is sent to our AI provider to generate personalized responses. We track the number of AI requests and associated costs per month.

2.8 Analytics & Tracking

We use PostHog for product analytics and the Meta (Facebook) Conversions API for advertising measurement. No non-essential tracking is activated unless you give explicit consent: through the cookie banner on the website, or the optional independent analytics and advertising controls under Settings → Privacy on web and mobile. You can withdraw your choice at any time. See section 11 for details.

2.9 Content Reports

When you report AI content, we receive the selected content, your chosen reason, name, and email through our support system. We use these reports to review safety concerns and improve our content safeguards.

3. How We Use Your Data

We use your data to:

• Provide, operate, and maintain the ErgManiac Service
• Connect to your ergometer over Bluetooth and record your workouts
• Generate personalized training plans and workout analysis
• Sync workouts from Concept2 Logbook and publish to Strava
• Process payments and manage your subscription
• Send transactional emails (verification, password reset, receipts)
• Send marketing emails about features and tips, where you have opted in
• Calculate personal bests, analytics, and fitness trends
• Measure and improve our product and marketing (with your consent)
• Protect the Service against fraud, abuse, and security threats

We do not sell your personal data.

4. Legal Basis for Processing (GDPR)

As an EU-based controller, we process your personal data only where we have a lawful basis under the GDPR:

• Contract (Art. 6(1)(b)) - to create your account, provide the Service, sync and analyze your workouts, and process your subscription.
• Consent (Art. 6(1)(a)) - for product and advertising analytics, non-essential cookies, marketing emails, and access to device sensors such as Bluetooth, camera, photos, and microphone. You may withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)) - to secure and improve the Service, prevent fraud and abuse, and communicate essential service information, balanced against your rights.
• Legal obligation (Art. 6(1)(c)) - to comply with accounting, tax, and other legal requirements.

Some fitness and heart-rate data may be considered health-related data. Where that is the case, we rely on your explicit consent (Art. 9(2)(a)) to process it for the purposes described in this policy.

5. Third-Party Services & Sharing

We share data with the following third-party services only as necessary to provide the Service. We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

If you choose to share a workout, a unique share link is generated and anyone with the link can view that specific workout's data. You can unshare a workout at any time to revoke public access.

6. Data Retention

We retain your account data and workout history for as long as your account is active. You can delete individual workouts and training plans at any time, and you can disconnect third-party integrations (Concept2, Strava), which removes the stored access tokens.

Scan images are retained only as long as needed to extract your workout data and support the feature. If you request account deletion, we will delete your personal data, workout history, training plans, and associated files within 30 days, except where we must retain limited records (for example, invoices) to meet legal obligations. Anonymized, aggregated data that can no longer identify you may be retained for service improvement.

7. Your Rights (GDPR)

If you are in the European Economic Area, you have the following rights under the GDPR:

• Access - request a copy of your personal data
• Rectification - correct inaccurate personal data
• Erasure - request deletion of your personal data
• Restriction - restrict processing of your data
• Portability - export your data in a machine-readable format
• Objection - object to processing based on legitimate interests
• Withdraw consent - withdraw consent for analytics, advertising, marketing emails, or device permissions at any time

To exercise any of these rights, email info@ergmaniac.com or use our contact form. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority; in Croatia this is the Croatian Personal Data Protection Agency (AZOP).

8. Children's Privacy

ErgManiac is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under 16. If we learn that we have collected such data, we will delete it promptly.

9. Security

We take reasonable technical and organizational measures to protect your data. All data is transmitted over HTTPS with TLS encryption. Passwords are hashed before storage, and OAuth tokens for third-party services are stored encrypted in our database. We do not store full payment card details - this is handled by Stripe. While no system can be completely secure, we work to protect your data against unauthorized access, loss, or misuse.

10. International Data Transfers

Your core data is stored and processed within the European Union (AWS Frankfurt, eu-central-1). Some third-party providers, such as Anthropic and certain analytics or advertising services, may process data in the United States. Where data is transferred outside the EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision to ensure your data receives an equivalent level of protection.

11. Cookies & Tracking

We use essential cookies that are necessary to run the Service (for example, to keep you signed in). We also use non-essential analytics and advertising cookies and technologies, including PostHog and the Meta Conversions API, but only after you give explicit consent via our cookie banner.

You can accept or reject non-essential cookies at any time, and your consent preference is stored so we can honor your choice. If you reject them, no analytics or advertising tracking is activated. In the mobile app, optional usage analytics and advertising measurement both start off and can be changed independently under Settings → Privacy.

12. Marketing Emails

We may send you transactional emails that are necessary to operate your account (such as verification, password resets, and payment receipts). Where you have opted in, we may also send marketing emails about new features, tips, and offers. Every marketing email includes an unsubscribe link, and you can opt out at any time without affecting transactional messages.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our website. The "Last updated" date at the top of this page indicates when it was last revised.

14. Contact

If you have any questions about this Privacy Policy or how we handle your data, contact us at info@ergmaniac.com or through our contact form.

Data controller: PinkyFish d.o.o., Croatia.