SWOLEY
Privacy & Data Protection

Privacy Policy

Effective Date: September 19, 2026•Last Updated: September 19, 2026•Gonzo Software LLC (El Paso, TX)

Gonzo Software LLC ("Company," "we," "us," or "our"), a limited liability company organized under the laws of the State of Texas, USA, operates the Swoley mobile application, the Swoley web application (located at my.swoley.app), and the Swoley marketing website (located at swoley.app) (collectively, the "Service").

This Privacy Policy describes how we collect, process, store, and disclose your personal data when you use the Service, and explains your statutory privacy rights under applicable law.

1. Information We Collect

We collect information you provide directly to us, data generated through your use of the Service, and device telemetry necessary to compute strength metrics:

A. Account & Authentication Information

When registering an account, we collect your name, email address, optional username, encrypted password/session tokens managed via Better Auth, and application preferences (such as weight units in lbs/kg and dark/light UI modes).

B. Strength & Biomechanical Telemetry (Fitness Data)

To power our volume telemetry engine, we collect and store: body weight logs, exercise routines, workout logs (reps, weight lifted, Rate of Perceived Exertion (RPE), rest timer intervals, set types), domain-validated sub-10-rep estimated One-Rep Maximums (1RM), cumulative tonnage, and fractional volume distributions across our 21-muscle anatomical taxonomy. Optional gender fields are used solely for standardized Dots/Wilks relative strength scoring divisions.

C. Community, Social & Leaderboard Information

If enabled, we display your profile avatar, workout activity posts, PR announcements, comments, reactions, and competition lift rankings. You can set your account visibility to public, friends, or private, or completely opt out of leaderboards in your User Settings.

D. Billing & Transaction Data

Payments for Swoley Elite on the web are processed securely via Stripe. In-app mobile subscriptions are processed through the Apple App Store or Google Play Store and verified via RevenueCat. We retain customer reference IDs and entitlement statuses; we do not store raw credit card numbers or CVVs on our servers.

E. Strict AI Workout Generator Privacy Safeguard

Workout generation prompts, muscle focus preferences, and equipment inputs sent to AI APIs (such as OpenAI or Google Gemini) are processed strictly to return real-time workout recommendations. Your personal data, workout logs, and telemetry are NEVER used to train public or commercial third-party foundation models.

F. Offline-First Storage & Diagnostics

Swoley stores active workouts locally on your device via client-side IndexedDB (Dexie) so workouts can be logged in gym dead zones. Data synchronizes idempotently with Convex cloud servers upon reconnection. We also collect basic hardware device specs, crash diagnostics, and server access logs via Cloudflare and Convex.

2. How We Use Your Information

We process your information to:

  • Calculate 21-muscle volume analytics and progressive overload recommendations.
  • Securely authenticate your account and sync data across your mobile and web devices.
  • Process subscriptions, verify entitlements, and enforce freemium quotas.
  • Deliver social feed updates, friend connections, and verified competition rankings according to your privacy settings.
  • Maintain platform security, prevent unauthorized automated scraping, and detect leaderboard cheating.

3. Third-Party Service Providers

We do not sell your personal data. We disclose information only to service providers performing operational functions under data processing agreements:

  • Convex: Cloud database, backend computation, and real-time synchronization.
  • Stripe: Payment processing and web billing portal.
  • RevenueCat: Mobile in-app subscription verification for iOS and Android.
  • Cloudflare: Edge routing, DDoS defense, and static content hosting.
  • AI Inference APIs: Ephemeral completion of custom workout generations.

4. Children's Privacy (COPPA)

Swoley is not directed to children under 13 years of age. We do not knowingly collect personal data from children under 13. If you become aware that a child under 13 has provided us with personal information, contact us at privacy@swoley.app, and we will promptly delete the data. Athletes between 13 and 17 must have parental or guardian consent.

5. Data Retention & Account Deletion (Right to Erasure)

We retain your information as long as your account is active. You have the right to permanently delete your account and all associated personal data and workout logs at any time directly within the application without needing to submit an email request.

How to Delete Your Account in the App:

  1. Open the Swoley app and navigate to Settings (or tap your athlete avatar and select Preferences & Profile).
  2. Scroll to the Danger Zone section at the bottom of the dialog and click Delete Account.
  3. Review the deletion confirmation modal:
    • Stripe Web Subscriptions: Active web subscriptions processed through Stripe are automatically cancelled immediately upon account deletion.
    • Apple App Store & Google Play Subscriptions: Subscriptions billed through Apple or Google Play cannot be cancelled by third-party apps and must be cancelled directly in your device's Apple ID or Google Play Store account settings. Direct links are provided in the dialog.
  4. Type DELETE in the confirmation box and click Permanently Delete My Account.

Upon confirmation, all your personal information, workout sessions, exercises, sets, personal records, workout routines, body weight logs, leaderboard rankings, social interactions, and Better Auth authentication credentials will be immediately and irreversibly purged from our active Convex database, and all local offline device caches will be wiped. If you are unable to access the application, you may alternatively email privacy@swoley.app to request manual assistance.

6. Your Rights & Self-Service Data Portability (GDPR, CCPA/CPRA & TDPSA)

Depending on your location (including the European Union, United Kingdom, California, and Texas under the Texas Data Privacy and Security Act), you possess statutory privacy rights regarding your personal information:

  • Right to Data Portability (Instant In-App Export): You can download a complete, portable copy of all your fitness metrics and account data directly in the app at any time without submitting a request. In Settings > Preferences & Profile, click Export My Data (ZIP) to immediately receive a packaged archive containing:
    • swoley-data-export.json: Machine-readable profile metrics, lifetime statistics, routines, and complete workout histories.
    • workouts_and_sets.csv: Spreadsheet of all completed workouts, exercises, sets, weights, reps, and RPE values.
    • personal_records.csv: All logged one-rep max milestones and achievement dates.
    • bodyweight_history.csv: Chronological body weight logs and check-in notes.
  • Right to Erasure (Self-Service Deletion): You may permanently purge your account and all associated telemetry in real time via Settings > Delete Account as detailed in Section 5.
  • Right to Rectification: You may edit and correct your display name, username, body weight, and unit preferences at any time in your User Settings.
  • Right to Non-Discrimination: We do not discriminate against any athlete for exercising their privacy rights.
  • Right to Opt-Out of Sale / Targeted Advertising: We do NOT sell your personal data or fitness metrics, nor do we share your information with data brokers or utilize third-party targeted advertising.

For questions or assistance regarding your statutory rights, please contact our privacy team at privacy@swoley.app.

7. Contact Information

For questions, concerns, or requests regarding this Privacy Policy, please contact our privacy team:

Gonzo Software LLC

El Paso, Texas, USA

Email: privacy@swoley.app

Website: https://swoley.app