Legal

Privacy policy

Last updated: 1 October 2026

This is a translation of the Spanish original. If the two ever differ, the Spanish version prevails.

Chuzi is a workout logging app. This policy explains what data it handles, where it ends up and what you can do about it. It is written from what the code actually does, not from a template.

The essentials

• You can use Chuzi without an account. As a guest, everything you log stays on your phone and never leaves it.
• With an account, your data is copied to the cloud so you can recover it if you change phones or reinstall.
• No data is sold to anyone. There are no ads or ad networks in the app.

Who is responsible for your data

Data controller: Pol Canet Bartés, in the province of Barcelona (Spain). Contact: chuzisupport@gmail.com.

What is stored, why, and on what legal basis

Weight, body measurements and heart rate are health data. That is why they are only processed if you enter them or connect the watch, and you can delete them whenever you like.

How long it is kept

• Without an account: while the app is installed. Uninstalling it removes them.
• With an account: while the account exists. Deleting it from Settings also deletes what was in the cloud.
• Crash reports: Firebase Crashlytics’ retention periods, up to 90 days.

Permissions the app asks for, and why

• Location — only while you record a cardio activity. Without it there is no route or distance. If you don’t use cardio, you never need to grant it.
• Camera — only to scan food barcodes. The image is processed on the phone itself and sent nowhere.
• Notifications — for the rest timer, workout reminders and notices from your friends.
• Body sensors (on the watch) — to read your heart rate during the workout.
• Vibration and foreground services — so the rest timer keeps counting with the screen off.

Who it is shared with

Chuzi talks to these services, and only for what is stated:

• Google Firebase (Google Ireland Ltd.) — account, backup of your data and crash reports. It also delivers the social notices (Firebase Cloud Messaging) and runs, on its servers in the European Union, the ranking checks and the clean-up when an account is deleted (Cloud Functions).
• Google Maps (Google Ireland Ltd.) — draws the map your cardio route is shown on. To draw it, the phone asks Google for the map of the area you are in, so Google receives that area and your IP address. What it does not receive is your route: the line is drawn on the phone over the map, and the GPS points stay on your phone and in your backup.
• Open Food Facts — when you scan a barcode, that code is looked up to get the product.
• wger — illustrations and descriptions of some exercises.

Nothing of yours is sent to the last two: they are asked for public information (a barcode, an exercise).

If you don’t use the cardio part, your phone never talks to Google Maps.

The social side

The social side only exists if you create an account. Friends are made with an invite code that expires after a week: redeeming it stores the friendship between the two accounts, and either of them can undo it.

Your accepted friends always see your display name and what you send them: a routine you send them or a gym plan you suggest, with the time and who is joining.

Your progress is only shared if you turn on Share progress in Settings. It comes switched off and you switch it off in the same place. With it on:

• Your accepted friends see your per-exercise history (dates, top weight, volume and reps), your week and whether you are training at that moment.
• Your best mark in each exercise counts towards a global table. Your name, your identifier and your exact weight are not in it: one person is just added to the band you fall into, which is what lets the app tell you your percentile without publishing anyone’s numbers.
• So that each person counts only once, your account stores which band you count in for each exercise. Only you can read it.

Social notices (a new friend, a routine or a plan) arrive straight away through Firebase Cloud Messaging. For that, every phone you sign in on stores an installation identifier in your account, used only to deliver those notices: it says nothing about you, changes when you reinstall and is deleted when you sign out. The notice carries only its type and your friend’s name; your phone writes the text. If Cloud Messaging fails, your phone keeps checking your account every so often and notifies you itself.

A server checks that every ranking mark really comes from the history you share, and corrects the ones that don’t. When you delete your account, your ranking markers are deleted too and you are removed from the global table, along with your registered phones.

Your profile

If you have an account, the app publishes a profile with your display name, the description you write, your avatar’s colour and icon, your streak, your average days per week, three of your best lifts (the ones you choose, or the main ones if you don’t; and how many times your bodyweight you lift, if you have it logged) and since when you have been training. You choose who sees it: only your friends (the default), anyone with an account or nobody. Change it in Social → Your profile whenever you like.

If you make it public and have Share progress on, you also appear with your name and your best mark in each exercise’s leaderboard. A server writes that leaderboard after checking the mark against your history, and you leave it as soon as your profile stops being public or you delete your account. The server also checks the description and removes insults and contact details.

Train together

If you create a group workout or join one, the people in that group see your display name, whether you have joined and, when you finish, the result of that workout: your best set in each exercise, the volume, the sets, the duration and how much you improved on your previous best. Nothing else from your history. Only the group sees it, it is published when you finish (not during the workout) and it is deleted automatically after 30 days, or earlier if you delete your account.

Public routines (Discover)

If you publish a routine, it is stored in the cloud and anyone with an account can see it: the routine, the name and description you give it, its tags and your display name. It is only published when you do it, routine by routine, and you can unpublish it whenever you like.

When you copy, rate or report a routine, the fact that you did is stored (so each person counts once); others only see the total, not who. Authors you block are stored in your account and only you see them. A server reviews the text of published routines to hide insults and contact details. Deleting your account deletes your published routines, your ratings and everything else in this section.

Health Connect

If you turn it on in Settings, Chuzi connects to Health Connect, Android’s health data store, and asks for only four permissions:

• Write workouts: every finished workout is saved as a strength session, and every cardio session with its type, start and duration.
• Write distance: the distance of your cardio sessions.
• Read weight: fills in the days you haven’t logged in Weight and measurements. What you enter always wins.
• Read steps: to show you today’s.

Health Connect stores that data on your phone. Chuzi doesn’t send what it reads from there to any server, doesn’t use it for advertising and doesn’t sell or transfer it. Imported weight becomes one more entry in Weight and measurements, and like the rest it is copied to the cloud only if you have an account. You can turn it off in Settings and remove each permission in Health Connect whenever you like.

Chuzi’s use of information received from Health Connect complies with the Health Connect permissions policy, including the Limited Use requirements.

Transfers outside the European Union

Firebase and Google Maps may process data on servers in the United States. Google relies on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses, which are the safeguards provided for in Article 46 of the GDPR.

This website

The website is separate from the app and collects data in one place only: the launch notice form.

• What we ask for. Your email address, and nothing else.
• Why. To write to you once, when Chuzi is published on Google Play. No newsletter, no second email, and it is not passed on to anyone.
• Legal basis. Your consent, given by ticking the box on the form.
• How long it is kept. Until that notice is sent. After that the whole list is deleted.
• How to leave. Write to chuzisupport@gmail.com.
• Who stores it. The form is processed by the provider hosting this website, acting as data processor, which may process the data outside the European Union with the European Commission’s standard contractual clauses as the safeguard (Article 46 of the GDPR).

Fonts are served from this same domain, not from Google Fonts: opening the website does not send your IP address to any third party. For cookies and local storage, see the cookie policy.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent whenever you like, by writing to chuzisupport@gmail.com. You will get an answer within one month.

On top of that, inside the app you can save a full copy to a file, export your history to CSV, turn off crash reports and delete your account with everything it has in the cloud.

If you believe your rights have not been respected, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

Children

Chuzi is not aimed at children under 14 and does not knowingly collect data from them.

Changes

If this policy changes, the date above is updated. If the change affects what is done with your data, you are told inside the app before it applies.