Privacy Policy

This policy applies to everyone who uses the RAAV mobile application — whether you signed up as an individual user, as an athlete connected to a coach, or as a coach managing athletes. This policy does not cover third-party services we integrate with (each has its own privacy policy, listed in Section 4), other apps you use alongside RAAV, or information you share publicly outside the App.

WHO WE ARE: RAAV, we, our, and us in this document refer to the developers and operators of the RAAV mobile application. You can reach us at raavsupport@gmail.com. We respond to privacy questions and data requests within 30 days, usually much sooner.

WHEN YOU CREATE AN ACCOUNT: Your email address (used for account access and notifications), display name (visible to coaches and athletes you are connected with), password (encrypted by Firebase Authentication — we never see it in plain text), sign-in method (email, Google, or Apple), and account creation date.

WHEN YOU USE THE NUTRITION GOALS QUIZ: The optional quiz that estimates your daily calorie and macro targets asks for your sex, height, weight, goal (lose, maintain, or gain), activity level, and a body-type selection. We use these to calculate your targets. We save your calculated calorie and macro goals, and we save your sex, height, goal, and activity level so the quiz can pre-fill if you take it again. The weight you enter in the quiz is not saved — logging your body weight is a separate action. We do not collect your birthdate. Your unit preference (kg or lb, cm or in) is saved so values display correctly. Your quiz inputs are not shown to coaches.

WHEN YOU USE THE APP: Workouts you log (exercises, sets, reps, weight, duration, notes), body weight history, nutrition logs (foods, portions, macros, timestamps), custom foods you save, saved meals you create, programs you create or receive, coach-athlete connections you establish, and your onboarding progress.

AUTOMATIC DATA: Device info (iOS version, app version, device model) sent in crash reports only. Anonymous usage data — which screens you visit, common errors — used in aggregate. Crash reports scrubbed of personal data where possible. App session data (when you opened the App, how long you used it).

SUBSCRIPTION DATA: We do not see your payment information. Apple handles all payments. We only receive confirmation that you have an active subscription, which tier (free or Pro), and when it renews or expires. We never receive your credit card number, Apple ID, or billing address.

HEALTHKIT DATA: When enabled, the App reads your daily step count from Apple HealthKit. We read only — we never write to HealthKit. Step counts are not stored on our servers and not shared with any third party. Revoke access any time via iOS Settings > Privacy and Security > Health.

WHAT WE DO NOT COLLECT: Your contacts, photos (outside of what you explicitly upload), calendar, microphone, or location. Your activity outside RAAV. Government IDs, social security numbers, or financial account numbers.

TO PROVIDE THE APP: Your account info lets you sign in and identifies you. Your profile data displays your information to you and your coach (if connected) and calculates personalized recommendations. Your workout, nutrition, and body composition data powers your history, charts, and statistics. Coach-athlete data enables the coaching features.

TO IMPROVE THE APP: Crash reports help us find and fix bugs. Aggregate usage data tells us which features are used and where the App is breaking. Legal basis: legitimate interest in providing a working app.

TO MANAGE YOUR SUBSCRIPTION: Subscription state lets the App know whether you have access to Pro features.

TO COMMUNICATE WITH YOU: We send transactional emails (account confirmation, important changes, support responses). We do not currently send marketing emails. If we ever do, you would have to opt in first.

WHAT WE DO NOT DO: We do not sell your data to anyone. We do not share it with advertisers. We do not use your health or fitness data to train AI or machine learning models. We do not profile you for advertising. We do not share data with data brokers.

FIREBASE (Google LLC): Hosts our database, authentication, file storage, and serverless functions. Receives essentially all your account and App data. Data stored in the European Union (europe-west1, Belgium). Privacy policy: policies.google.com/privacy

SENTRY (Functional Software, Inc.): Collects crash reports so we can fix bugs. Receives technical crash info (device model, iOS version, app version, code path). Based in the United States. Privacy policy: sentry.io/privacy

REVENUECAT (RevenueCat, Inc.): Manages our subscription flow. Receives an anonymized identifier for your account, your subscription status, and subscription events. Does not receive your name, email, or any health or fitness data. Based in the United States. Privacy policy: revenuecat.com/privacy

APPLE STOREKIT (Apple Inc.): Processes all in-app purchases. We never see your payment details. Governed by Apple privacy policy: apple.com/legal/privacy

FATSECRET (Spoonacular GmbH): Provides food nutritional data for the food search feature. Receives your search queries — no account identifier is sent. Privacy policy: platform.fatsecret.com/api/Default.aspx?screen=pricpo. Powered by fatsecret Platform API (www.fatsecret.com)

USDA FOODDATA CENTRAL (U.S. Department of Agriculture): Provides nutritional data for the food search feature. Queries are sent anonymously — no account identifier is sent. Privacy policy: www.usda.gov/privacy-policy

OPEN FOOD FACTS: Provides the public food database for food search. Receives your search queries anonymously — no account identifier is sent. Food data is available under the Open Database License (ODbL). Privacy policy: world.openfoodfacts.org/legal

TZAMERET (Israeli Ministry of Health): The Tzameret Israeli food composition database is used as a local food database for Israeli foods. Data is imported and stored on our servers — no queries are sent to external servers at search time. Data source: health.gov.il

GOOGLE SIGN-IN AND SIGN IN WITH APPLE: Enable signing in without a password. They receive notification that a sign-in occurred, governed by their own policies. They do not receive your RAAV data.

All your account and App data is stored in the European Union — Google Cloud data centers in europe-west1 (Belgium). Backend processing also happens in the EU. Some third-party services are based outside the EU (Sentry, RevenueCat, Apple) and receive only the minimum data they need to function. If you use RAAV from outside the EU, your data is transferred to and stored in the EU. By using the App, you consent to this transfer.

ACCESS: All your data is visible in the App itself. For a machine-readable export, email raavsupport@gmail.com and we will provide one within 30 days.

CORRECTION: Edit most data directly in the App. For anything you cannot reach, email us.

DELETION: Delete your account from within the App: Settings > Account > Delete Account. Section 7 explains what gets deleted and what stays.

PORTABILITY: Email raavsupport@gmail.com for a structured export. We respond within 30 days.

OBJECTION AND RESTRICTION: You can object to uses based on legitimate interest (mainly crash reporting). Email us and we will limit processing accordingly.

WITHDRAW CONSENT: For HealthKit, revoke access via iOS Settings > Privacy and Security > Health. For other consents, email us.

COMPLAINT: EU residents can file with their country data protection authority at edpb.europa.eu/about-edpb/about-edpb/members_en. California residents can file with cppa.ca.gov.

FOR CALIFORNIA RESIDENTS: We do not sell your personal information and we do not share it for cross-context behavioral advertising. We do not knowingly process personal information of consumers under 16 years of age.

HOW TO EXERCISE YOUR RIGHTS: Use the App built-in features for most things. For anything else, email raavsupport@gmail.com. We respond within 30 days. We do not charge for these requests and we will not discriminate against you for making them.

WHILE YOUR ACCOUNT IS ACTIVE: We keep your data as long as your account exists. We do not have an automatic inactivity-based deletion policy.

WHEN YOU DELETE YOUR ACCOUNT: We delete: your user account and profile, workout history and exercise statistics, body weight logs, nutrition logs, custom food library, saved meals, notifications, workouts and exercises you created, programs you created, profile photo and uploaded media, and your public profile snapshot. Deletion usually completes within minutes.

WHAT MAY REMAIN AFTER DELETION: Community food contributions: if you added a food to the public community database, the food entry stays but your identity is removed. Programs you sent to other users: the program stays in the athlete account, your identity as sender is anonymized. Notifications you sent to others: stay in the recipient account, sender anonymized. Aggregated anonymous analytics may persist in Sentry or Firebase for up to 13 months with no way to link them back to you.

If you want even anonymized data removed, email raavsupport@gmail.com and we will remove the underlying entries.

All data in transit is encrypted via HTTPS (TLS 1.2 or higher). All data at rest is encrypted by Firebase. Authentication is handled by Firebase Auth using secure password hashing — we never see your password in plain text. Firestore security rules ensure users can only access their own data, and coaches can only access their athletes data through verified relationships. We never see or handle payment card information.

If you believe you have found a security issue, email raavsupport@gmail.com. We treat security reports with priority.

RAAV is intended for users aged 16 and older. We do not collect your birthdate, and we do not have technical means to verify your age — eligibility relies on your confirmation when you create an account.

By using RAAV, you confirm that you are at least 16 years old. Any user who creates an account by providing false information about their age is in violation of these Terms, and is responsible for their own use of the App.

When we update this policy, we update the date at the top. For significant changes, we will notify you within the App before they take effect. We will never retroactively reduce your rights without telling you. Your continued use of the App after a change takes effect indicates your acceptance.

For all privacy-related questions, data requests, or concerns: raavsupport@gmail.com

We respond within 30 days, usually much sooner. For formal data requests (access, deletion, correction, portability), include the email address associated with your account, the specific request, and any relevant context.