Privacy Policy
1. Controller and contact
ORYKON is operated by Paul Braun, an individual (natural person), at Rudolfstraße 231, 8047 Graz, Austria. Paul Braun is the controller responsible for the processing described here. Privacy, account and support requests can be sent to support@orykon.com.
2. Information processed
ORYKON processes information needed to operate an athlete account, calculate and display an athletic profile, provide optional public rankings, secure the service and provide support.
- Account and identity: email address, Supabase user ID, username/handle, optional display name and authentication/session information.
- Athlete profile: date of birth where provided, derived age, scoring sex/gender selection, bodyweight, training focus, goal, archetype, onboarding state and leaderboard visibility.
- Fitness and performance: exercises, sets, repetitions, weights, times, distances, personal-best history, calculated scores, ORYKON SCORE, Laurels and progress. Detailed history is currently stored primarily on the device.
- Leaderboard summaries: username, archetype, derived age, scores, coverage and ranking snapshot fields.
- Support and beta feedback: messages, optional screenshots, category and enabled technical diagnostics.
- Local data: theme, language and unit preferences, cached assets, pending verification state and local athlete record.
3. Purposes and legal bases
Information is used to authenticate accounts; provide scoring, progress and ranking features; save settings; secure the service; prevent misuse; recover accounts; and answer support or privacy requests. Necessary service processing is based on performance of the user agreement (Article 6(1)(b) GDPR). Security, abuse prevention and reliable operation rely on legitimate interests (Article 6(1)(f)). Legal obligations rely on Article 6(1)(c). Optional processing that legally requires consent relies on Article 6(1)(a), and consent may be withdrawn for the future.
ORYKON currently includes no advertising, behavioral tracking or third-party analytics SDK.
4. Providers and recipients
- Supabase — authentication, database/profile storage, leaderboard snapshots, private beta-feedback and screenshot storage, and server-side account deletion.
- Resend — transactional verification and password-recovery email delivery through Supabase SMTP.
- Namecheap — domain, DNS, website hosting and support-email services once configured.
- Expo/EAS — development, build and update infrastructure where used for distributed builds.
- Apple — App Store and TestFlight distribution under Apple’s own terms and settings.
5. Leaderboard visibility
Visibility is Public by default. While Public, ORYKON may display the username/handle, archetype, derived age for active age filters, ORYKON SCORE and pillar scores or coverage. Date of birth, email and credentials are not public leaderboard fields. Select Private under Settings → Identity → Leaderboard visibility to stop appearing in leaderboard results.
6. Retention and deletion
Account and profile data are retained while the account is active. Support correspondence and beta feedback are retained only as reasonably necessary to resolve requests, investigate reports, protect legal claims or meet legal obligations, and are reviewed for deletion when no longer needed.
Permanent deletion is available under Settings → Account → Delete account. It deletes the Supabase Auth account, associated user-owned backend records and private feedback files, and clears that account’s local athlete record. Residual copies may remain temporarily in provider backups until rotation; they are not used for ordinary processing and are restored only for disaster recovery or legal requirements.
7. User rights
Depending on applicable law, users may request access, correction, deletion, restriction, objection, withdrawal of consent for the future, and portability where applicable. Requests can be sent to support@orykon.com. Users may complain to their competent authority. In Austria: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at.
8. Security
ORYKON uses authenticated Supabase sessions, row-level database policies and server-side account deletion. Privileged Supabase admin credentials are not embedded in the mobile app. No internet service can guarantee absolute security.
9. Age
ORYKON is intended only for users aged 16 or older. Account creation confirms this minimum age. A provided birth date is used to derive age for leaderboard filtering and is not an identity-verification system.
10. International processing
ORYKON is offered worldwide. Providers may process information in the EEA, United States or other countries. Where applicable, ORYKON relies on recognized safeguards such as adequacy decisions or Standard Contractual Clauses.
11. Changes
Material changes will be published with a revised date and communicated where required by law.