Privacy Policy
1. Controller and contact
ORYKON is operated by Paul Braun, an individual (natural person), at Rudolfstraße 231, 8047 Graz, Austria. Paul Braun is the controller responsible for the processing described here. Privacy, account and support requests can be sent to support@orykon.com.
2. Information processed
ORYKON processes information needed to operate an athlete account, calculate and display an athletic profile, provide optional public rankings, secure the service and provide support.
- Account and identity: email address, Supabase user ID, username/handle, optional display name and authentication/session information.
- Athlete profile: date of birth where provided, derived age, scoring sex/gender selection, bodyweight, training focus, goal, onboarding state and leaderboard visibility.
- Fitness and performance: exercises, sets, repetitions, weights, times, distances, personal-best history, calculated scores, ORYKON SCORE, Marks and progress. Detailed history is currently stored primarily on the device.
- Leaderboard summaries: username, derived age, scores, coverage and ranking snapshot fields.
- Social features: friend requests and friendships, clubs you create or join with their name, handle, description and your role, club invitations and join requests, a player card summary (ORYKON SCORE, pillar scores, coverage, status, up to three chosen Marks and the number of Marks earned), athletes you have blocked, and reports you submit with their reason and optional note.
- Support and beta feedback: messages, optional screenshots, category and enabled technical diagnostics.
- Local data: theme, language and unit preferences, cached assets, pending verification state and local athlete record.
3. Purposes and legal bases
Information is used to authenticate accounts; provide scoring, progress and ranking features; save settings; secure the service; prevent misuse; recover accounts; and answer support or privacy requests. Necessary service processing is based on performance of the user agreement (Article 6(1)(b) GDPR). Security, abuse prevention and reliable operation rely on legitimate interests (Article 6(1)(f)). Legal obligations rely on Article 6(1)(c). Optional processing that legally requires consent relies on Article 6(1)(a), and consent may be withdrawn for the future.
ORYKON currently includes no advertising, behavioral tracking or third-party analytics SDK.
4. Providers and recipients
- Supabase — authentication, database/profile storage, leaderboard snapshots, private beta-feedback and screenshot storage, and server-side account deletion.
- Resend — transactional verification and password-recovery email delivery through Supabase SMTP.
- Namecheap — domain, DNS, website hosting and support-email services once configured.
- Expo/EAS — development, build and update infrastructure where used for distributed builds.
- Apple — App Store and TestFlight distribution under Apple’s own terms and settings.
5. Visibility to other athletes
Leaderboard visibility is Public by default. While Public, ORYKON may display the username/handle, derived age for active age filters, ORYKON SCORE and pillar scores or coverage, and other athletes can find you by handle. Someone who is not connected to you only sees your handle and ORYKON SCORE. Date of birth, email and credentials are never shown. Select Private under Settings → Identity → Leaderboard visibility to stop appearing in leaderboard results and handle search.
Accepted friends and members of a club you share can see your full player card: ORYKON SCORE, pillar scores, coverage, status and up to three Marks you chose to show. Individual performances, sets and weights are never shared. Leaving a club or removing a friend ends that access.
You can block another athlete. Blocking hides you from each other in search, rankings and player cards, removes any friendship between you, and stops further requests. The blocked person is not notified. You can also report an athlete or a club; a report stores your user ID, the subject, your reason and optional note so it can be reviewed, and is not visible to the person reported.
6. Retention and deletion
Account and profile data are retained while the account is active. Support correspondence and beta feedback are retained only as reasonably necessary to resolve requests, investigate reports, protect legal claims or meet legal obligations, and are reviewed for deletion when no longer needed.
Permanent deletion is available under Settings → Account → Delete account. It deletes the Supabase Auth account, associated user-owned backend records including friendships, club memberships, invitations, blocks and reports you submitted, and private feedback files, and clears that account’s local athlete record. Residual copies may remain temporarily in provider backups until rotation; they are not used for ordinary processing and are restored only for disaster recovery or legal requirements.
7. User rights
Depending on applicable law, users may request access, correction, deletion, restriction, objection, withdrawal of consent for the future, and portability where applicable. Requests can be sent to support@orykon.com. Users may complain to their competent authority. In Austria: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at.
8. Security
ORYKON uses authenticated Supabase sessions, row-level database policies and server-side account deletion. Privileged Supabase admin credentials are not embedded in the mobile app. No internet service can guarantee absolute security.
9. Age
ORYKON is intended only for users aged 16 or older. Account creation confirms this minimum age. A provided birth date is used to derive age for leaderboard filtering and is not an identity-verification system.
10. International processing
ORYKON is offered worldwide. Providers may process information in the EEA, United States or other countries. Where applicable, ORYKON relies on recognized safeguards such as adequacy decisions or Standard Contractual Clauses.
11. Changes
Material changes will be published with a revised date and communicated where required by law.