Privacy Policy

This Privacy Policy explains how Oblige(“we”, “us”) processes personal data when you use our mobile app, coach admin atapp.oblige.fit, and marketing site atoblige.fit. It should be read together with ourTerms of Service.

The data controller is Enrique Velasco, a natural person operating as a sole trader in Spain.

Privacy requests:hello@oblige.fit.

This policy covers personal data processed through:

• The Oblige mobile application (iOS / Android)
• The coach authoring studio at app.oblige.fit
• The public website oblige.fit (including waitlist and founding-coach forms)

Depending on how you use Oblige, we may process:

You sign in with Apple or Google via Firebase Authentication. We receive a Firebase user ID (UID) and, when the provider supplies them, an email address and display name. Your profile may also store a display name, optional avatar image URL, and bio.

Workouts, programs, session logs, and related training data you create are stored in Cloud Firestore under your user account (users/{uid}/…). This data is owner-scoped: only you can read or write it under our security rules.

Optional progress photos and other images you upload are stored in Firebase Storage under your account path. Access is limited to you (owner-only), subject to our storage rules.

Coaches may publish programs to a storefront. Published program metadata may be visible to signed-in users. If you subscribe to or clone a published program, the copy and subscription record live under your account.

If you join the waitlist or submit a founding-coach form, we collect your email address and any other fields you provide on that form. These submissions are handled by MailerLite on our behalf.

We use Firebase Analytics / Google Analytics 4 on the apps and site to understand product usage (for example session starts, set logging, marketplace subscribe/unsubscribe events) and basic device or app metadata. We do not use this data to sell advertising.

We process personal data for the following purposes and GDPR legal bases (Art. 6):

• Providing the service (accounts, workouts, sessions, storage, marketplace features) — performance of a contract (Art. 6(1)(b)).
• Security, abuse prevention, and reliability— legitimate interests (Art. 6(1)(f)).
• Product analytics to improve Oblige — legitimate interests (Art. 6(1)(f)).
• Marketing emails (waitlist / coach updates via MailerLite) — consent (Art. 6(1)(a)); you can withdraw anytime.
• Optional progress photos — provided by you for the service; where consent is required under applicable law, we rely on consent.
• Legal compliance when we must — legal obligation (Art. 6(1)(c)).

We use trusted providers to operate Oblige:

• Google — Firebase Authentication, Cloud Firestore, Firebase Storage, Firebase Hosting, Firebase Analytics / GA4
• Apple — Sign in with Apple
• MailerLite — waitlist and founding-coach email capture and related email delivery

These providers may process data in the United States or other countries outside the European Economic Area. Where required, transfers rely on the providers’ contractual safeguards (such as Standard Contractual Clauses) and their published terms.

We keep account and training data while your account is active. When you delete your account in the app, we permanently remove your Firestore data, Storage objects under your account, and Firebase Auth user, subject to short technical delays in provider systems.

You may also request deletion by emailinghello@oblige.fit.

MailerLite contacts are kept until you unsubscribe or ask us to delete them. Analytics data is retained according to Google’s product retention settings for our property.

Under the GDPR you may have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (“right to be forgotten”)
• Restrict or object to certain processing
• Data portability
• Withdraw consent where processing is based on consent

The fastest way to erase account data is the in-app delete-account flow (Settings). For other requests, email hello@oblige.fit.

You also have the right to lodge a complaint with the Spanish data protection authority (AEPD) or your local supervisory authority in the EEA.

Oblige is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a minor has created an account, contact us and we will delete it.

We use Firebase security rules, authentication, and owner-scoped paths to limit access to your data. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security.

As described above, some processing occurs outside the EEA under provider safeguards. See Section 5.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Continued use of Oblige after an update means you accept the revised policy, where permitted by law.

Questions about privacy:hello@oblige.fit. For product help, seeSupport.