500KG Privacy Policy

Controller and scope

The controller is Feliz Co., Ltd. This Policy applies to the 500KG Android phone and Galaxy Watch apps and the 500kg.app website.

Information we process

Account and setup

• Required: email, authentication information, account ID, and display name
• Setup: birth year, gender, height, weight, training experience and goals, weekly frequency, interests, and injury selection
• 500KG does not store your plaintext password. It is encrypted in transit to Supabase Auth for authentication.

Workout and fitness information

• Exercises, sets, weight, reps, RPE, rest, volume, routines, personal records, and notes
• Optional body measurements and condition logs, plus game progress such as XP, quests, badges, and character data
• Heart rate during an active workout if you grant permission on a Galaxy Watch

Optional and automatic information

• Expo push token if you enable notifications
• Pseudonymous account ID, app/OS and device information, error type and stack, and sampled performance data in builds where diagnostics are enabled
• Security and network metadata such as IP address, request time, and user-agent. This may reveal an approximate region.

The free v1 public scope does not collect payment data, contacts, calendars, microphone or camera files, or public community posts.

Why we process it

• Registration, email verification, sign-in, password recovery, and account management
• Storage and synchronization of workouts, routines, statistics, records, and game progress
• Optional Galaxy Watch heart-rate and push notification features
• Error analysis, performance, security, fraud prevention, and support
• Recording legal-document versions and handling privacy requests

Retention and deletion

We keep account, profile, workout, routine, fitness, and game data while your account is active and delete it from active systems when account deletion is completed. The free v1 release has no payment transactions, so we do not apply a blanket commerce-record retention period.

• Push token: removed on logout, permission withdrawal, account deletion, or confirmed invalidity
• Error and performance events: rotated after the retention period configured for the production project
• Web, authentication, and security logs: rotated after the minimum period needed for security and incident response
• Support email: deleted after the request and any necessary dispute period are complete

If law requires separate retention, we isolate only the required information and delete it after that period. Limited backup or security-log copies are separated from ordinary service use and may remain until the provider's normal overwrite or deletion cycle.

Electronic files are deleted so they are not readily recoverable; paper records, if any, are shredded or destroyed.

Disclosure, processors, and international processing

500KG does not sell your information. In the free v1 release, private workout records are not shown to other users. We do not disclose personal information to independent third parties unless required by law or separately authorized by you.

The providers below process information on our behalf. Transfers occur over encrypted networks when you use the app, website, updates, or notifications. We request deletion when your account is deleted, the purpose ends, or the contract ends, subject to limited provider log and backup cycles.

You may avoid optional international processing by not enabling push notifications or Watch heart rate, or by deleting your account. Refusing Supabase authentication and storage means we cannot provide the account-based core service.

Your rights and choices

Subject to applicable law, you may request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or account deletion. Edit supported profile information in the app and review the account deletion page for in-app and web options.

Include only your 500KG account email in a request. Do not send a password, workout records, or identity document unless we provide a secure, necessary verification step. An authorized guardian may act where applicable after we verify the relationship.

Security measures

• TLS in transit and provider encryption at rest
• Per-user access controls, Row Level Security, least privilege, and private file storage
• Separation of authentication tokens and administrative keys from app code
• Removal of emails, request bodies, and headers from diagnostics, using a pseudonymous account ID
• Ordered removal of stored files, app data, and the authentication identity during account deletion

Children

500KG is not directed to children under 14 in South Korea and does not permit registration below 14 until a verified guardian-consent process exists. In other countries, users must meet the local digital-consent age or have legally valid guardian consent.

If you believe a child's information was processed without valid authorization, contact us so we can investigate and delete it or apply appropriate safeguards.

Website and cookies

500kg.app currently uses no login, advertising, behavior analytics, or non-essential cookies. Cloudflare may process technical request data such as IP, user-agent, time, and path to deliver and secure the website.

Changes and contact

We announce changes in the app or on this website before they take effect. Material changes affecting your rights receive reasonable advance notice, and we request renewed consent where required.

You may also contact the data-protection authority or dispute-resolution body in your jurisdiction.