RAW — Privacy Policy

Version 6 · 18 October 2026

This is the policy for RAW now that it has an account and a cloud backup. It says only what is true today. Every change is versioned and dated; what changed since version 5 is at the end.

In one sentence

RAW needs an account, and keeps a copy of what you log on a server in the European Union so that a new phone gets it all back; we do not sell it, we run no analytics and no advertising, and your health data goes into that copy with the consent you give when you sign in.

What is required and what is not

To use RAW you need three things, all on the last screen of setup: an account (with Google or your email, or with Apple on an iPhone), accepting the terms and this policy, and being 16 or over. Tapping «Continue with Google», «Continue with Apple» or «Continue with email» is how you accept them; the sentence above the buttons says so.

The same tap does two more things:

• it agrees that your backup includes your health data (listed under «Health data»). It goes with your account: to withdraw it, delete your account, and your backup is erased from the server;
• it starts crash reports, which you can turn off at any time under Settings › Privacy without losing RAW.

There is no separate box to tick: the sentence above the buttons names each of these, and tapping one of them is your agreement to all of it. If you do not want your health data in the backup, do not sign in; once you have, the way to take it back is to delete your account.

Everything else is optional: your name, your photo, your year of birth, your sex, your height, your weight, your body measurements and your progress photos. You can skip them, leave them empty or choose “Prefer not to say”, and RAW works just the same.

Your account

Your account is handled by Supabase Auth, a service that processes it on our behalf, on servers in the EU (Frankfurt, Germany).

• With Google or Apple, the phone’s own sign-in sheet opens. Google or Apple confirms who you are and gives the account your email and an identifier for you; Google also gives your name and a link to your profile picture, which Supabase stores with the account. RAW does not use the name; it uses the link once, at the sign-in that creates your account (see «What RAW sends»). From Apple, RAW asks only for your email: the account gets that and an identifier, never your name or a picture. With Apple you can hide your email: the account then gets Apple’s relay address. Google and Apple learn that you signed in to RAW; what they do with that is under their own privacy policies.
• With your email, RAW sends you a one-time link that opens the app. That email is sent through Resend (see «Who receives your data»). There is no password.

If you sign in with Apple on an iPhone, RAW’s server also keeps a token Apple gives it for your account (Apple’s «refresh token»). It is used for one thing only: when you delete your account, RAW sends it back to Apple to end RAW’s access to your Apple ID, as Apple requires. It is kept with your account and deleted with it; RAW never uses it to read anything from Apple.

Supabase also keeps, as any sign-in service does, when the account was created and when it last signed in. Each sign-in, sign-out and session renewal also goes to Supabase Auth’s security log, with the account’s identifier, its email and the IP address it came from. That log is not kept in RAW’s database: it lives in Supabase’s own logging service, in the EU, which deletes each entry after 7 days. Deleting your account does not remove entries already in it; they go when those 7 days are up.

The account’s identifier is a random code. It is the only thing that links your backup, your crash reports and your RAW PRO purchases; your email is never sent to any of them.

One phone at a time. The phone you signed in on last is the one that writes to your backup. If you sign in on another phone, that one takes over: the first one, the next time it tries to back up, sends only the entries it had newly created, stops, and asks you to sign in again; changes it made to existing entries after the takeover are not backed up.

What RAW stores, and where

On your phone, everything below. In your backup, everything below except what is marked «phone only».

• the exercises you create (the catalogue that ships with the app is the app’s, not yours: it is not in your backup);
• your workouts once you finish them: date and time, duration, exercises, sets, weights, reps, times and distances; if you log them, the effort of each set, how you felt and the effort of the workout; the title and any notes you write. A workout in progress is phone only until you finish it, and one you discard never leaves the phone. Your records and statistics are worked out from your workouts again on each phone, so they are not stored in the backup;
• your routines and folders, with their notes and the days they are due;
• your profile, if you fill it in: name, year of birth, sex and height; the look you choose for the exercise drawings — body type, skin tone, hair colour and outfit (skin tone and hair colour start with a default, so one is saved even if you never choose); and your answers when you set the app up (goal, experience, days a week, workout length, equipment and what you want to work on most). A skin tone could be read as saying something about your racial or ethnic origin, so the drawings’ look goes into your backup on the same explicit consent as your health data (see «Health data»);
• your body measurements, if you log them: weight, body fat percentage and circumferences (neck, shoulders, chest, abdomen, waist, hips, and upper arm, forearm, thigh and calf on each side), with the date and notes of each entry;
• your progress photos and your profile photo, with their date: each one as RAW saved it (stripped of metadata, see below) and a small thumbnail of it;
• the equipment at each place you train: bars, plates, dumbbells, machines;
• your training settings: units, rest, warm-up and how sets are filled in;
• your phone’s settings — appearance, language, notifications, sounds, lock-screen detail — phone only;
• the record of your consents: which ones you gave or withdrew, when, in which language and under which version of this policy. The crash-reports switch is phone only.

RAW uses all this to show you your history, work out your records, suggest plates and warm-up sets with your equipment, sort and adapt the routine templates, and give it all back on a new phone. If you give your year of birth, the templates are adapted to your age. The template recommender does not use your sex, weight or height.

To pick the starting units — kilograms or pounds — RAW looks at the region set on your phone. It stores the unit, not the region.

The backup

Your backup lives in a Supabase Postgres database in the EU (Frankfurt, Germany), and your photos in Supabase Storage, in the same place, in a private folder of your account. The database only lets your account read or write your rows (row-level security), and the folder only lets your account add, open or delete its photos. Every connection is encrypted, and Supabase encrypts everything it stores (AES-256).

It is not end-to-end encrypted: the server can read it. That is a choice: it is what lets your history come back on any phone you sign in on. We do not sell it, we do not use it for advertising, and nothing in it goes to any analytics service.

Who at RAW can see it: only Randy, who runs RAW, through Supabase’s administration console or a private administration page. He can look at any account, your name, email and health data included, for three reasons: to understand how RAW is used and make it better, to help you when you ask, and when the law obliges us. What he sees is never shared, sold or published. No one else at RAW has access. You agree to this when you sign in, with the health data, and it ends when you delete your account.

RAW backs up in batches, never while you log: when you finish a workout, when you open RAW and when you come back to it. Without a connection, RAW works as before and backs up later. If your session expires, logging goes on, the backup pauses, and RAW asks you to sign in again.

Photos are backed up the same way, after the rest, and never while you train. On a new phone, the thumbnails come down on their own after your history; each photo itself comes down when you open it. Until then, or without a connection, you see a grey tile with its date.

When you sign in on a phone and your account already has a backup, RAW downloads all of it to that phone, and what you had answered during setup on that phone is replaced by it.

How it is protected on the phone

The database on the phone and the photos are not encrypted by RAW: they rely on the phone’s own encryption, which every recent iPhone and Android phone applies to the apps’ files. On iPhone they can only be opened once the phone has been unlocked after starting up. When RAW deletes something, SQLite overwrites it on disk.

Before saving a photo, RAW strips its metadata — location, date, phone model — and keeps only the orientation. It deletes the temporary copy the system leaves when you take or pick the photo. It does not touch the photo in your gallery.

The database, the photos and the account’s session are left out of system backups — iCloud and computer backups, Google backups, and Android’s transfer to a new phone — because your RAW backup is the copy that counts.

The consequence: if you lose your phone, replace it or uninstall RAW, you get everything back by signing in again, photos included, except what had not been backed up yet (for example, if you uninstall without a connection right after a workout or a photo).

What RAW sends

• Your backup and your photos, to Supabase, as described above.
• Sign-in: to Supabase, and to Google or Apple if you use them; and your email address to Resend if you sign in with your email.
• Your Google profile picture: when signing in with Google creates your account, RAW downloads your Google profile picture once, from Google’s servers, at that sign-in, and saves it as your profile photo (it then goes into your backup like any profile photo). Google receives that request like any image a phone loads. RAW never replaces a photo you chose with it, and you can change or delete it like any profile photo; once you delete it, it does not come back, not even when you sign in again. Apple gives no picture.
• Crash reports, to Firebase Crashlytics, described below.
• RAW PRO: to RevenueCat, described under «RAW PRO».

Anything else leaves the phone only when you do it yourself:

• Export my data (Settings › Data) prepares your workouts, measurements and routines as CSV, and all your data as JSON, without photos, and opens the system share sheet. The file is not encrypted. You choose where it goes, and from then on it is handled by the app or service you send it to.
• Recommend RAW opens the share sheet with a short text and the link getraw.fit/app, or shows you a QR code with that same link. It carries no data of yours, and RAW does not know whether you share it or with whom.
• Links — the terms, this policy, or one you put in a routine’s notes — open in the system’s in-app browser (Safari on iPhone, Custom Tabs on Android), which loads the page like any browser. RAW passes it no data of yours.

Notifications — the end of a rest, a workout left open, the weekly reminder — are scheduled by the phone itself. They go through no server.

Crash reports

If something goes wrong in RAW or it closes unexpectedly, it sends a technical report so we can fix it. Reports start when you sign in; the sentence above the sign-in buttons says so. You can turn them off under Settings › Privacy at any time; from then on nothing is sent, and reports still waiting on the phone are deleted. The switch belongs to each phone: on a new phone, or after reinstalling, reports are on again until you turn them off.

A report is sent through Firebase Crashlytics, a Google service that processes it on our behalf. It contains:

• what went wrong: the type of error and where in the code it happened; for errors raised by the phone’s system or by native code, the technical message they carry; and for errors raised by the app framework, its one-line technical summary, with any identifier cut out;
• the names of the last screens you opened, not what they showed;
• each time RAW opens, a short note with the same technical details, so we can tell what share of uses end without a fault;
• the app’s version, the phone’s model, its system version, its memory and free space, and whether RAW was in the foreground;
• how many changes are waiting to be backed up, and, when the server refuses one, which kind of entry it was and the error code, never its content;
• your account’s identifier (the random code, not your email), so that we can tell whether a fault keeps happening to the same person;
• random identifiers created by Firebase for this installation, so that the same fault on the same phone is counted once.

So reports are linked to your account, though not to your name or your email. They do not contain your name, your email, your workouts, your measurements, your photos, your notes or anything else you type or log. RAW writes its own error messages without any of that, and of the other errors in its own code it sends only the type, never the message.

Google keeps crash reports for 90 days. We use them only to find and fix faults, on the basis of our legitimate interest in RAW working (Article 6(1)(f) GDPR), and you can object at any time by turning them off. If you delete your account, reports still waiting on the phone are deleted; those already sent expire within those 90 days.

RAW PRO

RAW PRO is the paid part of RAW, where your version of the app offers it. Logging your workouts never needs it, and neither does the backup.

The payment is made in the App Store or Google Play, under their terms, with the account you use there. RAW never sees your card or your store account.

To know whether you have RAW PRO, RAW uses RevenueCat, a service that processes purchase data on our behalf. RAW connects to it on your account’s identifier when you sign in and each time it opens while you are signed in (after it has opened, without making you wait), so that RAW PRO is ready when you open it and a purchase follows your account to another phone.

What RevenueCat receives:

• your account’s identifier (the random code, not your name, your email or your store account);
• your purchases in RAW: the product, its price and currency, the dates, and the receipt the store issues;
• technical details: the app’s version, the phone’s system and version, its language and the store’s country;
• on iPhone, the identifier Apple gives this app on this phone (the «vendor identifier»), sent with every request. It is not the advertising identifier, and it is not used to track you.

It does not receive your name, your email, your workouts, your measurements, your photos or anything else you log. RAW keeps on the phone only whether you have RAW PRO and until when, so it keeps working offline.

We use this data to provide what you paid for (Article 6(1)(b) GDPR). RevenueCat keeps it while you have your account. When you delete your account, RAW asks RevenueCat to delete everything it holds under your identifier, and RevenueCat carries the deletion out shortly after. The App Store or Google Play keep their own record of the payment and its invoice, under their own terms. RAW PRO may show you a last offer once if you close it without buying; that is recorded only on your phone.

Deleting your account does not cancel a subscription: you cancel it in the App Store or Google Play. RAW reminds you of this when you delete the account with RAW PRO active.

Analytics and advertising

RAW contains no analytics SDK and no advertising SDK: nothing measures how you use the app. It does not track you across apps or websites, and it does not use an advertising identifier. Your backup is not used to profile you. Three things the app stores count as «analytics» in their forms: Randy looking at accounts to understand how RAW is used (see «Who at RAW can see it»), the crash reports (to find and fix faults, see above) and RevenueCat’s subscription figures (how many people pay, from the purchases themselves, see «RAW PRO»).

Health data

What you log about your body and about how a workout went is health data, special category data under Article 9 GDPR. In RAW that is:

• your body measurements: weight, body fat percentage and circumferences, with their notes;
• in each workout: the title, your notes, the routine’s notes as they were copied into it, how you felt, the effort of the workout and of each set, and your body weight on that day;
• heart rate and calories, if a later version reads them from Apple Health or Health Connect; RAW does not ask for them today;
• your progress photos.

These go into your backup with your explicit consent, which you give with the sign-in tap, on every phone you sign in on: the sentence above the buttons names them. The same consent covers the look you choose for the exercise drawings (see «What RAW stores»). The consent goes with your account; to withdraw it, delete your account (Settings › Account › Delete account), which erases your backup, your photos and your account from the server.

The rest of a workout — exercises, sets, weights, reps — can also say something about your body. RAW does not split your log into parts that are backed up and parts that are not: everything you log goes into the backup with that same consent, so nothing depends on where the line falls.

RAW does not read from or write to Apple Health or Health Connect.

Permissions

RAW asks for each permission when it is needed, not when you open it, and it works if you say no:

• Notifications: when you start your first rest, to tell you when it ends with the screen locked, and when you turn on the weekly reminder, which starts off. Without it, RAW does not alert you outside the app.
• Exact alarms, on Android only: so the end of a rest arrives on time. On Android 14 or later you grant it yourself in the system settings, from the rest panel.
• Camera: only if you take a progress or profile photo.
• Photos: the gallery opens in the system picker, and RAW receives only the photo you choose. It does not see the rest.

RAW does not ask for your location, your microphone or your contacts.

On the lock screen, the rest notification says what comes next — the exercise and the set number — never weights or other health data. If you would rather not show even the exercise, turn off “Details on the lock screen” under Settings › Notifications and sound.

Minimum age

RAW is for people aged 16 or over. It is part of the terms, and you confirm it with the sign-in tap.

Your year of birth is separate and optional. If you give it, the templates are adapted to your age (16 to 17, and 60 and over), and it is part of your backup. If the year you give means you are under 16, RAW does not create an account.

Who receives your data

Only these services, each processing it on our behalf under a data processing agreement, for what is described above:

Google and Apple, when you sign in with them, and the App Store and Google Play, when you buy RAW PRO, act under their own terms and privacy policies, not on our behalf.

Transfers outside the EU. Some of these services handle data outside the EU, each with a safeguard the GDPR recognises (Chapter V):

• Google (Crashlytics) and Resend are certified under the EU–US Data Privacy Framework, which the European Commission has found to give adequate protection; Resend’s agreement adds the Commission’s standard contractual clauses.
• RevenueCat (United States) and Supabase (whose support staff work from the United States and Singapore, among other places) are not certified under that framework: their agreements use the Commission’s standard contractual clauses.

We do not sell your data and do not share it with anyone else, except where the law obliges us to.

How long we keep it

• Your backup, your photos and your account: while you have the account, even if you stop using it: RAW does not delete an account for being inactive. When you delete it, they are deleted at once. Supabase’s daily backups of the database may keep a copy of your backup for up to 7 days more; they are kept only to recover from a failure, and if one is ever restored, accounts deleted since are deleted again. Photos are not in those backups: they go at once.
• After you delete your account: only a note that that random identifier was deleted, with the date, for 35 days, so that another phone still signed in cannot upload to it. No email, no data.
• Sign-in emails at Resend: 30 days.
• Apple’s token (Apple sign-in only): until you delete your account.
• Supabase’s security logs: 7 days, in Supabase’s own logs, not in RAW’s database.
• Crash reports: 90 days.
• RAW PRO purchases at RevenueCat: until you delete your account.
• On your phone: until you delete it, sign out, delete your account or uninstall RAW.

Why we may use it (legal bases)

• Your account, your backup (except health data), the sign-in email and keeping your purchases: to provide RAW as the terms describe (Article 6(1)(b) GDPR).
• Your health data in the backup, and the look you choose for the exercise drawings: your explicit consent (Articles 6(1)(a) and 9(2)(a)), which you withdraw by deleting your account.
• Randy looking at accounts, your name, email and health data included, to understand how RAW is used and make it better: your consent, given with the sign-in tap and named in the sentence above the buttons (Article 6(1)(a), and Article 9(2)(a) for your health data and the drawings’ look), which you withdraw by deleting your account.
• Fetching your Google profile picture once, at the sign-in with Google that creates your account: our legitimate interest in your account showing your usual picture from the start, as with other services you sign in to with Google (Article 6(1)(f)). You object by deleting it (Settings › About you): it is deleted from your backup too, and RAW never fetches it again.
• Crash reports and the security logs: our legitimate interest in RAW working and staying secure (Article 6(1)(f)); you can object to crash reports by turning them off.
• Looking at your backup: to help you when you ask (Article 6(1)(b)), or because the law obliges us (Article 6(1)(c)).

Your rights

You have the rights of Articles 15–22 GDPR. Most of them work from the app, without asking anyone:

• See and correct: it is all in the app and edited where it lives: your profile under Settings › About you, and each workout, routine and measurement entry on its own screen.
• Take it with you: Settings › Data › Export my data.
• Delete: workouts, routines, measurement entries, photos, the profile photo, training places and the exercises you create can be deleted one by one, and the deletion reaches your backup. To delete everything, delete your account (Settings › Account › Delete account): after two confirmations (in the second you type DELETE), RAW deletes your photos, your backup and your account on the server, at once, and then empties the phone. It needs a connection; if it fails, you can try again. RAW also asks RevenueCat to delete your purchase records and, if you signed in with Apple, asks Apple to revoke RAW’s access. More in Deleting your data.
• Withdraw a consent: under Settings › Privacy, with the date of each one. «Crash reports» is a switch. The terms, this policy and the health data in your backup go with your account: withdrawing them means deleting it.
• Restrict or object: turning crash reports off is your objection to them; for anything else, write to us.

You can also write to privacy@getraw.fit, including if you no longer have the app and want your account deleted (the steps are on Deleting your data). Tell us the account’s email address. Before deleting anything we check the account is yours: we send a code in a new message to the address the account has (never only a reply to the address your request came from, which anyone can fake), and we delete once you answer with that code, exactly what deleting it in the app deletes. If you hid your email with Apple, write from any address and give us the relay address Apple shows for RAW in your Apple ID’s «Sign in with Apple» settings: Apple forwards our code to your inbox and your answer back to us. Or sign in to RAW and delete the account there. We answer within one month.

Signing out (Settings › Account) deletes everything RAW keeps on the phone: the database, the photos, the session and pending notifications. Before that, RAW tries to back up what is pending, and if something could not be backed up, tells you how many changes and photos would be lost and asks you to confirm; it also says when a workout in progress, which is only on the phone, will be deleted. Your backup stays on the server.

If you think we have not respected your rights, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) or the authority where you live.

Who is responsible, and how to reach us

RAW is developed by Randy Esperben (Spain), who is responsible for your data. Fabrica Studio, Barcelona (Spain): fabrica.studio. For any question about this policy, write to privacy@getraw.fit.

Changes

Each version of this policy is dated and kept. If a version of RAW is going to send anything new off the phone, this policy will be updated before that version ships. If a change matters, we will tell you by email; a change in how your health data is used will ask for your consent again where the law requires it.

Since version 5, of 14 October 2026:

• An account is now required, with Google, Apple or your email, at the end of setup. The tap on «Continue with…» accepts the terms and this policy, confirms you are 16 or over, agrees to back up your health data and starts crash reports. RAW is for people 16 and older: if the year of birth you give says otherwise, there is no account to create. The separate first screen with the terms and the age is gone.
• Everything you log is backed up to Supabase, in the EU, behind row-level security, not end-to-end encrypted, so a new phone gets it back: your progress photos and profile photo too, in Supabase Storage. Only Randy can look at it: to understand how RAW is used and improve it, to help you, or when the law obliges us. Version 5 said RAW kept it all on the phone and sent nothing but crash reports and RAW PRO purchases.
• Health data, and the look you choose for the exercise drawings, go into that backup with the consent you give at sign-in; to withdraw it, delete your account, and your backup is erased from the server.
• Your Google profile picture is downloaded once, when signing in with Google creates your account; deleted, it does not come back.
• The database and the photos on the phone are no longer encrypted by RAW (they were, with SQLCipher and AEGIS-256); the phone’s own encryption protects them.
• Crash reports now start at sign-in instead of at the first screen, and carry your account’s identifier: they are linked to your account, still without your name, email or anything you log.
• RevenueCat now receives your account’s identifier instead of an installation’s, and RAW connects to it each time it opens while you are signed in, not only when you open RAW PRO. Deleting your account deletes your records there.
• New processors: Supabase (account, backup and photos) and Resend (sign-in emails, with the email and its logs in the United States); the safeguard for each transfer outside the EU.
• New: signing out empties the phone; deleting your account deletes your photos, your backup and your account at once, from the app or by email; one phone writes to your backup at a time; how long we keep each thing, the legal bases and how to complain.
• The health questionnaire at the end of setup is gone.

Version 5 changed, since version 4 of 14 October 2026:

• New: RAW PRO purchases. If you buy it, or restore a purchase, the App Store or Google Play handles the payment and RevenueCat handles the purchase record: what it receives, and when RAW contacts it, is under «RAW PRO». If you never touch RAW PRO, nothing changes.

Version 4 changed, since version 3 of 27 September 2026:

• Version 3 said RAW sent nothing on its own and that crash reports would have to be switched on by you. RAW now sends crash reports, on from the start, and you can turn them off on the first screen or under Settings › Privacy. What they contain, and what they never contain, is under «Crash reports».
• Version 3 said usage analytics would come. They will not: RAW has no analytics.

Version 3 changed, since version 2 of 23 September 2026:

• Version 2 said RAW did not ask for weight or body measurements. You can now log, if you want to, your profile (name, photo, year of birth, sex and height), your weight, your measurements and progress photos. All of it is optional and stays on the phone; the photos are encrypted separately and stripped of metadata. It still does not ask for heart rate.
• Version 2 said RAW requested no permissions. It now asks for notifications and, depending on what you use, exact alarms on Android and the camera, each one when it is needed.
• New: what is required — only the terms and the minimum age — and the record of your consents, with how to withdraw them.
• New: exporting your data, recommending RAW and links in the in-app browser, which are the only ways anything can leave the phone, and only when you do it yourself.
• New: the health questionnaire, which saves nothing, and the database set aside if the phone cannot open it.
• It still sends nothing on its own, with no analytics, crash reports or advertising. It now says they are coming, that you will have to switch them on yourself, and that this policy will change first.