Privacy Policy
City Workouts turns streets, stairs and parks into GPS-guided workout courses. Doing that means the app needs to know where you are and something about your fitness. This page explains exactly what we collect, why, who else sees it, and how to get rid of it.
City Workouts is operated by Wend Labs LLC, an Idaho limited liability company. In this policy, "we" and "us" mean Wend Labs LLC, and "the app" means City Workouts on Android and iOS.
What we collect
| Data | Why we need it | Where it lives |
|---|---|---|
| Email address | To create your account and sign you in | Firebase Authentication |
| Password | To sign you in. We never see it — Firebase stores it hashed | Firebase Authentication |
| Fitness profile | To size workouts to you: age range, goals, gear you own, fitness tier, joint sensitivities | Firestore, on your account |
| Waiver acceptance | A record that you accepted the fitness waiver, and when | Firestore, on your account |
| Precise location | To follow your route during a workout, measure distance and pace, and place course stations on the map | Your device; station coordinates only if you publish a course |
| Photos you take | Only when you photograph a park feature — a bench, a bar, a set of stairs — while tagging it | Your device, and Firestore if you submit the tag |
| Motion sensor | Counting reps. Read live and discarded — never stored, never transmitted | Nowhere |
| Workout history | Your past workouts, saved courses and personal records | Your device only |
What we do not collect
- No advertising identifiers. There are no ads in City Workouts.
- No third-party analytics or tracking SDKs.
- No contacts, calendar, microphone or call data.
- No background location. The app reads your position only while a workout is open on screen. Close it and location stops.
- No payment information. We do not process payments in the app.
Location, specifically
Location is the one permission the app genuinely cannot work without, so it is worth being precise about it.
- We request foreground location only. Android and iOS will confirm this — the app has no background location permission at all.
- Your live GPS track stays on your phone. We do not upload the route you ran.
- If you publish a course, the coordinates of that course's stations become public, along with the display name on your account and a city label. That is the point of a shared course — other people have to be able to find it. Don't publish a course that starts at your front door.
- If you tag a park feature, its coordinates and your photo are submitted for the shared feature map.
Who else sees your data
We do not sell your data. We have never sold it and the app has no mechanism to. We share it with exactly two categories of third party:
Google (Firebase and Maps)
Firebase Authentication, Firestore and Hosting store your account and profile. The Google Maps SDK renders the maps you see. Google processes this data as our infrastructure provider under its own terms. See Firebase privacy and the Google Privacy Policy.
Other City Workouts users
Anything you deliberately publish — a shared course, a tagged feature — is visible to other users, along with your display name. Nothing else about you is.
Legal requests
We would disclose data if legally compelled by valid process. If that ever happens and we are permitted to tell you, we will.
Deleting your account
In the app: Options → DELETE MY ACCOUNT. You will be asked for your password to confirm. This is immediate and permanent.
On the web: use the account deletion request form.
Deleting removes your email and login, your fitness profile, your waiver record, any courses you published to the community, and all City Workouts data stored on the device you delete from. It cannot be undone and we cannot restore it afterward.
Workout history saved on other devices you have signed in from is removed when you delete the app from those devices, since that history never leaves the phone.
Requests made through the web form are completed within 30 days, and normally much sooner. We keep no copy afterward.
Your rights
Depending on where you live — including under the CCPA in California and the GDPR in the UK and EU — you may have the right to access the data we hold about you, correct it, delete it, or receive a copy. The app gives you all of these directly: your profile is visible and editable in Options, and deletion is one screen away. For anything the app does not cover, email us and we will handle it within 30 days.
We will not discriminate against you for exercising any of these rights.
Security
Traffic between the app and our servers is encrypted in transit. Account data is protected by Firestore security rules that permit each user to read and write only their own record. Passwords are hashed by Firebase Authentication and are never visible to us.
No system is perfectly secure, and we won't pretend otherwise. If you believe your account has been compromised, change your password and email us.
Children
City Workouts is not directed to children and is intended for users 18 and older. We do not knowingly collect personal information from anyone under 13. If you believe a child has created an account, email us and we will delete it.
Changes to this policy
If we change this policy we will update the date at the top. Material changes will be announced in the app before they take effect.
Contact
Wend Labs LLC
Idaho, United States
keith.wohlwend@gmail.com
