Privacy policy
Last updated: 6 November 2026
RIVAL is a social fitness app. You log activities, earn Effort, and share them with the teams you join. This policy explains what RIVAL collects, who can see it, and how to remove it. RIVAL collects only what it needs to run, does not sell personal information, and does not show advertising.
What RIVAL collects
Account. Email address, display name, optional username, profile photo, cover photo and personal quote.
Activities. Each activity you add: type, date and time, duration, distance, elevation, exercises, sets and weights, notes, Effort, personal bests, goals, events and finish times. Activities come from manual entry, workout scanning, archive import and, on iPhone, Apple Health and RIVAL's own GPS recording.
Routes. When an activity has a GPS route, RIVAL stores a simplified outline of it. Teammates see route maps only if you turn on route sharing.
Photos and videos. Files you attach to activities, set as a cover, or upload for workout scanning.
Team activity. Messages, comments, reactions (Respect and Inspired), notes, challenges and planned activities you post in your teams, and who invited you to a team.
Device token. A push-notification token, if you allow notifications.
Usage. RIVAL does not use analytics, advertising or tracking tools. The services that host RIVAL keep standard technical logs, such as IP address and request times, for security and to fix faults.
RIVAL does not collect contacts or advertising identifiers.
Apple Health
On iPhone, you can let RIVAL read your workouts from Apple Health. RIVAL reads workout type, time, duration, distance, elevation, energy and route, and only after you allow it in the Health permission screen. Health data is used only to record your activities, score Effort and show them to your teams. It is never used for advertising or marketing, never sold, never given to data brokers, and never stored in iCloud. RIVAL does not write anything to Apple Health. You can turn access off at any time in the iPhone's Settings.
GPS recording
When you record an activity in RIVAL, the app uses your location only while that activity is recording, to measure distance and draw the route. Your live location is never shared.
Garmin Connect
If you connect a Garmin account, RIVAL receives the activities your Garmin device records: activity type, start time, duration, distance, elevation, heart rate, pace and splits, route, and the exercises, sets, repetitions and weights of strength activities. RIVAL does not request sleep, stress, steps or other wellness data.
Garmin data is used only to record your activities, score Effort and show them to the teams you choose. Activities from Garmin are marked with the device that recorded them. RIVAL never sells Garmin data, never uses it for advertising and never shares it with anyone other than the service providers that run RIVAL. Disconnecting Garmin stops new activities arriving, and deleting your account deletes the Garmin data RIVAL holds.
Imports from other apps
You can import your history from a Strava or RIVAL archive file. The import reads the activities, routes, photos and videos in the file you choose. Nothing else on your device is read.
RIVAL no longer connects to Strava. Data that earlier reached RIVAL through Strava's connection will be deleted within 30 days of that connection ending, as Strava's terms require. Activities you import from your own archive are kept.
AI features
Some features send content to Anthropic, an AI provider, to produce a result:
- Workout scanning sends the photo you choose, such as a whiteboard or gym screen, to read the workout details from it.
- Find events sends the event name you search for.
- Team crests send the team's name. The crest image is made by fal.ai.
These providers process the content only to return the result. RIVAL does not send your activity history to them or use your content to train AI models. If a photo includes other people, make sure they are happy for it to be uploaded.
Who can see your information
- Your teammates see your name, photos, activities, Effort, rank, profile, reactions, comments and messages in the teams you join. RIVAL asks for your agreement before your activities are shared with any team.
- Public teams show their name, crest and member count in Discover. Joining one needs a member or an admin to confirm.
- Images you share go wherever you send them.
- Service providers run RIVAL on its behalf: Supabase (database, sign-in and file storage), Vercel (web hosting), Cloudflare (domain), Anthropic and fal.ai (the AI features above), Expo (push notifications) and Resend (account emails).
RIVAL never sells personal information and does not share it with anyone else except where the law requires.
Keeping and deleting your data
- Your data is kept while your account is open.
- You can delete any activity, photo, goal or event in the app.
- Profile, Download my data saves a copy of everything RIVAL holds about you.
- Profile, Delete account first saves an archive of your activities, photos and videos, then permanently deletes your account and its data. Teams you created pass to another member, or are deleted if you were the only one.
- If anything goes wrong, contact hello@therivalapp.com and the deletion will be completed within 14 days.
Security
Data is stored with Supabase. It is encrypted in transit, and access rules in the database limit each person to the data they are allowed to see.
Children
RIVAL is not for children under 13, or the minimum age in your country, and does not knowingly collect their information.
Your rights
Depending on where you live, including under Canada's PIPEDA, New Zealand's Privacy Act 2020 and the GDPR, you can ask to access, correct, export or delete your personal information. Contact hello@therivalapp.com.
Changes
If this policy changes in a meaningful way, RIVAL will say so in the app and update the date above.