rivals

Privacy policy

Last updated 28 September 2026

Rivals is a fitness and habit challenge app for small groups. This policy covers the Rivals apps for Android and iPhone and the website tryrivals.com. Questions or requests: welcome@tryrivals.com.

What we store, and why

Your account. Your email address (to sign you in with a one-time code), your display name, your age (to keep Rivals to people 13 and older and challenges fair; never shown to anyone), an optional profile photo, your two onboarding answers (how competitive you are and what usually breaks your streak, used for your rival card and the time of your reminders) and your phone's time zone (so a day ends at your midnight). Basis: providing the service you signed up for.

Your challenges. The challenges you create or join, and one number per day for each metric you compete on (for example steps, kilometres run or hours slept), whether you type it or the app reads it for you, plus where it came from. Basis: providing the service.

Chat. Messages and emoji reactions you send in a challenge chat. Basis: providing the service.

Notifications. A push token for your device, if you allow notifications, used to tell you when a rival logs, writes or a challenge starts or ends. Daily reminders are scheduled on your phone and never leave it. Basis: your consent, which you can withdraw in your phone's settings.

Rivals Pro. Whether your account has Pro and until when, and which promo codes it redeemed. Payments are made to Apple or Google; we never see your card or bank details. Basis: providing the service.

Waitlist. If you join the waitlist on the website: your email, the phone you picked and your browser language, used only to email you when Rivals is available. Basis: your consent. Write to us to be removed at any time.

Rivals has no ads, no advertising or analytics trackers, and does not sell or rent data to anyone. The website sets no cookies.

Health and fitness data

If you connect Apple Health (iPhone) or Health Connect (Android), Rivals reads, only after you grant permission in the system dialog, the data types behind the challenges you play: steps, walking and running distance, cycling distance, active minutes and workouts, sleep, mindful minutes, water and body weight. It stores only one daily total per metric, never the individual samples, and never writes anything back.

Health data is special-category data under the GDPR, so the basis is your explicit consent, given when you connect. You can withdraw it at any time by turning the connection off in Settings → Integrations or in the Health / Health Connect app; numbers already logged stay until you delete them or your account. Health data is used only to fill in your daily numbers, is shown only to the people in your challenge, and is never used for advertising, sold or shared with anyone else. Rivals' use of data from Health Connect follows the Health Connect Permissions policy, including its Limited Use requirements.

If you connect Strava, we store the access tokens Strava gives us and read your activities' type, date, distance and moving time to fill in the matching challenges. We read nothing else and never post to Strava.

Who can see what

People in the same challenge as you see your name, photo, daily numbers, score, streak and your messages in that challenge. Someone with a challenge's invite code can see its title, rules and its creator's name before joining. Nobody else sees your data.

Who processes it for us

Where a provider is outside the European Economic Area, transfers are covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

Everything in your account is kept until you delete the account. Waitlist entries are deleted after the launch email, or earlier on request. If a database backup exists, it rolls over within 7 days of a deletion. Purchase records are kept by Apple, Google and RevenueCat for as long as tax law requires.

Deleting your data

In the app: Settings → Account → Delete account removes your account, profile, photo, daily numbers, reactions, push tokens and Strava connection immediately. Challenges you created stay for your rivals, cancelled if still running, without your name; messages you wrote stay in those chats as from a deleted account. Without the app: see tryrivals.com/delete-account.

Your rights

You can ask to access, correct, export or delete your data, to restrict or object to its processing, and withdraw any consent, by writing to welcome@tryrivals.com. We answer within one month. You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es).

Age

Rivals is for people aged 13 and over. We don't knowingly hold data about younger children; if you think we do, write to us and we'll delete it.

Changes

If this policy changes in a way that matters, we'll say so in the app before it applies.