Barva is a gym app that helps you log workouts, rest between sets and follow a training plan. This policy explains what personal data Barva processes, why, and the rights you have. In short: Barva only keeps what it needs to run your account and your training history, it shows no ads, and it doesn't sell or share your data for marketing.
1. Who is responsible
The controller within the meaning of Art. 4 (7) of the EU General Data Protection Regulation (GDPR) is:
Rigaer Str. 22A
10247 Berlin, Germany
Email: hello@joaomira.com
For any question about your data, or to use your rights, write to the email address above.
2. Data processed in the app
2.1 Using Barva as a guest
When you first open Barva, it creates an anonymous guest account so your workouts can be saved and synced. No name or email is needed. The guest account is identified by a random ID.
Legal basis: performance of a contract, Art. 6 (1)(b) GDPR.
2.2 Signing in
You can add a sign in to keep your workouts safe and use them on another phone. Depending on what you choose, Barva receives:
- Email: your email address. Barva emails you a six digit code to confirm it. The emails are sent through Resend (Resend, Inc., USA).
- Sign in with Apple: an identifier from Apple and, if you allow it, your email address or an Apple relay address.
- Sign in with Google: an identifier from Google, your email address and your name.
Legal basis: performance of a contract, Art. 6 (1)(b) GDPR.
2.3 Your training data
Barva stores the workouts you finish (exercises, sets, weights, repetitions, hold times, start and end times) and your training settings (weekly goal, weight unit and rest times). This data is stored on your phone and in your account so it's available on all your devices. Barva doesn't use it for any other purpose.
Workout data can say something about your fitness. Barva doesn't ask for health conditions, and you decide what you log.
Legal basis: performance of a contract, Art. 6 (1)(b) GDPR.
2.4 Backend and storage (Supabase)
Accounts and training data are stored with Supabase (Supabase, Inc., USA) on servers in Frankfurt, Germany. Each person can only read and change their own data.
2.5 Rest timer notifications
If you allow notifications, Barva schedules a reminder on your phone for when your rest ends. These notifications are created on the device and are not sent through a server.
2.6 Exercise images and tutorials
Exercise photos are loaded from GitHub (GitHub, Inc., USA), which receives your IP address when an image is requested. The "Watch a tutorial" button opens a YouTube search in your browser or the YouTube app; from then on, YouTube's own privacy policy applies.
Legal basis: legitimate interest in showing exercise instructions, Art. 6 (1)(f) GDPR.
2.7 What Barva doesn't do
Barva has no advertising, no analytics or tracking tools, and no in app purchases at the moment. If this changes, this policy will be updated before the change takes effect.
3. This website
This website is hosted by Netlify (Netlify, Inc., USA). When you visit it, Netlify processes your IP address, the page requested, the time and your browser details in server logs, to deliver the site and keep it secure. The website uses no cookies, no analytics and no external fonts.
Legal basis: legitimate interest in a secure, working website, Art. 6 (1)(f) GDPR.
4. Service providers and transfers outside the EU
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Accounts and training data | Frankfurt, Germany |
| Resend | Sign in code emails | Ireland and USA |
| Apple, Google | Sign in, if you choose them | USA |
| GitHub | Exercise images | USA |
| Netlify | Website hosting | USA |
Where data is transferred to the USA, it's covered by the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise by the European Commission's Standard Contractual Clauses.
5. How long data is kept
Your account and training data are kept for as long as you have an account. When you delete your account, your profile and all your workouts are deleted right away. Server logs at the providers are kept for a short period set by them, usually a few days to a few weeks.
6. Deleting your account
You can delete your account in the app under Settings > Account > Delete account. This permanently deletes your account and all your workouts. You can also ask by email; see how to delete your account.
7. Your rights
Under the GDPR you have the right to access your data (Art. 15), to have it corrected (Art. 16) or deleted (Art. 17), to restrict processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). To use any of these rights, email hello@joaomira.com.
You also have the right to complain to a data protection authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.
Barva makes no decisions about you based solely on automated processing.
8. Security
All data is sent over encrypted connections. Access to the database is protected so each account can only reach its own data.
9. Children
Barva is meant for people aged 16 and over. It isn't directed at children, and we don't knowingly collect data from children under 16.
10. Changes
This policy may change as Barva grows, for example when new features are added. The date at the top shows the latest version. Important changes will also be announced in the app.