Draft for review. This document describes how the AVEN application handles
data as built. The legal entity, registered address, supervisory authority, and a monitored
contact address must be confirmed before this policy is relied on in production.
1. Who we are
AVEN ("AVEN", "we", "us") provides trust infrastructure for strength performance: athletes
record training results, coaches verify them, and verified performance drives reputation,
rankings, communities, and opportunities.
Data controller: [LEGAL ENTITY NAME], [REGISTERED ADDRESS].
Contact for privacy matters: privacy@avenstrength.com.
2. The data we collect
2.1 Account and identity
- Email address and, if you register with a password, a hashed password (handled by our
authentication provider, Supabase Auth - we never store the plain password).
- If you sign in with Google or Meta (Facebook): your
name, email address, profile picture URL, and the provider's user identifier, passed to us
by that provider at sign-in. We request only the email and public profile
scopes and use this data solely to create and secure your AVEN account. We do not post to
your social accounts and do not read your friends, posts, or contacts.
- Display name, and (for coaches) a short bio, coaching modalities and specialities.
2.2 Athlete profile
- Sex/gender category, date of birth (used to derive age), body weight, and optionally
height. These are required to calculate international weightlifting normalisation metrics
(Olympic Total, Sinclair coefficient, Robi points) and weight-class placement.
- Profile photo and banner image, if you upload them.
- Your training base ("Arena") affiliation, if you set one.
2.3 Training and performance
- Records of lifting attempts: exercise, weight, repetitions, date, your body weight at the
time, an optional video URL, an optional photo, and whether you marked the record
public or private.
- Coach verification events (which coach validated which record, when, and at which Arena).
- System-derived data: personal records, reputation score and tier, rankings, challenge
standings, and opportunity match eligibility - all computed from the above.
2.4 Social and activity graph
- Who you follow, Arena memberships, challenges you join, coaching requests you send or
receive, and opportunity applications. Coaching requests and applications are private to
the two parties involved.
2.5 Technical and usage data
- First-party product analytics events (for example "record created", "record verified"),
with identifiers scrubbed of names, emails and other direct identifiers before storage. We
do not use third-party advertising or tracking cookies.
- Local storage / IndexedDB on your device, used as an offline cache of your own data.
- Standard technical information your browser sends when loading the app and its assets.
3. How we use your data
| Purpose | Legal basis (GDPR Art. 6) |
|---|
| Create and secure your account; authenticate you | Performance of a contract |
| Calculate normalisation metrics, personal records, rankings and reputation | Performance of a contract |
| Show your public records, profile and rankings to others | Performance of a contract; your choice of the public setting |
| Coach verification of your records | Performance of a contract |
| Communities, challenges, and the opportunities layer | Performance of a contract |
| Product analytics and reliability | Legitimate interests (improving the service), balanced against your rights |
| Security, abuse prevention, and legal compliance | Legitimate interests; legal obligation |
We do not sell your personal data. We do not use it for advertising. Paid inputs never
change a ranking, a reputation score, or an eligibility result.
4. Public versus private
You control the visibility of every record. A record marked private is never
shown to other athletes, coaches, Arenas, or on any leaderboard, and never contributes to a
public ranking. A record marked public may appear on leaderboards, your
public profile, your Arena's boards, and challenge standings, and may contribute to your
public reputation score once verified.
5. Who processes your data for us
- Supabase - authentication, database, and file storage hosting, in the
European Union (eu-west-1). Supabase acts as our processor.
- Google Fonts and jsDelivr - content delivery networks
that serve fonts and a script library when the app loads. These receive your IP address as
a normal consequence of your browser requesting a file.
- Google and Meta - only if you choose to sign in with
them, and only at the moment of sign-in, as described in section 2.1. Their handling of
your data is governed by their own privacy policies.
We do not otherwise transfer your personal data outside the European Economic Area. Where a
processor operates outside the EEA, transfers are covered by an adequacy decision or Standard
Contractual Clauses.
6. How long we keep it
We keep your account and training data for as long as your account exists. Product analytics
events are retained in de-identified form. When you delete your account (see section 8), your
profile, records, verification events, and derived data are removed; short-lived operational
logs and backups are purged on their normal cycle.
7. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, and port your data,
and to object to processing based on legitimate interests. You can edit your profile directly
in the app; to exercise any other right, contact privacy@avenstrength.com. You also
have the right to lodge a complaint with your data protection supervisory authority
([SUPERVISORY AUTHORITY]).
8. Deleting your data
You can permanently delete your AVEN profile and training history at any time by emailing
privacy@avenstrength.com (an in-app one-click deletion control is being added). Full
instructions, including for accounts created with Google or Meta sign-in, are on our
Data Deletion page.
9. Children
AVEN is not directed at children under 16. If you believe a child has provided us personal
data without appropriate consent, contact privacy@avenstrength.com and we will remove it.
10. Changes to this policy
We will update this page when our practices change and revise the "Last updated" date. Material
changes will be notified in the app.