Privacy policy
Effective from: 26 September 2026
This is a translation. If it differs from the Polish version, the Polish version prevails.
1. Data controller
The controller of your personal data is Miłosz Nieć, a sole trader operating as Miłosz Nieć Software, Jurków 207, 32-860 Jurków, Poland, tax ID (NIP) 8691988402. Contact for data matters: kontakt@rampset.com.
2. The short version
- Without an account your data never leaves your phone. Your plan, workout history, body weight and settings are stored on the device only. We have no access to them.
- An account and sync are optional. Only then does data reach our server.
- There are no ads, no analytics and no tracking. We don't sell data or share it for marketing.
- You can export your data at any time (Profile → Export data) and delete your account together with all data on the server.
3. What data and why
| Data | When | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| E-mail address and Google or Apple account identifier | when you sign in | creating and running your account | Art. 6(1)(b) (contract for the service) |
| Profile: sex, height, year of birth, experience; plans, workout history (exercises, sets, reps, weights, difficulty ratings, times), settings | when you have an account with Premium and sync turned on | a cloud copy and the same plan on several phones | Art. 6(1)(b) |
| Health data: body weight measurements (including body weight saved with a workout) and the health note (e.g. injuries) | as above | as above | Art. 9(2)(a): your explicit consent, which the app asks for after you sign in. Without it this data stays on your phone only. You withdraw consent in Profile: we then delete this data from the server, and it stays on the phone |
| Premium purchase history and customer identifier | when you buy Premium | running your subscription and access to features | Art. 6(1)(b) and (c) (tax and accounting obligations) |
| Server logs: IP address, time and type of request (no passwords or tokens) | when connecting to the server | security, abuse prevention, troubleshooting | Art. 6(1)(f) (legitimate interest) |
Providing data is voluntary. Without an account the app works fully on your phone, except for sync.
4. Who we share data with
We use providers that process data on our behalf (processors):
- Railway Corporation (USA): server and database. Data is stored in the EU region (Amsterdam).
- Cloudflare, Inc. (USA): storage of encrypted database backups in the EU region, and the rampset.com website and contact e-mail.
- GitHub, Inc. (USA): creating the automatic database backup. Data is processed there briefly and encrypted before it is stored.
- RevenueCat, Inc. (USA): subscription handling. It receives the customer identifier and purchase history, not workout or health data.
- Google and Apple: sign-in (if you choose it) and store payments. The stores process payments under their own rules. We don't see your card details.
Providers based in the USA may access data from outside the EU. Such transfers rely on the standard contractual clauses approved by the European Commission, included in our processing agreements with these providers, or on the EU-US Data Privacy Framework where the provider is certified under it.
5. How long we keep data
- Account and sync data: until you delete your account.
- Database backups: up to 30 days from creation, then deleted automatically.
- Server logs: up to 30 days, then deleted automatically by the hosting provider.
- Purchase data: for the period required by tax law.
6. Your rights
You have the right to access your data, rectify it, erase it, restrict its processing, port it (in the app: Profile → “Export data” for data on the phone and “Download account data” for everything we hold on the server), object to processing based on legitimate interest, and withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). You can also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the supervisory authority in the EU country where you live.
How to delete your account and data: account deletion.
7. Automated decisions
The app automatically suggests the weight for your next workout based on your results. It's a suggestion you can change. We don't make decisions with legal effects or profile users for marketing.
8. Children
The app is intended for people aged 16 or older.
9. Security
Connections to the server are encrypted (HTTPS). Sign-in tokens are stored in the system's secure storage. Backups kept outside the hosting provider are encrypted.
10. Changes to this policy
We will announce significant changes in the app before they take effect.