Privacy Policy
1. Who We Are
Matilha ("Matilha," "we," "us," or "our") is a fitness-tracking social app operated by:
- Alfredo Manuel Rodrigues de Almeida Pascoal
- Manuel João da Silva Rocha
acting jointly as private individuals (not through a registered company), and jointly responsible as data controllers for the personal data processed through the Matilha app, available at matilha.app (the app itself runs at app.matilha.app).
For any question about this Privacy Policy or about how your data is handled, contact us at:
matilhagym@gmail.com
(We plan to move to a dedicated address, e.g. privacy@matilha.app, once custom email sending is set up for the domain; matilhagym@gmail.com is the working contact address until then.)
This Privacy Policy is written to comply with the EU General Data Protection Regulation (GDPR) and applicable Portuguese data protection law, as Matilha is primarily used by people in Portugal and the European Union. It applies regardless of where you access Matilha from.
2. Minimum Age
Matilha is not intended for children. You must be at least 16 years old to create an account and use Matilha, in line with the GDPR's default digital consent age. We do not knowingly collect personal data from anyone under 16. If we become aware that we have collected personal data from someone under this age, we will delete it promptly. If you believe a child under 16 is using Matilha, please contact us at matilhagym@gmail.com.
3. What Data We Collect
3.1 Account data (required)
When you sign up, we collect the minimum needed to create and secure your account:
- Email address — via Google Sign-In or via a passwordless "Magic Link" sent to your inbox (both handled by our authentication provider, Supabase Auth).
- Name and profile photo — if you sign up with Google, we receive your Google account name and profile picture. If you sign up via Magic Link, no photo is provided by default and Matilha generates a colored initials avatar instead.
- Username and display name — chosen by you during onboarding.
- Technical account metadata such as account creation date and onboarding status.
3.2 Workout and activity data (core to the service)
To provide the core fitness-tracking functionality, we store the data you log yourself:
- Workouts (date, duration, notes) and individual sets (exercise, muscle group, reps, weight, or cardio metrics such as distance/time/calories, depending on the exercise type).
- Personal records (PRs), streaks, and badges you unlock.
- Challenges you create or join, and your challenge results.
- Friend connections ("Pack"), friend requests, and social interactions such as "Howl" reactions and in-app notifications you generate or receive.
- Pack Plans (workout routines) you create or save.
3.3 Optional data (only if you choose to provide it)
- Biometric data — body weight measurements you choose to log over time on the Biometrics page. This is entirely optional and only stored if you enter it yourself.
- Custom exercise images — if you create a custom exercise and choose to upload an image for it.
- Gym name — an optional free-text field on your profile.
- Favourite badges and display preferences you configure in Settings.
3.4 Waitlist email (before you have an account)
If you join the founders waitlist on our landing page (matilha.app), we collect only the email address you submit. We use it to contact you about early/founder access to Matilha — nothing else. This is collected with your consent, given by submitting the form, and you can withdraw it at any time by contacting us at matilhagym@gmail.com. We keep it until you either create an account (at which point it's simply your account email going forward) or ask us to delete it.
3.5 Technical data (via our hosting providers)
Our infrastructure providers (described in Section 5) automatically process standard technical data needed to operate a web service — such as IP address, browser/device type, and request logs — for security, abuse prevention, and reliability purposes. We do not currently use any separate analytics or advertising tracking service.
4. How We Use Your Data
We use your data to:
- Create and maintain your account and authenticate you.
- Record and display your workouts, personal records, streaks, and badge progress.
- Calculate rankings and leaderboard positions (Power Index, monthly/global rankings, strength percentiles).
- Power social features: friend connections, the Pack activity feed, challenges, and reactions/notifications.
- Generate the shareable workout, PR, profile, and challenge-win cards you can download or share.
- Keep the service secure and prevent abuse (e.g., rate limiting, fraud/cheating prevention on rankings).
- Communicate with you about your account (e.g., notifications about friend requests, badges, or challenge results) and, if you contact us, to respond to you.
Legal bases (GDPR Art. 6):
- Performance of a contract — processing your account and workout data is necessary to provide the Matilha service you sign up for.
- Consent — for optional data you choose to provide, such as biometric measurements or custom exercise images, and for the waitlist email described in Section 3.4. You can withdraw this by deleting the data, your account, or by contacting us, at any time.
- Legitimate interests — for basic security, fraud/abuse prevention, and service reliability, weighed against your rights and freedoms.
We do not sell your personal data, and we do not use it for third-party advertising.
5. Sharing With Third Parties
We only share data with the service providers ("processors") that are necessary to run Matilha. We do not sell or rent your data to anyone.
| Provider | Role | What they process |
|---|---|---|
| Supabase (Supabase, Inc.) | Database, authentication, file storage, and backend serverless functions | All account, workout, and social data described in Section 3; uploaded images (avatars, custom exercise images) |
| Vercel (Vercel Inc.) | Frontend hosting and content delivery (CDN) | Serves the Matilha web app; processes standard web request/technical data |
| Google (via Google Sign-In) | Optional authentication method | Name, email, and profile photo, only if you choose "Continue with Google" |
International data transfers: Our database, authentication, storage, and backend functions (Supabase) are hosted in the West EU (Ireland) region — within the European Economic Area. Some of our other providers (such as Vercel's hosting/content-delivery network, and Google if you use Google Sign-In) may process limited technical or account data outside the EEA (e.g., in the United States). Where this happens, it is carried out under the safeguards those providers commit to (such as the EU Standard Contractual Clauses).
We may also disclose data if required by law, to comply with a legal process, or to protect the rights, safety, or property of Matilha, our users, or the public.
6. Social Visibility — What's Public vs. Private
Matilha is a social app, so some of your information is visible to other users by design:
- Visible to other registered users: your username, display name, avatar, gym (if set), unlocked badges, personal records, and ranking/leaderboard positions — this is how the ranking and public-profile features work.
- Visible only to your confirmed friends (your "Pack"): your individual workout activity in the Pack feed, and related reactions/notifications.
- The "Private Profile" setting limits how your display name and details appear to people who are not your friends, but does not make your account fully invisible within the app.
- Never shown to other users: your email address. It is used only internally for login and account identification, never displayed in the app's user interface.
If you'd rather keep certain achievements private, you can control some visibility via your profile settings, or simply avoid logging data you don't want reflected in shared views (e.g., biometric data, which is never shared with other users under any circumstance).
7. Data Retention and Deletion
We keep your data for as long as your account is active, so that your workout history, streaks, and rankings remain meaningful over time.
You can permanently delete your account at any time from Profile → Settings → Delete Account. This triggers our account-deletion process, which removes:
- Your profile, authentication record, and all workout/set data.
- Biometric entries, custom exercises and their images, badges, and preferences.
- Your friendships, friend requests, and participation in challenges.
- Notifications, activity reactions, and rankings entries tied to your account.
Deletion is designed to be complete and irreversible — once processed, your data cannot be recovered. Some minimal records may be retained where we are legally required to (e.g., for fraud prevention or legal compliance), but only for as long as strictly necessary.
8. Your Rights Under GDPR
As a data subject, you have the right to:
- Access the personal data we hold about you.
- Rectification of inaccurate or incomplete data (most of this you can already edit directly in your Profile).
- Erasure ("right to be forgotten") — via the in-app Delete Account feature, or by contacting us.
- Data portability — receive your data in a structured, commonly used format, or have it transmitted elsewhere where technically feasible.
- Restriction of processing or objection to certain processing based on our legitimate interests.
- Withdraw consent at any time for anything based on consent, without affecting the lawfulness of processing before withdrawal.
- Lodge a complaint with a supervisory authority. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt.
To exercise any of these rights, contact us at matilhagym@gmail.com. We will respond within the timeframes required by GDPR (generally within one month).
9. Cookies and Local Storage
Matilha does not use advertising or third-party tracking cookies. We use browser storage strictly for the app to function:
- Session/authentication tokens — stored locally by our authentication provider (Supabase Auth) to keep you signed in between visits.
- Offline/installable app cache — as a Progressive Web App (PWA), Matilha caches certain static assets locally (such as the app's code, icons, badge artwork, and logo) so the app can load faster, support installing it to your home screen, and keep working when you lose network connection. These are generic app assets, not personal data — the same files for every user — and are automatically cleared after a period of disuse (currently up to 90 days) or when you clear your browser's site data. This does not track your activity across other sites.
We do not currently use any analytics, advertising, or cross-site tracking tools. If this changes in the future, we will update this policy and, where required, ask for your consent.
10. Changes to This Policy
We may update this Privacy Policy from time to time, for example as Matilha adds new features or as our infrastructure changes. We will update the "last updated" date at the top of this page, and where changes are material, we will make reasonable efforts to notify you in-app before they take effect.
11. Contact
Questions, requests, or concerns about this Privacy Policy or your data:
matilhagym@gmail.com
Alfredo Manuel Rodrigues de Almeida Pascoal and Manuel João da Silva Rocha, joint controllers of Matilha.