PRIVACY POLICY

This Privacy Policy explains how TORQ ("we", "us", "our") collects, uses, stores, shares, and protects your information when you use our mobile applications for iOS and Android and our website at torqapp.co.uk (together, the "Services").

We're a small UK-based business and we keep things deliberately simple: your training data stays on your device, the app collects anonymised usage data (no personal identifiers) so we can see what's working and fix what's broken, the app measures advert performance if you agree to it when asked, the website tracks page views for ads, and Stripe handles all payment data. We don't run accounts, we don't sell data, and we don't tie any of it to your name.

We encourage you to read this policy in full. If anything in it is unclear, or if you would like it provided in a different format, contact us using the details in Section 22 and we will help.

1. Who We Are

TORQ is operated by Oliver, a sole trader based in the United Kingdom. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller for the personal data described in this policy, except where this policy states that a third party acts as an independent controller in its own right.

This policy is written to comply with the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). It also references the California Consumer Privacy Act (CCPA) and other United States state privacy laws for visitors from those jurisdictions.

We do not have a statutory obligation to appoint a Data Protection Officer, and we have not appointed one voluntarily. Privacy enquiries are handled directly by the business owner using the contact details in Section 22.

2. Definitions

The following terms are used throughout this policy. They carry the meanings given to them in the UK GDPR, summarised here in plain language:

• Personal data — any information relating to an identified or identifiable living individual. A person may be identifiable directly (by name) or indirectly (by reference to an identifier such as a device ID).
• Processing — anything done with personal data, including collecting, recording, storing, using, sharing, and deleting it.
• Controller — the party that decides why and how personal data is processed.
• Processor — a party that processes personal data on behalf of a controller, under that controller's instructions.
• Third party — any person or organisation other than you, us, or our processors.
• Pseudonymised data — data that cannot be attributed to a specific person without additional information held separately.
• Anonymised data — data that has been irreversibly stripped of identifying elements and can no longer be linked to a person. Anonymised data is not personal data and falls outside the scope of the UK GDPR.
• Aggregated data — statistical or demographic data derived from personal data but which does not identify any individual, for example a count of how many users opened a screen.

3. The TORQ App (iOS & Android)

The app has no accounts and no login, and your training data stays on your device. Up to version 1.3 the app sent nothing off your phone at all. From version 1.3.1 it also collects anonymised usage data — no personal identifiers — so we can see which features people actually use and fix what's broken faster. This is on by default and you can turn it off in one tap. From version 1.4.3 the app also measures advert performance, but only if you agree when asked. Here's the full breakdown.

3.1 What stays on your device

Your actual training data never leaves your phone. None of the following is sent to us or anyone else:

• Lift logs — the weights, reps, and sets you record
• Bodyweight and weight logs
• Nutrition and calorie entries
• Tier scores and strength history
• Routines and schedules

All of this is stored locally on your device using on-device storage (AsyncStorage). We hold no copy and have no way to read it. If you have iCloud Backup or Google Backup enabled, this data may be included in your device manufacturer's standard encrypted device backup, governed by Apple's Privacy Policy or Google's Privacy Policy respectively. We have no access to those backups.

Because this data never reaches us, we cannot recover it for you if you delete the app, lose your device, or reset it. We recommend using the export function in Settings → Data Controls if you want your own copy.

3.2 Anonymised usage data (PostHog)

To understand what's working and what isn't, the app records anonymised usage events using PostHog, provided by PostHog Inc. The point is simple: the more we know about which features matter to people, the faster we can improve the app. These events are not tied to your name, email, or any account, because there is no account.

This is switched on automatically when you install the app. You can turn it off at any time in Settings → Data Controls, and events stop flowing immediately.

What we collect:

• Screen names you visit — e.g. "Home", "Sessions", "Strength Breakdown"
• Buttons and features you tap — e.g. lift_entry_added, opening the radar, generating a session
• The app version you're running and your device model — so we can fix bugs faster
• A randomly generated device identifier — not your name, email, Apple ID, or anything else you've given us
• The country your phone reports

What we never collect:

• Your weights, lifts, reps, sets, or any training data
• Your name, age, height, or bodyweight
• Your notes or anything else you've typed into the app
• Your contacts, photos, or precise location

Because the device identifier is randomly generated and never linked to anything you've given us, we call this data anonymised rather than fully anonymous — technically it's pseudonymous, and we'd rather be precise than overclaim. Either way, we can't turn it back into a name and we can't contact you through it.

How long we keep it: 90 days, then it's automatically deleted.

Legal basis: We rely on legitimate interest (UK GDPR Article 6(1)(f)) for this processing. The data is minimal, never identifies you personally, and the opt-out is one tap inside the app — which is why we don't ask for consent upfront. If you'd like a copy of our Legitimate Interests Assessment, email support@torqapp.co.uk.

Your control:

• Opt out anytime — open the app → Settings → Data Controls → toggle "Anonymous analytics" off. Events stop flowing immediately.
• Delete what's already there — email support@torqapp.co.uk with the words "delete my analytics data" and we'll remove it within 30 days.
• Export your local data — Settings → Data Controls → Export. This is everything TORQ holds about you, and it's all on your device.
• Delete your local data — Settings → Data Controls → Delete. This wipes everything off your phone.

3.3 Advert measurement (TikTok)

From version 1.4.3 the app includes the TikTok App Events SDK, provided by TikTok (part of the ByteDance group), so we can measure whether our TikTok adverts lead to installs and subscriptions.

This only runs if you agree. On first launch you'll see the standard system prompt asking whether TORQ may track your activity across other companies' apps and websites. If you decline, the SDK does not run and none of the data below is sent. The app works identically either way.

If you allow it, the following may be sent to TikTok:

• Your advertising identifier (IDFA on iOS, Advertising ID on Android)
• Device model, operating system version, language, and time zone
• IP address, from which TikTok derives country-level location
• App events — install, app open, trial started, subscription purchased, with amount and currency
• Campaign identifiers, if you arrived from a TikTok advert

No training data is ever sent. Not your lifts, weights, reps, sets, bodyweight, tier scores, nutrition entries, routines, or anything you have typed into the app. Not your name, email, contacts, photos, or precise location. Not your card details.

• Legal basis: Consent (UK GDPR Article 6(1)(a)).
• Withdraw consent: iOS — Settings → Privacy & Security → Tracking → toggle TORQ off. Android — Settings → Google → Ads → Delete advertising ID.
• Recipient: TikTok acts as an independent controller for this data and combines it with its own records to attribute and target advertising. See TikTok's Privacy Policy.
• Transfers: Processed outside the UK and EEA, including in the United States and Singapore, under Standard Contractual Clauses and the UK International Data Transfer Addendum.
• Retention: Held by TikTok under its own retention schedule. We keep no copy and see only aggregate campaign figures.

3.4 Permissions the app may request

The app requests only the permissions it needs to function. Where a permission is declined, the app continues to work with that feature unavailable. We do not repeatedly re-prompt for permissions you have declined.

• Notifications — optional, used for training reminders you have configured yourself. Declining this has no effect on any other feature.
• Tracking (iOS) — optional, used solely for the advert measurement described in Section 3.3.

The app does not request access to your contacts, camera roll, microphone, calendar, health records, or precise location.

4. The TORQ Website (torqapp.co.uk)

Our website is hosted on Netlify and uses one tracking technology: Meta Pixel.

4.1 Meta Pixel

The website uses Meta Pixel (Pixel ID: 1256081949398477) provided by Meta Platforms Inc. This is a piece of JavaScript that sets cookies (including _fbp, and _fbc if you arrived from a Facebook or Instagram link) and records:

• When you visit the site (page view events)
• When you tap a Download or Get the App button to go through to the App Store
• Your approximate location (country-level, derived from IP address)
• Your browser type and operating system

The honest version of what this tracks: the Pixel can see what you do on this website, including the moment you tap through to the App Store. It cannot follow you into the App Store or into the app — Apple does not share that with us or with Meta — so it does not know whether you actually downloaded TORQ, and it cannot see anything you do inside the app.

We use this data to show TORQ adverts on Instagram and Facebook to people who have visited the site, and to measure how those adverts perform. Meta is a joint data controller for the Pixel data, and Meta combines what it receives with its own records to power that ad targeting. We do not sell this data or share it with anyone other than Meta. Meta's use of the data is governed by Meta's Privacy Policy.

By continuing to use this website, you consent to the use of Meta Pixel as described above. If you do not consent, please leave the site or use the opt-out methods listed.

4.2 Cookies and Similar Technologies

A cookie is a small text file placed on your device by a website. Cookies are widely used to make websites work, to remember preferences, and to provide information to site owners. Similar technologies include local storage, pixels, and web beacons, which perform comparable functions.

The cookies used on torqapp.co.uk fall into the following categories:

• Strictly necessary — required for the site to function and to keep it secure. These cannot be switched off through our site. They do not store personally identifiable information.
• Analytics and advertising — the Meta Pixel cookies described in Section 4.1. These help us understand how the site is used and allow us to show relevant adverts.

We do not use cookies for any purpose beyond those described above. We do not operate an advertising network, we do not place cookies on behalf of other advertisers, and we do not use cookies to build a profile of your interests beyond what Meta does for the retargeting described in Section 4.1.

Most browsers allow you to refuse or delete cookies through their settings menu. Doing so may affect how parts of the site function. Guidance for common browsers is available from their respective help pages, and general guidance on cookies is published by the Information Commissioner's Office at ico.org.uk.

4.3 Hosting and Server Logs

Our website is hosted by Netlify Inc. Netlify automatically records standard server log information for every visit, including:

• IP address
• Browser type and version
• Pages visited and timestamps
• Referring website

These logs are used by Netlify for security, abuse prevention, and infrastructure operation. They are retained according to Netlify's Privacy Policy. We do not access these logs except in the case of investigating suspected abuse.

4.4 Email Capture Form

The homepage contains an email capture form. If you submit your email address through this form, it is stored by Netlify Forms.

We do not currently send any marketing emails. At present we have no email-sending infrastructure in place. If and when we begin sending emails (for product announcements, launch updates, or similar), every email will include:

• A clear and accurate subject line — no clickbait or deceptive headers
• An unsubscribe link in the footer of every message
• Our identity and contact details

You can request deletion of your email address at any time by messaging @TorqApp on Instagram or emailing support@torqapp.co.uk.

5. Payments

When you purchase through our website, payment is processed by Stripe, an independent payment processor. Stripe collects your card details, billing address, and payment metadata directly. We never see, store, or have access to your card information.

We receive only the following from Stripe when a purchase completes:

• The email address you provided at checkout
• The amount paid and the transaction ID
• Country of payment (for VAT/tax purposes only)

Stripe's handling of your payment data is governed by Stripe's Privacy Policy.

For subscription purchases made through the iOS App Store or Google Play (monthly or annual TORQ subscriptions), Apple and Google handle all payment processing respectively. We receive no payment data from either — only confirmation that a subscription is active. See Apple's Privacy Policy and Google's Privacy Policy.

6. How We Use Your Information

We use the limited information described in this policy for the following purposes, and no others:

• To provide the Services — running the app and website, and delivering the features you have chosen to use.
• To maintain and improve the Services — identifying bugs, understanding which features are used, and prioritising development work.
• To process payments — completing purchases and managing subscriptions.
• To measure and improve our advertising — understanding which campaigns bring people to TORQ, where you have consented to this.
• To keep the Services secure — detecting, preventing, and investigating abuse, fraud, and technical attacks.
• To meet our legal obligations — including tax, accounting, and responding to lawful requests from authorities.
• To respond to you — handling support enquiries and data rights requests.

We do not use your information to make decisions about you, to assess your creditworthiness, to determine eligibility for any service, or for any purpose unrelated to running TORQ.

7. Data Sharing and Disclosure

We do not sell your personal data. We do not rent it, trade it, or make it available to data brokers. We share data only in the following circumstances:

• With the service providers listed in Section 8 — each of which processes data only for the purposes described in this policy.
• Where you have consented — for example the advert measurement described in Section 3.3.
• Where required by law — if we receive a valid legal order, court order, or request from a competent authority, we may disclose information to the extent legally required. In practice we hold almost nothing that could be disclosed, because your training data never reaches us.
• In connection with a business transfer — if TORQ is sold, merged, or otherwise transferred, information may pass to the acquiring party. Any acquirer would remain bound by the commitments in this policy, and we would notify you of any material change before it takes effect.
• To protect rights and safety — where disclosure is necessary to protect our legal rights, the safety of users, or the integrity of the Services.

8. Third-Party Services Summary

To be fully transparent, here is every third party that has access to any data related to your use of TORQ:

• Apple — iOS app distribution, in-app subscription processing
• Google — Android app distribution and in-app subscription processing via Google Play
• PostHog — Anonymised in-app usage data, stored in the EU (Frankfurt)
• Netlify — Website hosting, form submissions storage
• Meta (Facebook/Instagram) — Website analytics via Meta Pixel, ad delivery
• TikTok (ByteDance) — In-app advert measurement, only where you have agreed to tracking
• Stripe — Payment processing for purchases made through our website
• Google Fonts — The website loads typefaces from Google Fonts, which may log your IP address. See Google's Privacy Policy.

That's the complete list. We use no other analytics tools, no CRM, no marketing automation, no chat support tool (the on-site chatbot is a local-only keyword matcher that does not transmit your messages anywhere).

9. Automated Decision-Making and Profiling

Under Article 22 of the UK GDPR you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

We do not carry out any such automated decision-making. The tier scores and strength rankings the app produces are calculated entirely on your own device from data you have entered yourself, are shown only to you, are not transmitted to us, and have no legal or similarly significant effect. They are a training tool, not a decision about you.

Where third parties described in this policy carry out profiling for advertising purposes — specifically Meta and, where you have consented, TikTok — that profiling is carried out by those companies as independent controllers under their own policies, and you can object to it using the opt-out methods described in Sections 3.3 and 4.1.

10. Your Rights Under UK GDPR

If you are a UK or EU resident, you have the following rights regarding your personal data:

• Right of access — you can request a copy of any personal data we hold about you
• Right to rectification — you can ask us to correct inaccurate data
• Right to erasure ("right to be forgotten") — you can ask us to delete your data
• Right to restrict processing — you can ask us to stop using your data in certain ways
• Right to data portability — you can ask for your data in a portable format
• Right to object — you can object to our processing of your data, including for marketing
• Right to withdraw consent — where we rely on consent, you can withdraw it at any time
• Right to lodge a complaint — you can complain to the UK Information Commissioner's Office (ico.org.uk) if you believe we have mishandled your data

To exercise any of these rights, email support@torqapp.co.uk or contact us at @TorqApp on Instagram. We respond within 30 days.

Exercising these rights is free of charge. We may ask for information to verify your identity before acting on a request, in order to prevent someone else obtaining your data. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act, and we will explain our reasons if so.

Because the app has no accounts, in most cases we genuinely hold nothing that identifies you — which means an access or erasure request will often return very little. That is not evasion, it is a consequence of the design.

Our legal basis for processing your data:

• Performance of a contract — for processing payments and delivering access to TORQ after purchase
• Legitimate interests — for website hosting logs, security, basic operational data, and anonymised in-app usage data (UK GDPR Art. 6(1)(f); opt out any time in Settings → Data Controls)
• Consent — for in-app advert measurement via the TikTok SDK, for Meta Pixel tracking on the website (signified by continued use of the site), and for any future email marketing
• Legal obligation — for retaining transaction records required by tax and accounting law

11. Notice for California Residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you specific rights regarding your personal information:

• The right to know what categories of personal information we collect about you
• The right to request deletion of your personal information
• The right to correct inaccurate personal information
• The right to opt out of the "sale" or "sharing" of your personal information for cross-context behavioural advertising
• The right to limit the use of sensitive personal information — we do not collect sensitive personal information as defined by the CCPA
• The right not to be discriminated against for exercising any of these rights

We do not sell personal information for money. However, our use of Meta Pixel on the website and the TikTok SDK in the app may be considered "sharing" of personal information for cross-context behavioural advertising under California law. To opt out of Meta Pixel, use the methods described in Section 4.1 above. To opt out of the TikTok SDK, decline the tracking prompt or use the device settings listed in Section 3.3.

To exercise your CCPA rights, email support@torqapp.co.uk or contact @TorqApp on Instagram. We respond within 45 days as required by California law. You may designate an authorised agent to make a request on your behalf, subject to reasonable verification.

12. Other United States State Privacy Rights

Residents of certain other US states — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana — have rights under their respective state privacy laws that are broadly similar to those described in Section 11. These typically include the right to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising and the sale of personal data.

We extend the same rights and the same response process to residents of all US states, regardless of whether a specific state law applies. Use the contact details in Section 22 to make a request. Where a state law provides a right to appeal a refused request, you may appeal by replying to our decision, and we will respond within the period required by that law.

13. Data Retention

We keep personal data only for as long as we need it for the purposes described in this policy, or for as long as the law requires.

• App training data — stored on your device until you delete the app. We have no copy.
• In-app usage data (PostHog) — automatically deleted after 90 days. You can opt out at any time in Settings → Data Controls.
• Advert measurement data (TikTok) — retained by TikTok under its own retention schedule. We hold no copy.
• Email addresses (from the website form) — retained until you request deletion.
• Stripe payment records — retained by Stripe according to their policy and applicable financial regulations (typically 7 years for tax purposes in the UK).
• Server logs — retained by Netlify per their policy (typically 30 days).
• Support correspondence — retained for up to 24 months so we can handle follow-up enquiries, then deleted.

14. Children's Privacy

TORQ is intended for users aged 17 and over. We do not knowingly collect personal data from anyone under 17, and we do not knowingly direct advertising to anyone under 17. If you believe we have inadvertently received data from a minor, please contact us and we will delete it.

If you are a parent or guardian and believe a child in your care has provided information to us, contact us using the details in Section 22 and we will investigate and delete anything we find.

15. International Transfers

Your in-app analytics data is stored in the European Union (PostHog EU Cloud, Frankfurt) and is not transferred outside the EU/UK.

Some of our other service providers (Meta, Stripe, Netlify, Google) are based in the United States. When your data is transferred outside the UK or EU, those providers rely on Standard Contractual Clauses (SCCs) or equivalent legal mechanisms approved by the UK Information Commissioner's Office to ensure your data is protected to UK GDPR standards.

Where you have consented to advert measurement, TikTok processes that data outside the UK and EEA, including in the United States and Singapore, and within the wider ByteDance group. Those transfers rely on Standard Contractual Clauses and the UK International Data Transfer Addendum.

You may request further information about the safeguards applied to any specific transfer by emailing support@torqapp.co.uk.

16. Security

Your training data stays on your device, so there's nothing on a server for us to leak. The only data leaving your phone is anonymised usage data stored by PostHog in the EU, and — where you have agreed to it — advert measurement events sent to TikTok. Both travel over encrypted connections. For the website, we use HTTPS encryption for all traffic. Stripe handles all payment data with PCI-DSS Level 1 compliance. We do not store any sensitive data ourselves.

The organisational measures we apply are proportionate to a business of our size: access to the small number of third-party dashboards we use is protected by strong, unique credentials and multi-factor authentication where the provider supports it; we collect the minimum data necessary for each purpose; and we review our third-party integrations when we add or change one.

No method of transmission over the internet or method of electronic storage is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security, and any transmission is at your own risk.

17. Data Breach Notification

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, as required by Article 33 of the UK GDPR.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify affected individuals directly and without undue delay, as required by Article 34. Because the app holds no account details and no contact information for the vast majority of users, direct notification may take the form of a prominent notice on torqapp.co.uk and within the app.

18. Links to Other Websites

Our website and app may contain links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control those third-party websites and are not responsible for their privacy statements. We encourage you to read the privacy policy of every website you visit.

19. Do Not Track and Global Privacy Control

Some browsers transmit a "Do Not Track" (DNT) signal or a Global Privacy Control (GPC) signal to websites you visit. There is no universally accepted standard for how sites should respond to DNT signals. Where our website receives a recognised GPC signal, we treat it as a valid opt-out of the "sharing" of personal information for cross-context behavioural advertising as described in Section 11.

20. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, our Services, or applicable law. Material changes will be noted at the top of this page (the "Last Updated" date and version number). For significant changes — such as introducing a new category of data collection — we will post a notice on the homepage and, where the change requires it, ask for your consent again.

We encourage you to review this page periodically. Continued use of the Services after a change takes effect constitutes acceptance of the revised policy, except where the change requires consent, in which case we will ask you directly.

21. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of England and Wales. Nothing in this policy limits any right you have under the UK GDPR, the Data Protection Act 2018, or any other applicable data protection law that cannot be limited by agreement.

22. Contact Us

For any privacy questions, requests to exercise your rights, or to report a concern:

• Email: support@torqapp.co.uk
• Instagram DM: @TorqApp

We aim to respond within one business day for general questions and within 30 days for formal data rights requests (45 days for CCPA requests, as required by California law).

If you are not satisfied with how we have handled your enquiry, you have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection. You can reach the ICO at ico.org.uk or on 0303 123 1113. We would ask that you give us the opportunity to resolve the matter first, but you are under no obligation to do so.