Privacy Policy for Rebase

Last updated: October 21, 2026

1. Introduction

Rebase ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App").

2. Information We Collect

We collect the following types of information:

2.1 Personal Information

• Email Address: Used for account creation, authentication, finding other users, and sending notifications and marketing communications
• Name: Used to identify you within the app and to other users in your challenges
• Profile Photo (Optional): You may choose to upload a profile picture using your device's camera or photo library

2.2 Fitness and Activity Data

• Workout Logs: Exercise activities, progress entries, and fitness goals you submit, including optional workout details such as distance and duration
• Imported Workouts: If you connect Strava or Apple Health, workouts from those services (see Sections 6 and 7)
• Challenge Data: Your participation in fitness challenges, progress tracking, and results
• Goal Information: Weight goals, workout objectives, and other fitness targets you set

2.3 Usage Data

• Analytics: We may collect analytics data to improve app performance and user experience (including Google Analytics)
• Device Information: Device type, operating system version, and app version for technical support

2.4 Subscription and Purchase Data

• Subscription Status: If you purchase Rebase Pro, we receive your subscription status (such as active, expired, trial, and plan type) and a purchase identifier so we can unlock paid features for your account.
• Payment Processing: Purchases are made through the Apple App Store or Google Play. We do not receive or store your full payment-card details - those are handled directly by Apple or Google.

3. How We Use Your Information

We use the collected information for:

• Providing and maintaining app functionality
• Creating and managing your user account
• Enabling challenge participation and tracking your fitness progress
• Allowing other users to find you by email address
• Sending notifications, reminders, and marketing communications
• Improving app performance and user experience
• Providing customer support

4. Data Sharing

We share your information in the following ways:

4.1 Within Challenges

When you participate in a fitness challenge, the following information is shared with other participants in that specific challenge:

• Your name and profile photo
• Your fitness progress and workout logs within that challenge, including any distance, duration and pace you log or import
• Your challenge goals and results

4.2 Service Providers

We use third-party services to operate our app:

• Firebase (Google): Authentication, database, cloud storage, and push notifications (Firebase Cloud Messaging)
• Google Analytics: Usage analytics and app performance monitoring
• Strava: Fitness activity data import via OAuth integration (see Section 6)
• Sentry: Error tracking and crash reporting
• RevenueCat: Manages and validates in-app subscriptions and reports your subscription status
• Apple App Store / Google Play: Process subscription payments and provide receipt and transaction data used to validate purchases
• TikTok and Meta (Facebook, Instagram): Measuring how well our ads work, only if you allow it (see Section 8)

4.3 Legal Requirements

We may disclose your information if required by law or to protect our rights, safety, or property.

5. Push Notifications

The App supports optional push notifications powered by Firebase Cloud Messaging (FCM).

• Token Collection: When you enable push notifications, we collect your device's FCM push notification token and link it to your user account.
• Purpose: The token is used solely to send you notifications about:
  • Challenge updates
  • Activity from other participants in your challenges
  • Challenge invitations
  • Pre-challenge reminders
• Token Refresh: Your push notification token is synced and refreshed every 30 days to ensure reliable delivery.
• Token Deletion: Your push notification token is deleted from our servers when you log out or delete your account.
• Opt-Out: Push notifications are optional. You can disable them at any time through your device's notification settings.

6. Strava Integration

The App allows you to connect your Strava account to automatically import fitness activities.

• Authentication: We use OAuth to connect to Strava with the following permission scopes: read and activity:read_all.
• Stored Data: When you connect your Strava account, we store your Strava access token, refresh token, and athlete ID to maintain the connection.
• Activity Data: We receive webhook events from Strava when you create or delete activities. We fetch activity details from Strava's API, including activity type, name, distance, duration, heart rate, calories, and other related metrics.
• Disconnecting: You can disconnect your Strava account at any time from the App's settings. Disconnecting deletes all stored Strava tokens from our servers.
• Account Deletion: When you delete your Rebase account, we revoke access with Strava and delete all stored Strava data, including tokens and imported activities.

7. Apple Health Integration (iOS)

On iPhone, you can connect Apple Health so that workouts recorded on your iPhone or Apple Watch can be logged in Rebase without typing them in.

• Only with your permission: The App asks for read access to workouts through Apple's Health permission screen. It does not ask for, and never writes, any other Health data. You can change this at any time in the Health app (your profile picture > Apps > Rebase).
• What we receive: For each new workout: its type, start and end time, duration, distance, calories, whether it was entered by hand, which app recorded it, and the workout record as Apple Health provides it.
• How we use it: Only to show you the workout so you can log it in your challenges, and to avoid showing the same workout twice (for example when it also arrives from Strava). Nothing is logged automatically: you choose which workouts to log, and only logged workouts are visible to others in your challenges (see Section 4.1). Workouts you don't log are no longer shown after 14 days.
• Background updates: With your permission, iOS lets the App know when a new workout is saved, so it can be ready to log right away.
• Never for advertising: Apple Health data is never used for advertising or marketing, never shared with TikTok, Meta or any other advertising partner, and never sold.
• Disconnecting: You can disconnect Apple Health at any time in the App (You > Apple Health). The App then stops sending new workouts. Workouts you already logged stay in your challenges until you delete them.
• Account Deletion: When you delete your Rebase account, all workouts received from Apple Health are deleted with it.

8. Advertising Measurement (TikTok and Meta)

We advertise Rebase on TikTok, Instagram and Facebook. If you allow it when the App asks, we use the TikTok and Meta software development kits (SDKs) to measure how well those ads work, so we can show them to people who are likely to enjoy Rebase.

• Only with your consent: On iOS, the App asks through Apple's App Tracking Transparency prompt. On Android, the App asks during setup. If you decline, the TikTok and Meta SDKs are not started and nothing is shared with them.
• What we share: That you installed and opened the App, that you created an account, that you logged your first workout, subscription purchases and renewals (reported to Meta by RevenueCat), and your device's advertising identifier (IDFA on iOS, Google Advertising ID on Android).
• What we never share: Your workouts, photos, comments, goals, or anything about other people in your challenges.
• Changing your choice: On iOS, go to Settings > Privacy & Security > Tracking and turn tracking off for Rebase. On Android, clear the App's storage in your device's app settings; the App then asks again.
• Processing outside the EU/EEA: TikTok and Meta may process this data outside the European Union and European Economic Area, in accordance with their own privacy policies.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

10. Your Rights

You have the right to:

• Access, update, or delete your personal information
• Opt-out of marketing communications
• Delete your account and associated data
• Request a copy of your data
• Withdraw your consent to advertising measurement at any time (see Section 8)

11. Data Retention

We retain your information for as long as your account is active or as needed to provide services. If you delete your account, we will delete your personal information within a reasonable timeframe, except where retention is required by law.

12. Children's Privacy

Rebase is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has created an account, please contact us and we will delete it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

14. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Email: daniel@docode.se

15. Permissions

The app requests the following permissions:

• Camera: To capture profile pictures (optional, only when you choose to take a photo)
• Photo Library: To select existing photos for your profile (optional)
• Notifications: To send challenge updates and reminders
• Apple Health (iOS, optional): To read your workouts so you can log them in Rebase (see Section 7)
• Tracking (iOS) / Advertising ID (Android): To measure our ads on TikTok and Meta, only if you allow it (see Section 8)
• Internet: To sync your data and communicate with our servers