Privacy Policy

• No account, no registration, no login. You never give us an email address or a password.
• No analytics, no crash reporting, no advertising. The app contains no tracking SDKs of any kind.
• No user profiles on our servers. Your training data stays on your phone.
• Data leaves your device in exactly one situation: when you actively use the Remote Control feature. See section 5.

The controller responsible for data processing within the meaning of Art. 4(7) GDPR and Art. 5(j) of the Swiss Federal Act on Data Protection (FADP) is:

We have not appointed a data protection officer; we are not required to do so under Art. 37 GDPR or under the FADP.

The following data is written to the app's private storage area (Android SharedPreferences, serialised as JSON). It is readable only by this app and is not transmitted to us.

The app currently permits Android's system backup (allowBackup="true"). If you have enabled backup in your Android settings, the data listed in section 3 may be copied to your personal Google account and restored when you set up a new device.

This backup is performed by Google, not by us. We have no access to it. It is governed by Google's Privacy Policy and by your device's backup settings, which you can change at any time under Settings → Google → Backup.

The Remote Control feature lets an external application control your training session by connecting through a room code. This is the only part of the app that sends data off your device. If you never use Remote Control, no data ever leaves your phone.

a) Signalling server

When you enter a room code and connect, the app contacts our signalling server at eaglefit-remote-signal-server.up.railway.app. The following is transmitted to it:

• the room code you entered
• WebRTC connection descriptions (SDP offers and answers)
• ICE candidates — these contain your device's IP addresses, including local network addresses and your public IP address

The server's only job is to introduce the two participants to each other. It does not receive your training data and does not store a user profile. The connection is closed when you leave the room.

The server is hosted at Railway Corp., 80 Bogart St, Brooklyn, NY 11206, USA. This means a transfer of personal data (your IP address) to a third country. See section 9.

b) STUN servers

To determine how your device is reachable through your router, the app queries two public STUN servers operated by Google LLC, USA (stun.l.google.com:19302 and stun1.l.google.com:19302). These servers receive your public IP address.

c) Peer-to-peer connection

Once the connection is established, control commands travel directly between the two participants over an encrypted WebRTC data channel (DTLS-SRTP). This traffic does not pass through our servers.

• We do not collect analytics or usage statistics.
• We do not use crash or performance reporting services.
• We do not display advertising and do not use advertising identifiers.
• We do not use cookies or comparable tracking technologies in the app.
• We do not sell, rent or share your data with third parties for their own purposes.
• We do not create user profiles and do not perform automated decision-making or profiling within the meaning of Art. 22 GDPR.

As a company established in Switzerland we process personal data in accordance with the Swiss Federal Act on Data Protection (FADP). Where we offer the app to users in the EU or EEA, the GDPR applies in addition under its Art. 3(2), and the legal bases above are stated accordingly.

Using Remote Control transfers your IP address to the USA (Railway Corp. as our hosting provider, Google LLC as STUN operator). Such transfers are based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework and the corresponding Swiss-U.S. Data Privacy Framework where the recipient is certified, and otherwise on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR together with the transfer safeguards of Art. 16 f. FADP.

If you do not use Remote Control, no international transfer takes place.

Data stored on your device is kept until you delete it. You can:

• delete individual profiles, training records, goals and custom programs inside the app,
• clear all app data at once under Settings → Apps → XREMS EMS Remote → Storage → Clear data,
• remove everything by uninstalling the app.

Uninstalling does not automatically remove an existing Google backup. Delete that through your Google account settings.

Signalling server data (room code, connection metadata) exists only for the duration of a session and is discarded when the session ends.

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3)). Users in Switzerland have equivalent rights of access, rectification and erasure under Art. 25 ff. FADP.

Because we do not operate user accounts and hold no personal data about you on our systems, we are in most cases unable to identify you from a request alone (Art. 11 GDPR). The data is under your own control on your device. For questions, contact us at contact@xrems.fit.

You also have the right to lodge a complaint with a supervisory authority. For us, the competent authority is:

If you are located in the EU or EEA, you may alternatively lodge a complaint with the supervisory authority of your country of residence, place of work or the place of the alleged infringement (Art. 77 GDPR).

The app is not intended for children and must not be used by persons under 18 without medical supervision. See the Medical and Safety Disclaimer. We do not knowingly process data from children.

We may update this policy when the app changes. The current version is always available at xrems.fit/android/policy/privacy/. Material changes affecting outbound data flows will be announced in the app.