Privacy policy.

Who is responsible

MaxOut is a workout tracking app developed by OSC Limitada, Chile, which is responsible for the personal data described here. Any questions about this policy or about your data can be sent to soporte@oscx.cl.

Use of the app is also governed by its terms and conditions.

What data we process

MaxOut works offline: everything you log is saved first to a local database on your phone. While you are signed in, the app syncs that data with our servers, so that you have a copy off your phone and can recover it on another device. That data is:

• Account: name and email address, and your password if you do not sign in with Google.
• Profile: display name, profile photo, body weight, height, date of birth and your phone's time zone.
• Training: every session, exercise and set you log, your routines and the custom exercises you create, including what you import from another app.
• Game progress: experience, coins, items, bags and achievements.
• Your preferences within the app.
• Health Connect, if you turn it on in Android: your weight records and your best step day, as explained under "Health Connect (Android)".
• Subscription, if you purchase MaxOut Premium: the plan, its status, dates and amount, the identifiers Google Play assigns to the purchase (the purchase token and the order number) and your account email.

Weight, height and training history are data related to your health and physical activity. We process them only to provide the service to you, never for profiling or advertising purposes.

What we use it for

• Creating and maintaining your account, and signing you in.
• Keeping a copy of your training and restoring it on another device.
• Calculating your game progress: experience, coins and achievements are validated on the server, and the time zone is used to count each session on the correct day.
• If you turn on Health Connect: recording your workouts there, showing how your weight evolves and granting the steps achievement.
• Detecting and fixing app failures.
• Verifying MaxOut Premium purchases with Google Play and granting, maintaining or removing access according to the subscription's status: renewals, cancellations and refunds.

The legal basis is your consent, which you give when you create the account, and providing the service you ask of us. You can withdraw it at any time by deleting your account.

Sign-in

To sign in we use our own identity service (Zitadel, at id.oscx.cl), operated by OSC Limitada. It stores your name, your email and, if you sign in with email and password, your password as a hash (bcrypt), never in plain text. The app receives from that service a session that renews itself and is kept in the operating system's secure storage.

If you sign in with Google, Google gives us your name and your verified email. The first time, the app also offers to bring your photo and date of birth from your Google account to complete your profile; Google asks for your permission and you can decline.

If your account predates this system, we link it to your new sign-in through your verified email, and the password you used before stays stored on our servers, also as a hash (Argon2), until you delete the account.

What stays on your phone

Your profile photo is taken with the camera, chosen from your gallery or, if you sign in with Google and agree, brought from your Google account; only the image you choose is uploaded, never the rest of your gallery. The files you import from Hevy, Strong or Jefit are read on the phone itself: the sessions that result from them are synced, not the file.

Backups and exports leave the device only if you share them. "Delete all my data", in Settings, erases the phone's local database.

Health Connect (Android)

If you turn it on in Settings, MaxOut connects to Health Connect and uses only:

• Exercise (write): when you finish a workout we record it in Health Connect as an exercise session (type, start and end time). If you delete the workout in MaxOut, we also delete it from Health Connect. This is not sent to our servers.
• Weight (read): we read your weight records, first those from the last 30 days and then new ones, to show how your weight evolves in the body weight chart. They are saved to your MaxOut account so they sync across your devices.
• Steps (read): we read your daily steps to grant achievements. In your account we only keep your best day (the step count and the date), so it syncs across your devices.

Each permission is off by default and is turned on separately. We do not read any other Health Connect data, any history older than 30 days before you turned it on, or anything in the background. Data obtained from Health Connect is not sold, not used for advertising or profiling, and not transferred to third parties, except to those who host our servers to the extent needed to provide these features: we use it only for the features described. You can revoke access at any time from Health Connect or from MaxOut's settings, and delete the data already saved by removing it from your log or deleting your account. The use of information received from Health Connect complies with the Health Connect Permissions Policy, including the Limited Use requirements.

Import matching

If you turn on "Help match imported exercises" in Settings, when you import we send how you matched the name of an exercise from another app to one in MaxOut, so that other people have less to match by hand. Only exercise names are sent, never your training.

Crash reports

When the app fails we send a technical report to Sentry (Functional Software, Inc., United States), which acts as a data processor on our behalf. The report contains the error, the device model, the system version and the app's technical state at that moment.

The app explicitly discards the content of requests and log messages before sending, and does not attach your name or your email, precisely so that a training record never travels alongside an error.

Payments

Payment for MaxOut Premium is processed by Google Play. We do not receive or store your card or payment method details: Google handles them under its own privacy policy.

To verify a purchase we query Google Play with the identifier Google itself assigned to it, and Google notifies us when the subscription renews, is cancelled or is refunded. We do not send Google your training or your profile.

Permissions we ask for

• Notifications: once, after you sign in, to show the session in progress and to tell you when your rest ends.
• Camera and photos: only when you choose your profile photo.
• Foreground service and keeping the device awake: so that the rest countdown keeps running with the screen off.
• Health Connect (Android), exercise write and weight and steps read: only if you turn it on, as explained under "Health Connect (Android)".

MaxOut does not access the microphone, your location, your contacts, your calendar or the phone's activity sensors.

Who we share your data with

We do not sell your data, we do not hand it over for advertising purposes, and we do not include analytics or advertising services. Your data is not visible to other people who use MaxOut.

The only parties involved are those who provide the infrastructure we need —the hosting of our servers, and Sentry for crash reports—, who process the data on our behalf and solely for that purpose. The data we obtain from Health Connect is not shared with anyone else. If you purchase MaxOut Premium, Google Play is also involved, as explained under "Payments". We may disclose data when a competent authority requires it under the law.

How we protect it

All communication between the app and our servers is encrypted (HTTPS). Passwords are stored only as hashes, never in plain text, and the session is kept in the operating system's secure storage.

How long we keep it

Your account data and synced training are kept for as long as the account exists. The record of each MaxOut Premium purchase is kept even if you delete your account, as accounting support for the transaction. Local data stays on your phone until you erase it or uninstall the app. Crash reports are kept temporarily and deleted automatically.

How to delete your account and your data

Within the app, in Settings → Account → Delete account. This option erases your account, profile, photo, training history, progress and the Health Connect data saved in it (weight and best step day) from our servers; if you created the account from MaxOut, it also erases your user in the identity service. It then erases the device's local database. The exercise matches you have shared are kept, unlinked from your account. This action cannot be undone.

If you have MaxOut Premium, deleting your account first cancels the subscription on Google Play, so that you are not charged again; if that cancellation fails, the account is not deleted and the app tells you so.

If you no longer have access to the app, write to us at soporte@oscx.cl from the email you registered with and we will delete the account. The full steps are in Delete your account.

Your rights

Under Chilean personal data protection law, you can ask us to access, rectify or delete your data, or object to its processing. Much of this can be done from the app itself: editing your profile, exporting your training or deleting your account. For anything else, write to us at soporte@oscx.cl.

Minors

MaxOut is not directed at children under 13 and we do not knowingly collect data from people of that age. If you believe a minor has given us data, write to us and we will delete it.

Changes to this policy

If we change what the app collects, we will update this page and the date shown at the top.