1. Information we collect
Draxstar collects data needed to operate a fitness-social account, provide training and recovery features, support community interactions, process subscriptions, protect users, and improve reliability.
This may include account identifiers, profile settings, workouts, plans, schedules, nutrition and recovery records, progress metrics, messages, posts, comments, group activity, selected media, push tokens, subscription metadata, analytics, diagnostics, waitlist details, and support request details.
2. Optional health and location data
HealthKit and location access are optional. HealthKit supports workout, sleep, recovery, and progress features. Location supports city autofill, maps, and active outdoor route tracking, including background location only during an active route workout.
3. How we use information
We use information to provide account access, workout tracking, plans, recovery, progress, messaging, groups, media features, waitlist communication, and service notifications.
We also use information to process subscription entitlement state, restore purchases, handle support requests, secure accounts, prevent abuse, investigate reports, troubleshoot reliability, improve product quality, and meet legal, safety, financial, support, and compliance obligations.
4. Sharing and service providers
Draxstar does not sell personal information and does not use HealthKit data for advertising, marketing, or unrelated data mining. We share data only where needed to operate the service, including with cloud hosting, authentication, storage, realtime, analytics, crash reporting, push notification, subscription, and support providers; with other users when you use social features; and where required by law or needed to protect rights and safety.
5. Cookies and tracking
The public Draxstar website does not use third-party tracking scripts. First-party cookies may be used for essential functions such as session management, CSRF protection, and preference storage. If we add analytics or product telemetry, it will be limited to product operation, reliability, and quality purposes and documented here.
6. Data retention, deletion, and portability
We retain personal data only as long as needed for account operation, feature delivery, security, fraud prevention, dispute resolution, financial records, legal compliance, or documented retention obligations. You can initiate account deletion in app settings. You may request a portable export of your data by emailing privacy@draxstar.org. Some records may be retained for a limited period when required for security, legal hold, support, finance, or compliance reasons.
7. Your rights and choices
You have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion of your data, withdraw consent for optional data processing (such as HealthKit or location), and request a portable copy of your data in a commonly used format.
To exercise these rights, email privacy@draxstar.org or use the in-app settings where available. We will respond to verified requests within the timeframe required by applicable law. We will not discriminate against you for exercising your privacy rights.
8. California privacy rights
If you are a California resident, the California Consumer Privacy Act (CCPA) provides additional rights regarding your personal information. Draxstar does not sell personal information. You have the right to request disclosure of the categories and specific pieces of personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information (which Draxstar does not engage in). To exercise your CCPA rights, email privacy@draxstar.org. We will verify your request and respond within the timeframe required by law.
9. Children
Draxstar is not intended for children under 13. If we learn that data from a child under 13 was collected without required authorization, we will take steps to remove it.
10. Security and incidents
Draxstar uses safeguards such as access controls, encryption in transit, encrypted local sensitive queues where supported, role-based backend controls, monitoring, and audit workflows. No system can guarantee absolute security. Where applicable law requires notice for a security or privacy incident, Draxstar will evaluate and provide required notices.
11. International access
Draxstar is operated from the United States. If you access the site from another region, your information may be processed in the United States or other locations where our providers operate.
12. Updates
We will update this policy as Draxstar evolves and will keep the current version available at this URL.