ROX-strat

Privacy Policy

Last updated: October 7, 2026

Short version: Your training data syncs to a server we run ourselves, in Frankfurt, so it follows you to a second device and survives a reinstall. We don't store your name or your email address, and your raw Apple Health data never leaves your phone. Deleting your account in the app erases it from our server. No analytics, no ad networks, no tracking.

1. Who we are

ROX-strat ("the app") is a personal pacing tool for HYROX® and hybrid-fitness athletes, built for iOS and Apple Watch. It is operated by Mehmet Gencol ("we," "us"), the data controller for the personal data described in this policy. Contact: hello@roxstrat.com. ROX-strat is not affiliated with HYROX® or Hyrox World GmbH. HYROX® is a registered trademark of Hyrox World GmbH.

2. What data the app handles

Identity

Data stored on our server

Signing in creates an account on the ROX-strat server at api.roxstrat.com, which runs on AWS in Frankfurt, in the EU. It holds:

That is the whole list, and it is what lets your data follow you to a second device and come back after a reinstall. Your name, your email address, and your raw Apple Health samples — HRV, sleep, heart rate, workouts — never end up in it. Like any web service, the server also keeps request logs, including your IP address, for 14 days to keep it secure and running. Your app preferences stay on the phone, except the in-app language sent with an announcements token (below).

Health data (read-only, from Apple Health)

Health data is read directly from Apple Health, used on your device to compute your readiness score and refine pacing projections. The samples themselves are never transmitted off your device; only the result, a single 0–100 readiness score, syncs to your account. You can revoke HealthKit permissions at any time in iOS Settings → Privacy & Security → Health → ROX-strat.

Strava data (optional, read-only)

If you connect Strava, the app reads your recent running activities to refine your pacing plan. The OAuth handshake goes through our Cloudflare Worker at strava-worker.roxstrat.workers.dev, which exists only to perform the token exchange so that the Strava client secret never lives in the app binary. The Worker does not log, persist, or forward any user data — it relays tokens straight back to your device.

Strava tokens are stored locally in the iOS Keychain. You can disconnect Strava at any time in Settings, which deletes the tokens from your device.

Subscription state

ROX-strat uses RevenueCat to manage in-app purchases for ROX-strat Pro. RevenueCat receives your random ROX-strat user id and the Apple-issued purchase receipt — enough to verify your subscription. It does not receive any of your training data. See RevenueCat's privacy policy for details.

Push notifications (optional)

If you turn on notifications, three kinds are scheduled entirely on your device: a countdown as your race gets close, a reminder to re-run your PFT, and a heads-up before your free Pro period ends. Nothing is sent anywhere to schedule them. Your race date and PFT results sync to your account like the rest of your training data; the start date of your free Pro period stays on your phone. You can turn each of these three on or off individually in Settings.

When you allow notifications, your device registers an anonymous push token with our Cloudflare Worker, along with your app version and in-app language — never your name, your Apple ID, or anything about your training. We only use it if you turn on Product news. Deleting your account removes this token from our systems.

3. What we do NOT collect

4. How your data is used

Everything described above is used for a single purpose: to give you a personalized pacing plan. There is no secondary use, no profiling for ads, no data brokers, and no sale of any data to third parties.

5. Data retention & deletion

You decide what is kept. You can:

Our database keeps rolling backups, so data deleted with your account can stay in them for up to 35 days. RevenueCat keeps its record of your purchases under its own privacy policy; deleting your account does not remove it.

6. Children

ROX-strat is intended for users 13 years or older. We do not knowingly collect data from children under 13. If you believe a child has used the app, contact us and we will help walk through deleting their account.

7. International users

ROX-strat is available worldwide. Account data is stored on our server in the AWS Frankfurt region (eu-central-1), in the European Union, wherever you live.

8. Your rights (GDPR, CCPA, etc.)

Under GDPR, CCPA, and similar frameworks, you have the right to access, correct, port, or delete personal data we hold about you. Section 2 lists everything we hold. You can delete all of it yourself from Settings → Delete Account, as described in Section 5. For access, correction, or a copy of it, write to us at the address below. You also have the right to complain to a data-protection authority.

9. Changes to this policy

If we materially change how data is handled, this page will be updated and the "Last updated" date at the top will move.

10. Contact

Questions, requests, or concerns: hello@roxstrat.com. See also our support page.

ROX-strat — pacing for hyrox and hybrid athletes. Not affiliated with HYROX® or Hyrox World GmbH.
Terms of Use