How we handle
your data.
DailyXplore is published by XPLORE CONSULTING. As the application publisher, XPLORE CONSULTING is the data controller within the meaning of Regulation (EU) 2016/679 (GDPR) and the French Loi Informatique et Libertés n°78-17.
Company name — XPLORE CONSULTING
Legal form — Société par Actions Simplifiée (SAS)
Registered office — 5 rue de la Pie, 76000 Rouen, France
Jurisdiction — France — European Union
Applicable law — GDPR (EU) 2016/679 · Loi n°78-17 Informatique et Libertés
Privacy contact — hello@maximedelaporte.com
Important. DailyXplore uses Supabase to sync your activity data and power the global leaderboard. Some of your data is transmitted to and stored on remote servers outside your device. This section explains exactly what is collected, why, and how it is protected.
We collect only what is strictly necessary to operate the app's core features — progress tracking, streak calculation, and the ranking leaderboard. No data is collected for advertising or profiling purposes.
| Data | Purpose | Where stored |
|---|---|---|
| Anonymous user ID (UUID) | Links your activity records across sessions without requiring a named account | Server |
| Exercise completions (type, date, duration / reps) | Core app function — daily progress tracking and streak calculation | Server Local |
| Streak count & history | Streak display, reset logic, and leaderboard ranking | Server Local |
| Daily targets (reps / seconds) | Progression logic — auto-increment each day | Server Local |
| Leaderboard display name | Optional — shown on the public leaderboard only if you choose to set one | Server |
| Notification time preference | Scheduling your daily reminder | Local only |
| App settings & preferences | Personalisation | Local only |
| Real name or email address | Not collected — no account creation required | Never |
| Location (GPS) | Not used — permission never requested | Never |
| Health / biometric data | No HealthKit integration in v1.0 | Never |
| Advertising identifiers (IDFA) | No advertising — no ad SDKs embedded | Never |
| Crash & diagnostic reports | Apple's standard crash reporting only — governed by Apple's privacy policy | Apple only |
The leaderboard display name is entirely optional. If you do not set one, you appear on the leaderboard as an anonymous identifier. You can remove yourself from the leaderboard at any time from within the app settings.
What stays on your device
Notification preferences and app UI settings are stored exclusively on your device using Apple's standard local storage APIs. This data never leaves your device and is not accessible to XPLORE CONSULTING.
What is synced to our servers
Your exercise completions, streak history, and daily targets are synchronised to our Supabase database. This is necessary to:
- Preserve your progress if you reinstall the app or change device
- Power the global leaderboard and ranking features
- Protect your streak history against local data loss
All server-side data is linked to an anonymous UUID generated at first launch — not to your name, email, or any externally identifying information, unless you voluntarily set a leaderboard display name.
Deleting your server data
You may request permanent deletion of all server-side data at any time via Settings → Delete my account & data in the app, or by emailing hello@maximedelaporte.com. Deletion is irreversible and completed within 30 days.
Every processing activity is grounded in a specific legal basis under Article 6 of the GDPR.
| Processing activity | Legal basis | Art. 6 ref. |
|---|---|---|
| Storing exercise completions & streak data server-side | Performance of a contract — necessary to deliver the app's core service | 6(1)(b) |
| Leaderboard display name | Consent — explicitly given when setting a display name | 6(1)(a) |
| Daily reminder notification | Consent — given via the iOS system permission prompt at first launch | 6(1)(a) |
| Support email correspondence | Legitimate interest — necessary to resolve user requests | 6(1)(f) |
| Security logging & fraud prevention | Legitimate interest — protecting the integrity of the service | 6(1)(f) |
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Withdrawal of leaderboard name consent removes your name from public display immediately.
| Sub-processor | Role | Location |
|---|---|---|
| Supabase Inc. | Database (PostgreSQL), authentication, and API — stores activity data, streak history, and leaderboard data | USA (AWS us-east-1) — see §6 |
| Apple Inc. | App distribution, local notifications, crash reporting, optional iCloud backup | USA — Apple Privacy Policy applies |
| Vercel Inc. | Web hosting for support, privacy, and marketing pages — no user app data processed | USA / EU edge nodes |
DailyXplore contains no advertising SDKs and no analytics SDKs — no Firebase, Mixpanel, Amplitude, or equivalent. This is verifiable by inspecting the application binary.
XPLORE CONSULTING does not sell, rent, or share your data with any third party for commercial or marketing purposes.
Your activity data is transferred to the United States. Supabase operates its primary database infrastructure on AWS us-east-1 (Northern Virginia, USA). Your exercise records, streak history, and leaderboard data are therefore stored on servers located outside the European Union.
Legal safeguards in place
This transfer is governed by Standard Contractual Clauses (SCCs) approved by the European Commission under Decision 2021/914, incorporated into our Data Processing Agreement (DPA) with Supabase Inc. These clauses contractually bind Supabase to protect your data to GDPR standards regardless of where it is hosted.
Supabase maintains a publicly available DPA and GDPR compliance documentation at supabase.com/privacy.
If you prefer not to transfer data outside the EU
Contact us at hello@maximedelaporte.com to request deletion of all server-side data. The app will continue to function in local-only mode — your streak history will not persist across device changes or reinstalls, but no data will be transmitted to our servers.
| Data category | Retention period | Deletion trigger |
|---|---|---|
| Exercise completions & streak history | Duration of active account + 90 days | Account deletion request, or 90 days after last app use |
| Anonymous UUID | Duration of active account | Account deletion request |
| Leaderboard display name | Until removed by user or account deletion | In-app removal or account deletion request |
| Support email correspondence | 12 months after resolution | Automated deletion at 12 months |
| Local device data | Until app uninstall or manual deletion | App deletion or Settings → Delete App Data |
You may request immediate deletion of all server-side data at any time, regardless of the periods above. See Section 9.
How notifications work
DailyXplore sends one local push notification per day as a workout reminder. Notifications are generated entirely on your device using Apple's local notifications API — no notification content is transmitted to our servers or to any third-party push service.
Legal basis
Processing your notification preference is based on your explicit consent (GDPR Article 6(1)(a)), given when you respond to the iOS permission prompt at first launch.
Withdrawing consent
Disable notifications at any time via Settings → Notifications → DailyXplore on your device. This does not affect any other app functionality or your server-side data.
Under the GDPR and French law, you have the following rights regarding your personal data. Contact hello@maximedelaporte.com to exercise any of them. We respond within 30 days as required by GDPR Article 12.
DailyXplore is rated 4+ on the App Store. We do not knowingly collect personal data from users under the age of 15 — the age of digital consent in France under Article 45 of the Loi Informatique et Libertés.
Users under 15 must obtain verifiable parental consent before using the app's server-connected features (streak sync, leaderboard). The app functions fully in local-only mode without parental consent — no data is transmitted to our servers in this mode.
If you believe a child under 15 has used server-connected features without parental consent, contact us at hello@maximedelaporte.com and we will delete the relevant data promptly.
We may update this Privacy Policy to reflect changes in the app's features, our sub-processors, or applicable law. For any material change — particularly one involving new data categories or new sub-processors — we will:
- Update the "Last updated" date at the top of this page
- Notify you via an in-app notice on next launch
- Request fresh consent where required by the GDPR
For non-material updates (wording clarifications, formatting), we will update this page without individual notification.
For any question about this policy, to exercise your rights, or to report a privacy concern — contact us. We read and respond to every message.
XPLORE CONSULTING
À l'attention du Responsable de la protection des données
5 rue de la Pie — 76000 Rouen — France
Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07
cnil.fr
