Privacy Policy

1. Who we are

Pentagon Strength is operated by Nerio Cedeno, based in Florida, United States. The app is a product of Pentagon Software LLC (registration in progress).

For any privacy-related question, contact us at nerio023@gmail.com — subject line: Privacy Question - Pentagon Strength.

We respond within 7 business days.

2. What information we collect

When you create an account, we collect:

• Email address — to identify your account and allow password recovery.
• Password — stored as a one-way cryptographic hash. We cannot read your password.
• Workout logs — sets, reps, weights lifted, and effort levels you record.
• Personal Records (PRs) — calculated automatically from your workout logs.
• Language preference — to display the app in your chosen language.
• IP address — captured once at the moment you accept our medical disclaimer, for legal compliance purposes only. It is not used for tracking, advertising, or profiling.

We do not collect:

• Real name, physical address, phone number, or government ID.
• Body weight, body measurements, or any biometric data.
• Location data beyond what is described above.
• Contacts, photos, or any device sensor data.
• Health data from Apple Health, Google Fit, or any third-party service.
• Payment information directly — all subscription payments are processed by Apple, and we receive only anonymized transaction confirmations.

3. How we use your information

We use your data exclusively to:

• Authenticate you when you log in.
• Display your training history and progress charts.
• Generate personalized workout plans based on the information you provide.
• Remember your language preference across sessions.
• Comply with our legal obligations (IP address retained with your disclaimer acceptance).

Automated decision-making: Pentagon Strength uses automated logic to generate your training plan based on the information you provide (training goal and days per week). No human reviews or modifies this plan before it is displayed to you. This process has no legal or similarly significant effect on you — it is a functional feature of the app. You may request a human review of your plan by contacting us at the email in Section 1.

We do not:

• Sell your personal information to any third party.
• Share your personal information for cross-context behavioral advertising or targeted advertising.
• Use your data to train machine learning models.
• Send marketing emails.
• Make automated decisions that produce legal effects concerning you.

4. Who we share your data with

Your data is processed by the following services solely to operate the app:

When you play an exercise video, YouTube receives your IP address and browser information. We use the youtube-nocookie.com domain to reduce the data YouTube collects, but we do not control YouTube's data practices.

We do not share your data with anyone else.

5. International data transfers

Pentagon Strength is operated from the United States. All data is stored on servers located in the United States, operated by Render.

If you access the app from outside the United States — including from the European Union or the United Kingdom — your personal data will be transferred to and processed in the United States. The United States may not offer the same level of data protection as your home country. By creating an account and using the app, you acknowledge this transfer.

6. How long we keep your data

• While your account is active: We retain your data indefinitely because it is necessary to provide the core functionality of the app. Your training history and progress tracking are only meaningful if retained over time. You may delete your account at any time (see Section 7).
• After account deletion: When you delete your account, your account and all associated data — profile, workout logs, PRs, and consent records — are permanently and irreversibly deleted immediately.
• IP address (disclaimer acceptance): Retained only while your account exists. It is permanently deleted when you delete your account.

7. Your rights and how to exercise them

You have the following rights regarding your personal data:

We will respond to all rights requests within 45 days. In cases of complexity or high volume, we may extend this period by an additional 45 days, in which case we will notify you of the extension before the initial 45-day period expires.

We may ask you to verify your identity before processing a request, to protect your data from unauthorized access.

California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know — categories and specific pieces of personal information we collect, purposes of use, and categories of third parties.
• Right to deletion — subject to certain exceptions.
• Right to correction — of inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share for cross-context behavioral advertising. There is nothing to opt out of, but you have this right and we honor it.
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights.

Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and other U.S. state residents

If you reside in a state with a comprehensive data privacy law, you may have rights similar to those described above, including the right to access, correct, delete, and obtain a portable copy of your personal data, and the right to opt out of certain automated profiling. We do not collect any sensitive data as defined under these laws.

8. Security

We implement industry-standard measures to protect your personal information:

• All data transmitted between your device and our servers is encrypted via HTTPS (TLS).
• Passwords are stored using a one-way cryptographic hash (bcrypt). We cannot retrieve or read your password.
• Access to the database is restricted to the application and authorized personnel only.
• Our hosting infrastructure (Render) maintains physical and network security controls.

No method of transmission over the internet or method of electronic storage is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security. In the event of a data breach that affects your rights and freedoms, we will notify you as required by applicable law.

9. Cookies and tracking

We use only essential cookies required to operate the app:

These cookies are strictly necessary. The app does not function without them.

We do not use:

• Analytics cookies (e.g., Google Analytics)
• Advertising or tracking cookies
• Third-party social media tracking pixels

Because we use only strictly necessary cookies, no cookie consent banner is required.

10. Children's privacy

Pentagon Strength is intended for users aged 18 and older. We do not knowingly collect personal information from anyone under 18.

If you are a parent or guardian and believe your child under 18 has created an account, please contact us immediately at nerio023@gmail.com with the subject line Minor Account Removal. We will investigate and delete the account and all associated data within 30 days.

If you are under 18, please do not use this app or submit any personal information to us.

11. Changes to this policy

We may update this Privacy Policy as the app evolves or as applicable law changes. When we do:

• The "Last updated" date at the top of this page will reflect the most recent revision.
• We will notify you of the change via an in-app banner or an email to the address associated with your account.
• We will require you to review and accept the new version before continuing to use the app.

We encourage you to review this policy periodically.

12. Contact

For any privacy-related question, request, or complaint:

nerio023@gmail.com — Subject line: Privacy Question - Pentagon Strength

Response time: Within 7 business days.

If you are located in the European Union and believe we have not adequately addressed your concern, you have the right to lodge a complaint with your local data protection authority.