Privacy & Cookie Policy

1) Who we are (Controller)

Joy2Move is operated by SC GLOBAL PERSPECTIVE SRL, the data controller for processing on joy2move.net. Contact: support@joy2move.net. Registered address: [Str. Buzoieni 10, Sector 5, Bucuresti, RO]. We have not appointed a DPO; please use the contact above for privacy matters.

2) What data we collect

• Account data (if you sign in): email (for authentication), nickname, avatar URL, profile ID, and authentication metadata needed to operate your account.
• App usage: favorites, workout history, leaderboard participation, and similar in-app actions (for your features and progress).
• Health-related workout data (only after explicit consent): duration, frequency, and perceived effort. Because these may reveal aspects of your physical condition, we treat them as health data (special category) and process them only with your explicit consent.
• Device & technical: limited device/browser info and network logs necessary to run the service securely (e.g., error logs).
• Subscription data: plan, billing provider, purchase/subscription identifiers, status, and renewal period. Payment card details are handled by Google Play or Stripe and are not stored by Joy2Move. We also retain verified Stripe paid-invoice identifiers, amounts, currencies, payment dates and test/live status as part of your billing records.
• Consent records: your cookie preferences stored in a first-party cookie (j2m_consent).
• Analytics (optional, only after consent): events, page views, approximate region, device/browser identifiers, and performance measurements via Google Analytics 4 and Vercel Analytics (see Section 5).

3) Purposes & legal bases

• Provide and secure the service (authentication, storage, PWA/offline, fixing bugs) — performance of a contract and legitimate interests.
• Health & progress features (store workout session details such as duration, frequency, perceived effort; show streaks/insights) — explicit consentfor any health-related data (Art. 9(2)(a)); where non-health data is used, performance of a contract. You can use the app without granting health-data consent and may withdraw consent at any time.
• Remember your consent — legal obligation and legitimate interests.
• Analytics (understand usage to improve the app) — consent.
• Marketing communications — consent. Joy2Move does not display third-party advertising in the app.

4) Cookies & storage we consider functional

We use essential cookies and storage (e.g., service worker cache, localStorage, IndexedDB) to keep the app fast, secure, and installable (PWA). These are required for core features and can’t be turned off within the app.

5) Analytics

We use Google Analytics 4 (GA4) and Vercel Analytics to measure usage only after you grant analytics consent. Until then, these analytics tools are not loaded. Your consent can be changed anytime below.

With analytics consent, we also measure visits from connectors such as Muse. We retain the connector name in this browser tab for up to 24 hours and, after sign-in, associate it with account and checkout activity to measure referrals. Withdrawing analytics consent clears the tab attribution and stops new tracking.

With analytics consent, our own measurement records broad traffic sources, page categories, setup steps, sign-in outcomes, video start/error signals and checkout milestones. The optional j2m_journey cookie identifies a visit for up to 24 hours. If you sign in during that visit, we associate those events with your account. We do not include your email, setup answers, workout titles or IDs, full URLs, payment tokens or raw error messages in these events.

These first-party journey events expire after 90 days through daily cleanup. Withdrawing analytics consent requests deletion of the current visit and any journey events linked to your signed-in account. Signed-in video signals also require health consent and are removed when that consent is withdrawn. Account exports include linked journey events; account deletion removes them. Billing records are separate from optional analytics.

To prevent delayed requests from restoring a deleted visit, we temporarily retain its random visit identifier without account or event information. This deletion marker is valid for 24 hours and is removed by daily cleanup afterward.

6) Service providers (processors) & recipients

• Supabase — authentication, database and application services (including transactional emails for sign-in).
• Vercel — hosting, build and edge delivery (including CDN and image optimization), plus analytics only after consent.
• Google Analytics — analytics measurement (only after consent).
• Google Play — Android app distribution, subscription checkout, billing status, and subscription management.
• Stripe — web subscription checkout, billing, and subscription management.

We sign data-processing terms with our providers where applicable, and only share what’s necessary to run Joy2Move.

7) International transfers

When data is transferred outside the EEA/UK (for example, to Google LLC in the United States), we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and provider commitments. We take steps to ensure an adequate level of protection consistent with applicable law.

8) Retention

• Account & app data: for as long as your account exists (deleted upon account deletion).
• Health-related workout data (duration, frequency, perceived effort): retained only while consent is active; deleted or anonymized if you withdraw consent or delete your account.
• Consent records: up to 12 months.
• Analytics: typically 14 months in GA4 (configurable).

9) Your rights

You have rights of access, rectification, erasure, restriction, portability, and objection; plus the right to withdraw consent at any time (this doesn’t affect past processing). You can also lodge a complaint with the Romanian supervisory authority (ANSPDCP).

10) Children

Joy2Move is intended for adults aged 18 and over. We don’t knowingly collect personal data from children.

11) Manage your consent

You can clear cookies and site data in your browser settings. This removes your saved consent and you’ll be asked again on your next visit. Your profile lets you withdraw health-data consent, download your data, or delete your account. Withdrawing health-data consent permanently deletes workout history, effort reports and workout achievements. Giving consent again starts a new history. For help, contact support@joy2move.net.

12) Updates & contact

We may update this page to reflect changes in our use of data or legal requirements. For questions, email support@joy2move.net.