WODFinder · Last updated 11 August 2026
WODFinder is a training app for CrossFit athletes. This policy explains what
we collect, why, and what you can ask us to do with it. It covers the WODFinder
mobile app and the API at wodfinder-server.fly.dev.
| Data | Why |
|---|---|
| Email address | To create your account, confirm it is yours, and sign you in. |
| Password | Stored only as a bcrypt hash. We never see or store the password itself. |
| Username, bio, gym, athlete level | Shown on your profile to other athletes. |
| Profile photo | Optional. Shown on your profile and next to your activity. |
| Training data — WODs you create, personal records, completed workouts, notes and dates | The core purpose of the app. |
| Who you follow, and the WODs you like | To build your activity feed. |
We do not collect your location, your contacts, your device identifiers, or your advertising ID. The app contains no analytics SDK, no advertising SDK, and no third-party trackers.
If you enable biometric sign-in, your session is encrypted with a key held in your device's secure hardware (Android Keystore / iOS Keychain). Your fingerprint or face is never read by the app and never leaves your device — the operating system only tells us whether the check passed.
We do not sell your data and we do not share it for advertising. We use these service providers to run the app:
Your data is stored in the United States. If you are outside the US, using the app means your data is transferred there.
Your username, photo, athlete level and the WODs you create are public inside the app. Your personal records and completed workouts are visible only to you unless you set your profile to public, which you can change at any time in Profile settings. Your email address is never shown to other users.
We keep your data while your account exists. An account that is created but never confirmed by email is deleted automatically after 24 hours. Email confirmation codes are deleted after 15 minutes.
Under Brazil's LGPD and the EU GDPR you may ask us to access, correct, export or delete your data, and to withdraw consent. Most of it you can do yourself in the app — edit your profile, delete a personal record, remove your photo. For anything else, including deleting your whole account, write to privacy@bruzascotech.com and we will respond within 30 days.
WODFinder is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.
Traffic between the app and our API is encrypted with TLS. Passwords are hashed with bcrypt. Sessions use signed tokens that expire after 30 days. No system is perfect, and we will tell affected users promptly if a breach occurs.
If this policy changes materially we will update the date above and notify users in the app.