Privacy policy

Effective 4 September 2026.

SuperStrong is an iPhone app that logs bodyweight exercise sets as tiles on a wall you can share with up to four friends. This page says what the app collects, why, where it is kept and how you delete it. It is written to be read, not to be skimmed past.

The app is made and operated by Toon Verbeek, based in the Netherlands (the "developer", "we"). Questions about this policy go to hey@toonverbeek.com.

What we collect, and why

Your account

You sign in with Sign in with Apple. Apple sends us a stable account identifier, your email address (or Apple's private relay address if you hide your email) and, on the very first sign-in only, the name you choose to share. We use the name as the display name your friends see on the shared wall; you can change it at any time in the app. The email address identifies your account and is never shown to other people, never used for marketing and never sold.

What you log

Every set you log is stored as a tile: the exercise, the count (reps or seconds), the time you logged it and the time zone you were in. Your daily goal (its difficulty and whether you have a pull-up bar) is stored too. If you join a wall with friends, the members of that wall see your tiles, your display name and the stickers you put on their tiles. Nobody outside your wall sees any of it.

Your wall with friends

A wall has a name, an invite code and up to five members. The name and the code are visible to its members. The owner of a wall can rename it, rotate the code, remove a member or delete the wall.

Sessions

To keep you signed in, the server stores a session token together with the IP address and the device description (user agent) of the request that created it. Sessions expire and are removed.

Purchases

SuperStrong Pro is bought through Apple's App Store. Apple handles the payment; we never see your payment details. RevenueCat, our purchase provider, receives your account identifier, the App Store receipt and the transaction history so the app knows what you own on every device you sign in on.

Product analytics and crash reports

We use PostHog (EU Cloud) to see how the app is used and where it breaks: screen views, taps, the named events in the app (a set logged, a sticker placed, a purchase made), crash reports and device information such as the iOS version and the app build. PostHog also records session replays of the app's screens; every text field and every image is masked in those recordings, so no exercise count you type and no sticker art is legible. The only identity attached is your account identifier. Analytics are off in development builds.

Install attribution

We use Layers to learn how people find SuperStrong: which link or ad brought them to the App Store. On first launch the app asks for App Tracking Transparency permission. If you say no, the app never reads the advertising identifier (IDFA) and attribution relies only on Apple's privacy-preserving SKAdNetwork postbacks. If you say yes, Layers receives the IDFA. Layers also receives the same account identifier and the sign-up and sign-in events, plus the parameters of any SuperStrong link you open.

What we do not collect

No location, no contacts, no photos, no Apple Health data, no weight, no advertising inside the app, no third-party ads and no sale of data. We never attach your name or email to analytics.

Where it is kept

A copy of your own wall is also kept on your phone so the app opens instantly and works offline. Signing out removes it.

How long we keep it

Your account, tiles, walls and goal stay until you delete your account. Sessions are removed when they expire. Analytics events and session replays are kept by PostHog for the retention period of our project and then removed.

Deleting your account

Open the app, go to Account and tap Delete account. The app asks Apple to confirm it is you, revokes the Sign in with Apple link, deletes every tile, sticker and goal you own, removes you from your wall (or hands the wall to the next member, or deletes it if you were alone) and removes your account. This is immediate and cannot be undone. Purchases stay with your Apple ID and can be restored on a new account.

You can also email hey@toonverbeek.com from the address on your account and we will delete it for you.

Your rights

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to access, correct, export and delete your data, to object to or restrict its processing, and to complain to your data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens). The legal bases we rely on are the performance of our contract with you (the account, the wall, the purchases), our legitimate interest in understanding and fixing the app (analytics and crash reports) and your consent (tracking for attribution, which you can withdraw in iOS Settings ▸ Privacy & Security ▸ Tracking). Email hey@toonverbeek.com to exercise any of these rights.

Children

SuperStrong is not directed at children under 13, and Sign in with Apple requires an Apple ID. If you believe a child has made an account, email us and we will delete it.

Changes

When this policy changes, the effective date at the top changes with it and the app's App Store listing links to the current version. A material change is announced in the app.