Villain Arc Privacy Policy

This Privacy Policy explains how FCT Technologies LLC handles information for Villain Arc.

Summary

• We do not sell personal data.
• We do not run ads, and we use no third-party analytics or tracking SDKs.
• Villain Arc requires an FCT account, and the app data you create is stored on FCT’s cloud infrastructure, scoped to your account and readable by no other account.
• Diagnostics are anonymous by construction: they are keyed to a random install identifier with no connection to your account or identity.
• We do not use Apple Health, health, fitness, or other sensitive data for advertising, marketing, or use-based data mining.
• Where a feature runs only on your device and its data is not transmitted, FCT does not collect that data.

Your FCT Account

Villain Arc requires an FCT account. You create one with Sign in with Apple, Sign in with Google, or an email address and password, and you can connect additional sign-in methods later in Settings.

We store the account identifier from your chosen sign-in method, or your email address. Authentication is handled by our authentication provider (Supabase) on our behalf.

What Villain Arc Stores, and Where

Your app data is stored on your device and synchronized to FCT’s cloud infrastructure (a Postgres database hosted on Supabase) so it is available on every device you sign in on, and so it can be restored if you reinstall the app. Synced data is scoped to your account and is not readable by another account.

The data Villain Arc synchronizes includes:

• your profile (name, date of birth, gender, height, fitness level) and app settings
• workout plans, splits, split days, exercise prescriptions and set prescriptions
• workout sessions, exercise and set performance, and pre-workout context
• your exercise library
• cardio sessions, including machine intervals and, for outdoor sessions, the route points recorded during that workout (latitude, longitude, altitude and speed)
• goals and goal history: training goals, weight, steps, sleep and hydration goals, and training condition periods
• progression suggestions and their outcomes

Body weight values that Villain Arc reads from Apple Health are stored alongside your goals and are synchronized as part of that data.

Files you attach in the app, such as a profile photo, are uploaded to FCT’s file storage and are likewise scoped to your account.

If you are still running a version 1.x build from the App Store, this policy describes an app you do not have yet. Those builds needed no account and kept everything in your own iCloud, which meant your training sat in Apple’s hands rather than ours and we could not read it. Nothing leaves your iCloud on its own. The account and the sync described above begin when you install the rebuilt version and sign in.

Apple Health and HealthKit

If you grant Apple Health permissions, Villain Arc may read and write Health data through HealthKit. Depending on the permissions you allow, it may read workouts, body weight, height, sleep, steps, distance, energy, heart rate, respiratory rate, flights climbed, and related workout metrics, and may write completed workouts and body weight entries back to Apple Health.

Your Apple Health history is not copied wholesale to our servers: HealthKit samples stay on your device under Apple’s own protections, and Apple Health carries them between your devices. The exception is stated above: a body weight value you set as part of a goal is stored with that goal and syncs with it.

Health access is optional and you can change it at any time in system settings. We use Health data only to provide app features you ask for, and never for advertising, marketing, or use-based data mining.

Location

For an outdoor cardio session, Villain Arc records your route while the session is running, so the app can show the map, distance and pace for that workout. Those route points are part of the session and synchronize with it, as described above. Villain Arc does not track your location outside a session you started.

AI Features

Villain Arc’s AI features, workout plan generation, exercise replacement, and progression suggestions, run on Apple’s on-device foundation models. The content of those requests is processed on your device and is not sent to FCT.

Diagnostics: Always On, Never Identified

Villain Arc reports anonymous diagnostics to FCT: crash and performance data, a short trail of screen and action names (never content) leading up to a problem, feature-use counts, and timing measurements such as how long setup took.

Diagnostics are keyed to a random install identifier created on first launch. They are not linked to your account or identity, the diagnostics system has no connection to account data by construction, and they contain no content you typed, viewed, or stored. We use diagnostics to fix crashes and improve the app, and for nothing else.

Deleting your account erases everything in it (see Your Choices and Deleting Your Data), but not these: nothing marks which diagnostics are yours, so none can be singled out, not by us, and not on request. They expire on their own schedule instead (see Retention).

Notifications

If you allow notifications, Villain Arc schedules local notifications on your device, such as rest timer and steps notifications you enable in settings. These are delivered through Apple’s notification systems; we do not run a separate notification backend for them.

No Third-Party Tracking

Villain Arc uses no advertising identifiers, no third-party ad tracking, no analytics SDKs, no behavioral profiling, and no cross-app tracking. The anonymous diagnostics described above are the only thing the app reports automatically, they go to FCT and nowhere else, and they are not linked to you.

Sharing

We do not sell your personal data, and we do not share it for advertising, profiling, or analytics.

We use service providers to operate the app: Supabase for authentication, database and file storage. They process data on our behalf, under our instructions.

When you use Apple platform features such as HealthKit, notifications, Sign in with Apple, or the App Store, Apple processes data as part of providing those services, governed by Apple’s own terms and privacy practices. The same applies to Google if you sign in with Google.

Retention

Your data is retained while your account exists. Deleting a record in the app removes it from your account across your devices.

Diagnostics are kept on their own clock, because they are not tied to your account: usage metrics and counters are deleted after 180 days, and crash diagnostics after 400 days. A daily job enforces both windows.

Security

We use reasonable technical and organizational measures designed to protect information. No system is perfectly secure.

If a breach happens, this is what we do. Where a personal-data breach is likely to result in a risk to your rights and freedoms, we notify the relevant supervisory authority within 72 hours of becoming aware of it. Where the risk to you is high, we notify you without undue delay, describing what happened, what data was involved, what we are doing about it, and what you can do. We keep a record of every breach and its handling whether or not it is notifiable.

We hold the whole app fleet to this single deadline deliberately: it is the strictest one that applies to us, so meeting it satisfies the others rather than requiring separate timetables to be tracked and one of them to be missed.

International Users

FCT Technologies LLC is based in the United States. If you use Villain Arc outside the United States, your information may be processed in the United States or in other locations where our service providers operate.

Your Choices and Deleting Your Data

• Delete your Villain Arc data. Settings removes everything Villain Arc holds in your account, on our servers and on your devices, and leaves your FCT account and any other FCT app you use intact.
• Delete your account. Settings also offers account deletion, which removes your FCT account and all of its data from our systems, everywhere, across every FCT app.
• Delete the app to remove its locally stored data from that device. This does not delete your account, and signing back in restores your data.
• Decline permissions. You can decline Apple Health, location, notification, camera and photo permissions, and change them later in system settings.

Children

Villain Arc is a fitness app and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

Changes to This Privacy Policy

FCT Technologies LLC may update this Privacy Policy from time to time. If that happens, the date at the top of this page will be updated.

Contact

If you have questions about this Privacy Policy, contact:

FCT Technologies LLC
[email protected], and we respond within 5 business days