EDROX · Last updated 22 September 2026
EDROX builds and adapts a HYROX training plan around your goal, your equipment and your race date, with an AI coach that adjusts sessions as you go. To do that it needs to know things about your training. This policy explains exactly what it stores, where that goes, and how to get rid of it.
We never learn your name or your email address. When you sign in with Apple, the app requests no name or email scope, so Apple sends us only an anonymous identifier for you. There is no field anywhere in this app for your name, your email, or your phone number.
EDROX is operated by Enes Zor ("we"). You can reach us at info@edrox.app. Because we hold no email address for you, that address is the only way to contact us about your data.
HYROX® is a trademark of its owner. This app is not affiliated with, endorsed by, or connected to the HYROX organisation.
Everything you enter during onboarding, and anything you later edit:
Three companies handle data on our behalf, and nobody else.
Everything above is stored in our Supabase project. Each row is locked to your account by database policy, so one account cannot read another's data. Supabase hosts this data in Frankfurt, Germany (eu-central-1).
When the app crashes, or hits an error it recovers from quietly, a diagnostic report is sent to Firebase Crashlytics so we can fix it. A report contains the technical state of the app: what went wrong, where in the code, your device model and iOS version, and an anonymous installation identifier that lets us tell one crash from fifty of the same crash.
It does not contain your account, your name for us, your training data, your body measurements, your injuries, or anything you said to the coach. We deliberately do not attach your account identifier to crash reports, which means we cannot look up "what crashed for this athlete" — we accepted that in exchange for reports that are not about you personally.
The same service also counts how the app is used: how many people open it, how often, on which device and iOS version, and which of a short list of moments happened — an onboarding finished, a week built, a session marked done or skipped, a message sent to the coach, the paywall shown, a subscription started. We use these to see whether the app works for people, not to build a profile of anyone.
These counts are not attached to your account either. We deliberately do not tell Firebase who you are, which means we can see that twenty sessions were completed yesterday but not which athlete completed them. What you tell the coach, your body measurements, your injuries and your session content are never sent here.
Firebase is a Google service and processes this data outside the EU, in the United States, under the EU–US Data Privacy Framework and Google's standard contractual clauses. It is the one place where data leaves Europe.
The coach is powered by OpenAI. Two things send data there:
We send this through OpenAI's API. We do not send your account identifier deliberately as an identifier, and OpenAI has no way to connect it to a real person — they receive no name, email or contact detail, because we do not have any.
We process this data to perform the service you asked for: generating and adapting your training plan. Injury and body data are health-related, and you provide them voluntarily and explicitly for that purpose. If you would rather not share an injury, leave it out — the plan still works, it just won't route around that area.
Until you delete it. There is no automatic expiry, because a training history is only useful over time.
Open Profile → Delete account. This permanently removes your account and everything attached to it: your profile, your plan and all its weeks and sessions, and your entire coach conversation. It is immediate and cannot be undone — there is no grace period and no backup we can restore you from.
Signing out is not the same thing. Signing out leaves your data intact so you can come back to it.
Deleting your account here does not delete anything already sent to OpenAI in the course of generating your sessions. That is governed by OpenAI's own retention practices for API data.
Depending on where you live, you may have the right to access, correct, export or erase your data, or to object to how it is processed. Most of that is built into the app already: the Profile tab shows and edits everything we hold about you, and Delete account erases it. For anything else, write to info@edrox.app.
EDROX is not intended for anyone under 16, and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact us and we will delete it.
Data is encrypted in transit. Access is enforced per-account at the database level rather than only in the app, so a request for someone else's data fails at the database. Your sign-in session is stored in the iOS Keychain on your device. No system is perfectly secure, and we cannot guarantee absolute security.
If this changes materially, we will update the date at the top and note the change in the app's release notes.