Privacy Policy

Version of October 18, 2026 · Русский

In short. We store only what the app needs to work. A workout reaches our server when you publish it yourself, count it towards a challenge, or have turned on auto-tracking - and until you publish it, only you can see it. Your location is used only during a workout and for "Nearby", if you turn it on. There are no ads and no trackers, data is not sold, and our servers are located in Russia. You can delete your account in the app together with all your data.

General provisions

This policy explains what personal data is processed in the Vyzov app for iPhone and Apple Watch and on the website vsport.fun, why, for how long, and how you can control it. The policy is published under Part 2 of Article 18.1 of Russian Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter "152-FZ").

The operator (controller) of personal data is Individual Entrepreneur Davydov Sergey Sergeevich, INN (taxpayer number) 110121285409, OGRNIP (state registration number) 319112100012301 (hereinafter "we"). Requests are accepted by email at davydovsergey96@yandex.ru. Phone: +7 904 222-45-54.

Consent to data processing is given in a separate document - the consent to the processing of personal data. What other users can see is shown under the consent to disclosure and within your privacy settings.

This is an English translation of the Russian document published at vsport.fun/privacy. The sections "For users outside Russia" and below are additions for users in the EU, the UK and other countries.

What data we process and why

Phone number. To register, sign in and protect your account. You sign in with a phone number from Russia or another country where the app is available: with a code from an incoming call, by calling our verification number yourself ("Call us"), or with a password if you have set one. Your number is not shown to other users; the app shows only its last digits. If you turn on "Find me by phone number" yourself, a person who knows your full number will find your profile by searching - we will not show them the number itself. This is off by default.
Password - only if you set one yourself, to sign in without a call. It is stored only as an irreversible hash: neither we nor anyone who obtained a copy of the database know the password itself. You can remove the password in the app settings.
Profile: name, city, sports, "about me" text, weekly goal. For your profile, finding people in your city and the leaderboard. You fill in this data yourself.
Workouts and routes: sport, time, duration, distance, pace, elevation gain, route points, heart rate - if you have turned on showing it yourself. Workouts that you have published or counted towards a challenge, including those with "only me" visibility; workouts from Apple Health, if you have turned on auto-tracking (see below); workouts from a Strava archive, if you have uploaded it yourself. Other workouts from Apple Health do not reach us. For the feed, profile, statistics, personal records, leaderboard, communities, the season pass and challenge results.
Communities: which community you belong to and in what role, answers to questions when joining, posts, reports, contribution to the community score, leagues, goals and challenges. For communities to work. Community membership and members' personal figures are visible only to its members; "only me" workouts are not included in personal figures.
Season pass, character and coins: season level and tasks, character strength, items, coin history. Calculated from your workouts; coins cannot be bought or sold.
Clubs: reviews of clubs and "this is our club" requests - if you have left them. Club cards are taken from open OpenStreetMap data.
Communication: messages, comments, "fire" reactions, friend requests, challenges and their terms, blocks. For the social network to work.
Reports of violations: what was reported and the reason. For moderation and protection against abuse and spam.
Photos that you attach to reports, messages and recipes. Before saving, their metadata is removed, including the geotag and phone model. A photo can be opened only by those who can see the report, message or recipe.
Reports and tasks: food, weight, wellbeing and sleep, workouts, photos and notes, tasks and completion marks. For the diary, tasks and working with a coach. A coach sees only the types of reports you have opened to them and loses access when you disconnect them.
Coach profile - if you have turned it on: code, "about me". You provide this information yourself.
Nutrition - only if you have turned on the Nutrition section: sex, year and month of birth, height, weight, body fat percentage, activity level, goal, diet, allergies, liked and disliked foods, food diary, your own foods and recipes. To calculate your daily norm, keep the diary and suggest a meal plan.
Children's profiles - if you have created them: the child's name, sex, year and month of birth, height, weight, activity, allergies and food diary. Only you can see a child's profile.
Health answers before workouts: year of birth and "yes/no" answers about heart disease, blood pressure, diabetes, symptoms during exercise, pregnancy, and also what hurts or has been injured (knees, back, neck, shoulders, elbows and wrists, ankles, hip joints) and how much. Only so that we do not suggest programmes and exercises that could cause harm.
Device token - if you have allowed notifications. To deliver notifications.
Approximate location for "Nearby" - only while the feature is on. The server immediately reduces the coordinate to a cell about 5 km in size and stores only the cell and the time: without the exact point and without a movement history. The cell is deleted when you turn the feature off, and in any case no later than 4 hours after it was turned on.
Technical data: IP address when you request a sign-in call and when a wrong password is entered - to limit the number of attempts, stored for no longer than 24 hours; server service logs (time and address of the request, IP address) - to protect against attacks and find failures, overwritten automatically as they fill up. Request addresses with parameters (they may contain coordinates) are not written to the log.
Sign-in sessions are stored as a hash. A session that has not been used for 180 days is closed; you can sign out on all devices at once in the settings.

We do not collect your precise location outside a workout and outside "Nearby", contacts from your phone book, the device advertising identifier, or information about your activity in other apps and on websites.

Apple Health data

With your permission, the app reads workouts, routes and heart rate from Apple Health and writes workouts recorded in Vyzov there. This happens on your device.

A workout reaches the server when you tap "Publish" yourself or count it towards a challenge. Visibility is chosen for each workout: everyone, friends or only you.
Auto-tracking is off until you turn it on yourself after a separate question. When it is on, it sends workouts and routes from Apple Health to the server, including those recorded by other apps and watches, with "only me" visibility: only you see them until you publish them. The distance and time of such workouts count towards the leaderboard, records, communities and challenges. You can turn auto-tracking off in the settings at any time.
Apple Health data is not used for advertising, marketing or analytics, is not sold and is not shared with third parties.
We do not store Apple Health data in iCloud.
You can withdraw permission at any time in the data access settings of the Health app. Workouts that are already in Apple Health stay with you.

Information about workouts may count as health data. We process it only with your consent and only for the app's features to work.

Coaches, nutrition and children

Any user can become a coach in Vyzov. A coach provides information about themselves, and we do not verify it. When you connect a coach, you choose which reports to open to them and can disconnect them with one tap - your reports and tasks stay with you.
When you join a marathon, you connect its curator as your coach and choose what to show to the group members. When you leave the marathon, the curator's access is closed if you are not in any of their other groups.
Weight, height, food diary and health answers may count as health data. We process them only with your separate consent, which you give by turning on the Nutrition section, creating a child's profile or answering the questions before workouts. By turning the Nutrition section off, you withdraw consent: the profile and diary are deleted.
A child's profile is created by a parent or legal guardian, who gives consent on the child's behalf. For children we calculate only the age-appropriate norm according to the standards of Rospotrebnadzor (the Russian consumer health authority), without diets.
We take products by barcode from our own copy of the open Open Food Facts database (ODbL licence). If a product is not there, the barcode is sent to Open Food Facts - only the number itself, without any information about you.

"Nearby"

The feature is off by default, available only from the age of 18 and turned on only by you.
It is turned off with one tap and switches itself off after 4 hours.
Others are shown not your point but the centre of an area about 5 km in size, with an offset, and the distance "about N km", rounded up. No screen shows the exact distance.
Movement history is not stored. People you have blocked cannot see you.

Legal bases (Russian law)

your consent to the processing of personal data (clause 1, Part 1, Article 6 of 152-FZ) - text of the consent;
your consent to the disclosure of data (Article 10.1 of 152-FZ) - text of the consent;
performance of the terms of use to which you are a party (clause 5, Part 1, Article 6 of 152-FZ);
performance of obligations imposed on us by law (clause 2, Part 1, Article 6 of 152-FZ).

Legal bases under the GDPR are listed below.

What we do with data

Collection, recording, systematisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion and destruction. Processing is automated.

We do not make decisions that have legal effects for you based solely on automated processing. The only automatic action is hiding obscene words in messages and comments.

Where and how data is stored

Data is stored on servers in Russia, as required by Part 5 of Article 18 of 152-FZ. We do not transfer personal data from Russia to other countries. If you use the app outside Russia, see "Transfer of data to Russia" below.

The connection to the server is encrypted (HTTPS). Codes, sign-in keys and passwords are stored only as a hash, the database is not accessible from the internet, and only the operator has access to it.

Who receives data

The call service zvonok.com (Russia) - processes your phone number on our behalf (Part 3 of Article 6 of 152-FZ), only for signing in: to call you with a sign-in code, and when you sign in with "Call us" - to check that the call to the verification number was made from your number. The service is obliged to keep the data confidential and comply with 152-FZ. Your password is not given to zvonok.com.
Apple - notifications are delivered through the Apple Push Notification service. It receives the technical device token and the notification text. There is no personal data in notifications: no names, no message text, no routes, no health figures. The map in the app is shown by Apple Maps; we do not give Apple your data.
Other users - only what your privacy settings and the consent to disclosure allow.
Government authorities - only on a request expressly provided for by law.

We do not sell data and do not give it to advertising networks or data brokers.

How long we keep data

Account data - as long as the account exists. Deleting the account deletes it immediately.
An individual workout, comment or message - until you delete it or as long as the account exists.
Sign-in code - 10 minutes, as a hash.
Password - until you remove it or as long as the account exists, only as a hash.
Phone number and IP address in records of call requests, waiting for a "Call us" call and wrong password entries - no longer than 24 hours.
"Nearby" cell - until the feature is turned off, no longer than 4 hours.
Sign-in session - until you sign out of the account or delete it.
After you withdraw consent, we stop processing and destroy the data within 30 days (Part 5 of Article 21 of 152-FZ).

The exception is cases where the law expressly requires us to keep information longer. It is then kept only for that purpose and only for the required period.

Your rights and how to exercise them

You have the right to:

receive information about the processing of your data and a copy of it;
require us to clarify, block or destroy data if it is incomplete, inaccurate, outdated or processed unlawfully;
withdraw your consent to processing and require us to stop disclosing your data;
appeal against our actions to Roskomnadzor (the Russian data protection authority) or in court.

Most of this can be done right in the app: change your profile and privacy settings, delete a workout, a message or the whole account. For anything else, email davydovsergey96@yandex.ru: give the phone number of the account and what needs to be done. To make sure the request comes from the account owner, we may ask you to confirm the number.

We reply no later than 10 working days after receiving the request. This period may be extended by no more than 5 working days; we will tell you the reason.

Your rights under the GDPR are listed below.

Deleting your account

In the app: Profile - Settings - "Delete account and all data". This deletes your profile, phone number, workouts and routes, messages, comments, challenges, friendships, blocks, reports, devices and sessions. Deletion is immediate and irreversible. Workouts in Apple Health on your device stay with you. Details are on the account deletion page.

Age

The app is intended for people aged 13 and over. If you are under 14, you may use the app only with the consent of a parent or legal guardian. The "Nearby" feature is available only from the age of 18. If we learn that an account belongs to a child under 13, we will delete it.

Outside Russia the app is not intended for children under 16. If you are under 16 and live outside Russia, please do not use the app. If we learn that an account of a user outside Russia belongs to a child under 16, we will delete it.

Website and cookies

The website vsport.fun does not set tracking or advertising cookies and does not use visit counters, analytics systems, third-party scripts or fonts. The server keeps only the service request logs described above.

Changes to this policy

We publish a new version on this page with its date. We will let you know about significant changes in the app in advance. Previous versions are available on request.

For users outside Russia

This and the following sections are an addition to the English version for users in the European Union and the European Economic Area, the United Kingdom, Switzerland and other countries with similar data protection laws (in particular the General Data Protection Regulation, "GDPR", and the UK GDPR). They add to the sections above and do not reduce the protections described there.

The controller of your personal data is Individual Entrepreneur Davydov Sergey Sergeevich, Russian Federation. For any privacy question or request, write to davydovsergey96@yandex.ru.

The phone number is needed to create an account and sign in: without it you cannot use the app. Everything else is optional and depends on which features you use.

Performance of a contract (Article 6(1)(b) GDPR) - to provide the app under the terms of use: your account and sign-in by phone number, profile, the workouts and routes you publish or count towards challenges, feed, friends, messages, challenges, communities, season pass, coaches and marathons, notifications you have allowed, and answers to your requests.
Consent (Article 6(1)(a) GDPR) - your location during workouts and for "Nearby", access to Apple Health and auto-tracking, notifications, and showing your data to other users within your privacy settings.
Explicit consent for health data (Article 9(2)(a) GDPR) - heart rate, workouts and routes read from Apple Health, health answers before workouts, and the data of the Nutrition section and children's profiles (weight, height, body fat, food diary, allergies). You give it separately, when you turn on the feature in question; a child's profile is created with the consent of the parent or legal guardian.
Legitimate interests (Article 6(1)(f) GDPR) - security of the service and prevention of abuse and fraud: limiting sign-in attempts by IP address, server service logs, moderation of reports, hiding obscene words, blocking accounts that break the terms. Our interest is keeping the service and its users safe; we keep this data only for the short periods stated above.

You can withdraw your consent at any time, as easily as you gave it: in the iPhone settings (Location, Health, Notifications), by turning off "Nearby", auto-tracking or the Nutrition section in the app, by changing your privacy settings, by deleting your account, or by writing to davydovsergey96@yandex.ru. Withdrawal does not affect the lawfulness of processing before it.

If the GDPR or a similar law applies to you, you have the right to:

access - find out whether we process your data and receive a copy of it;
rectification - have inaccurate or incomplete data corrected;
erasure - have your data deleted; you can also delete your account in the app yourself;
restriction - ask us to restrict processing, for example while the accuracy of the data is being checked;
data portability - receive the data you have provided to us in a structured, commonly used, machine-readable format and have it transmitted to another service;
object - object at any time to processing based on our legitimate interests, on grounds relating to your particular situation;
withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal;
not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you - we do not make such decisions;
lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where the alleged infringement took place (in the UK - the Information Commissioner's Office).

To exercise these rights, write to davydovsergey96@yandex.ru and give the phone number of your account. We may ask you to confirm the number. We reply within the period stated in "Your rights and how to exercise them", and in any case within one month.

Transfer of data to Russia

Vyzov's servers are located in the Russian Federation, and all data of the app and the website is stored and processed there. If you use the app from outside Russia, your personal data - including your phone number, workouts and routes, health data and approximate location - is transferred to Russia when you use the app.

The European Commission has not adopted an adequacy decision for Russia, and the United Kingdom has not recognised Russia as providing adequate protection either. This means that Russian law may not offer a level of data protection equivalent to that in the EU or the UK, and that Russian authorities may require access to data under Russian law (see "Who receives data"). The measures described in this policy - encryption of the connection, a database that is not accessible from the internet, hashing of codes and passwords, short retention periods - apply to all users.

The transfer is necessary to provide the app you have asked for: we have no servers outside Russia. By using the app, you understand and agree that your data is transferred to and processed in Russia. If you do not agree, please do not use the app.