Privacy Policy
Your data, plainly.
Effective 6 November 2026. This policy covers the EPiC Workout and Rate My Year apps and this website.
Who we areEPiC WorkoutRate My YearAccess and deletionContact
Who we are
The apps are developed and operated by Useful Things Pty Ltd (ABN 89 702 581 637), of [TODO: postal address], New South Wales, Australia ("we", "us"). We handle personal information under the Australian Privacy Principles in the Privacy Act 1988 (Cth).
The short version. We collect what each app needs to work. We don't sell your information, we don't use it for advertising, and we don't track you across other companies' apps or websites. You can delete your account and data from inside each app, or by emailing us.
EPiC Workout
EPiC Workout is for people aged 18 and over.
What it collects and why
| Data | Why |
|---|---|
| Account: email address, password (stored hashed), subscription status | To sign you in and manage your membership |
| Profile: name, optional profile picture, year of birth, sex, height, limitations you record | To calculate your training and nutrition figures |
| Training and health: programs, workouts, weights lifted, activities and GPS routes you record, food entries, goals, weight, body fat, progress photos | To provide the app's training, nutrition and progress tools |
| Apple Health data, only if you grant permission | To import workouts and body measurements into your progress |
| Location: precise location while recording an activity; a one-off position when you check in to a gym with Community | To draw your route, and to confirm you're at the gym you picked |
| Community, only if you turn it on: the gym you're checked in to, what you're open to, messages with members you've matched with | To run Community |
| Technical: server logs, notification registrations, account and activity logs | To keep the service running, deliver notifications and fix problems |
Most of this is health information, which Australian law treats as sensitive. We ask you for it rather than infer it, and turning on Community asks you again, separately, before anything is shown to another member.
Apple Health (HealthKit)
EPiC Workout reads Apple Health data only with your permission, and only to show it in your own progress. Data from Apple Health is never used for advertising or marketing, never sold, and never shared with third parties except the hosting provider that stores your records for you. It is not used in any anonymous insights. You can revoke access at any time in the iPhone Settings app.
Who we share it with
| Provider | What they receive | Where |
|---|---|---|
| Supabase | Your account, records and photos (database and file storage) | Hosted in Sydney; US-based provider |
| Cloudflare | Serves the app and website; request logs | Global network |
| Stripe | Payment details for web subscriptions. We never see your card number | United States |
| Apple | App Store purchases and notification delivery | United States |
| Anthropic | Only when you use them: a food photo you submit for recognition, or workout details you discuss with the planner. Not used to train their models | United States |
| Resend | Your email address, to send confirmations, password resets and release notes | United States |
| OpenStreetMap | Your coordinates while you record an outdoor activity, to draw the map | UK and Europe |
| Open Food Facts | A barcode you scan, never your identity | France |
Some providers are outside Australia, so your information is disclosed overseas. We remain accountable for how they handle it.
Partner gyms. We may give a partner gym anonymous, aggregated statistics, such as visit counts, peak times and training mix, only for groups of 10 or more members. These never identify you and never include Apple Health data.
Other members see nothing of yours unless you turn on Community. Then, while you're checked in, members at the same gym see your first name, profile picture and when you were last active. Your location is never shared with another member, and nobody can message you unless you both agree.
How long we keep it
- Training records, photos and profile: until you delete them or your account.
- A gym check-in: deleted when the session ends. A log of Community events (such as check-in and check-out times) is kept for 30 days for troubleshooting, then deleted.
- Community messages: until either member blocks the other or deletes their account. A report you make about someone keeps the last 20 messages for 90 days.
- Payment records: held by the payment provider, and by us as tax law requires.
- Backups roll off within 30 days of deletion.
Rate My Year
Rate My Year runs on the web at ratemyyear.com and is coming to the App Store. This section applies to both.
What it collects and why
| Data | Why |
|---|---|
| Self review answers: the scores you give yourself | To build your report card. A self review needs no sign-up |
| Crew details: the crew's name, type (family, mates or couple) and the first names or nicknames the admin adds | To run the crew and its invite link |
| Crew reviews: the scores each member gives, and which name each person picked | To build each person's report card and the crew report. Scores are shown to the crew without saying who gave them |
| Crew admin sign-in: the Google account name, email address and account ID of the person who sets up a crew | So the admin can manage the crew and pay for a pass |
| A random device ID, created when someone joins a crew without signing in | To keep each member's reviews linked to them without an account |
| Sharing: a name, and optionally a mobile number, typed in when sending a report card | To address the WhatsApp, text or email message you choose to send |
Rate My Year doesn't use your answers for advertising, doesn't sell them, and doesn't track you across other companies' apps or websites.
Who we share it with
| Provider | What they receive | Where |
|---|---|---|
| Google Firebase | Sign-in, and storage of crews, reviews and saved results | United States and elsewhere |
| GitHub Pages | Serves the website; request logs | Global network |
| Google Fonts | Your browser's request for the site's fonts, including your IP address | United States |
| WhatsApp, your messaging or email app | Only what you choose to send when you share a report card | Depends on the service |
| Apple | App Store purchases, once the app is on the App Store | United States |
Your crew sees the results of the crew you're in. People outside it see nothing unless you share your report card with them.
How long we keep it
Crews, reviews and saved results are kept until the crew admin deletes them or you ask us to. Self reviews you don't save stay on your device. Backups roll off within 30 days of deletion.
Children
Rate My Year is not directed at children under 16. If a family crew includes anyone younger, a parent or guardian should set it up and add them.
Access, correction and deletion
Delete your account in the app. In EPiC Workout, open Your account and choose Delete account. In Rate My Year, a crew admin can delete the crew's reviews from the crew screen, and anyone can leave a crew; a self review needs no account at all. Deleting removes your account and the data linked to it, and cancels an active web subscription. App Store subscriptions are managed by Apple: cancel them in Settings → your name → Subscriptions.
Or email us. If you can't use the app, email support@wemakeusefulthings.com from the address on your account. We'll delete your account and data and confirm by email, within 30 days.
Access and correction. You can see and edit your data in each app, and EPiC Workout lets you export everything as a file. To ask for a copy of anything else we hold, or to correct it, email us.
Choices. You can refuse location, camera, photo, notification or Apple Health permissions and keep using the rest of the app, though some features need them.
Children
Our apps are not directed at children. EPiC Workout is for people aged 18 and over. If you believe a child has given us personal information, email us and we'll delete it.
Security
Data is encrypted in transit and at rest. Your records are readable only by your own account, and photos sit in private storage reachable only through short-lived links issued to you. Staff access is limited to what's needed to run the service and answer support requests. If a breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
Changes to this policy
If we change this policy in a way that affects what is shared about you, we'll ask you again in the app before the change applies. Smaller changes are posted here with a new effective date.
Contact and complaints
Email support@wemakeusefulthings.com, or write to Useful Things Pty Ltd, [TODO: postal address]. We'll acknowledge a complaint within 7 days and answer within 30. If you're not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.