Team Sandu — Privacy Policy

Last updated: 13 May 2026

1. Introduction

Welcome to Team Sandu („the App”). This Privacy Policy explains how Sandu Iulian Marian, operating as Team Sandu (www.teamsandu.ro), collects, uses, stores, and protects your personal data when you use our Android application.

We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (GDPR) (EU 2016/679) and Romanian data protection law.

By installing or using the Team Sandu app you agree to the practices described in this policy. If you do not agree, please uninstall the app and contact us to request deletion of your data.

2. Data Controller

Name: Sandu Iulian Marian
Website: www.teamsandu.ro
Email: contact@teamsandu.ro
Location: Galați, Romania

3. What Data We Collect

Category	Data collected	Purpose
Account	Name, email address, phone number, profile photo	Account creation, identification, communication
Fitness & Training	Running logs (distance, duration, pace, date), training session records, AMRAP results, competition entries	Progress tracking, leaderboards, achievement awards
Health & Body	Body weight, body fat %, muscle mass, progress photos, daily step counts	Body progress tracking, wellness monitoring
Health Connect	Step count data read from Android Health Connect	Steps leaderboard, wellness overview
Strava (optional)	Workout activities synced from your Strava account (type, distance, duration, date)	Automatic import of runs and training sessions
Subscription	Subscription plan, start/end dates, attendance records	Membership management, access control
Payments	Order history, payment method type (card or bank transfer). Card details are processed directly by Stripe and never stored by us.	Shop purchases, payment processing
Nutrition	Dietary preferences, goals, intake questionnaire responses, AI-generated nutrition plan	Personalised nutrition guidance
Messages & Content	Direct messages with your trainer, blog posts you write, comments	Communication, community content
Device	Firebase Cloud Messaging token	Push notifications delivery

4. How We Use Your Data

Providing and personalising the app experience
Managing your gym membership and subscription
Tracking your fitness progress and displaying it to you
Running leaderboards and monthly challenges (your name and stats may be visible to other app members)
Sending push notifications about announcements, messages, and events
Processing shop orders and payments
Generating personalised nutrition plans
Communicating with you about your membership

5. Legal Basis for Processing (GDPR)

Contract performance — processing necessary to provide the service you signed up for (Art. 6(1)(b))
Legitimate interests — fitness tracking, leaderboards, app improvement (Art. 6(1)(f))
Consent — Health Connect access, Strava sync, optional features (Art. 6(1)(a)) — you may withdraw consent at any time
Explicit consent for health data — body measurements and health metrics are special category data processed under Art. 9(2)(a)

6. Third-Party Services

We use the following trusted third-party processors:

Supabase (database & authentication) — Privacy Policy. Your data is stored on Supabase-managed PostgreSQL servers.
Stripe (payment processing) — Privacy Policy. Card data is handled exclusively by Stripe and is never seen or stored by us.
Firebase (Google) (push notifications) — Privacy Policy. Used solely for delivering push notifications via Firebase Cloud Messaging.
Strava (optional fitness sync) — Privacy Policy. Only connected if you choose to link your Strava account. You can disconnect at any time from within the app.
Android Health Connect (Google) (optional step sync) — Privacy Policy. Step data is read only if you grant permission. No health data is shared with third parties.

7. Data Sharing

We do not sell your personal data. Your data is only shared:

With the third-party processors listed in Section 6, strictly to operate the service
With your trainer (Sandu Iulian Marian) who manages your membership — this is the core purpose of the app
With other app members in aggregated, leaderboard form (name + fitness stats only, no health or payment data)
If required by Romanian or EU law

8. Data Retention

Active accounts: data retained for the duration of your membership plus 12 months
Deleted accounts: all personal data deleted within 30 days of a deletion request
Payment records: retained for 5 years as required by Romanian fiscal law
Messages: retained for 24 months, then deleted automatically

9. Your Rights (GDPR)

As an EU resident you have the right to:

Access — request a copy of all data we hold about you
Rectification — correct inaccurate data (most data editable directly in the app)
Erasure — request deletion of your account and all associated data
Restriction — request we limit processing of your data
Portability — receive your data in a machine-readable format
Objection — object to processing based on legitimate interests
Withdraw consent — at any time for consent-based processing (e.g. Health Connect, Strava)

To exercise any right, email us at contact@teamsandu.ro. We will respond within 30 days.

You also have the right to lodge a complaint with the Romanian data protection authority: ANSPDCP — www.dataprotection.ro.

10. Data Security

All data is transmitted over HTTPS (TLS encryption in transit)
Database access is protected by Row-Level Security (RLS) — each user can only access their own data
Authentication is handled by Supabase Auth (bcrypt password hashing)
Payment data is handled exclusively by Stripe (PCI-DSS compliant)
Access to admin functions is restricted to authorised personnel only

11. Children’s Privacy

The Team Sandu app is intended for users aged 16 and over. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. When we do, we will update the „Last updated” date at the top of this page and notify active users via the app. Continued use of the app after changes constitutes acceptance of the updated policy.