Last updated: 18 October 2026.
This policy explains what data Cypher Masters —the app and the league— collects, what it is used for, who it is shared with, and what rights you have over it. It is drafted in compliance with the General Data Protection Regulation (EU) 2016/679 and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights (Spain).
CYPHER MASTERS, with Tax ID (NIF) 31023308B and address at Calle Esmeralda nº 5, 14014 Córdoba, Spain. Contact email: info@cyphermasters.com
If you have any question about this policy or want to exercise your rights, write to the address above.
When you sign in to the app with Google or Apple, we receive:
With Google or Apple your password never passes through Cypher Masters: they handle sign-in. If you create an account with an email and password in the web areas (organisers or artists), the password is stored encrypted by our authentication provider and nobody at Cypher Masters can see it.
What you enter or generate inside the app:
If you choose to fill these in, they're stored as private data on your account, visible only to you:
Each session you log —a training session, or a class you take or teach— may include:
Notes in MY NOTEBOOK are private: only you can see them.
On location: to help you fill in the venue, the app may ask permission to access your device's precise location and suggest where you are: a nearby place or, if there isn't one, the street address. Your position is turned into a place by the operating system's own location service (Apple on iOS, Google on Android). The place you confirm is stored —it may be an exact address— and is shown on your session, class or battle according to your privacy level; the coordinates are not stored on our servers. You can change or remove the place, hide where you train from others in Settings → Privacy, or deny the permission and type it by hand. This rule does not cover routes you choose to import from Apple Health, described in section 2.8.
If you take part in league competitions, or log them in the app: date, event name, city, category, format, rounds, result, score and your crew.
Event registrations. If you register for an event from the app or the website, we store your name, your aka, the category and, if you register as a team, the team name and the name and aka of each member. For members who don't have a Cypher Masters account we also ask for their email, to send them the confirmation: only register people who have given you permission. If you register from the website without an app account, we also collect your email, your age, your city, your crew and, if you create one, your avatar. The event's organiser sees the list of entrants for its events (name, aka, team and members) and manages the price and whether it's marked as paid. To register we ask for a WhatsApp number (if it isn't already in My data, it's saved there and we won't ask again), and the organiser sees that WhatsApp and your account email on your registration record so they can contact you about the event; if you're a team's contact person, yours, not the members'. They see it while it's in My data: if you delete it, they no longer do. The app doesn't charge anything: payment, if any, happens outside it and we don't store any payment method.
We don't collect advertising identifiers and we don't track you for third-party advertising purposes.
If you turn this feature on, we may import the following data from the workouts you authorise:
This data can reveal information about your health and is a special category of data. Apple Health starts switched off, requires a separate explicit consent, and the app works fine without it. The basic session follows your profile's visibility; heart rate, calories and route start private and are only shown to other people if you enable that afterwards in Privacy.
If you set a personal streak goal, we store the number of active days per week you choose and the date from which each change applies. This information is used to calculate your completed weeks without altering earlier history.
If you voluntarily turn on cycle tracking, you can log:
Period days, phases and rests can reveal information about your health and are a special category of data. The feature starts switched off, requires your explicit consent, is optional, and the app works fine without it. This detailed data is visible only to you: it is not shown to other users or to your crew. By default it is also not shared with the coach or sent to AI providers.
Only if you separately turn on and consent to CYCLE COACH will the coach take the calculated phase and today's cycle rest, if any, into account. Anthropic is sent only those two pieces of data together with your aggregated statistics: never dates or your menstrual history. Non-menstrual phases are always flagged as estimated and are never used to infer symptoms or fertility, or to automatically impose an intensity or a rest day on you. You can turn this option off without turning off your cyclical streak.
If you choose to show your cyclical streak on your profile, other people only see the streak type and its numeric record — never the dates, the phase, or which days you protected.
A cypher is a live room for training with other people. If you join one, we store your presence in the room while it lasts and the chat messages you write, which are deleted when the cypher closes. If you choose to step into the centre and broadcast, the app uses your camera and microphone only while you broadcast: your image and voice are streamed live to the people in the room through LiveKit and are not recorded. Only whoever chooses to broadcasts, one at a time, and you can stop whenever you like.
If you sign up as a DJ or producer on `cyphermasters.com/artistas` to license your music to the app's catalogue, we collect: your email and password (account), your artist name, city, Instagram, bio and photo (public: shown alongside videos that use your tracks), your full legal name (private: it identifies the party granting the licence), the audio and cover files you upload, and the record of your licence acceptance and your per-track declaration (text version, file fingerprint, and server date and time). Your real name and email are never published anywhere. As an artist you see how many times your music plays — in published moments and in cyphers — as aggregate counts only: never who listens to it or who uses it.
| Processing | Legal basis |
|---|---|
| Account, profile, sessions and app features | Performance of the service you request (Art. 6.1.b GDPR) |
| Height, weight and history (health data) | Explicit consent (Art. 9.2.a GDPR). Optional |
| Data imported from Apple Health, including GPS route | Separate explicit consent (Arts. 6.1.a and 9.2.a GDPR). Optional and revocable |
| Menstrual-cycle dates, phases and rests | Explicit consent (Arts. 6.1.a and 9.2.a GDPR). Optional and revocable |
| Cycle coach — sending the calculated phase and today's rest to Anthropic | Separate explicit consent (Arts. 6.1.a and 9.2.a GDPR). Optional and revocable |
| Publishing league results, rankings and honours | Performance of the service and legitimate interest in publicising the competition |
| Event registrations and passing them to the organiser | Performance of the service you request by registering |
| Live cyphers: chat, image and voice of whoever broadcasts | Performance of the service: only if you join a cypher and choose to write or broadcast |
| Crash reports and reviewing reports | Legitimate interest in keeping the app working and safe |
| Images taken at events (section 6) | Consent (Art. 6.1.a GDPR), revocable |
| Push notifications | Consent, revocable from the system or from Settings |
| AI avatar and coach advice | Consent: only if you use those features |
We use the following providers to run the app. Each one processes data solely to provide us with its service, under its own security guarantees:
| Provider | For what | What it receives |
|---|---|---|
| Supabase | Database, authentication and file storage | The data described in section 2, including any Apple Health and menstrual-cycle data you authorise (it's our backend infrastructure) |
| bunny.net | Storage and playback of your session videos | The videos you upload (processed and served from its content-delivery network) |
| Google Maps Platform | Searching for places when you type one and, on Android, showing maps | The text you type when searching; on Android, the maps SDK also collects the technical data described in section 2.7 |
| LiveKit | Streaming a cypher broadcast live | The image and voice of whoever broadcasts, and the identifier and aka of whoever is in the room, only during the live stream. It is not recorded |
| Google (Google Workspace) | Sending event-registration emails (confirmations and access links) | The email address, the name and the registration details |
| OpenAI | Generating your avatar from a photo | The photo you upload specifically to create the avatar. It is not stored on our servers: it is sent only at the moment of generation and discarded afterwards |
| Anthropic | Generating the "coach" comment on your progress | Aggregated, de-identified statistics about your activity and, if you configure them, the coach's tone and your goals. Only if you turn on CYCLE COACH, also the calculated phase —flagged as estimated where applicable— and whether you've chosen a cycle rest today. Never your name, username, email, dates or menstrual history |
| Expo and Google (Firebase Cloud Messaging) | Delivering push notifications to your device (Expo routes them via Google's Firebase Cloud Messaging on Android and via Apple on iOS) | Your notification token and the content of the alert |
We don't sell your data or transfer it to third parties, except where legally required. No transfers to third countries are envisaged beyond the guarantees offered by these providers.
We process your data to:
The right to one's own image is recognised in Article 18 of the Spanish Constitution and regulated by Organic Law 1/1982, of 5 May, on the right to honour, personal and family privacy and one's own image.
Photos and videos are taken at Cypher Masters events, in which you may appear, individually or in a group, as part of the normal running of the competition.
Participation in events is reserved to people aged 16 or over, per section 9.
Content you upload. The photos and videos you publish in the app are yours and you remain responsible for them: only upload content of your own or that you have permission to use. If other people appear in it, you need their consent.
We keep your data for as long as your account exists. If you delete your account, the associated data is deleted (profile, sessions, photos, videos, avatar, competitions, social relationships, blocks and notification tokens), unless the law requires us to keep some of it for an additional period.
Cypher chat messages are deleted when the cypher closes; live broadcasts are not recorded. Reports are kept for as long as needed to review them and, if action was taken, as a record of it. Crash reports are kept for as long as needed to fix the problem.
If you're a DJ or producer, licence data (your name, the version accepted, each file's fingerprint and the acceptance date) is kept for as long as any published video uses your music, because it's the evidence of the authorisation covering that video; your tracks are removed from the catalogue when you ask or when you close your account, and videos already published are not modified (the audio is part of the file). To close your DJ or producer account, write to the contact address in section 1.
You can delete your account from the app: Settings → Delete account. As an alternative, you can also request it by writing to the contact address in section 1.
Data imported from Apple Health is kept for as long as you keep the session or the account. You can stop new imports at any time. If you turn off ROUTES, the GPS tracks already imported are deleted from Cypher Masters and the session and its distance are kept. This does not delete the original data in the Apple Health app.
Cycle data is kept for as long as you keep the account or until you delete it from Settings → Streaks. Turning off tracking stops it being used for new estimates and keeps the records so you can recover them if you turn it back on; you can delete them permanently from that same screen. Withdrawing consent doesn't affect your sessions or your linear and personal streaks. Turning off tracking also turns off the cycle coach. If you turn off only the cycle coach, you stop sending it your cycle context and can keep using the cyclical streak as normal.
Under the GDPR, you have the right to:
To exercise them, write to info@cyphermasters.com stating your username in the app. We will respond within the legally established period (one month at most).
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es) if you believe the processing does not comply with the regulations.
Cypher Masters is not directed at people under 16, either the app itself or participation in its events. If we detect an account belonging to someone under that age without appropriate consent, we will remove it.
We may update this policy to reflect changes in the app, in the league, or in applicable regulations. The "last updated" date indicates the version in force. If the change is material, we will ask you to accept it again in the app: each version is sealed with its own digital fingerprint.