Privacy Policy
Introduction
Catalyst Code LLC ("we," "us," or "our") operates the Reach mobile application ("the app"). This Privacy Policy explains what personal information we collect, how we use and protect it, and your rights with respect to it.
By using Reach, you agree to the collection and use of information as described in this Privacy Policy.
What We Collect
We collect information you provide directly and indirectly, including:
- Contact information — your email address, only if you email us or sign up for updates on www.reachfurther.app. When you sign up for updates we also record the date and time you gave consent and the wording you agreed to, so we can demonstrate that consent if asked. The app does not currently ask for name and email address.
- User Preferences — information you enter during onboarding and in your profile, including: age, biological sex, activity level, sedentary habits, daily movement level, sleep habits, problem areas, experience level, and fitness goals.
- App usage data — session history, exercises performed, muscles stretched, and notification preferences.
- Device information and identifiers necessary to operate the app.
- Install source — where your install came from, such as the ad, post, or link you tapped before downloading the app, together with your IP address. See Advertising below.
- Advertising identifier — where you permit it, your device's advertising identifier (Apple's IDFA or Android's Advertising ID), used only to measure how our own ads perform. See Advertising below.
Where Your Data Is Stored
Your User Preferences and fitness activity data are stored locally on your device. PostHog, Sentry, and Adjust will have restricted data associated with a pseudoanonymous or anonymous identifier.
Security notice. We implement reasonable technical and organizational measures to protect your personal information. However, no data transmission or storage system can be guaranteed to be completely secure — you use the app understanding that absolute security cannot be assured. In the event of a breach involving your personal information, we will notify you as required by applicable law.
How We Use Your Information
We use your information to:
- Operate the app and deliver personalized fitness guidance.
- Surface appropriate caution banners based on your indicated problem areas.
- Monitor app performance, detect errors, and improve the product.
- Send push notifications and in-app messages.
- Send marketing communications where you have consented or where permitted by applicable law (see Marketing Communications below).
- Comply with legal obligations.
We do not sell your personal information. We do not share your User Preferences with advertisers.
Third-Party Services
Reach uses the following third-party services that may receive limited data:
| Service | Provider | What they receive | Purpose |
|---|---|---|---|
| RevenueCat | RevenueCat, Inc. | Device ID, subscription status, app store receipt, the Adjust identifier for your app install, the ad campaign your install came from (network, campaign, ad group, and creative), your IP address and, where you permit it, your advertising identifier. RevenueCat reports subscription events (trial started, purchase, renewal, cancellation, refund) to Adjust. | Subscription management and measuring which ads lead to subscriptions |
| PostHog | PostHog, Inc. | Pseudonymous usage events (e.g., screens visited, sessions completed, onboarding progress) linked to a random install identifier that carries no name or email. We also send PostHog aggregated statistics based on additional App Usage Data and User Preferences - which are anonymized and cannot be linked to you. | Product analytics and to make the app a better experience |
| Adjust | Adjust GmbH | Install and app-open events, the source of the install (for example the ad, post, or link that was tapped), device and network information including your IP address, a random identifier Adjust generates for the app install, a small set of in-app milestones (completing onboarding, your first Full Body Unlock) and subscription events from RevenueCat. Where you permit it, your advertising identifier — Apple's IDFA or Android's Advertising ID. Adjust passes install and event data to the advertising networks we run ads on (such as Meta and TikTok) so they can measure our ads. | Measuring where app installs come from and how our ads perform |
| Sentry | Functional Software, Inc. | Crash and error reports, app performance measurements, device info, app state and screens visited around the time of an error, a random app-install identifier; | Error monitoring and app performance |
| Apple In-App Purchase | Apple Inc. | Payment handled entirely by Apple | Subscription billing (iOS) |
| Google Play Billing | Google LLC | Payment handled entirely by Google | Subscription billing (Android) |
| Kit | Kit.com | Your email address and the date you signed up, only if you enter your email in the waitlist form on our website | Launch notification and marketing email |
We may also use service providers to deliver email communications on our behalf; such providers receive only your email address.
User Preferences
Problem area and sleep habit selections and other User Preferences are used to personalize your experience and surface exercise cautions. They are stored on your device and are never shared with third-party analytics or advertising services in identifiable form. We may collect aggregated, anonymous statistics about onboarding and profile answers (for example, the percentage of users who select a particular body area) in order to make the app experience more useful to people.
HIPAA Notice. Reach is not a HIPAA-covered entity or business associate. Our services are general wellness and fitness services and are not covered by the Health Insurance Portability and Accountability Act (HIPAA). We do not collect, store, or process medical records or other information covered by HIPAA. Users who require HIPAA-covered healthcare services are solely responsible for using appropriate HIPAA-compliant providers.
Analytics and Error Monitoring
PostHog receives pseudonymous usage events identified by a random install identifier — not your name or email — and is configured to discard IP addresses. Sentry receives crash and error reports, app performance measurements. Sentry is configured not to attach your IP address to reports. Sentry is provided a randomly generated identifier that the provider cannot connect to your name or email.
Our attribution provider, Adjust, does receive your IP address — it is how an install is matched to the link that led to it and how the install's country is estimated. Adjust is covered under Advertising below.
Neither PostHog nor Sentry receives identifiable User Preferences. Your onboarding and profile answers reach PostHog only as anonymous, aggregated statistics that cannot be linked to you. Because those statistics carry no identifier at all, they cannot be traced back to you and cannot be deleted on request.
Advertising
We promote Reach through social platforms and advertising networks such as Meta, TikTok, and Reddit. To understand which of those placements bring people to the app, we work with an attribution provider (Adjust), which receives install and app-open events, the source of the install, and your IP address. We may also serve Reach advertisements through third parties, such as Meta, to the extent that you have consented to, or have been provided with notice of and an opportunity to opt out of, such practices under applicable law. We never share your User Preferences with advertising partners, and we never sell your personal information.
Advertising identifiers. On iPhone, Reach asks your permission through Apple's App Tracking Transparency prompt during onboarding. Apple's IDFA is read only if you tap Allow; if you choose Ask App Not to Track, it is never read, and our ads are measured only through Apple's privacy-preserving SKAdNetwork, which reports aggregated results without identifying you. You can change your choice at any time in iOS Settings → Privacy & Security → Tracking. On Android, Reach reads the Advertising ID provided by Google Play services; you can delete or reset it at any time in Android Settings → Google → Ads (or Settings → Privacy → Ads, depending on your device), after which it can no longer be read.
Advertising identifiers and in-app events are used only to measure how our own ads perform — which ad led to an install, and whether that install went on to complete onboarding or start a subscription. Reach shows no ads inside the app. Advertising networks such as Meta and TikTok may combine this measurement data with information they already hold in order to improve the delivery of our ads, under their own privacy policies.
If your device is set to a region in the European Economic Area, the United Kingdom, or Switzerland, Reach does not show the tracking prompt, does not read any advertising identifier, and instructs Adjust not to share your install or event data with advertising networks.
Erasing attribution data. Sending a deletion request from Profile → Erase My Data in the app instructs Adjust to permanently delete the data held for your app install and to stop collecting further data for it. This cannot be undone.
Marketing Communications
We may send you marketing emails about new features and promotions. The app does not collect your email address, so the only way you join our marketing list is by submitting it yourself through the email signup form on our website. You can opt out at any time by clicking "Unsubscribe" in any marketing email, or by contacting us at contact@reachfurther.app.
International Data Transfers
Your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. These countries may have data protection laws that differ from those in your country of residence. By using Reach, you acknowledge that your information may be transferred internationally in accordance with this Privacy Policy.
Where personal data is transferred outside the European Economic Area, the United Kingdom, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum where applicable), as incorporated into our data processing agreements with RevenueCat, PostHog, Sentry, Adjust, and Kit.
Apple and Google act as independent controllers in connection with app store payments and apply their own safeguards for international transfers under their respective privacy policies.
Data Retention
Your fitness data and User Preferences are stored on your device. Deleting the app erases all of them, and we never hold a copy.
A limited amount of usage and crash data is held by our providers and is not erased when you delete the app. It is linked only to a random install identifier — never to your name or email. Sentry deletes crash and performance data automatically after approximately 90 days. PostHog may retain usage events for up to 7 years, and will delete them on request.
To have that data deleted, email us at contact@reachfurther.app and include your Install ID, which you can find in the app under Profile → Erase My Data. Send your request before you delete the app. The identifier is stored on your device, so once the app is removed neither you nor we can recover it, and the data can no longer be located or deleted. We cannot action a request that does not include it.
Deleting attribution data: sending the request from Profile → Erase My Data instructs Adjust directly from your device to delete the install's data and stop collecting, so no Install ID is needed.
Your subscription status is held by RevenueCat and by the app store that processed your payment.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. For material changes — particularly those affecting how we handle your personal information — we will give notice in the app and on our website before the changes take effect. For minor changes, we will update the "Last Updated" date at the top of this document. Your continued use of the app following any posted changes constitutes your acceptance of the revised Privacy Policy.
Your Rights — All Users
You have the right to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Request deletion of your data.
- Receive a copy of the usage and crash data we hold about you.
To exercise any of these rights, email us at contact@reachfurther.app and include your Install ID (Profile → Erase My Data). Without it we cannot identify which data is yours, and we will not be able to action the request.
California Residents (CCPA)
Under the California Consumer Privacy Act, you have the right to know what personal information we collect and how it is used, to request deletion, and to opt out of the sale or sharing of your information. We do not sell your personal information. In the event any of the ways we share data (such as sharing device identifiers with advertising partners for ad measurement) is considered a "sale" or "sharing" under the CCPA's broad definitions, you have the right to opt out. To submit any CCPA request — including an opt-out — email contact@reachfurther.app with a request that can be verified as the user. We will respond within 45 days of receiving a verifiable request.
Canadian Residents (PIPEDA / Quebec Law 25)
We collect, use, and disclose your personal information only with your consent or as permitted by law. You may withdraw consent at any time, subject to legal or contractual restrictions. Quebec residents have additional rights under Law 25, including the right to data portability and the right to be informed of automated decision-making that affects them. To exercise these rights, email contact@reachfurther.app.
Australian Residents (Privacy Act / Australian Privacy Principles)
We comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth). To the extent any information we collect is classified as sensitive information under the Privacy Act, it is afforded additional protection. To make a request, contact us first at contact@reachfurther.app. Unresolved complaints may be referred to the Office of the Australian Information Commissioner (OAIC).
New Zealand Residents (Privacy Act 2020)
We comply with the New Zealand Privacy Act 2020 and its information privacy principles. Unresolved privacy concerns may be referred to the New Zealand Privacy Commissioner.
EU, UK, and Switzerland Residents (GDPR)
If you are located in the European Union, the United Kingdom, or Switzerland, you have the following rights under applicable data protection law:
- Access — request a copy of the personal data we hold about you.
- Rectification — request correction of inaccurate or incomplete personal data.
- Erasure — request deletion of your personal data under certain circumstances.
- Portability — receive your personal data in a structured, machine-readable format.
- Restriction — request that we restrict processing of your personal data in certain situations.
- Objection — object to processing of your personal data for certain purposes, including direct marketing.
- Withdraw consent — where processing is based on your consent, withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
Our legal bases for processing your personal data are: (a) performance of a contract — to provide the app and its services; (b) your consent — for marketing communications where required; and (c) legitimate interests — for analytics, advertising measurement, and error monitoring. For users in the European Economic Area, the United Kingdom, and Switzerland, Reach does not read advertising identifiers or share install and event data with advertising networks.
To exercise any of these rights, email us at contact@reachfurther.app. We will respond within one month of receiving your request. Where a request is complex, or where we receive a number of requests, we may extend that period by up to two further months and will notify you of the status of the request within the first month.
Because the data we hold is linked only to a random install identifier, we may be unable to identify you from it. Where that is the case we will tell you. You may supply your Install ID (Profile → Erase My Data) so that we can act on your request.
You also have the right to lodge a complaint with your local data protection supervisory authority.
Contact
For any privacy questions or data subject rights requests:
Catalyst Code LLC
260 E. Main Street, Suite 6928
Rochester, NY 14604
United States
contact@reachfurther.app