This Privacy Policy explains how Rafael Cabrera, operating as Alpha Training ("we", "us", or "our") collects, uses, stores, and protects your personal data when you use the Alpha Training mobile application.
This policy complies with the EU General Data Protection Regulation (GDPR) (Regulation 2016/679) and applicable Spanish data protection law (Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales — LOPDGDD).
The data controller responsible for your personal data is:
We collect only data that is necessary for the operation of the app. The table below lists each category, the specific data points, and the legal basis under GDPR Article 6 or Article 9.
| Category | Data Points | Legal Basis |
|---|---|---|
| Identity | Full name, email address, display name, profile photo | Art 6(1)(b) — Contract |
| Account | Role (coach / student / manager / collaborator / admin), account creation date, last login timestamp, active/inactive status, fighter nickname | Art 6(1)(b) — Contract |
| Body metrics | Weight, height, reach, blood type, body fat percentage, body measurements (chest, waist, hips, arms, legs) | |
| Health / injury records | Injury type, body area, severity, diagnosis, activity restrictions, estimated recovery date, recovery status (active / recovered / recurring) | |
| Recovery metrics | Sleep quality rating, muscle soreness level, stress level (entered daily/optionally) | |
| Progress photos | Front, back, and side body photographs with associated weight, body fat %, and measurement data at the time of photo | |
| Training data | Assigned and completed workouts, exercise configurations (sets, reps, weight, tempo, rest), workout completion timestamps, training notes, workout ratings and feedback | Art 6(1)(b) — Contract |
| Personal records | Bench press, deadlift, squats, pull-ups, push-up count, plank duration, sprint times (10m / 20m / 30m), V-ups count | Art 6(1)(b) — Contract |
| Combat sports records | Fight records (wins / losses / draws, opponent name, event name, location, date, method of result), belt ranks and belt grades, championship and competition placements, martial arts disciplines | Art 6(1)(b) — Contract |
| Nutrition | Diet plan assignments, daily calorie targets, macro targets (protein / carbs / fat), water intake targets | Art 6(1)(b) — Contract |
| User-uploaded documents | Documents you voluntarily upload such as passports, national ID cards, insurance certificates, federation registrations, medical certificates | |
| Communications | In-app messages exchanged between coaches and students, message timestamps, read receipts | Art 6(1)(b) — Contract |
| Notifications | Firebase Cloud Messaging (FCM) device tokens, Apple Push Notification Service (APNs) tokens, notification preferences (enabled / disabled per category) | Art 6(1)(a) — Consent |
| Payment data (upcoming) | Subscription status, billing period. Card and payment details are processed exclusively by Stripe — we never store raw payment card data. | Art 6(1)(b) — Contract |
| Technical / device data | Device platform (iOS / Android), app version, crash logs, anonymous usage analytics | Art 6(1)(f) — Legitimate interest (app stability and security) |
This data is stored encrypted in transit (TLS 1.2+) and at rest in Google Firebase infrastructure. It is accessible only to you, your assigned coach, and your academy administrator within the app.
We use your personal data solely for the following purposes:
We do not use your data for advertising, profiling for third-party commercial purposes, or any automated decision-making with legal or significant effect on you.
We do not sell, rent, or trade your personal data to any third party.
Your data is shared only in the following limited circumstances:
We rely on the following processors to operate the app. Each is bound by a Data Processing Agreement (DPA) and is obligated to protect your data in compliance with GDPR.
| Processor | Purpose | Location | Privacy Policy |
|---|---|---|---|
| Google Firebase (Auth, Firestore, Storage, Cloud Functions, FCM, Hosting) |
User authentication, database storage, file storage, push notifications, serverless functions, website hosting | USA (EU–US DPF + SCCs) | firebase.google.com/support/privacy |
| Google Sign-In | Optional OAuth-based login via Google account | USA (EU–US DPF + SCCs) | policies.google.com/privacy |
| Apple Push Notification Service (APNs) | Delivery of push notifications on iOS devices | USA | apple.com/legal/privacy |
| Stripe Upcoming | Payment processing for subscriptions. We never receive or store raw card data; all card processing occurs on Stripe's infrastructure. | USA (EU–US DPF + SCCs) | stripe.com/privacy |
Google Firebase servers are located primarily in the United States and may also operate in other countries outside the European Economic Area (EEA). This means your personal data may be transferred to and processed in countries that do not have the same level of data protection as the EU.
We rely on the following safeguards for these transfers (Art 46 GDPR):
You can request a copy of the applicable transfer safeguards by contacting us.
| Data Category | Retention Period |
|---|---|
| Account and profile data (name, email, role, settings) | Until account deletion; purged within 30 days of verified deletion request |
| Training data, personal records, diet plans, fight records, belt ranks | Deleted on account deletion within 30 days |
| Health data (injuries, body metrics, recovery metrics) | Deleted on account deletion or consent withdrawal within 30 days |
| Progress photographs and uploaded documents | Deleted from Firebase Storage on account deletion within 30 days |
| In-app messages | Deleted on account deletion within 30 days |
| Firebase infrastructure backups | Up to 90 days in automated Firebase backup cycles |
| Financial / payment records Upcoming | 7 years (Spanish legal obligation — Ley General Tributaria) |
| Technical logs and crash reports | 90 days, then automatically deleted |
To request deletion, email rafaelcabrera.online@gmail.com with subject "Account Deletion Request". We will confirm and complete deletion within 30 days.
As a data subject under GDPR, you have the following rights. To exercise any of them, email rafaelcabrera.online@gmail.com with subject "GDPR Request — [Right]". We will respond within 30 days (extendable by a further 2 months for complex requests, with notice).
If you believe your personal data has been processed in violation of GDPR, you have the right to lodge a complaint with the competent supervisory authority. In Spain, that is:
EU residents outside Spain may also lodge a complaint with the supervisory authority in their own country of residence or the country where the alleged violation occurred.
We encourage you to contact us first at rafaelcabrera.online@gmail.com so we can try to resolve your concern directly.
The app does not use browser cookies. The mobile application stores the following data locally on your device using Android/iOS secure storage (SharedPreferences):
This locally stored data does not leave your device to any third party directly. It is used solely to improve app performance and maintain your session. You can clear this data by logging out of the app or uninstalling it.
Alpha Training is a professional training management platform and is not directed at children under 16 years of age.
If a minor uses the app (for example, a young athlete training under a coach), their account and data must be created and supervised by a parent, legal guardian, or registered coach. We require explicit parental or guardian consent before processing any health or biometric data for users under 16.
If you believe we have collected data from a child under 16 without appropriate consent, please contact us immediately at rafaelcabrera.online@gmail.com and we will delete the data promptly.
We may update this Privacy Policy from time to time to reflect changes in the app's features, applicable law, or our processing practices.
For material changes (changes to legal bases, new data categories, new processors, or changes to your rights), we will notify you via an in-app notification at least 14 days before the change takes effect.
For minor changes (clarifications, corrections, formatting), we will update the "Last updated" date at the top of this page.
Continued use of the app after a notified material change constitutes acceptance. If you do not agree with a change, you may delete your account before the effective date.
Previous versions of this policy are available upon request.
© 2026 Rafael Cabrera, operating as Alpha Training. All rights reserved.
This policy was last reviewed and updated on April 18, 2026.