OnMoreOnMore

Privacy Policy

Last updated: November 4, 2026

1. Who we are

Code Cacto is the developer of OnMore and the controller of the data described here. Data Protection Officer (DPO) for privacy matters: [email protected].

2. What data we collect

  • Registration data: name, email and phone number you provide when creating your account. Your password is stored only as a hash — we cannot read it.
  • Profile: name, email, phone, date of birth, sex, weight and height.
  • Training: programs, completed sets, loads, repetitions and average and maximum heart rate when the watch reports it.
  • Health: health questionnaire answers, measurements, skinfolds and physical assessment photos.
  • Payment data: provided by you on the payment gateway's page, not here. We only receive back the confirmation and the charge identification — never the card number.
  • Subscription status in the store (active, expired, cancelled), reported by the App Store/Google Play. The charge itself happens in the store, with the data you already have there.
  • Approximate location: the city and country estimated from your IP address when you use the service, so we know in which regions it is used. We don't use GPS, and the IP address is not stored.
  • Messages you send us through feedback or contact forms, with whatever you type in — so we can reply.

3. What we use it for

We use the data to operate OnMore, respond to what you write to us, process billing and improve the product. We do not sell personal data, and we do not use it for third-party advertising.

4. Legal basis

We process data to perform the contract with you (what the product needs to work), to comply with legal obligations (e.g. tax record-keeping), and for the legitimate interest of keeping the service secure and improving it. Where the law requires consent, it is requested explicitly.

5. Who we share data with

We share the minimum necessary, always under a confidentiality obligation:

  • Infrastructure providers that host the service.
  • Payment gateway, to process billing.
  • App Store and Google Play, which administer the subscription.
  • Authorities, when there is a legal order to do so.

6. How long we keep it

For as long as your account exists. When you request deletion, your account will be permanently deleted after 30 days; during that period it stays locked, with the data kept, so you can change your mind. On permanent deletion, we erase the associated personal data, except what the law requires us to keep (tax and access records). Contact messages are kept for the duration of the support case.

7. Your rights

Brazil's General Data Protection Law (LGPD) entitles you to confirm the existence of processing, and to access, correct, port and delete your data, as well as to withdraw consent. Deleting your account is available directly in the app: your account will be permanently deleted after 30 days from the request, and during that period you can change your mind. For any of these requests, write to [email protected] — we reply within 15 days.

8. Children and teenagers

The service is not intended for anyone under 13 years old, and we do not knowingly collect data from that age group. If this happens, delete it in the app or let us know at [email protected] and we will remove it.

9. Health data and assessment photos

The health questionnaire, measurements and physical assessment photos are health data. They are visible only to the Professional the client has an active link with (the independent trainer or the gym) and, when the gym has a team, to the team trainer responsible for the client. The assessment photo does not appear in the client app, and nobody on the platform's administration has a screen to view this data.

Every time this data is opened, the platform logs the access. Photo metadata (such as location) is removed on upload. If the link ends, the Professional loses access; if the client's account is deleted, this data is erased.

10. Sharing with the linked professional

By joining with the code of a trainer or a gym, the client starts sharing with the Professional their profile (name, date of birth, sex, weight, height and phone), the health questionnaire answers, measurements and workout sessions. If the client is served by a team trainer, this data is also visible to that trainer. The client can leave the link at any time.

11. Gym and team: who has access

For clients' data, the Professional (independent trainer or gym) is the controller and CodeCacto is the processor.

At a gym, the owner sees the data of the gym's clients. Each team trainer sees the clients they are responsible for and no others. Conversations between a client and a team trainer are not read by the gym owner, unless the client starts being served by the gym itself.

12. Change of responsible trainer

A client can move from one team trainer to another, or to the gym's direct service. When a trainer leaves the team, their clients stay with the gym. In any change, the previous trainer loses access to the client's data and the new one gains it.

13. Deleting the gym's account

If the gym owner requests deletion of the account, the account is locked, the data is kept, and the team and clients are notified. During that period the owner can restore the account. Your account will be permanently deleted after 30 days.

14. Changes

This policy may be updated. Relevant changes are published on this page, with the revised date — and, when they affect the use of your data, we notify you within the product.