Draft – to be reviewed by a lawyer before launch.
Privacy policy
We process as little data as possible. Here is which data ends up where, and when.
Without an account
Your questionnaire answers are only processed in your browser – in memory and in the tab's session storage, which is cleared when you close the tab. Nothing is sent to our server.
Account
For an account we store your email address, your password as a secure hash (scrypt – we never know the password itself), when you signed up, your confirmation that you are at least 16, and your sign-in sessions (including IP address and browser identifier to protect your account). The legal basis is performance of a contract (Art. 6(1)(b) GDPR).
Health data
We only store your training plan together with your questionnaire answers (year of birth, sex, height, weight, complaints, health check) with your explicit consent (Art. 9(2)(a) GDPR). You can withdraw it at any time in your account; we then delete this data and all saved plans immediately.
Hosting
The app and database run on our own server in a data centre in Germany (netcup GmbH, Karlsruhe). The data does not leave the EU.
Email delivery
We currently don't send any emails. Once we offer sign-in codes or password resets by email, we will use an email provider as a processor (Art. 28 GDPR); it then only receives your email address and the content of the message.
Cookies
We only set cookies that are technically necessary for signing in (Section 25(2) TDDDG). No tracking, no ads, no analytics; fonts are served from our own server.
Retention
Data is kept until you delete it, withdraw consent or delete your account. We keep at most the last 20 versions of each plan. Backups are overwritten after 14 days.
Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection, and to lodge a complaint with a data protection authority. You can trigger export and deletion directly in your account.