Privacy Policy

1. Controller

The controller responsible for the processing of personal data in this app is:

Email: cristian.cristea.dev@gmail.com

2. General Information

3. Data We Process

When you use the app, we may process the following types of personal data.

Account data

• Name
• Email address
• Encrypted password
• Login and authentication data
• Language, timezone, or similar settings

Contact and support data

• Name, if provided
• Email address
• Message content
• Date and time of the message
• Technical or account-related context, where needed to handle the request
• Internal admin notes or handling status, where used to process and document the request

Invitation and waitlist data

• Name, if provided
• Email address
• Optional message submitted with an invitation request
• Request, subscription confirmation, invitation, and acceptance status
• Invitation token metadata, such as expiry and acceptance time
• Brevo synchronization status, where used for double opt-in waitlist confirmation

Profile data

• Height
• Sex, if provided
• Date of birth or year of birth, if provided
• Personal goals, such as target weight, step goal, calorie goal, or training goal

Body, fitness, and activity data

• Body weight
• Body metrics
• Progress data
• Training entries
• Activities such as running, strength training, walking, cycling, mobility, swimming, or other activities
• Running distance, training duration, repetitions, weights, or similar training details
• Step counts

Nutrition data

• Food entries
• Calories
• Protein
• Drinks or other voluntarily entered nutrition data
• Entries marked as estimated

Technical data

• IP address
• Date and time of access
• Browser and device information
• Server log data
• Session and security data
• Cookie, session, and local storage consent or preference data
• Error logs, where needed for operation and troubleshooting

4. Purposes of Processing

We process personal data to:

• provide your user account
• enable login and password reset
• store your personal fitness, nutrition, body, and activity data
• show daily, weekly, and progress summaries
• show goals and progress toward goals
• receive and respond to contact, feedback, and support requests
• receive and manage invitation requests
• operate an invitation-based access flow
• manage double opt-in subscription confirmation for the waitlist
• document support handling and communication history
• investigate technical issues, misuse, or account-related questions
• provide, secure, and maintain the app
• detect and fix errors
• prevent misuse and unauthorized access
• comply with legal obligations, where applicable

5. Legal Bases for Processing

Where applicable, the processing is based on:

• Art. 6(1)(b) GDPR, where processing is necessary to provide the app and user account
• Art. 6(1)(a) GDPR, where you voluntarily provide optional personal data based on consent
• Art. 9(2)(a) GDPR, where body, fitness, activity, health-related, or nutrition data may qualify as special-category data and processing is based on your separate explicit consent
• Art. 6(1)(f) GDPR, where processing is necessary for security, troubleshooting, and reliable technical operation
• Art. 6(1)(c) GDPR, where processing is necessary to comply with legal obligations

Acceptance of the Terms and Privacy Policy is separate from consent to process body, fitness, activity, health-related, and nutrition data. Before using tracking features, you may be asked to provide separate explicit consent for this processing.

Providing body, fitness, training, and nutrition data is voluntary. Some app features may not work or may be limited if you do not provide this data.

6. Body, Fitness, and Nutrition Data

7. Registration and User Account

8. Password Reset and Email Delivery

Provider:

Waitlist provider:

For these purposes, your email address, email subject, technical delivery data, email content, invitation request status, and subscription confirmation status may be processed.

9. Contact and Support Messages

10. Hosting and Technical Operation

The app is hosted on Heroku.

Provider:

11. Content Delivery Network and Frontend Resources

Provider:

12. Cookies, Sessions, and Local Storage

The app uses technically necessary cookies and browser storage technologies to operate the app and remember your choices.

Technically necessary cookies

The app uses technically necessary cookies or similar technologies to:

• keep you signed in
• manage secure sessions
• provide security features
• protect forms and requests

Local storage

The app uses local storage in your browser to remember technical preferences and interface choices.

This may include:

• your cookie or analytics consent choice
• whether certain interface sections, such as exercise details, are expanded or collapsed

Local storage remains on your device until it is deleted by you, your browser, or the app. You can delete local storage through your browser settings.

Analytics cookies

Analytics provider:

13. Server Logs and Security

When you access the app, server log data may be processed, including:

• IP address
• date and time
• requested URL
• browser and device information
• technical error data

14. Recipients and Processors

Personal data is not sold.

Data may be shared with service providers necessary to operate the app, including:

• Heroku, for hosting, database, and technical infrastructure
• Resend, for transactional email delivery
• Brevo / Sendinblue GmbH, for invitation waitlist management and double opt-in subscription confirmation
• jsDelivr / Prospect One, for delivery of technical frontend resources
• Google Ireland Limited, for analytics, if you consent to analytics cookies
• error monitoring or logging providers, if used

These providers process data only as required to provide their services.

15. Transfers Outside the EU/EEA

Some service providers may process personal data outside the European Union or European Economic Area. Heroku and Resend are providers based in the United States. Brevo / Sendinblue GmbH is based in Germany and may use subprocessors or infrastructure outside the EU/EEA where legally permitted. If you consent to analytics, Google Analytics may involve processing by Google Ireland Limited and Google LLC, including possible processing in the United States. jsDelivr / Prospect One is based in Poland but may use globally distributed CDN infrastructure.

Such transfers take place only where an appropriate legal basis exists, such as:

• an adequacy decision by the European Commission
• Standard Contractual Clauses
• additional contractual and technical safeguards
• another legally permitted basis

16. Storage Period

17. Account Deletion

• body data
• weight entries
• training data
• activity data
• running data
• step counts
• nutrition entries
• goals

A minimal deletion record may be retained, such as the time of request, time of deletion, and a reduced technical reference, where this is necessary for documentation, security, or legal defense.

18. Data Export

You may request or download a copy of your stored data where this feature is provided.

The export may include:

• profile data
• body data
• weight entries
• training data
• activity data
• step counts
• nutrition entries
• goals

19. Your Rights

Under the GDPR, you may have the following rights:

• right of access to your personal data
• right to rectification of incorrect data
• right to erasure of personal data
• right to restriction of processing
• right to data portability
• right to object to certain processing
• right to withdraw consent with effect for the future
• right to lodge a complaint with a data protection supervisory authority

To exercise your rights, contact:

cristian.cristea.dev@gmail.com

20. Withdrawal of Consent

21. Required Data

22. Automated Decision-Making

23. Changes to This Privacy Policy

This Privacy Policy may be updated if app features, service providers, or legal requirements change.

The current version is available in the app or on the website.