Privacy Policy

Last updated: 2026-07-15

1. Who is responsible

The controller responsible for processing your personal data under the GDPR is:

[YOUR NAME OR COMPANY]
[STREET ADDRESS]
[POSTAL CODE, CITY, COUNTRY]
Email: [CONTACT EMAIL]

2. What data we process and why

  • Account data — your email address and a securely hashed password. Used to create and secure your account and to sign you in. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Google Sign-In data — if you sign in with Google, we receive your Google account identifier and email address to create or link your account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Fitness & coaching data — bodyweight entries, calorie and food logs, workout templates and tracking, and, where you use coaching, the coach–client relationship, chat messages and coach notes. Used to provide the app's core features. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Security & session data — session records and login metadata used to keep you signed in and to protect against abuse. Legal basis: legitimate interest in securing the service (Art. 6(1)(f) GDPR).

3. Cookies

We use only strictly necessary cookies. We do not use analytics, tracking or advertising cookies, and we do not require cookie consent because these cookies are essential to operate the service:

  • session — keeps you signed in; expires after 1 hour of inactivity.
  • oauth_state / oauth_popup — short-lived cookies used only during Google Sign-In to protect against cross-site request forgery and to manage the login window. They are deleted immediately after login completes.

4. Hosting and where your data is stored

The application and database are hosted on Google Cloud Platform in the EU region [e.g. europe-west3, Frankfurt, Germany]. Google acts as our data processor under a data processing agreement. Where Google may process data outside the EU, this is covered by the EU Standard Contractual Clauses.

5. Sharing with third parties

We do not sell your data. We share it only with the processors needed to run the service (our hosting provider, Google Cloud) and, if you sign in with Google, with Google as the authentication provider. If you use coaching features, data you share with your coach is visible to that coach.

6. How long we keep your data

We keep your account and app data for as long as your account exists. When you delete your account, we delete the associated personal data within [RETENTION PERIOD, e.g. 30 days], except where we are legally required to keep certain records.

7. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you (Art. 15);
  • have inaccurate data corrected (Art. 16);
  • have your data deleted (Art. 17);
  • restrict or object to processing (Art. 18 and 21);
  • receive your data in a portable format (Art. 20).

To exercise any of these rights, contact us at [CONTACT EMAIL].

8. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence or workplace. Our competent authority is [SUPERVISORY AUTHORITY].

9. Changes to this policy

We may update this policy as the service evolves. The "last updated" date at the top reflects the most recent change.