Privacy Policy

Overview

This policy describes what personal data we hold about you, how we process it, and the rights you have under the EU General Data Protection Regulation (GDPR). This is a strength-training application; the only personal data we collect is what you give us at sign-up and what's generated by your training activity.

Data we collect

• Account: username, display name, hashed password, hashed recovery key, language preference, body weight (kg), training-experience flag.
• Training: enrollments, weekly schedule, calibration lifts and resulting 1RM estimates, completed workouts (exercise, set, weight, reps, timestamps).
• Session: IP address and user-agent on each sign-in (kept on the session row; not used for tracking).
• Audit: a record of admin actions taken on your account, plus your own login/recovery/account-delete events.

Sub-processors we use

We process your data on the following services. Each is bound by a Data Processing Agreement (DPA) where applicable:

• Neon (serverless PostgreSQL) — primary database. Hosted in EU by default.
• Vercel — application hosting and edge runtime.
• Have I Been Pwned (HIBP) — when you set or recover a password, the SHA-1 hash of the first 5 characters is sent to the HIBP range API to check whether the password has appeared in known breaches. The full password is never sent. We fail open: if HIBP is unreachable, the password is allowed.
• Sentry — error and performance monitoring. We send unhandled exceptions and a small percentage of trace samples. We do NOT send personally-identifying request bodies, cookies, or usernames by default; only error stack traces, route names, and runtime metadata.
• Email: we currently do NOT send emails. Account-recovery uses an offline recovery key delivered at registration, and admin actions are communicated out-of-band. If we wire an email provider in the future, we'll add the provider here as a sub-processor before the first email is sent.

Your rights (GDPR Articles 15, 16, 17, 20)

You can exercise the following rights from the Profile page once signed in:

• Access (Art. 15): we surface your account state directly on the Profile page.
• Portability (Art. 20): the "Export my data" button downloads a JSON file with everything we hold.
• Erasure (Art. 17): the "Delete my account" button permanently removes your account and personal training data. Audit log entries are retained but de-identified.
• Rectification (Art. 16): you can edit your display name, body weight, and training-experience flag from the Profile page; for other fields, contact your admin.

Retention

We keep your account and training data for as long as your account is active. After self-deletion, personal data is erased immediately by database cascade; audit log entries are kept (de-identified) for security and abuse-investigation purposes. Session IP/user-agent rows are kept until session expiry.

Contact

Questions or requests should go to the admin who issued your access code. If you cannot reach them, contact the application operator listed in the source repository.