📋 Privacy Policy

Last updated: 07/26/2026

1. Data Controller

2. General Information on Data Processing

We process our users' personal data only to the extent necessary to provide a functioning website as well as our content and services. Personal data is processed only with the user's consent or where a legal basis exists.

3. Legal Basis for Data Processing

Your data is processed on the basis of the following legal grounds:

• Art. 6 (1)(a) GDPR - User consent
• Art. 6 (1)(b) GDPR - Performance of a contract (providing the training tracker functions)
• Art. 6 (1)(f) GDPR - Legitimate interests (e.g. security of the website)

4. What Data Is Collected?

4.1 Registration and Account Data

During registration, we collect the following data:

• Username (freely chosen, no real name required)
• Password (stored encrypted using a bcrypt hash)
• Registration date
• Invitation code (deleted or logged after use)

Purpose: Providing a personal account to use the training tracker functions.

Legal basis: Art. 6 (1)(b) GDPR (performance of a contract)

4.2 Training Data

While using the app, we store:

• Exercise name (e.g. "Bench Press")
• Muscle groups (e.g. "Chest", "Triceps")
• Training data (sets, reps, weight)
• Workout date
• Notes (optional, entered by you)
• Hidden recommendations (your preferences)

Purpose: Documenting your training progress and providing personalized workout recommendations.

Legal basis: Art. 6 (1)(b) GDPR (performance of a contract)

4.3 Server Log Files

Each time the website is accessed, the following information is automatically recorded:

• IP address (anonymized after 7 days)
• Date and time of access
• Page accessed
• Browser type and version
• Operating system
• Referrer URL

Purpose: Ensuring system security and error analysis.

Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in security)

Retention period: Automatically deleted after 7 days.

5. Use of Cookies

Our website uses exclusively technically necessary cookies required for the functionality of the application. Under GDPR and TTDSG, these cookies do not require consent.

5.1 Overview of Cookies Used

Cookie name	Purpose	Retention period	Type
PHPSESSID	Session management (login status)	Until browser is closed	Technically necessary
remember_token	"Stay logged in" function	30 days	Technically necessary
muscle_filter_days	Storing the time-period filter setting	1 year	Technically necessary

5.2 Disabling Cookies

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis. Please note that disabling cookies may limit the functionality of the website.

6. Data Security

We use technical and organizational security measures to protect your data:

• Password encryption: All passwords are hashed with bcrypt (never stored in plain text)
• Secure database: SQLite database with restricted access
• Session security: Secure session management with HttpOnly cookies
• Regular updates: Current security patches for server software

7. Data Disclosure

We do NOT share your personal data with third parties. An exception applies only if:

• You have explicitly consented (Art. 6 (1)(a) GDPR)
• There is a legal obligation to do so (Art. 6 (1)(c) GDPR)
• It is necessary to enforce our rights (Art. 6 (1)(f) GDPR)

8. Retention Period

Data type	Retention period
Account data	Until the account is deleted by the user
Training data	Until manual deletion or account deletion
Session cookie	Until the browser is closed
Remember token	30 days or until logout
Filter cookie	1 year
Server log files	7 days (automatically deleted)

9. Your Rights as a Data Subject

You have the following rights regarding your personal data:

9.1 Right to Information (Art. 15 GDPR)

You have the right to obtain information about the data we hold about you.

9.2 Right to Rectification (Art. 16 GDPR)

You can request the correction of inaccurate data.

9.3 Right to Erasure (Art. 17 GDPR)

You can request the deletion of your data. You can do this directly in the app's settings or by requesting it via email.

9.4 Right to Restriction of Processing (Art. 18 GDPR)

You can request the restriction of the processing of your data.

9.5 Right to Data Portability (Art. 20 GDPR)

You have the right to receive your data in a structured, commonly used, and machine-readable format.

9.6 Right to Object (Art. 21 GDPR)

You can object to the processing of your data for reasons arising from your particular situation.

9.7 Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority:

10. Account Deletion

You can delete your account yourself at any time in the settings. Upon deletion, all your data is irrevocably deleted:

• Account information (username, password)
• All training data and exercises
• All cookies and session tokens
• All preferences and settings

Alternatively, you can request deletion by email to ok90@gp-server.com.

11. No Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. Training recommendations are based exclusively on the training data you have entered and serve only as guidance.

12. Transfers to Third Countries

Your data is not transferred to third countries outside the EU/EEA. All data is stored exclusively on servers within the European Union.

13. Changes to This Privacy Policy

We reserve the right to amend this privacy policy in order to adapt it to changes in the law or changes to our services. The new privacy policy will then apply to renewed visits.

14. Contact for Privacy Questions

If you have any questions about data protection or wish to exercise your rights, you can contact us at any time:

← Back to the app