Privacy policy

Draft: the app is still in development and this text has not been legally reviewed yet. Version 2026-10-10.2.

Back to the app

What data we keep

  • Email address and nameAccount and signing in. If you sign in with Google, we get them from Google.
  • Password, only as a secure hashSigning in with a password
  • Passkey: public key, name and device typeSigning in without a password. The private key never leaves your device.
  • Google ID and sign-in keys from Google, encryptedOnly if you sign in with Google
  • Workouts, sets, weights, reps and notesThe core function of the app
  • Device name, platform and last activitySyncing and signing out devices
  • Consents with version and timeProving your consent
  • Session data (IP address and user agent)Security

Cookies and storage in your browser

  • Cookies for signing inA session cookie keeps you signed in, and with a passkey a temporary cookie is briefly set. They are needed for the app to work.
  • Storage in your browserWorkouts, routines and settings are also stored locally, so the app works without a connection. Your browser also remembers that you gave consent.
  • No trackingNo advertising or tracking cookies and no analytics about you.

Who else looks along

  • NeonDatabase. In use.
  • HetznerServer of the API. Comes at go-live.
  • VercelHosting of the web app. Comes at go-live.
  • ResendSends our emails. Receives your email address, name and the text of the email. Comes at go-live.
  • GoogleOnly if you choose to sign in with Google. Google sees that you sign in to this app.

Before going live we agree the region and a data processing agreement with these parties.

How long we keep it

  • Account and training dataUntil you delete your account
  • Passkeys and consentsUntil you delete your account, then they go with it
  • SessionsUntil they expire or until you sign out or sign out a device
  • Server logs14 days, without training data
  • BackupsAccording to the policy of the database provider

Your rights

Access and taking your data with you
You can export all your data as JSON in the settings, even after you have withdrawn your consent. The export contains your account, sign-in methods, consents and workouts, without secrets such as your password.
Deletion
Delete your account in the settings. Everything we have of you on the server is then removed.
Withdrawing consent
You can do that in the settings. After that the app cannot continue. Your data stays until you delete your account, and you can give consent again.
Rectification
You can correct your own data yourself.
Complaint
You can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

What we do not do

  • No advertising and no tracking.
  • No selling of your data and no sharing with third parties for their own purposes.
  • Only you see your own data.
  • Your data is kept until you delete it yourself.

Health data

Training data can count as health data. That is why we ask for explicit consent when you create an account, separate from reading this text. We record it with the version of this text and the time. If the text changes, we ask again.

Emails we send

Only emails that belong to your account: a link to confirm your email address and a link to reset your password. Those links are valid for one hour. No newsletters and no advertising.