Privacy notice
Last changed 2026-10-13. Draft, to be reviewed before launch.
Who
useful.fitness is run by Jan Vesely (the controller under the GDPR). Questions and requests: the contact form.
What is stored, and why
- Your account: first name, an optional last name, email address, a hash of your password (never the password itself), and, if you turn on two-factor, its secret (encrypted). Needed to log you in.
- Invites: who invited whom, the notes you add to your invites, and the address an invite was emailed to. Needed to keep the app invite-only.
- Your training: the workouts, drafts and places you save, the sessions you record (step by step), and your evaluations and comments. This is what the app is for.
- Security: your logged-in devices (the browser's description and when they were used), a log of account events (logins, changes, invites), and the web server's access logs with IP addresses. Needed to keep accounts safe.
- Contact messages: what you send through the contact form (your message, and a name and email address if you give them), to answer you.
- Anonymous timings: how long sets take, without any link to you, to improve everyone's time estimates.
The legal basis is the agreement to provide the app you asked for (GDPR art. 6(1)(b)), and for the security records the legitimate interest in keeping accounts safe (art. 6(1)(f)). Nothing is sold, shared for marketing or used for ads.
Where
On a server of STRATO AG in Germany (EU). Emails (login links, invites, password resets) are sent through Scaleway in France (EU). Backups are encrypted on the server before they leave it, and kept on the operator's computer and in pCloud storage (pCloud AG, Switzerland); neither can read them. Each of these providers has a data processing agreement.
How long
As long as your account exists. When you delete it (Account page → Delete my account), your data is deleted at once; it disappears from the backups within 30 days. Access logs are deleted after 14 days, contact messages 12 months after they're answered. The account log keeps only "user N deleted", without your name.
Cookies and storage
One cookie, to keep you logged in; it's strictly necessary, so no consent is asked. The app also keeps your settings and an offline copy of your data on your device (browser storage). No analytics, no ads, no trackers, nothing loaded from other sites.
Your rights
You can see and download everything stored about you (Account page → Download my data), correct it (your name and password on the Account page; your email address through the contact form), delete it (Delete my account), and object to its use. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Health
The app keeps a training log, not medical records. Please don't write about injuries or health in comments.