Privacy policy

1. Who processes your data

Data controller: Xabier Otamendi. Contact: xotamendi@gmail.com.

2. What data we store

• Your email and your password (the password is stored encrypted; nobody can read it).
• Your training data: routines, exercises, sets, reps, weights, times and session dates.
• Your training preferences from the initial questionnaire (goal, level, days per week, time per session and available equipment), so your plan can be rebuilt.
• The date you accepted these terms and the version you accepted.

In the initial questionnaire you can indicate areas you would rather not load (for example, shoulders or knees). That answer is only used at that moment to choose the exercises in your plan and is not stored. We do not ask for other health data, location or payment details in this version of AppGym.

3. What we use it for

Only to provide you with the service: storing your workouts, calculating your progress and showing you your statistics. We do not sell or share your data with third parties, we do not use it for advertising and we do not build commercial profiles.

Legal basis: performance of the contract you accept when you create your account (Art. 6(1)(b) of the General Data Protection Regulation).

4. Who else is involved

To work, AppGym uses providers that process data on our behalf and only following our instructions:

• Supabase: database and account management.
• Vercel: hosting of the web application.
• The email delivery provider, only to confirm your account and reset your password.

Some of these providers may process data outside the European Economic Area. In that case they do so with the safeguards required by the GDPR (the European Commission's standard contractual clauses or the EU-US Data Privacy Framework).

5. How long we keep it

For as long as you have the account. If you delete it, your account and all your workouts are removed immediately. If the provider keeps backups, that data disappears from them when they expire.

6. Your rights

You can access your data, correct it, take it with you (portability), object to its processing or ask for it to be deleted. From the Account section you can download all your data and delete your account yourself at any time. For any other request, write to the contact email in section 1.

If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Cookies

We only use the technical cookies strictly necessary to keep you logged in and to remember your language. We do not use analytics or advertising cookies.

8. Changes

If we change this policy in a significant way, we will let you know in the application before the change takes effect.