Privacy Policy

Who is responsible

The controller under the GDPR is Jakub Szwajka, a sole proprietor operating as Jakub Szwajka JDG.

Use this email address for privacy, legal and support questions.

What Trainer handles, and why

Your account

Clerk runs sign-in. It holds your email address, name, account and sessions, and sends sign-in and verification emails. If you choose Google sign-in, Google supplies your account profile to Clerk, including your email address, name and profile image. Trainer keeps your Clerk account id to link your athlete record to you. Legal basis: a contract with you, to give you the app, Article 6(1)(b) GDPR.

Your training record

Trainer stores this data in Postgres:

• Your athlete id, Clerk account id, timezone, preferred metric or imperial units, and creation and update times.
• Each session log's id, athlete id, start instant, minutes, timezone, training date, optional title and note, effort from 0 to 10 or not rated, effort scale and time recorded, source, and creation and update times.
• Each activity block's id, session log id, position, activity kind, optional minutes, effort, effort scale and note.

The current web quick log records activities, minutes and effort. The API also supports titles and notes. Legal basis: the same contract. Do not put medical diagnoses or other sensitive health information in notes. Trainer is a training record, not a medical service.

Technical requests

Clerk, our hosting provider and Cloudflare may handle IP addresses, browser details and request information to deliver and protect the service. Legal basis: our legitimate interest in security and fixing faults, Article 6(1)(f) GDPR.

Backups

A nightly pg_dump copies the database to an S3 storage bucket. Backups hold the data in the database and expire after 14 days. Legal basis: our legitimate interest in not losing your training record, Article 6(1)(f) GDPR.

Trainer takes no payments, shows no ads, and does not sell your data. Clerk uses the cookies needed to keep you signed in. The app does not store session tokens in local storage. Its install-only service worker does not cache your training records. No push notifications are live.

Who else handles your data

• Clerk: sign-in, accounts, sessions and sign-in emails.
• Google: the profile you choose to use for Google sign-in, under Google's own terms and privacy policy.
• Hetzner Online GmbH: the servers we rent and run with Dokploy.
• Cloudflare: DNS and a proxy in front of the site. Every request passes through Cloudflare.
• An S3 storage bucket: the nightly database backups.

We use service providers to process data for the service. Google also acts under its own privacy policy. We may pass data to authorities or advisers when the law requires it or to defend a claim.

Data outside the EEA

These providers may process data outside the European Economic Area. Their notices describe the transfer safeguards:

• Clerk's Data Privacy Framework notice states that it is certified under the EU-U.S. Data Privacy Framework.
• Google's data transfer notice states that Google LLC is certified under the EU-U.S. Data Privacy Framework and describes Standard Contractual Clauses where required.
• Cloudflare's privacy policy states that it relies on the EU-U.S. Data Privacy Framework for EEA transfers to the United States. It uses Standard Contractual Clauses for other EEA transfers and if its certification lapses or becomes invalid.

How long we keep it

Your account and athlete record stay until you ask us to erase them. Session logs and their activity blocks stay until deleted through the API or erased on your request. The web app has no account-erasure button yet. Deleted data can remain in a backup until it expires, at most 14 days.

Your rights

You can ask for access, a copy, correction, erasure, a limit on use, and portability. You can object to uses based on legitimate interest. Email us from the address on your account to request these rights or close your account. We may need to check it is you. We answer within one month, subject to the extensions allowed by law.

Trainer makes no automated decision about you that has a legal or similar effect.

You can complain to the President of the Personal Data Protection Office, UODO, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, uodo.gov.pl, or to the authority in the EU country where you live or work.

Security and changes

The API checks which athlete may access each training record. If a breach puts your rights at risk, we report it to UODO within 72 hours where the law requires, and tell you when the risk is high.

When this policy changes, the effective date above changes too.