Privacy Policy

1. Data controller

The data controller is Alexandr Rešetňak, a private individual based in the Czech Republic (the “controller”, “we”). Contact e-mail: mail@resetnak.cz. The service is provided free of charge as a personal project.

2. What data we process and why

We only process data you provide by using the service:

• Account data — name, e-mail address, password (stored exclusively as a secure hash), an optional profile photo, timezone, preferred language, app preferences (units, rest timer, theme), and the platform you created the account on (web or iOS). Legal basis: performance of a contract (Art. 6(1)(b) GDPR) — the account cannot exist without it.
• Training data — workouts, exercises, sets, stretching sessions, and notes you log in the app. Legal basis: performance of a contract.
• Aggregate statistics — from account data and training data we compute, in our own database, aggregate numbers only, such as how many new accounts saved a first workout in a given week or how many people trained in at least two different weeks. This tells us whether the service actually helps people. The results contain no names, e-mail addresses or record content, are shared with no one, and are never used for profiling or decisions about individuals. Body data and Apple Health data are not included. Legal basis: legitimate interest in evaluating and improving the service (Art. 6(1)(f) GDPR); you can object to this processing.
• Body data — body measurements, weight, progress photos, and the discomfort score (0–10) on stretching sessions, if you choose to record them. This is health-related data (a special category under Art. 9 GDPR); we process it solely on the basis of your explicit consent, which you give by voluntarily entering it. You can withdraw consent at any time by deleting the records or your account.
• Apple Health data — your daily step count and body weight records, if you enable reading from Apple Health or start the import yourself. This is health data (a special category under Art. 9 GDPR); section 3b covers the detail and the legal basis.
• Google or Apple sign-in data — if you use one of these options, the provider shares your name, e-mail (for Apple, possibly a private relay address), and a technical identifier with us. Legal basis: performance of a contract.
• Feedback — a message you choose to send through "Help shape Maintenea" (its type and text) and, unless you switch it off in the form, the app version, operating system version and device family (iPhone/iPad). The form shows everything it will send before you send it. The message is e-mailed to the service administrators so they can respond. No training or body data is attached. We keep it in our database for as long as the account exists, and it is part of the data export; the copy delivered by email stays in the administrators' mailbox until they delete it, and we delete it there too on request. Legal basis: legitimate interest in improving the service and answering your requests (Art. 6(1)(f) GDPR).
• Technical data — IP address and basic browser information in server logs, kept short-term for security and diagnostics. Legal basis: legitimate interest in operating the service securely (Art. 6(1)(f) GDPR).

3. What we do not do with your data

• We do not sell or rent your data to third parties.
• We show no ads and do not use your data for ad targeting.
• We use no tracking or analytics tools without your consent (the aggregate numbers in section 2 are computed by us from our own database, with no third-party tool). Both the optional product analytics (section 3a) and Google Analytics 4 web analytics (section 3c) run solely with your consent and are off by default.
• We perform no automated decision-making or profiling within the meaning of Art. 22 GDPR.

3a. Optional product analytics (opt-in)

To understand which parts of the service help people stick with training, we may record a small set of pre-defined product events (e.g. “first workout completed”). This analytics is off by default and only activates with your explicit consent in account settings (and, on the web, additionally with your consent in the cookie bar). Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by switching the toggle off.

For each event we store only: an event name from a fixed list, the platform (web/iOS), the app version, an optional context tag from a fixed list (such as the screen you send feedback from or the app you import from), an optional experiment identifier, and a timestamp. We store no IP address, no workout content, no body data, and no free-form metadata. Events are kept for at most 90 days and then deleted automatically; they are deleted immediately with your account. This data stays on our own infrastructure — it is never shared with external processors.

3b. Apple Health (iOS app)

Writing to Apple Health. If you grant permission, the iOS app writes completed workouts (activity type and duration) to Apple Health on your device. This happens on your device only and sends us nothing.

Reading from Apple Health. The app can read two kinds of data from Apple Health, and in both cases it sends them to our servers and stores them with your account: your daily step count and your body weight records. Reading steps is off by default and starts when you connect the app to Apple Health: in the first-run intro, on the dashboard Steps card, or with the “Sync steps” toggle in the app settings. Weight is read only when you start the import yourself; imported records are stored among your body data. We read nothing else from Apple Health.

Legal basis and handling. This is health data (a special category under Art. 9 GDPR) and we process it solely on the basis of your explicit consent, which you give by enabling the step sync or by starting the weight import. We keep it for as long as your account exists and it is deleted together with the account; it is also included in your data export. You can withdraw consent by turning the toggle off, by deleting the records, or by revoking the permission in iOS Settings (Privacy & Security → Health). We use Apple Health data only to show you your own training and body history. We never sell it, and we never use it for advertising, marketing, product analytics (section 3a), data mining or profiling. We do not disclose it to any third party; it is stored only in our database at the hosting provider named in section 4, which processes it solely on our instructions.

3c. Google Analytics 4 web analytics (opt-in)

If you consent to analytics cookies in the cookie bar, we use Google Analytics 4, provided by Google Ireland Ltd., to measure visits and app usage on the web (pages viewed, approximate city-level location, device and browser type). Without consent the measurement script does not load at all. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the “Cookie settings” link in the footer; withdrawal takes effect immediately and deletes the Google Analytics cookies from your browser.

Google may transfer the data to the USA; the transfer is covered by the adequacy decision for the EU–U.S. Data Privacy Framework or, where applicable, by Standard Contractual Clauses under Art. 46 GDPR. The cookies Google Analytics sets are listed in the Cookie Policy.

3d. Transactional emails

We send messages to your email address that the account needs to work — above all the password reset code. These are not a newsletter and cannot be unsubscribed from, because without them you cannot get back into your account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Sending is carried out for us by our processor Sendinblue SAS (trading as Brevo), which processes your email address, your name and the content of the message for that purpose. The provider records technical delivery and open data for the messages sent; we have anonymisation enabled, so that data is not tied to an individual recipient or their IP address.

3e. iOS app launch email

If you enter your email address on the homepage to hear when the iOS app is out, we store that address, the language of the page you sent it from, whether and when you confirmed it, and hashes of two random links (to confirm and to unsubscribe), never the links themselves. Nothing else: no name, no IP address and no link to an account. Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by clicking the confirmation link.

We write to a confirmed address once, when the app is on the App Store, and delete the address right after that email is sent. The confirmation link is valid for 7 days; if you do not use it, we delete the unconfirmed address once it has expired, at the latest when the launch email goes out. You can leave the list at any time with the unsubscribe link in the confirmation email, which deletes the address immediately. The emails are sent by the processor named in section 3d.

3f. Sharing routines, reports and blocks

You can share a routine with a link that works for 7 days and that you can cancel at any time. After signing in, the recipient sees its name, type, notes and exercise names, including your custom exercises. Weights, your name and your email are not shared. Before a link is created we automatically check the name, notes and custom exercise names against a list of objectionable words.

A recipient can report a shared routine and block the author of the link. With a report we store the reason, an optional message, the reporting account and a copy of the reported content so an administrator can review it. We act on reports within 24 hours: we can cancel the link and disable an account that breaks the terms. Resolved reports are deleted after 12 months, and immediately when the reporter or the author deletes their account. Only you can see your blocks; you can remove a block in the app settings, and blocks are deleted with your account. Legal basis: our legitimate interest in running the service safely (Art. 6(1)(f) GDPR).

4. Processors and recipients

We use a limited set of processors who handle data only on our instructions:

• A server infrastructure provider in the European Union — application and database hosting.
• Cloudinary Ltd. — storage of progress photos and profile photos. Transfers outside the EU are covered by Standard Contractual Clauses under Art. 46 GDPR.
• Sendinblue SAS (trading as Brevo), 17 rue Salneuve, 75017 Paris, France — sending transactional emails (section 3d), the iOS app launch email (section 3e) and forwarding feedback to the service administrators (section 2). The company is established in the European Union.
• Cloudflare, Inc., 101 Townsend Street, San Francisco, USA — routing inbound mail sent to our support address. Transfers outside the EU are covered by Standard Contractual Clauses under Art. 46 GDPR.
• Google Ireland Ltd. — if you sign in with Google (the provider shares basic account data with us), and as the operator of Google Analytics 4 web analytics, only if you have consented to it (section 3c).
• Apple Distribution International Ltd. — only if you sign in with Apple; this provider shares basic account data with us.
• Functional Software, Inc. (Sentry), San Francisco, USA — application error reporting. A report contains a technical description of the error, the page address, browser and device; we send no IP address, workout content or body data. Transfers outside the EU are covered by Standard Contractual Clauses under Art. 46 GDPR.

5. Retention

We keep your data for as long as your account exists. After account deletion, all personal data including photos is removed without undue delay. Login (refresh) tokens expire after at most 30 days. Server logs are kept short-term and rotated continuously. Addresses for the iOS app launch email are kept only until that email is sent or until you unsubscribe (section 3e). Resolved reports of shared routines are kept for 12 months (section 3f).

6. Security

All communication with the service is encrypted (HTTPS). Passwords are stored only as secure hashes using a modern algorithm. Data access is protected by short-lived access tokens and rotated refresh tokens. Where the refresh token is kept depends on the client: on the web it is an httpOnly cookie the browser never hands to JavaScript; in the iOS app it is the device Keychain (readable only after the first unlock, and never copied to another device). The access token is held in memory in both cases and is gone when you sign out.

7. Your rights

Under the GDPR you have the right to:

• access your personal data and information about its processing,
• have inaccurate data corrected,
• erasure (“right to be forgotten”) — you can delete your account directly in the app settings, or we will delete it on request sent from the registered e-mail address,
• restriction of processing and data portability (in the app settings, under Your data, you can download all your data as a JSON file at any time),
• object to processing based on legitimate interest,
• withdraw your consent to the processing of body data at any time (withdrawal does not affect the lawfulness of prior processing),
• lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.

8. How to exercise your rights

Write to mail@resetnak.cz from the e-mail address your account is registered to. We will respond without undue delay, at the latest within one month.

9. Children

The service is not intended for anyone under 16, and we do not knowingly process their data. If we learn that an account belongs to someone under 16, we delete it. A parent or guardian can ask us to do so at mail@resetnak.cz.

10. Changes to this policy

We may update this policy, for example when the service changes. We will inform you about material changes in the app. The current version is always available on this page.