This privacy policy explains what personal data this website processes and why.
Controller
The person responsible for data processing on this website is named in the imprint.
Overview
This website does not require registration, does not use any analytics or advertising services, and does not share data with third parties. The sections below describe the only data processing that happens.
Cookies and storage on your device
When you create your first workout or save a preference, this website sets one cookie named "user_token": a randomly generated, anonymous identifier (no name, email, or other personal detail), stored for up to 2 years. It is used solely to recognize your device so that your workouts, exercises and history are shown to you. There is no account, login, or cross-site tracking. While a workout runs, each result is first stored in your browser's local storage and stays there until the server has confirmed it, so no result is lost without reception; the start of the running break stays there too and is never sent. The app also keeps a copy of the pages you open (such as your workouts, your history and the running workout) and of its files on your device (a service worker cache), so they open again without reception. The copy is deleted when you delete your data or your account, or when another profile is used on this device. Neither is sent anywhere else. If you create a restore link on the profile page, the server stores only a one-way hash of its one-time code, and only until the link is used or replaced; the code itself is never part of a web address sent to the server, so it does not appear in server logs. While you create or open such a link, a second cookie named "restore_code" keeps the code on your device for up to one hour so the page can show or use it; it is deleted once the link is used. Using the link moves your profile to the new device, and the device the link came from is logged out. After you close the app's welcome screen, a cookie named "onboarding_seen" remembers this for up to 2 years, so the screen does not show again. It holds only the value "1", is sent only to this app and contains no identifier. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing a working website) and, where applicable, Art. 6(1)(b) GDPR (performing the feature you requested).
Workouts, results and your optional username
The names of your workouts and exercises, your goals, breaks, results, the extra values of a set (such as a weight) and your units are stored on the server together with your anonymous identifier. Only you see them; they are never shown to other users and never sent to any third-party service. On the profile page you can also choose a username. It is optional, currently not shown to other users, and can be changed at any time. Before anyone else sees it, it is checked for offensive content: automatically by a program on the operator's own computer (no third-party service), and by hand if the result is unclear; until approved it appears as "Unverified User". On the profile page, "Delete Gain Streak's data" and "Delete all my data" permanently delete your workouts, exercises, history and units (the latter in all apps on this site) and keep your username; "Delete my account" deletes everything, including your username. Legal basis: Art. 6(1)(b) GDPR (performing the feature you requested).
Server logs
Like virtually all web servers, our hosting provider's web server automatically records technical access data (such as IP address, date and time, and the requested page) for a limited time to keep the site secure and operating correctly. This website's own application additionally logs technical error messages (never names, results or page content) to a server log file that only the site operator can access. To protect the site against overload and abuse, the application counts how many requests arrive from each network address (for IPv6, its first half) per minute, and how many new anonymous play ids are created per hour; too many requests are briefly refused. The address itself is not stored: the counters are named by a keyed one-way hash whose random key is replaced daily and then deleted, so past counters can no longer be linked to an address. Counters are deleted after at most about one hour. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security, protection against overload, and troubleshooting).
Hosting
This website is hosted by IONOS SE, a hosting provider based in Germany. Your request necessarily passes through IONOS's infrastructure to deliver this website to you.
No analytics, no advertising
This website does not use Google Analytics or any other analytics, tracking, or advertising service, and does not embed third-party content that could track you.
Your rights
Under the GDPR, you have the right to:
- access the personal data we hold about you (Art. 15 GDPR)
- have inaccurate data corrected (Art. 16 GDPR)
- have your data deleted (Art. 17 GDPR); you can also do this yourself at any time on the profile page
- have processing of your data restricted (Art. 18 GDPR)
- receive your data in a portable format (Art. 20 GDPR)
- object to processing based on legitimate interest (Art. 21 GDPR)
- lodge a complaint with a data protection supervisory authority
Contact
For any privacy question or to exercise these rights, contact the person named in the imprint.
