Privacy policy

1. Who controls your data

The controller is Mateusz Ołtarzewski, a natural person without a registered business, operating under the name MO - MAKSIMUM ODPOWIEDZIALNOŚCI (e-mail: [email protected]). I am the trainer and the owner of the app, so I decide on the purposes and means of processing your data and I am solely responsible for it. This applies both to people who train with me and to people who use the app for their own workouts, without a trainer.

For any data matters, write to [email protected]. I have not appointed a data protection officer, so you deal with all matters directly with me.

2. What data I collect

I divide data into two groups. Health data is a special category of data (Art. 9 GDPR) and I protect it more strictly.

Ordinary data:

• Account and profile: first name, last name, e-mail, year of birth, optionally full date of birth (only for the birthday badge), sex, optionally body type (only to describe the profile), height, goal, level, equipment, training days.
• Training: plans, completed sets, weights, repetitions, exercise notes, fitness test results, training priorities, daily step count (if you enter it).
• Body and progress: body weight, circumferences and measurements, a photo of a body composition scale printout or screen (if you add one).
• Contact and appointments: messages to the trainer, appointment requests, availability, training package counter and e-mails sent to the contact address.
• Technical data: login e-mail address, account ID, display settings saved in browser storage, the IP address visible to providers when connecting to the app and when downloading exercise materials.

Health data (Art. 9 GDPR):

• Health status affecting training: injuries, traumas, pain, past procedures and illnesses, health notes.
• Data from training and surveys: reported pain, well-being, fatigue, stress, set difficulty ratings, readiness surveys (e.g. sleep, resting heart rate).

Body measurements (weight, circumferences, body composition) may indirectly indicate health, so I treat them with care and cover them with the same consent as health data.

3. Why and on what legal basis I process data

• Creating an account, contact, running training sessions (including your own, without a trainer) and scheduling appointments: Art. 6(1)(b) GDPR (performance of a contract).
• Adapting training to your health and exercise safety: Art. 9(2)(a) GDPR (your explicit consent).
• Monitoring progress: weight, circumferences, photos: Art. 6(1)(b) GDPR; where the data indicates health status, additionally Art. 9(2)(a) GDPR.
• Replying to messages sent to the contact address: Art. 6(1)(b) GDPR where they concern a contract or entering into one, otherwise Art. 6(1)(f) GDPR (my legitimate interest).
• App security, detecting abuse, defence against claims: Art. 6(1)(f) GDPR (my legitimate interest).
• Daily backup of app data, so I can restore it after a failure or error and keep the service running: Art. 6(1)(f) GDPR (my legitimate interest). The backup covers the same data the app processes.
• Documenting that you accepted the terms and gave consent: Art. 6(1)(f) GDPR in connection with Art. 7(1) GDPR.

Consent to health data is separate from accepting the terms. You can withdraw it at any time, which does not affect the lawfulness of processing before withdrawal. After you withdraw consent, I stop processing health data, delete the information about injuries and complaints you entered, and suspend the account (section 7). I may keep data needed to defend against claims only to the extent necessary (Art. 9(2)(f) GDPR).

4. Who I share data with

Your data is seen by you and me. I do not sell it and do not share it with advertisers. I use providers that process data only on my instructions (entrustment under Art. 28 GDPR):

• Google (Firebase Authentication and Cloud Firestore): login, the app database and sending messages from the app, e.g. for password changes.
• Netlify: hosting the app files and technical handling of connections (e.g. IP address).
• Cloudflare: delivering exercise materials (e.g. IP address when they are downloaded), domain handling, forwarding messages sent to the contact address to my mailbox, and storing backups in a private file store.
• GitHub (owned by Microsoft): running an automated tool that creates a backup once a day. Data passes through it only while the task runs, and the repository with the tool contains only code, no user data.

I have a data processing agreement (Art. 28 GDPR) with each provider, on the provider's standard terms. Providers may process data outside the European Economic Area. In that case they do so on the basis of the mechanisms in Chapter V GDPR, e.g. standard contractual clauses approved by the European Commission. I may also disclose data to authorities when the law requires it.

5. How I protect data

• Encrypted connection. The app works over HTTPS, so data travelling between your phone and the server is encrypted.
• Database encryption. Data in the database is encrypted at rest by the infrastructure provider.
• Access control. Database rules ensure that you see only your own data and only the trainer has access to clients' data. There is no public access to the database.
• Login. Your account is protected by e-mail and password. Do not share your password with anyone.
• Minimisation. I collect only the data needed to run your training. Health information is voluntary.
• Administrative access. Only I have access to the database console and to the app in the trainer role.
• Backups. Once a day a copy of the app data is created and saved in a private store with no public access. Downloading a backup requires logging in to the trainer account.
• Breaches. If a personal data breach occurs, I will report it to the President of the Personal Data Protection Office (UODO) within 72 hours, and if it poses a high risk to you, I will inform you without undue delay (Art. 33 and 34 GDPR).

6. How long I keep data

• Account, profile, training and body data: until the account is deleted, or up to 12 months after the end of cooperation or use of the app if you have not deleted the account earlier.
• E-mails sent to the contact address: for as long as needed to handle the matter, and if they concern claims, until the claims become time-barred.
• Health data: until consent is withdrawn or the account is deleted.
• Evidence of consents and acceptance of the terms, data needed to defend against claims: until claims become time-barred (as a rule up to 6 years, counted to the end of the calendar year).
• Backups: I keep the last 7 daily backups; older ones are deleted automatically. After you delete your account, your data may therefore remain in backups for at most 7 more days.
• Technical data and logs: I do not keep my own logs. Infrastructure providers keep technical connection logs for the period set out in their terms.

After the period ends, I delete the data or permanently anonymise it.

7. Your rights and how to exercise them

You have the right to: access your data, rectify it, erase it (the “right to be forgotten”), restrict processing, data portability, object to processing based on my legitimate interest, and withdraw consent at any time. You can also lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

• See and download your data: Account, the data section, “Download my data” button. You will receive a file with your data.
• Correct data: change it in your profile in the app or write to the trainer.
• Delete data and the account: Account, the data section, the account deletion option. You can also request it by e-mail.
• Withdraw consent to health data: Account, the data section, “Withdraw consent to health data” button. The account will be suspended and you will see a screen where you can give consent again or delete the account. You can also write to the address in section 1. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Restrict processing or object: send an e-mail describing the matter to the address in section 1.
• Lodge a complaint: with the President of UODO, regardless of whether you write to me first.

I will reply within one month of receiving your request (Art. 12(3) GDPR). Before acting I may ask you to confirm your identity. Deleting the account is irreversible, and data I am legally required to keep will be deleted once the obligation ends (section 6).

8. Do you have to provide data

Providing account and profile data is voluntary but needed to run your training. Without it I cannot provide the service. Consent to processing health data is required to create a profile and use the app. I require it because health information is necessary for me to choose and run your training safely. If you do not give it, I will not create a profile for you in the app. You enter specific information about injuries, pain or illnesses voluntarily and only to the extent you want to share, but the less you provide, the less I can tailor the training and the less safe it may be.

• The app is intended for people aged 16 and over. I do not knowingly process data of younger people; if I learn of it, I will delete the account and data.

9. No automated decisions

I do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). The app includes a workout generator that works according to predefined rules. It creates a workout suggestion, not a decision about you. Workouts prepared by the trainer are checked by me; a workout generated automatically is not reviewed by me and you use it at your own responsibility. I do not carry out profiling for advertising purposes.

10. Local storage and keeping you signed in

The app does not use advertising or analytics cookies and does not track you across websites. It stores in your browser only what is needed for it to work, using technologies called local storage and similar:

• Keeping you signed in: the login provider's session data, so you do not have to enter your password every time.
• Display settings: light or dark theme, gym mode, vibrations.
• Working offline: a draft copy of the workout and pending saves that are sent when the connection returns, as well as exercise videos you save to the device with “Save offline” or watch in the app.
• Convenience: hidden reminders and recently used settings.

These entries are necessary for the app to work the way you use it, so they do not require separate consent (Art. 399 of the Polish Electronic Communications Law). You can delete them at any time in your browser settings or by signing out and clearing site data. After deletion, login and settings return to defaults. If I add analytics or advertising tools in the future, I will ask for your consent before enabling them. The app currently works as a web app (PWA). If it is also released on the App Store and Google Play, I will update this policy before that version is released.

11. Changes to this policy

If I change the policy, the new version will appear in the app with its effective date. I will inform you about significant changes in the app. This version is effective from 8 October 2026.

12. Contact

For data matters and the rights in section 7, write to: [email protected] (controller: Mateusz Ołtarzewski, MO - MAKSIMUM ODPOWIEDZIALNOŚCI).