Privacy Policy

1. Information We Collect

When you register an account, we collect the following personal data:

• Email address
• First name
• Last name
• Avatar
• Password (stored securely as a hash)

For authentication we also use an HTTP-only cookie containing an encoded JWT refresh token.

While you are signed in, a copy of your basic profile (email, first name, last name, avatar, role) is held in your browser’s localStorage so the app can display it without re-fetching it on every page load. It is cleared when you sign out. See our Cookie Policy for the technical detail.

To prevent recent workout edits being lost during a refresh, an unsaved workout draft may be held temporarily in per-tab sessionStorage. It is scoped to your account, contains no authentication token, and is removed after the server confirms the save, when the tab session ends, or after seven days at the latest.

2. How We Use Your Data

We use your data for:

• Authentication and maintaining your secure session
• Providing personalized services within the application
• Operating, securing, and improving the site (see Section 4)

3. Legal Basis for Processing

• Performance of a contract (Art. 6(1)(b) GDPR) – account creation, authentication, and providing the service you signed up for.
• Legitimate interests (Art. 6(1)(f) GDPR) – aggregated, cookieless analytics and error monitoring used to keep the site working and improve it. You have the right to object to processing based on legitimate interests (see Section 6).

4. Third-Party Processors

We do not sell or share your personal data with third parties for marketing. We do rely on the following processors to operate the service:

• Vercel Inc. – hosting and content delivery for the website and API. Vercel also provides:
  • Vercel Web Analytics – cookieless, aggregate visitor statistics (page views, referrer, country, device type, daily-rotated visitor hash). It does not identify individual visitors and does not use cookies or browser storage.
  • Vercel Speed Insights – anonymous Core Web Vitals performance metrics. Also cookieless.
• Sentry (Functional Software, Inc., EU region) – application error and exception monitoring. When something fails, technical context (error message, stack trace, route, browser/OS, anonymized IP) is sent to Sentry so we can fix the bug. Data is stored in the EU region. No cookies or browser storage are set on your device.
• Google (Google Ireland Ltd.) – only if you choose “Sign in with Google”. Google handles that authentication step and shares your basic profile (email, name, avatar) with us. If you never use Google sign-in, no data is shared with Google.
• Resend (Resend, Inc.) – transactional email delivery (account verification, password reset).
• ImageKit – image storage and delivery (e.g. your avatar).

Each processor acts on our instructions under a data-processing agreement. Some providers (Vercel, Sentry, Resend, ImageKit) are US-based companies; where personal data is transferred outside the EU/EEA, the transfer is covered by the European Commission’s Standard Contractual Clauses.

5. Data Storage, Security, and Retention

Account data is stored in our database hosted in the European Union. Passwords are stored only as a hash.

We keep your account data for as long as your account is active. If you request deletion (see Section 6), your personal data is removed from our systems within 1 week. Error reports in Sentry and aggregate analytics are retained according to those providers’ standard retention periods and do not identify you personally.

6. Your Rights Under GDPR

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data (you can update your password and avatar from your account settings)
• Request deletion of your account and personal data
• Request portability of your data
• Object to processing based on legitimate interests (e.g. analytics, error monitoring)
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email us at contact@dofitness.com.

7. Cookies and Browser Storage

We use only strictly-necessary cookies and browser storage. We do not use tracking, advertising, or profiling cookies. See our Cookie Policy for the full list.