Privacy & cookies

Who is responsible?

Trainalitix is a hobby project, not a registered company. Fabiano Verhagen and Laurens Willems jointly decide why and how personal data are used for this service and are the joint controllers.

Both are contact persons for privacy questions and requests via info@trainalitix.com. You may address either of them. Using this shared contact point does not limit your rights against either controller.

Account, profile and contact details

We process your username, email address, first and last name, password hash, account status and role to create, secure and manage your account. This is necessary to perform our agreement with you (Article 6(1)(b) GDPR). Required registration fields must be completed to create an account. We do not store your readable password.

You may add a profile photo, biography, date of birth and gender, and create friend connections. These optional details support the profile features you request. Usernames can appear in friend search and friend requests. Do not enter medical details in your biography or other public text.

When you email us, we use your address and message to answer you. Service support is based on performing the agreement; other enquiries and defending specific claims are based on our legitimate interest in answering correspondence and protecting our rights. You can object to processing based on legitimate interests.

Fitness and health information — your choice

Workout dates, exercises, repetitions, weights, distances, notes, schedules, protein entries, height and body weight can reveal information about your health. We store and analyse these entries only after you explicitly opt in through Privacy & consent. Our basis is consent under Article 6(1)(a) and explicit consent under Article 9(2)(a) GDPR.

We use the information to show your training history, progress, personal records, BMI and training/recovery estimates. These are fitness estimates, not medical diagnoses. We do not make automated decisions that have legal or similarly significant effects on you. We do not use your fitness information for advertising.

Consent is separate from the terms and cookie choice. You can keep your basic account and contact us without giving it. Without consent the fitness features are unavailable. You can withdraw through the same settings page; this stops those features and deletes your fitness data from the active database. Withdrawal does not affect the lawfulness of processing before withdrawal.

Visibility and sharing

Your profile is private when you first enable fitness processing. In account settings you can choose private, accepted friends, or public (including visitors without accounts), and select which categories to show. Enabling a category explicitly shares it with the selected audience. Body information may include height, weight and BMI. You can change visibility at any time. Accepting a friend request alone does not make a private profile public.

A workout share link lets someone who has the link import your schedule while the link is valid (24 hours). Share it only with intended recipients. Copies other people already saved or imported cannot be recalled by changing your settings or deleting the original.

Hosting and recipients

The website and database are hosted by Ferox Hosting in the Netherlands. Hosting support and the project operators may access data where necessary to operate, secure or support the service. Emails are processed by the email services involved in delivering your message.

We do not sell personal data, load advertising trackers, or send newsletters. We may disclose data if a valid legal obligation requires this, or where necessary and lawful to handle a specific legal claim. We do not rely on using the website as consent for international transfers. If a new provider or transfer outside the EEA is introduced, we will explain the recipient, purpose and applicable transfer safeguards before the new processing starts.

How long data are kept

Account information is kept while your account is used, until you request erasure or the account is closed, except for information necessary for a specific legal obligation or claim. Fitness data are kept while you use the fitness features with consent, until you delete them or withdraw. Existing fitness data awaiting a renewed consent choice are hidden from the fitness features and profiles.

We record the terms version, age confirmation, exact fitness-consent notice, decision and timestamp to demonstrate your choices. These records are restricted to account administration and compliance; they are not used for marketing. We keep this evidence while your account exists and afterwards only where necessary for a specific legal obligation or claim. Support correspondence is kept for up to 12 months after the request is resolved, unless a related dispute requires longer retention.

Our retention policy limits ordinary hosting access/error logs to 30 days and recovery backups to 90 days. Logs may contain IP addresses, request URLs and browser information and are used for troubleshooting and security, based on our legitimate interest in keeping the service secure. Relevant incident records may be retained longer while a specific security incident or claim is being investigated.

An active-database deletion does not instantly remove a historical backup. Deleted information may remain in restricted backups until rotation, for at most 90 days. It must not be reused for ordinary operation; erasures must be reapplied before restoring a backup into service. Contact info@trainalitix.com about erasure or these periods.

Cookies and local storage

We use a necessary login session and local browser storage. There are no advertising or analytics trackers. Your browser sends necessary technical request information, such as an IP address, to our host to load the service.

Optional preference storage starts only after your choice. Selecting “Necessary only” leaves the site usable; theme changes apply to the current page. Open cookie settings to change or withdraw your preference choice. Withdrawing removes the stored optional preferences. Expired local-storage values are cleared when the site next runs; you can also clear site data in your browser. Previously placed third-party advertising cookies may need to be cleared through your browser.

The Android app uses local storage for its login token; tokens expire after seven days of inactivity. Its local app settings are separate from the website cookie choice.

Your rights and requests

You can request access, correction, erasure, restriction of processing, and, where applicable, a machine-readable copy of the data you supplied. You can object to processing based on legitimate interests and withdraw consent at any time.

Email info@trainalitix.com. We may ask for proportionate information to verify that the request concerns your account. We respond without undue delay and within one calendar month. If a lawful extension is needed for a complex request, we explain it within that first month. Requests are normally free.

You may complain to the Autoriteit Persoonsgegevens or your local supervisory authority. You do not need to contact us first.

Age and security

Trainalitix is for people aged 16 or older. Registration asks you to confirm this. Do not create an account if you are younger. If you believe an under-16 user has registered, tell us so we can investigate and take appropriate action.

Passwords are hashed, access to personal features requires authentication, and profile visibility and fitness consent are checked on the server. No service can guarantee absolute security. Contact us if you suspect unauthorised access.

Changes to this statement

We will explain material changes through the service or by email before new processing starts where required. New purposes requiring consent need a new active choice; continued use does not count as consent. You can print or save this page for your records.