Privacy Policy

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you.

Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. Contact details can be found in the imprint of this website.

How do we collect your data?

Your data is collected either by you providing it to us (e.g., when creating your workout plan) or automatically by our IT systems when you visit the website (e.g., IP address).

What do we use your data for?

Your data is used to create personalized workout and nutrition plans using AI technology and to deliver them to you via email.

2. Hosting

Hetzner Online GmbH

We host our website with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

When you visit our website, Hetzner collects various log files including your IP addresses. For details, please refer to Hetzner's privacy policy: https://www.hetzner.com/legal/privacy-policy

The use of Hetzner is based on Art. 6 (1) lit. f GDPR. We have a legitimate interest in ensuring the most reliable presentation of our website possible. For users in the United States, this processing is conducted in accordance with applicable US data protection laws and represents our legitimate business interest.

3. General Information and Mandatory Disclosures

Data Protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

Information About the Responsible Party

The party responsible for data processing on this website is:

Storage Duration

Unless a more specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you submit a legitimate deletion request or revoke consent for data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data. This applies to users in all jurisdictions, including the United States.

Withdrawal of Your Consent to Data Processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of data processing carried out prior to the withdrawal remains unaffected by the withdrawal.

Right to Lodge a Complaint with the Supervisory Authority

In the event of violations of data protection law, the affected party has the right to lodge a complaint with the competent supervisory authority. For users in the European Union and Germany, this right exists regardless of other administrative or judicial remedies. For users in the United States, you may have additional rights under federal and state privacy laws, including the California Consumer Privacy Act (CCPA) and similar state laws.

Right to Data Portability

You have the right to have data that we process automatically based on your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. This right applies to users worldwide, including those in the United States.

Information, Deletion, and Correction

Within the scope of applicable legal provisions, you have the right to free information about your stored personal data, its origin and recipients, and the purpose of data processing at any time, as well as a right to correction or deletion of this data. Users in California and other US states may have additional rights under applicable state privacy laws.

4. Data Collection on This Website

Server Log Files

The website provider automatically collects and stores information in server log files:

• Browser type and browser version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources. Data collection is based on Art. 6 (1) lit. f GDPR. For US users, this represents our legitimate business interest in maintaining website security and functionality.

Inquiry by Email

If you contact us by email, your inquiry including all resulting personal data (name, inquiry) will be stored and processed by us for the purpose of handling your request. We do not share this data without your consent.

Registration and Use of the Service

When using our service to create workout and nutrition plans, we collect the following data:

• Email address (for delivering the plans)
• Body data (weight, height, age, gender)
• Fitness goals and preferences
• Health information (as provided by you)

This data is used exclusively to create your personalized plans and is processed based on your consent (Art. 6 (1) lit. a GDPR) and for contract performance (Art. 6 (1) lit. b GDPR). For US users, this processing is also in accordance with applicable federal and state privacy laws.

5. External Services

AI Services

To create personalized training and nutrition plans and to power the coaching feature in the app, we use AI services provided by OpenAI (Ireland/USA) and Mistral AI (France). We transmit the details from your profile: your training goal and target weight, age, height, weight, dietary preferences, allergies and dislikes, as well as your training level and available equipment. We do not transmit your name, email address, or account data. The results are matched to your profile exclusively on our servers.

The legal basis is your consent (Art. 6(1)(a) GDPR), which we obtain in the app before the first processing. You can withdraw it at any time in the app settings under "AI & Data"; after withdrawal, we no longer create new plans, while existing plans and your tracking data remain available.

We have concluded data processing agreements pursuant to Art. 28 GDPR with both providers. The providers do not use the transmitted data to train their AI models. Transfers to the USA are safeguarded under the EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses.

Apple Health (App)

With your permission, the fytrr app reads activity data from Apple Health to account for burned calories in your daily budget. If you choose, the app also saves completed workouts to Apple Health.

Activity data is processed exclusively on our servers to calculate your calorie budget. It is not shared with third parties, in particular not with the AI services listed above, and is not used for advertising or analytics. You can revoke the permissions at any time in the Apple Health app.

The legal basis is your consent (Art. 6(1)(a) GDPR, in conjunction with Art. 9(2)(a) GDPR for health data), which you grant via the Apple Health permission dialog.

PostHog (App Analytics)

In the fytrr app, we use PostHog to understand how the app is used and to improve it. We collect usage events (e.g. features accessed) and technical information such as device type and app version. We do not transmit your name or email address to PostHog; events are associated via a randomly generated identifier. Processing takes place on servers in the EU.

The legal basis is our legitimate interest in improving our app (Art. 6(1)(f) GDPR). More information: https://posthog.com/privacy

Resend (Email Delivery)

We use Resend to send your personalized plans via email. Your email address is transmitted to Resend for this purpose. For more information: https://resend.com/legal/privacy-policy

Plausible Analytics

We use Plausible Analytics, a privacy-friendly analytics tool. Plausible does not use cookies and does not collect personal data. Data collection is anonymized and complies with GDPR and US privacy regulations.

Polar.sh (Payment Processing)

We use Polar.sh for payment processing. During payment transactions, your payment data is transmitted directly to Polar.sh and processed there. We do not store complete payment data. The legal basis is Art. 6 (1) lit. b GDPR (contract performance) and compliance with applicable payment processing regulations in all operating jurisdictions.

6. Data Deletion

Your data will be deleted as soon as it is no longer required for the purpose for which it was collected. You can request deletion of your data at any time by email to hello@fytrr.com. This right applies to users in all jurisdictions, including specific deletion rights under California CCPA and similar state laws.

7. SSL/TLS Encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the browser address line changing from "http://" to "https://".