Privacy policy

Who is responsible

The data controller is the operator of Sapphiron. Contact: contact details will be published on this page.

What we collect

• Account: your email address, your name if you give one (private: other people never see it), a public handle generated for you that you can change, a bcrypt hash of your password (we never store the password itself), and your Google identity if you sign in with Google.
• Training data: the routines, workout logs, results, presets and schedule you create.
• Public content: routines and blocks are visible to other users and to signed-out visitors, shown with your public handle as their creator. Your handle is a random pseudonym (for example athlete-k3x9p2qa) until you change it; we never show your name or email address in its place.
• Import inputs: text you paste and images you upload when importing a routine, plus the structured result we extract. Location and camera metadata (EXIF) is removed from images before they are processed.
• AI features: your muscle-coverage data, routines and workout history, used as input for gap analysis and progression suggestions.
• Billing: your subscription status and Stripe customer ID. Card details go to Stripe and never reach us.
• Product analytics: which screens are used and a few bounded events (for example, an import completed). See “Analytics” below.
• Technical data: server logs and error reports. Our server logs never hold your full IP address: the web server keeps only a shortened form (the network part, which does not identify your device on its own), and the application keeps only a keyed pseudonymous code derived from it, used to rate-limit abuse.

Why we use it, and on what legal basis

• To provide the service you asked for (your account, routines, logging, imports, AI features, subscription): performance of a contract, Art. 6(1)(b) GDPR.
• To keep the service secure, rate-limit abuse and find bugs (server logs, error reports): legitimate interest, Art. 6(1)(f).
• To understand which parts of the product are used so we can improve it (analytics): legitimate interest, Art. 6(1)(f). It is designed to be cookieless and privacy-preserving, so no consent banner is needed.
• To send emails about your account (verification, password reset, trial reminders, confirmation that your account was deleted): performance of a contract, Art. 6(1)(b).
• To keep payment and tax records through Stripe: legal obligation, Art. 6(1)(c).
• We keep the text you import and the extracted result so we can measure and improve the import prompt (the instructions we give the AI model) and the quality of imports. We do not use them to train machine-learning models. If that ever changes we will update this policy first and ask for your consent where the law requires it.

Analytics

We run our own analytics on our own servers; no third-party analytics service receives your data and nothing is stored on your device for it.

Events record the screen (route) and a few bounded properties, never free text, URLs or query strings. Signed-out visitors get a daily-rotating anonymous identifier derived on our server, so it cannot be linked across days. Signed-in users' events carry their account ID.

Raw events are deleted after 90 days. Aggregated daily counts that contain no identifiers are kept indefinitely.

Who else processes your data

We use these processors. Each acts on our instructions under a data processing agreement.

• Hetzner (Germany): hosts our servers, database and backups.
• Anthropic (Claude API): receives the text and images you import, and the training data used for AI features, so it can extract routines and produce suggestions.
• Stripe: processes subscriptions and payments, and holds your billing record.
• Resend: delivers our transactional emails (your email address and the message).
• Sentry: receives error reports (stack traces, the log lines leading up to the error, which can include your email address for sign-in events, and your account ID). We configure it not to send request bodies, variable values, query strings, cookies, authorization headers or IP addresses.

Independent controllers

These companies receive some of your data but decide for themselves how they use it, under their own privacy policies. Each is responsible for its own use of that data.

• Google: signs you in if you choose “Continue with Google”. Google handles your Google account under its own privacy policy.
• Stripe: besides processing payments for us, Stripe uses payment data as an independent controller to prevent fraud and to meet its own legal obligations, such as verifying identities and keeping financial records, under its own privacy policy.

Transfers outside the EU

Our servers are in the EU. Anthropic, Stripe, Resend and Sentry may process data in the United States or other countries. Where they do, the transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision such as the EU–US Data Privacy Framework, as set out in each processor's data processing agreement. Stripe's data transfer terms also cover the data it handles as an independent controller. Google transfers the sign-in data it handles under its own terms and privacy policy.

How long we keep it

• Account and training data: until you delete your account.
• Uploaded images: deleted when you save the import, and otherwise automatically about 24 hours after you upload them. We keep the text we extract from them (the imported routine).
• Pasted text and import results: until you delete your account (they are deleted with it, not anonymised).
• Raw analytics events: 90 days. Identifier-free daily aggregates: indefinitely.
• Server logs (with IP addresses shortened or replaced by a pseudonymous code and, for sign-in events and the emails we send you, email addresses) and error reports: 30 days.
• Backups: deleted data can remain in encrypted database backups until their retention period ends (currently about 90 days), and in short-lived local copies we take before database upgrades or maintenance (about 30 days).
• Routines that other people depend on, and tags that other people's routines or blocks use, are kept, without your name, when you delete your account. Community catalog entries (exercises, tools) stay with your name removed; everything else you created is deleted.
• Billing records: Stripe keeps invoices and payment records as tax law requires, even after your account is deleted.
• A minimal record that a deleted account used a free trial is kept so the trial cannot be claimed again.
• When you delete your account we keep its internal account ID, a keyed, non-reversible digest of your email address (and of your Google account ID, if you signed in with Google) and the date of deletion, and nothing else. It stops a new account with the same email address (or Google account) from getting a fresh free import allowance before the deleted account's 30-day period ends, it lets us re-apply your deletion if we ever restore a backup taken before it, and if you sign up again with the same email address or Google account it lets us count that sign-up as a return, so we know how often people delete their account and come back (we record only that it happened and whether you signed up with email or Google, not the new account's ID). Legal basis: legitimate interest, Art. 6(1)(f). We keep it for 92 days.

Your rights

Under the GDPR you can ask for access, correction, erasure, restriction, portability, and you can object to processing based on legitimate interest. You can also complain to your data-protection authority.

• Erasure: delete your account yourself in Profile → Delete account. It removes your data and your Stripe customer.
• Access and portability: download your data yourself in Profile → Download my data, as a machine-readable JSON file. For anything else, ask us (see “Contact” below).
• Correction: edit your name, public handle and routines in the app, or contact us.
• Objection and restriction: contact us.

Cookies and browser storage

We use no tracking or analytics cookies. The only cookie is a short-lived, strictly necessary, HTTP-only cookie set while you sign in with Google (OAuth state), which protects the sign-in from forgery. Your browser's local storage holds your sign-in token, your language choice, drafts, interface hints and, for signed-out visitors, a random identifier used to rate-limit the free routine-of-the-day. These are strictly necessary for the service to work, so no consent is needed. Analytics stores nothing on your device.

Changes

When we change this policy in a way that matters we will update the “last updated” date at the top of this page.

Contact

Questions or requests: contact details will be published on this page.