Privacy Policy

Scope and controller

This policy applies to the SmartGainer website and the current SmartGainer app. It describes the processing that is actually implemented today; it does not cover planned features.

Controller

XXX

Legal form

XXX

Address

XXX

Country

XXX

Email

smartgainer.support@gmail.com

Data protection officer (if applicable)

XXX

Data processed

Account and authentication data (via Supabase): your email address, an internal user ID, authentication and session timestamps and authentication security data. SmartGainer does not receive your plain-text password.

Profile and onboarding data: name, an optional avatar identifier, age, gender, height, current and target weight, training goal, training schedule or training days, available equipment, selected injury or affected-body-area information, onboarding state and app preferences.

Training data: created workouts, selected exercises, sets, repetitions, weights, timestamps, duration, completion or early-ending status, personal records, workout feedback including energy and execution scores, planned workouts and reminders, favorites, fitness tests, weight history, Daily Drop and Morning Stretch activity, AI quota and usage counters and generated workout proposals.

Technical and support data: necessary server and security logs such as IP address, timestamp, requested URL, browser or device information and error information, as well as your support email address, your message, any attachments and the device or app details you provide.

SmartGainer does not sell personal data, and the website currently uses no advertising or marketing tracking.

Purposes and legal bases

• Providing your account, saving your workouts and delivering the functions you request: Art. 6(1)(b) GDPR (performance of a contract).
• Processing you have expressly consented to, such as personalized functions based on injury or body-area information: Art. 6(1)(a) GDPR and, where health-related data is involved, Art. 9(2)(a) GDPR.
• Security, abuse prevention, technical stability and answering ordinary support requests: Art. 6(1)(f) GDPR. Our legitimate interest is to keep the service available and secure and to respond helpfully to messages you send us.
• Processing and retention that is legally required: Art. 6(1)(c) GDPR.

We do not rely on consent where processing is strictly necessary to deliver a function you explicitly requested; in those cases contract performance is the correct legal basis.

Health-related data and explicit consent

Injury or affected-body-area information and weight entries can be health-related data. Where such processing requires it, we rely on your explicit consent under Art. 9(2)(a) GDPR.

You can withdraw your consent at any time. Withdrawal does not affect processing that was lawful before the withdrawal. If you withdraw consent that a personalized function needs, that function may no longer be available.

AI-supported workout generation

When you request an AI-supported workout, the current function can send the following context: your training goal, your effective experience or baseline level, your available equipment, selected injury or body-area restrictions, recent exercise names and a summary of your recent training and volume, your favorites count, your desired focus, duration, intensity and workout structure, optional custom instructions and a ranked shortlist of candidate exercises.

Your name and email address are not intentionally included in that AI prompt. Requests are sent through the Lovable AI Gateway to Google Gemini.

The result is a workout suggestion you can accept, adjust or skip. It is not medical advice and it is not a decision that produces legal or similarly significant effects for you.

Service providers and international transfers

• Supabase, Inc. — authentication, PostgreSQL database and Edge Functions.
• Lovable — website hosting, error delivery and the Lovable AI Gateway.
• Google Gemini via the Lovable AI Gateway — AI-supported workout selection.
• Cloudflare, Inc. — delivery of exercise videos and media.
• Google / Gmail — support mailbox communication.

These providers process data on our behalf or as independent controllers for their own service operation. Processing can involve a transfer outside the European Economic Area; in that case the transfer is safeguarded by the mechanisms offered by the respective provider, such as EU standard contractual clauses.

• Supabase, Inc.
• Lovable
• Google (Gemini, Gmail)
• Cloudflare, Inc.

Local device storage and optional device integrations

Settings such as language, appearance, reminder and haptic preferences, temporary workout or editor state and similar preferences may be stored locally on your device.

Calendar or notification identifiers are only processed if you enable the corresponding optional function.

Support communication

If you write to smartgainer.support@gmail.com, we process your email address, your message, any attachments and the device or app details you provide in order to answer your request. Please never send your password.

Retention and deletion

• Account, profile and training data are stored while your account is active.
• When you delete your account, the associated data is deleted, subject to technical backup cycles and any legally required retention.
• Support messages are kept as long as they are needed to resolve and document your request.
• Security and server logs are retained according to the security and retention settings of the respective provider.

We cannot promise immediate removal from every backup copy; backups are overwritten according to their technical cycle. Anonymized or aggregated information that can no longer be linked to you is not personal data.

Account deletion

You can delete your account in the app under Profile → Settings → Account & Data → Delete account. The dedicated account deletion page describes exactly what is removed and what may remain.

Your rights

• Access to the personal data we process about you.
• Correction of inaccurate data.
• Deletion of your data.
• Restriction of processing.
• Data portability.
• Objection to processing based on legitimate interests.
• Withdrawal of consent you have given.
• Complaint to a competent data protection supervisory authority.

To exercise these rights, write to smartgainer.support@gmail.com, ideally from the email address connected to your account.

Withdrawal of consent

Consent can be withdrawn at any time with effect for the future, without affecting the lawfulness of processing already carried out. Where a function depends on that consent, the function may stop working.

No automated decisions with legal effect

SmartGainer does not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. AI-supported workout suggestions are proposals you remain in control of.

Security

We use technical and organisational measures appropriate to the risk, including encrypted transport, access controls and database-level access rules, to protect your data against loss, misuse and unauthorised access.

Changes to this policy

We update this policy when the website, the app or the services we use change. The date above always shows the current version.

Contact and right to complain

For any privacy question, contact smartgainer.support@gmail.com. You also have the right to lodge a complaint with the data protection supervisory authority competent for the controller or for your place of residence.