Privacy Policy
Last updated: 16 August 2026
This is a courtesy translation. The operator is based in Germany; in case of any discrepancy, the German version prevails.
1. Controller
Mika Gärtner
Ahornring 2
61191 Rosbach, Germany
Email: workoutlogbuchmanagement@gmail.com
2. In short
Workout Logbook keeps your training data on your device only. It is stored on a server as well only once you voluntarily sign in with an account, so that you can use it across several devices. There is no advertising, no tracking and no sharing with third parties for advertising purposes.
3. What data is processed
| Data | When | Why |
|---|---|---|
| Training data (exercises, weights, repetitions, notes, training plan) | always locally, additionally on the server once signed in | providing the core function |
| Email address and password (stored only as a cryptographic hash) | only when registering | linking your data to your account |
| Time of the last change | when using sync | merging versions from several devices |
| Server log data (IP address, time, requested address) | on every request | operation and defence against attacks |
4. Storage on your device
The app stores your training data, your settings and – once signed in – your session token in your browser's local storage. These are not analytics cookies but data technically required for operation. Your behaviour is not analysed.
You can delete this data at any time by clearing the browser data for this site or by uninstalling the app.
5. Without an account
If you use the app without signing in, your training data never leaves your device. No transmission to a server takes place.
6. With an account: sync via Supabase
Once you sign in, your training data and your email address are stored with our processor:
Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513
Database location: Ireland (European Union)
A data processing agreement pursuant to Art. 28 GDPR is in place with Supabase. It forms part of Supabase's terms of service and can be viewed at supabase.com/legal/customer-resources/data-processing-addendum.
As Supabase is based outside the EU, the transfer relies on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), which form part of the data processing agreement. The database itself is located in Ireland and therefore within the EU.
Supabase in turn engages sub-processors. The current list is available at supabase.com/legal/customer-resources/subprocessor-list.
Access to your data is restricted at database level so that only your own account can read and change it. Data is transmitted and stored encrypted.
Legal basis: Art. 6(1)(b) GDPR – processing is necessary to provide the service you requested (storage across devices).
7. Feedback
If you send feedback through the app, your text, the app version, the selected language and your browser identifier are transmitted to the same server and stored there. You only provide an email address if you would like a reply – that field is optional.
Legal basis: Art. 6(1)(a) GDPR (consent given by sending) or Art. 6(1)(f) GDPR – legitimate interest in improving the service. Feedback is deleted once it has been dealt with, at the latest after twelve months.
8. Hosting
The app is delivered via Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Technically necessary log data is recorded on access (IP address, time, requested address, browser identifier). The legal basis is Art. 6(1)(f) GDPR – legitimate interest in secure and stable operation.
9. Retention
Your data is retained until you delete it. If you delete your account in the app under Settings → Account → Delete account, your account and all associated data on the server are removed irreversibly. Data on your own device is not affected and can be deleted by you.
10. Your rights
- Access (Art. 15 GDPR) – which data is stored
- Rectification (Art. 16 GDPR) – correction of inaccurate data
- Erasure (Art. 17 GDPR) – possible at any time within the app
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR) – the app provides a complete export in a machine-readable format under Settings → Data → Export backup
- Objection (Art. 21 GDPR)
- Complaint to a supervisory authority (Art. 77 GDPR)
A message to workoutlogbuchmanagement@gmail.com is sufficient for any request.
11. No analytics, no advertising
No analytics or advertising services are used, no profiles are created and no automated decisions are made. Data is not shared with third parties other than the processors named above.
12. No health data
The logbook is intended for training data – exercises, weights, repetitions. Please do not enter health information in the notes field, such as complaints, diagnoses, injuries or medication. Such information falls under the special categories of personal data under Art. 9 GDPR and is subject to stricter requirements. The service is not designed for it.
13. Children
The app itself has no age limit. Without an account all data stays on the device, nothing is transmitted, and there is nothing to consent to. The age of 16 concerns the sync account only: that is the age at which a person in Germany can consent to such data processing themselves (Art. 8 GDPR). Anyone younger needs the consent of a parent or guardian.
14. Changes
This policy will be adapted when the service changes. The version published here at the time applies.