Privacy Policy
Last updated: July 23, 2026
This Privacy Policy explains how GYMCORE ("we", "our", or "us") collects, uses, and protects your personal data when you use our workout planning application at gym.kellokoski.org.
1. Data Controller
The data controller responsible for your personal data is the operator of GYMCORE. If you have any questions about this policy or wish to exercise your rights, please contact us at:
2. What Data We Collect
We collect the following categories of personal data:
Account Information
When you register, we collect your username and a hashed password. Passwords are stored using bcrypt hashing and are never readable in plain text.
Google Account Data (Optional)
If you choose to link or sign in with Google, we receive your Google ID and email address from Google. This is used solely for authentication purposes. You can unlink your Google account at any time from your Dashboard settings.
Workout & Activity Data
We store your scheduled workouts, exercise logs, completed workouts, forum posts, and comments. This data is associated with your account and is used to provide the core functionality of the application.
Calendar Sharing (Optional)
If you enable public calendar sharing, your username and workout schedule become visible to anyone with the shared link. You can disable this at any time from your Dashboard.
3. Legal Basis for Processing (GDPR)
We process your personal data under the following legal bases:
- Performance of a contract (Art. 6(1)(b) GDPR) — processing your account and workout data is necessary to provide the service you registered for.
- Consent (Art. 6(1)(a) GDPR) — for optional features like Google account linking and public calendar sharing, which you can enable or disable at any time.
- Legitimate interests (Art. 6(1)(f) GDPR) — for service improvement, security, and fraud prevention.
4. Cookies & Session Storage
We use essential cookies and local storage to maintain your session and authentication state. These are strictly necessary for the application to function:
- Session cookie — a signed, encrypted cookie that keeps you logged in across page loads. This is a first-party, HTTP-only cookie.
- Local storage — used by our Zustand state management to cache UI preferences and workout data locally for performance.
We do not use tracking cookies, analytics cookies, or third-party advertising cookies. Google's Identity Services library may set its own cookies when you use Google sign-in; those are governed by Google's Privacy Policy .
5. How We Use Your Data
Your data is used exclusively for:
- Authenticating you and maintaining your session
- Storing and displaying your workout schedules, logs, and forum activity
- Enabling optional public calendar sharing
- Generating leaderboard rankings based on completed workouts
- Improving the application and diagnosing technical issues
We do not sell your personal data to third parties. We do not use your data for advertising or profiling.
6. Data Sharing & Third Parties
We share your data only in the following circumstances:
- Google — if you use Google sign-in, your Google ID and email are verified via Google's OAuth 2.0 API. We do not share data with Google beyond the authentication flow.
- Public sharing — if you enable calendar sharing, your username and workout schedule are publicly accessible via a unique link.
- Service providers — our hosting provider (the server infrastructure) has access to the data as necessary to operate the service.
7. Data Retention
We retain your personal data for as long as your account is active. If you delete your account, all associated data — including workouts, logs, forum posts, and comments — is permanently deleted from our database. You can delete your account at any time from the Dashboard settings.
8. Your Rights (GDPR)
If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):
Right to Access
Request a copy of the personal data we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete data.
Right to Erasure (Right to be Forgotten)
Request deletion of your personal data. You can also delete your account directly from the Dashboard.
Right to Restrict Processing
Request that we limit how we use your data.
Right to Data Portability
Request a copy of your data in a machine-readable format.
Right to Object
Object to our processing of your data based on legitimate interests.
Right to Withdraw Consent
Withdraw consent at any time for optional features like Google linking or calendar sharing.
To exercise any of these rights, contact us at privacy@gym.kellokoski.org. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Passwords are hashed using bcrypt with a salt round factor of 10
- Sessions are secured with HMAC-signed, encrypted cookies
- All traffic is served over HTTPS
- Database access is restricted to authorized services only
- Google OAuth tokens are verified server-side using Google's official client library
10. Children's Privacy
Our service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via the application. Continued use of the service after changes constitutes acceptance of the updated policy.