Privacy Policy

1. Controller

The controller responsible for processing personal data in the “Herdy Fitness” app and on this website is:

2. Overview

We only process the data needed for the app’s features. There is no tracking, no advertising, no analytics tools and no sharing with advertisers or data brokers. Our servers are located in the EU (Finland). To fix crashes and errors, we use an error reporting service that receives no information about you as a person (section 5.11). To improve the app, we evaluate existing data only in aggregated form (section 5.12).

3. Hosting

The app servers, database and this website are operated for us by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its data centre in Helsinki, Finland (EU). Hetzner processes the data solely on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

4. Visiting this website

When you visit the website, the server processes technically necessary information: a shortened IP address (last part removed), date and time, the page requested, browser identifier and referring page. This serves secure operation and troubleshooting (Art. 6(1)(f) GDPR). These logs are deleted after 14 days at the latest.

The public pages do not set cookies and do not load content from third parties (no external fonts, scripts or maps). Only the non-public administration area uses a strictly necessary session cookie for logged-in administrators.

4.1 Launch notification

If you sign up on the website to be notified when the app launches, we store your email address, the chosen language and the time of sign-up and confirmation. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG). We first send a confirmation email; we only write to you after you click the link in it (double opt-in). We store the time of confirmation as proof of your consent. The emails are sent by the mail server of our host Hetzner (section 3).

You can withdraw your consent at any time – via the “Unsubscribe” link in every email or by emailing us. Your address is then deleted immediately.

4.2 Audience measurement (Umami)

To understand how the website is used, we count page views with Umami, which we run ourselves on our server at Hetzner (section 3). No cookies are set and no data is passed to third parties. We record the page visited, the referring page, browser, operating system, device type, screen size, language, country and clicks on elements such as the store buttons. Your IP address is only processed briefly to derive the country and an anonymous visit identifier that changes every month; it is not stored. This does not allow us to identify you.

The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR). You can object by enabling “Do Not Track” in your browser – then nothing is counted.

5. Using the app

5.1 User account

For registration we process your email address, display name, language and password. Passwords are stored only as a hash (Argon2id), never in plain text. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

5.1a Signing in with Google or LINE

Instead of email and password, you can sign in with a Google account (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or a LINE account (LY Corporation, 1-3 Kioicho, Chiyoda-ku, Tokyo, Japan). In doing so, we receive a unique identifier, your name and – if you allow it – your email address from the provider. We verify the sign-in using the provider’s digital signature; no password is stored. Google and LINE are responsible for their own processing; their privacy policies apply. For LINE users in the EU this may involve a transfer to Japan, for which an EU adequacy decision exists. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

5.2 Health and training data

So that the app can create training plans and show your progress, we process the information you enter yourself:

• Profile: gender, date of birth or age, height, body weight, training goal, experience level, training days per week
• Body weight history
• Workouts: exercises, sets, weights, repetitions, rate of perceived exertion (RPE), duration, rating and notes
• Exercises you create yourself

Body and training data may be health data within the meaning of Art. 9 GDPR. We only process it with your explicit consent (Art. 9(2)(a) GDPR), which you give when registering. You can withdraw your consent at any time with effect for the future – by email or by deleting your account in the app. Without this data the app cannot be used.

5.3 How training plans are created

Training plans are generated rule-based from your goal, experience level and training days. There is no automated decision-making with legal or similarly significant effects (Art. 22 GDPR) and no profiling for advertising.

5.4 Security and abuse prevention

To protect against attacks we briefly process IP addresses (limiting requests per minute, in memory or for at most 2 minutes) and, after failed login attempts, a hash of the email address (for at most 15 minutes). Server error logs contain the IP address and are deleted after 14 days. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

5.5 Storage on your device

The app stores your login tokens (in the operating system’s protected keystore), your chosen language and – on poor connections – training sets not yet transmitted on your device. This is strictly necessary for the app to work.

5.6 Photos and profile picture

You can add photos to workouts and set a profile picture. The app shrinks images before uploading; the server stores them re-encoded and removes metadata such as location (GPS) and camera data in the process. Workout photos are visible only to you. Apart from you, only users you are friends with can see your profile picture. Photos are deleted when you remove them, delete the related workout or delete your account; they remain in backups for at most 30 days. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR); if photos show your body, your consent under section 5.2 also applies.

To take or choose photos, the app asks for access to the camera or photo library. You can revoke this access in your device settings at any time.

5.7 Community

In the community you can set a username by which other users can find you and send friend requests – via search or your personal QR code, which you can regenerate at any time. Other users only see your username, your display name and – only as friends – your profile picture; your email address, body and training data are never visible. We store your friendships, pending requests and the users you have blocked. Reports about other users are stored with reason and time in order to review abuse; they are deleted when the reported account is deleted, but no later than 12 months after the review is completed. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR), and for reports our legitimate interest in a safe community (Art. 6(1)(f) GDPR).

5.8 Challenges and comments

If you take part in a challenge, the other participants see your challenge score (e.g. heaviest weight or volume of the chosen exercise within the period) and your ranking – no other training or body data. Comments in a challenge are visible only to its participants and are deleted together with the challenge or your account; you can delete your own comments at any time. If a comment is reported, we store its text together with the report (see 5.7). The legal basis is your consent under section 5.2, which you extend to the participants by taking part in a challenge, and the performance of the user agreement.

5.9 Push notifications

If you allow notifications on your device, the app informs you about new friend requests, accepted requests, challenge invitations, new comments in your challenges and your placing when a challenge ends. For this we store a device token (a random identifier that lets notifications reach your device) and the operating system (Android or iOS) with your account. A notification contains the display name or username of the user who triggered it, the name of the challenge and, where applicable, an excerpt of the comment (at most 120 characters) – no body or training data apart from your placing.

To send notifications we use the push service of Expo (650 Industries, Inc., USA) as a processor. Expo forwards the notification to Google's Firebase Cloud Messaging (Android) or the Apple Push Notification service (iOS), which deliver it to your device. In the process, the device token and the content of the notification are transferred to the USA (see section 7).

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you give via the system prompt. Under Profile → Notifications you can switch off individual types; you withdraw your consent altogether in your device settings. We delete the device token when you sign out, when you delete your account and as soon as the delivery service reports it as invalid (e.g. after the app has been uninstalled).

5.10 App stores

When you download the app, Apple (App Store) or Google (Google Play) process data under their own responsibility. We have no influence on this; their respective privacy policies apply.

5.11 Error reports (Sentry)

If the app crashes or an error occurs on our server, the app or server sends an error report to the service Sentry (Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA), which we use as a processor with data storage in the EU. An error report contains the error message and the place in the program code where it occurred, the app version, operating system and version, device model, and date and time; for server errors also the type of request and the requested path.

Error reports do not contain names, email addresses (these are made unrecognisable in error messages before sending), passwords, sign-in tokens, body or training data, or screenshots. We do not set an identifier for you or your device, do not record usage sessions and do not measure performance. Your IP address is technically transmitted during the transfer but is not stored by Sentry.

The legal basis is our legitimate interest in an error-free and secure app (Art. 6(1)(f) GDPR). The app briefly stores an error report on your device until it is sent, which is necessary for this purpose (Section 25(2) No. 2 TDDDG). You can object at any time (section 9). Error reports are deleted after 90 days at the latest.

5.12 Aggregated evaluations

To improve the app, we evaluate the data that is stored anyway only in aggregated form – for example, how many users train per week, which training programs are chosen or what share of new users trains in their first weeks. This only produces totals; we do not create profiles of individuals and do not use the results for advertising.

In addition, we count which suggested exercises in the training plan are swapped for which others. Only the two standard exercises, the training program and the date are stored – without any link to your account. Exercises you create yourself only appear in evaluations if at least three users have created an exercise with the same name, and then only with the name and the count.

The legal basis is our legitimate interest in developing the app further (Art. 6(1)(f) GDPR); for health data, this is an evaluation for statistical purposes that is compatible with the purpose of your consent under section 5.2 (Art. 5(1)(b), Art. 89(1) GDPR).

6. Recipients

Recipients of your data are our hosting provider (section 3), Sentry for error reports (section 5.11) and – only if you allow notifications – the push service Expo (section 5.9) as processors, and Google or Apple for delivery. When you sign in with Google or LINE, we exchange the data needed for sign-in with the respective provider (section 5.1a). We do not sell data or share it for advertising. Data is only disclosed to authorities where we are legally obliged to do so.

7. Transfers to third countries

Your data is stored in the EU (Finland). Sentry stores error reports (section 5.11) in the EU; since Sentry is a US company, access from the USA cannot be ruled out, for which the same safeguards as below apply. A further exception is push notifications (section 5.9): the device token and the content of a notification are transferred to Expo, Google or Apple in the USA. This is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). For users in Japan this means your data is processed in the EU (Finland), and notifications additionally in the USA (see section 14). The EU and Japan have mutually recognised each other as providing an adequate level of data protection.

8. Retention

• Account, profile and training data: until you delete your account. Deleting it in the app removes the data from the database immediately.
• Backups: deleted after 30 days at the latest; until then, deleted data may still be contained in backups.
• Workouts that were started but never finished: 7 days.
• Photos and profile picture: until you delete them, the workout or your account.
• Device tokens for push notifications: until you sign out or delete your account, or until the delivery service reports the token as invalid.
• Server and error logs: 14 days.
• Error reports at Sentry: 90 days at most.
• Count of swapped exercises: has no link to your account and is therefore not removed when you delete your account.
• Launch notification: until the launch email has been sent or until you unsubscribe; unconfirmed sign-ups after 30 days.
• Audience measurement (Umami): 14 months, then deleted automatically.

9. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). You can export your training data as a CSV file in the app at any time.

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Withdrawal: You can withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR).

Complaints: You may lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR).

An email to info@herdyfitness.com is all it takes. We respond within one month.

10. Minimum age

The app is intended for people aged 16 and over.

11. Data security

Connections between the app, website and server are encrypted via TLS (version 1.2 or higher). Passwords are hashed with Argon2id. Access to the servers is restricted to what is necessary.

12. Paid features

The app is currently free of charge. Once paid subscriptions are offered, we will add the necessary information (in particular on payment processing via the app stores) to this policy before the feature becomes available.

13. Changes

We update this policy when the processing changes. We will inform you about material changes in the app.

14. Information for users in Japan (APPI)

For users in Japan, the Japanese Act on the Protection of Personal Information (APPI) applies in addition:

• Purposes of use: account management, creating training plans, recording and displaying workouts and progress, responding to enquiries, preventing abuse, fixing errors and aggregated statistical evaluations to improve the app.
• Handling abroad: we are a company based in Germany and the data is stored in Finland (EU). Japan’s Personal Information Protection Commission (PPC) recognises the EU as providing an equivalent level of protection. If you allow push notifications, the device token and the content of notifications are transferred to Expo, Google or Apple in the USA. The USA has no comprehensive federal data protection law; we have contractually agreed measures with Expo that correspond to the principles of the APPI. Error reports without information about you as a person are stored by Sentry (USA) in the EU (section 5.11).
• Security measures: encrypted transmission, hashed passwords, access restrictions, limited log retention.
• Please send requests for disclosure, correction, suspension of use or deletion by email. After verifying your identity, we handle them free of charge.