This Privacy Policy explains what personal data the gym-track.io website collects, why, and the choices and rights you have.
1. Who we are
This website, gym-track.io, is operated by Volodymyr Filon, an individual based in Poland. We are the controller of the personal data described in this policy within the meaning of the EU General Data Protection Regulation (GDPR).
You can reach us about anything in this policy — including any request to exercise your rights — at support@gym-track.io.
We have not appointed a Data Protection Officer, because the scale of our processing does not require one under Article 37 GDPR.
2. What data we collect
Newsletter: if you subscribe, we collect your email address and the fact and time of your confirmation (we use a double opt-in, so we record that you confirmed).
Contact form: if you write to us, we collect your name, email address, the topic you choose, the content of your message, and the time you sent it. Please do not include sensitive details you do not want us to have — a message is an email, and it stays in our support mailbox until we delete it.
Analytics and usage data: if you consent, we collect anonymous or pseudonymous information about how you use the site — pages viewed, approximate region derived from your IP address, device and browser type, and referring links.
Technical data: our servers briefly process your IP address to deliver pages and to rate-limit abusive requests. This is transient and not stored in a profile.
Free tools such as the 1RM calculator run entirely in your browser — the numbers you enter are not sent to us or stored.
3. How we use your data, and our legal bases
Newsletter — to send you the updates you asked for. Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time using the unsubscribe link in every email.
Analytics — to understand how the site is used and improve it. Legal basis: your consent, collected through our cookie banner (Article 6(1)(a) GDPR). We do not run non-essential analytics before you accept.
Contact form — to receive your message and reply to it. Legal basis: our legitimate interest in answering people who contact us, which is also what you expect when you write to us (Article 6(1)(f) GDPR). We do not use these details for marketing, and writing to us does not subscribe you to anything.
Security and delivery — to serve the site and prevent abuse. Legal basis: our legitimate interest in a functioning, secure website (Article 6(1)(f) GDPR).
5. Who we share data with
We do not sell your personal data. We share it only with service providers ("processors") who help us run the site, under contracts that require them to protect it:
Supabase — stores our site content, such as blog posts and the changelog (hosted in the EU). Resend — stores newsletter subscriptions and delivers our email, including messages sent through the contact form. Google Workspace — hosts our support mailbox, where contact-form messages are received and kept. Vercel — hosts the website and provides privacy-friendly analytics; through Upstash it also keeps short-lived counters used to rate-limit abusive requests (hosted in the EU). Google Analytics 4 and Google Tag Manager — only after your consent.
6. International data transfers
Supabase stores our data in the EU. Its parent company is based in the United States, so where any transfer occurs it relies on the European Commission’s Standard Contractual Clauses.
Resend, Vercel, and Google are based in the United States and are certified under the EU–US Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection. You can request a copy of the relevant safeguards from us.
7. How long we keep it
Newsletter data: until you unsubscribe, after which we remove your address from the active list.
Contact messages: for as long as we need them to handle your enquiry and any follow-up, after which we delete them. If a conversation turns into an ongoing matter, we keep it only while that matter is open.
Analytics data: retained for a limited period by our analytics providers and in aggregated form thereafter.
8. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to data portability. Where processing is based on consent, you may withdraw that consent at any time.
To exercise any of these rights, email support@gym-track.io. We will respond without undue delay and within one month, as required by Article 12(3) GDPR.
10. Children
This website is not directed to children under 16. In Poland the age of digital consent is 16, and we do not knowingly collect personal data from anyone below that age. If you believe a child has provided us data, contact us and we will delete it.
11. Automated decisions
We do not make decisions about you based solely on automated processing, and we do not carry out profiling that produces legal or similarly significant effects.
12. Changes to this policy
We may update this policy. If we make a material change, we will update the date at the top and, where appropriate, give notice on the site.
13. Contact
This service is operated by Volodymyr Filon, an individual based in Poland.
For any question, request, or complaint, email support@gym-track.io. We aim to respond within 30 days.