Privacy Policy

1. Data Controller

The party responsible for data processing on this website and in the hitPR app is:

2. What data is collected?

hitPR works without a user account. There is no registration and no sign-in with us; to use the app, we need neither your name nor your email address. Your training data (exercises, sets, weights, repetitions, personal records, plans and settings) is created by your input and lives in a database on your device. We do not operate a server on which it is stored, and we do not receive it. It is processed by the app on your device in order to provide hitPR to you — the legal basis for this is Art. 6(1)(b) GDPR (performance of our usage contract with you). If you choose your own cover image for a plan or a photo for an exercise you created, your operating system's image picker opens. hitPR receives only the image you select there and stores a copy of it in the app folder on your device. Acceptance of the terms of service: when you complete onboarding, we record which version of the terms of service you accepted — version, time and where in the app you accepted them. This record stays on your device; we do not receive it. There are no mandatory fields in the app. Content only reaches us if you send it yourself: a feedback message, or permission to send usage statistics and crash reports. You can withdraw that permission at any time, with no disadvantage in the app. Independently of this, the app fetches content from us: the plan catalog, the cover images of the catalog plans and, once a day, a small file with in-app messages and the state of the catalog. Every request over the network produces technical connection data, including your IP address — without it no connection can be established. The management of your purchase also runs through a service provider. Both are described in the “Third-party services” section. Where data can nevertheless go is described in the sections “Storage and deletion”, “Third-party services”, “Crash reports”, “Feedback feature” and “Tracking and analytics”. The principle behind it: we do not see your training data. If you consent, the usage statistics send only broad ranges for how much you train, and your settings — without an identifier, so we cannot attribute them to you.

3. Purpose of data processing

• Local data: app functionality — recording training, evaluating progress, suggesting training weights • Data backup: protection against data loss and moving to a new device • Crash reports: troubleshooting and app stability • Feedback: processing and answering your message • Anonymous usage statistics: aggregated, unlinked signals used to improve the app and the plan catalog and to find errors • Purchase handling: unlocking the features you have bought • Fetching the plan catalog and in-app messages: showing current content in the app and securing the service • Contact: handling and answering your enquiries by email

4. Storage and deletion

Your training data lives in the app on your device and is deleted when you uninstall it. We keep no copy of it — there is nothing on our side that we could keep for you or delete on request. Data backup (hitPR Pro): if you switch on automatic backup, hitPR places a single backup file in your own cloud storage — on Android in your Google Drive, on iOS in your iCloud. That storage belongs to you, not to us; Google's or Apple's terms apply to it. The file is encrypted on your device with AES-256-GCM before it is transferred. The key is generated on your device and exists there and in your recovery code — on iOS also in your iCloud Keychain, so that a new iPhone with the same Apple Account can open the backup without the code. We do not know it and cannot read the backup. Each new backup overwrites the previous file. If you switch backup off, the last file written stays in your cloud storage until you delete it. The backup contains your training data, but not image files you have chosen yourself: of a plan cover image or the photo of an exercise you created, only the reference is backed up, not the image. It is therefore missing on a new device. The backup is created and transferred by the app on your device — the legal basis for this is Art. 6(1)(b) GDPR (performance of our usage contract with you). Manual export: under Settings → “Data” you can export your data yourself at any time — encrypted, or as an unencrypted JSON or CSV file. The export goes through your operating system's share sheet and can therefore end up in any folder and with any service you select there. You decide where the file goes; after that, we no longer have any influence on it. An unencrypted export file is not protected. Deletion: “Delete All Data” in the settings removes your training data and the images you chose yourself from the device. What remains is the bundled exercise catalog including your adjustments to it, your settings, the record of which version of the terms of service you accepted, the records of your choices on crash reports and usage statistics, and the identifier of the feedback feature. Usage statistics events not yet sent are deleted as well; if the statistics are switched on, they keep running afterwards. If the data backup is switched on, you can have the backup file in your cloud storage deleted in the same step; otherwise it stays there until you delete it yourself. Export files you have passed on yourself, and copies in an operating system backup, are not covered by this. Where something is held by us or by a service provider on our behalf is set out in the sections that follow — among them “Third-party services”, “Crash reports”, “Feedback feature”, “Payment data”, “Tracking and analytics” and “Contact”. The retention periods stated there apply.

5. Third-party services

• Cloudflare (Cloudflare, Inc., USA) – operation of hitpr.app: delivery of the plan catalog, the cover images of the catalog plans and a small file that the app retrieves once a day (in-app messages, catalog version, minimum required app version), and receipt of the anonymous usage statistics and the feedback messages. The database for this is created with EU jurisdiction. The legal basis for delivery and for the daily request is our legitimate interest in showing you current content and in securing the service (Art. 6(1)(f) GDPR). Data processing agreement (DPA) in place; under it, the data stays there until our agreement with Cloudflare ends or the processing is no longer necessary for operating the service — whichever comes first. Data transfers on the basis of the EU-US Data Privacy Framework, additionally safeguarded by Standard Contractual Clauses (SCC). • Google Drive (Google Ireland Limited, Ireland) – only if you switch on the data backup on Android. hitPR asks for your Google sign-in for this and uses the “drive.file” scope for Drive. It covers files the app creates itself and files you explicitly hand to it via Google's file picker — hitPR does not use that picker, so the app only ever sees its own backup file. It has no access to your other Drive files. In doing so, Google also passes the email address of the selected account to the app; we show it to you in the settings, it stays on your device and is not transmitted to us. The backup lies in your own storage — here Google is your provider, not our processor. • Apple iCloud (Apple Distribution International Ltd., Ireland) – only if you switch on the data backup on iOS. The backup lies in your own iCloud storage, which your device has already set up; the app performs no separate sign-in with Apple. Here Apple is your provider, not our processor. • Google Firebase Crashlytics (Google Ireland Limited, Ireland) – crash reports, only after your explicit consent. Details in the section “Crash reports”. Data transfers on the basis of the EU-US Data Privacy Framework; where it is not available, Standard Contractual Clauses apply. • RevenueCat (RevenueCat, Inc., USA) – management of purchases and subscriptions. The app sets up RevenueCat once you have completed onboarding and from then on queries the purchase status at every start — including if you never buy anything. In doing so, RevenueCat assigns a pseudonymous app user ID that is not linked to any account with us. Purchase receipts and purchase and subscription status are processed. No payment data is transmitted; training data does not reach RevenueCat. The data stays there for as long as we use the service; when the agreement ends, we have it deleted. We delete your individual record on request at any time — see “Your rights”. Data transfers on the basis of Standard Contractual Clauses. • Google Play services (Google Ireland Limited, Ireland) – on Android, for the connection to the Wear OS Watch Companion, see the section “Watch Companion”. We provide a copy of the Standard Contractual Clauses on request (info@hitpr.app).

6. Crash reports

Crash reports are switched off by default. If you enable them, the app transmits the following data to Google Firebase (Google Ireland Ltd.) when it crashes and when it catches an error during use: • Installation identifier (pseudonymous) • Device model and operating system version • IP address • Error logs (stack traces) with a short error message from which the app first removes email addresses, identifiers and file paths Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time in the settings. From the moment of withdrawal nothing more is sent. Reports already sent carry only a pseudonymous installation identifier; we cannot attribute them to you and therefore cannot delete them specifically — they expire over the period stated below. According to Google, crash reports are kept for 90 days, after which their removal from live and backup systems begins. More information: https://firebase.google.com/support/privacy

7. Feedback feature

When you use the feedback function, your message, the type of feedback you have selected, a randomly generated device identifier (UUID), the name and version of your operating system and the app version are transmitted to our service at hitpr.app and stored there with Cloudflare in a database with EU jurisdiction. The time of receipt is recorded; it is the start of the retention period stated below. If your message concerns a plan from the catalog, which plan it is about is transmitted as well. For an Adapt plan, this means the inputs it was calculated from (goal, experience, days, duration, body part, split and equipment) and the version of the rules. The form shows you beforehand what is sent. The device identifier is generated randomly the first time you use the feedback feature, is not linked to any account and serves solely to prevent spam (limiting the number of messages per device). It is also transmitted in the preliminary check with which the app determines whether you can currently send a message. Feedback entries are deleted no later than 24 months after receipt. Legal basis: legitimate interest in improving the product (Art. 6(1)(f) GDPR). Please do not include any health details in your message — we do not need them to process it. Optionally you can provide an email address if you would like a reply. It is used solely to answer your message and is removed from the entry after 12 months at the latest. For the reply it passes through our email mailbox — see “Contact”; we do not pass it on to third parties for their own purposes. Legal basis: consent (Art. 6(1)(a) GDPR), revocable at any time.

8. Tracking and analytics

hitPR uses no advertising, tracking or third-party analytics SDKs. There is no user tracking: no cross-device or cross-app tracking, no advertising IDs, no usage profiles, no sharing with advertising partners. Anonymous usage statistics: to improve the app we collect anonymous, aggregated usage signals. The app sends which screens and features are opened (for example which analyses and which workout tools), whether a workout is started, discarded or finished and with what kind of plan (catalog plan with its name, Adapt plan or own plan), how long it took and how many exercises it had (both only in broad ranges), whether it is shared, which progression scheme is chosen, which catalog plans are adopted, whether an Adapt plan is created, which answers are chosen in the Plan Finder and where a Pro feature is locked. Once a day, once a week and once a month it reports that the app is in use, together with a broad range for how many workouts were done in total. Once a week it adds broad ranges for how many workouts were done in the last 28 days, since when the person has been training and whether hitPR Pro is used, each as a separate event. Once a week it sends one event for each screen opened and each feature used, and once a month the general settings such as language and unit system, each as a separate event. If an error occurs in the app, it also sends what kind of error it is and where in the app it occurred. Never sent: the content of your workouts (weights, repetitions, hold times, the exact duration), body data, photos, names you give things yourself, and free text. The events contain no device or user identifier and no time of day, only the app version, the app language and the calendar day. They cannot be combined into a history or traced to a person. Without a network connection, the app keeps them on the device for up to 7 days and then sends them together. The recipient is our service at hitpr.app hosted by Cloudflare (database with EU jurisdiction). There, each event is folded into a daily counter the moment it arrives; individual events are not stored, and no IP address enters our statistics database. For the transmission itself, Cloudflare processes technical connection data, as described in the section “Third-party services”; we do not use it to recognise you or to link events. The daily figures are deleted after 12 months at the latest. If you switch the statistics off, the app stops sending and deletes events that have not been sent yet. A link next to the switch under Settings → “Data” shows what exactly is sent. Collection only takes place with your explicit consent (Art. 6(1)(a) GDPR) — you can enable it during onboarding or at any time in the settings (default: off). Crash reports, too, are only sent with your explicit consent (default: off). We ask for this consent also because these two functions access information on your device; that requires consent under § 25(1) of the German TDDDG — regardless of whether personal data is involved. It does not apply to access that is strictly necessary for a function you have expressly requested (§ 25(2)(2) TDDDG).

9. Payment data

hitPR does not process payment data directly. Purchases are handled exclusively through the Apple App Store or Google Play. The stores' respective privacy policies apply. To manage purchases and subscriptions we use RevenueCat; details in the section “Third-party services”. This management does not begin only with a purchase — the app already asks at start-up whether one exists. The legal basis for managing your purchase and your subscription status is the performance of our user agreement with you (Art. 6(1)(b) GDPR).

10. Watch Companion

If you use the Wear OS Watch Companion, hitPR transmits the state of the running workout to your paired watch: exercise names, sets, weights, repetitions, rest times, effort values (RPE/RIR), distances and durations, your notes and labels for the exercise, your Training Max, the values from your last workout, and personal-record markers. The watch sends control commands back, such as completing a set. Transmission is handled by the Wear OS system service of Google Play services. hitPR does not operate a server for this, and the data does not reach us. Without a paired watch, no transmission takes place. If your watch has a heart-rate sensor, hitPR shows your heart rate on the watch during the workout. For this, the watch asks once for the body sensors permission. The value stays on the watch: it is not transmitted to your phone, not stored and not recorded with your workout. It is only visible while it is displayed, and disappears when you close the app on the watch. If you do not grant the permission, everything else works unchanged.

11. App store download

When you download the app, your device transmits the information required for this to the respective app store (Apple App Store or Google Play Store) — in particular your store user ID, the time of download, a device identifier and, for paid purchases, payment information. We have no influence over this data collection by the store operator; it takes place under their sole responsibility. The privacy policies of Apple and Google apply.

12. Your rights

You have the right at any time to:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent you have given, with effect for the future (Art. 7(3) GDPR)

Because hitPR works without a user account, your training data rests with you alone. You therefore exercise these rights largely yourself, without going through us: • Access and data portability: the export under Settings → “Data” — it outputs your stored data in a machine-readable format. • Rectification: directly in the app. • Erasure: “Delete All Data” in the settings; if you also select the cloud backup there, the app deletes the backup file in your cloud storage as well. If it cannot be deleted right then — for example without an internet connection — the app tells you instead of reporting success. • Withdrawing consent to crash reports and to the usage statistics: the switches in the settings.

For personal data held by us or by a service provider on our behalf — your feedback messages including any email address given there, your contact enquiries, your waitlist entry and the management of your purchase — a message to info@hitpr.app is enough; we will provide access and delete the data, unless a statutory retention obligation prevents us from doing so. Feedback messages are deleted anyway within the periods stated in the section “Feedback feature”. The identifier used for purchase management is assigned by RevenueCat and is not linked to any account with us. To find your record there, we need additional information from you, such as your purchase receipt. Deleting it does not end a running subscription — you cancel that with Apple or Google. The anonymous usage statistics contain no identifier that would allow events to be attributed to you; we can therefore neither provide access from them nor delete specific entries.

You have the right to lodge a complaint with a data protection supervisory authority — in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany https://datenschutz.hessen.de

13. Objection to processing based on legitimate interests

You can object at any time to the processing of your data insofar as we base it on a legitimate interest (Art. 6(1)(f) GDPR) — on grounds relating to your particular situation. An informal note to info@hitpr.app is enough. We examine it and reply to you. For your feedback message that means: we delete it. We do not base the website analytics on a legitimate interest but on your consent (Sec. 25(1) TDDDG, Art. 6(1)(a) GDPR). It is therefore not subject to objection but to withdrawal under Art. 7(3) GDPR: open the analytics settings — the button is at the end of this page, the link additionally in the footer of every page — and choose “Decline”. Measurement then stops immediately for the future; the lawfulness of the processing carried out beforehand is unaffected. Your decision applies to the browser in which you make it; details are in “Cookies and local storage”.

14. Automated decision-making

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR: no decision with legal effect or similarly significant impact is made about you. The app does, however, calculate a number of things automatically: from your training history it derives training weights, repetition ranges and values such as Training Max or Estimated 1RM, the Plan Finder suggests a plan based on your inputs, and hitPR Adapt calculates a training plan for you. These are computed results under fixed rules that are the same for everyone — suggestions you can override at any time, not an assessment of you as a person. The calculation runs on your device.

15. Minimum age

Under our terms of service, use is permitted from the age of 16. From that age you can give consent yourself — to the usage statistics and crash reports and to the processing of an email address you provide voluntarily (Art. 8 GDPR).

16. Changes to this privacy policy

We update this privacy policy when the app or legal requirements change. You can always find the current version in the app and at https://hitpr.app.

17. Contact

For privacy-related questions, contact: info@hitpr.app Your email to us is stored by our email provider on our behalf on servers in the USA; this is safeguarded by Standard Contractual Clauses. The legal basis is our legitimate interest in handling your enquiry (Art. 6(1)(f) GDPR). We delete the message once it has been dealt with and no statutory retention obligation applies.

18. Website hosting

We use Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) to host, deliver and secure this website. Cloudflare processes IP addresses, request times, requested URLs and browser information. The legal basis is our legitimate interest in reliable and secure operation (Article 6(1)(f) GDPR). The data processing agreement forms part of Cloudflare’s contractual terms. We do not keep a server log of our own. The connection data arises at Cloudflare. How long it stays there is set by the data processing agreement: until our agreement with Cloudflare ends or until the processing is no longer necessary for operating the site — whichever comes first. We do not export it and keep no copy. Processing outside the EU, particularly in the USA, is possible. Transfers covered by the EU-US Data Privacy Framework to DPF-certified US recipients rely on Article 45 GDPR; Cloudflare’s agreement provides in particular for EU Standard Contractual Clauses for other necessary third-country transfers (Article 46 GDPR). References to EU storage apply to the respective database at Cloudflare.

19. Website analytics

Only with your consent do we analyse website usage to improve content, navigation and access to the app. We record individual pageviews, entry pages, referring domains and campaigns, link clicks and waitlist requests, visible page time and scroll depth, plus country, browser, operating system and device type. Random browser, session and page identifiers link these events: the data is pseudonymous, not anonymous. Names, email addresses, form entries and training values are excluded. IP addresses are processed for the connection but are not stored as analytics fields or used to generate identifiers. Cloudflare processes analytics data on our behalf; see Hosting for international transfers. According to Cloudflare, individual events are kept for three months. Daily statistics without browser or session identifiers are retained for twelve months. The legal bases are consent under section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw at any time in Analytics settings; the website remains usable. Withdrawal stops future measurement without affecting the lawfulness of previous processing. It does not delete events already recorded — they expire over the three months stated above. Contact info@hitpr.app to exercise your data protection rights.

20. Cookies and local storage

Your analytics choice is saved in a first-party cookie for up to 180 days. To manage and demonstrate consent, we store a random receipt ID, notice version, time, expiry and any withdrawal in a database at Cloudflare. Receipts are deleted no later than 90 days after expiry (Article 6(1)(c) in conjunction with Article 7(1) GDPR). Saving the choice in your browser serves your requested preference (section 25(2)(2) TDDDG). Only after consent do we use localStorage for a random browser identifier used for recognition for up to 30 days and a session identifier lasting until 30 minutes without interaction. Expired entries are renewed or removed on the next access; withdrawal removes these identifiers. A locally saved refusal and earlier opt-outs remain effective until you change your choice or clear site data. Your preferred weight unit in the tools is saved locally independently. Choices apply to this browser; clearing site data or using another device requires a new choice.

21. Fonts

This website uses self-hosted fonts (DM Sans, DM Mono). There is no connection to external servers such as Google Fonts. The fonts are loaded directly from our server.

22. Waitlist

When you join the waitlist on our website, we process your email address and — as proof of your consent (double opt-in) — the time of signup and confirmation together with the IP address used. The sole purpose is to notify you once when the app launches. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future — for example via the unsubscribe link in the email or the contact details listed above under “Data Controller”. We use a database at Cloudflare (Cloudflare, Inc.) to store the data; this database is provisioned with EU jurisdiction, so your entry is stored there exclusively in the EU. We use Resend (Plus Five Five, Inc.) to send the confirmation and notification email; the email and its delivery log are held there in the USA and stay for as long as we use Resend — when the agreement ends, Resend deletes them within 90 days. If we delete your waitlist entry, that does not cover the delivery logs at Resend. Both process the data as processors on our behalf. Where data is transferred to the USA — in particular for sending the email — we base this on the EU Standard Contractual Clauses and additionally on the EU-US Data Privacy Framework. We delete unconfirmed signups no later than 30 days after signup; confirmed entries are deleted once the launch notification has been sent or you unsubscribe. The signup form is protected against automated abuse by Cloudflare Turnstile (Cloudflare, Inc.). The check script is only loaded once you start using the form. According to Cloudflare, it processes your IP address, a TLS fingerprint, the browser identifier (user agent) as well as our form's key and its origin. For protecting our form Cloudflare acts on our behalf; to improve its own bot detection Cloudflare additionally processes the same details under its own responsibility. The legal basis for our part is our legitimate interest in preventing spam and automated signups (Art. 6(1)(f) GDPR).

23. Additional recipients on the website

• Resend (Plus Five Five, Inc., USA) – sending the confirmation and notification emails for this website's waitlist. Data transfers on the basis of Standard Contractual Clauses and additionally on the basis of the EU-US Data Privacy Framework.