Gymskra Privacy Policy
Version 1.0 · Last updated: 8 November 2026 · Effective: 8 November 2026
This policy explains which personal data the Gymskra app and its servers process, why, who receives it, how long we keep it, and what rights you have. It describes the app as it exists today. Before any feature processes your data in a new way, we update this policy first.
In short
- We collect your account (name, email, sign-in method), your training data (workouts, sets, loads, programs, and the statistics and progression derived from them), your settings, and error reports when something breaks.
- We use it to run the app, sync and back up your data, keep your account secure, fix errors, and compute aggregate statistics that never identify you.
- We do not collect health or body data, location, or advertising identifiers. No ads, no third-party analytics software, no selling of data, no marketing email.
- Providers of hosting, app updates, email, and error tracking process data for us under contract: Hetzner, Cloudflare, Sentry, Resend, Expo, and Google Workspace for our mailbox. Some are US companies; transfers rest on the EU-US Data Privacy Framework or Standard Contractual Clauses.
- We keep your data until you delete your account. Encrypted backups expire within 12 months.
- Delete your account in the app under Account → Delete account, or request it at gymskra.hr/delete-account. You can object to the aggregate statistics at any time.
- If you link a partner gym, the gym sees your membership and your check-ins there, never your workouts.
The sections below are the full policy.
1. Who is responsible
The controller of your personal data is:
CODESKRA, obrt za računalno programiranje, vl. Danijel Katarić
Ulica Frana Folnegovića 6A
10000 Zagreb, Croatia
MBO: 99368706
Email: info@gymskra.com
CODESKRA is a registered sole trade (obrt) owned by Danijel Katarić. A sole trade has no legal personality separate from its owner, so the person responsible for your data is its owner.
2. What this policy covers
The Gymskra app for iOS and Android, the servers at api.gymskra.com that the app communicates with, the website gymskra.hr, and the two tools partner gyms use: the staff dashboard for managing memberships and the entrance scanner on the gym’s tablet that reads entry QR codes. The public website uses no cookies and no analytics. The staff dashboard uses one session cookie, required to keep you signed in; it carries no tracking. An account created on the web is the same account, under this same policy, as one created in the app.
3. Data we process
3.1 Account
- Your display name (the name you choose).
- Your email address.
- A profile image, only if your sign-in provider supplies one.
- Your sign-in method: email and password (the password is stored only as a cryptographic hash), Google, or Apple. From Google or Apple we receive the name and email address they share with us and an account identifier. Apple may give us a private relay address instead of your real email address.
- Email verification codes and links, valid for a short time.
3.2 Security and sessions
- For each sign-in session: a session token, the IP address, and the device or browser identifier (user agent). We use these to keep you signed in and to detect abuse.
- Request counters keyed by IP address and account, used to limit abusive traffic. These are held in memory only.
3.3 Training data
Everything you record in the app: workouts, exercises and variations, sets, loads, repetitions, rest times, duration, start and end times together with your time zone, programs and templates, the names and notes you type, muscle stimulus estimates, and the values derived from all of that: statistics (volume, peaks) and progression (XP, level, flashpoints, challenges, streaks, titles).
Text you type (workout names, notes, your finishing move label) is private to you. We do not review it.
Training data is stored in a database on your device and synced to our servers so that it is backed up and follows you to a new phone.
3.4 Preferences
Language, units, and app settings.
3.5 Diagnostics
When the app or our server hits an error, a report is sent to our error-tracking provider: device model, operating system version, app version, the error and its technical trace, and your account identifier. For an error on our server, the report also carries the IP address of the request. We do not send your name, email address, location, or advertising identifiers.
3.6 What we do not collect
- No body measurements or health data: no weight, height, heart rate, birth date, or sex.
- No location.
- No contacts, calendar, or photos on your device. The only image we hold is the account picture a sign-in provider may supply (section 3.1).
- No advertising identifiers.
- No third-party analytics or advertising software.
- We do not read the health apps on your device.
3.7 Partner gyms
If you link your account to a partner gym:
- Membership: the gym, your plan, its status, validity dates, and whether the gym has marked it as paid. This record is created by the gym.
- The gym’s register: the details the gym records for its membership contract, such as your legal name, OIB, phone number, or date of birth. Each gym chooses which of these it needs. Staff enter them at the desk; they are visible only to that gym, and the gym is responsible for them under its own privacy notice.
- Entry key: on each device you sign in on, the app generates a pair of cryptographic keys. The private key never leaves that device. The public key is sent to our servers so that the gym’s scanner can verify your entry QR code; with it we keep whether the device is an iPhone or an Android phone and when it last opened a door. A device’s key is removed when you sign out there, when you remove the device in the app, and when you delete your account.
- Check-ins: gym, time, activity, and the scanner that recorded the entry.
Your gym can see your membership and your check-ins at that gym. It cannot see your workouts, statistics, or progression, and it cannot see anything about other gyms you use.
If you come to the desk with another account, the gym can link its existing record of you to that account instead of opening a second one. An account that loses the record this way is told by email and can no longer open the door at that gym.
Roles: for your account and training data, Gymskra is the controller. For the gym’s member register and check-in log, the gym is the controller and Gymskra processes that data on the gym’s behalf under a data processing agreement.
If a gym stops using Gymskra, its member register and check-in log are returned to the gym and deleted from our systems. Your account, workouts and statistics are unaffected.
4. Why we process your data and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Provide the app: your account, sync, backup, restore on a new device | Account, training data, preferences | Performance of a contract, Art. 6(1)(b) |
| Sign-in, session security, prevention of abuse and fraud | Account, sessions, IP address, request counters | Contract, Art. 6(1)(b); legitimate interest in security, Art. 6(1)(f) |
| Fixing crashes and errors | Diagnostics | Legitimate interest in a working service, Art. 6(1)(f) |
| Transactional email: verification, security notices, deletion confirmation | Email address | Contract, Art. 6(1)(b) |
| Aggregate statistics about how Gymskra is used (section 5) | Training data; results contain no identity | Legitimate interest, Art. 6(1)(f); you may object |
| Legal obligations, requests from authorities, disputes | Whatever is required | Legal obligation, Art. 6(1)(c); legitimate interest, Art. 6(1)(f) |
| Gym features: linking, entry QR, check-ins | Membership, entry key, check-ins | Contract, Art. 6(1)(b), based on your request to link; the gym has its own basis for its register |
We do not send marketing email. If we ever want to, we will ask for your consent first, and you will be able to withdraw it at any time.
5. Aggregate statistics
We use training data to compute statistics about the app as a whole: for example the most used exercises, typical loads for an exercise, or how many workouts users log per week. The results are aggregated across many users, are never produced for groups smaller than ten people, and contain nothing that identifies you.
The computation itself uses your personal data, so you have the right to object under Article 21 GDPR. To object, turn off Usage statistics under Account → Privacy in the app, or write to the address in section 1. Objecting has no effect on your own statistics in the app.
6. Who receives your data
We do not sell personal data and we do not share it with advertisers. The providers below process data for us under contracts (data processing agreements) that bind them to our instructions.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers, database, primary encrypted backups | Germany (EU) |
| Cloudflare, Inc. | Secure network path between the app and our servers; second encrypted backup copy in an EU-jurisdiction bucket | EU network locations; US company |
| Functional Software, Inc. (Sentry) | Error reports (section 3.5) | EU region, Frankfurt, Germany; US company |
| Resend, Inc. | Sending transactional email | United States |
| 650 Industries, Inc. (Expo) | Delivering app updates. When the app checks for an update, the device sends its platform, app version and a random identifier of that installation, not linked to your account; Expo also sees the IP address of the request. If an update failed to start, the app reports which one and the error text | United States |
| Google LLC (Google Workspace) | Our mailbox at info@gymskra.com: receiving and answering the email you send us, including privacy and deletion requests | United States |
| Google and Apple | Optional sign-in providers. They act as independent controllers under their own privacy policies | — |
| Apple App Store and Google Play | App distribution. Independent controllers under their own privacy policies | — |
Backups are encrypted on our server before they are stored. The backup providers cannot read them.
7. Transfers outside the EU
Some of our providers are companies based in the United States. Transfers to them rest on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses included in our contracts with them.
8. How long we keep data
| Data | Retention |
|---|---|
| Account, training data, preferences | Until you delete your account (section 9) |
| Sessions | Until they expire or you sign out |
| Email verification codes | Until used or expired |
| Error reports | 90 days at our error-tracking provider |
| Server logs, which contain IP addresses | Kept 30 days at our error-tracking provider; the server itself keeps only the most recent entries |
| Email we send you | Our email provider keeps a copy, with your address, for 30 days |
| Backups | Daily backups are kept for 14 days, weekly backups for 8 weeks, monthly backups for 12 months. A deleted account remains inside these encrypted backups until they expire. Backups are never restored into the live service in a way that brings a deleted account back |
| Deletion log | A hash of the account identifier with the request and completion dates, kept as proof that a deletion happened. Kept indefinitely; it contains no identity |
| Aggregate statistics | Indefinitely. They contain no personal data |
| Membership register and check-in log | Determined by your gym as controller. After you delete your account, the link to your account is removed and the records stay with the gym |
9. Deleting your account
You can delete your account in the app under Account → Delete account. You can also request deletion without the app at gymskra.hr/delete-account; we verify the request by email.
What happens:
- You are signed out on every device immediately and a 14-day grace period begins. Sign in during this period and choose to keep your account, and the deletion is cancelled; signing in alone changes nothing.
- After 14 days we permanently delete your account, sessions, training data, statistics and progression, preferences, and entry keys.
- The app deletes its local database and its encryption key on the device where you requested deletion. If you have the app on another device, choose Sign out and remove data there, or reinstall the app.
- If you signed in with Apple, we revoke your Apple sign-in token as part of deletion.
- Backups expire as described in section 8.
- Aggregate statistics already computed remain. They contain no personal data.
- Your gym keeps its own member register and check-in log with the link to your account removed. Entering the gym with the app stops as soon as you request deletion; the membership itself is the gym’s and stays. Contact the gym about those records.
- If you are the only owner of a partner gym on Gymskra, we tell the gym that it needs a new owner, without your details, and our support inbox with your name and email address, so the handover can be arranged. The gym itself keeps working.
We send one confirmation email when deletion is complete, and nothing after that.
10. Your rights
Under the GDPR you have the right to:
- Access your data and receive a copy of it.
- Rectification of inaccurate data.
- Erasure (section 9).
- Restriction of processing.
- Data portability: receive your training data in a machine-readable format (JSON). Until an export exists in the app, request it by email and we deliver it within one month.
- Object to processing based on legitimate interest, including the aggregate statistics in section 5.
- Withdraw consent at any time where processing is based on consent. Currently no processing relies on consent.
- Complain to a supervisory authority. In Croatia this is the Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, azop@azop.hr, www.azop.hr. You may also complain to the authority in the EU country where you live.
To exercise a right, write to us from the email address on your account so we can verify that the request is yours. We respond within one month.
11. Security
All traffic between the app and our servers is encrypted (TLS). Passwords are stored only as cryptographic hashes. Database access is restricted to the service itself. Backups are encrypted before they leave our server. On your device, the app keeps your data in an encrypted database. Error reports carry no personal identifiers beyond your account ID and, for errors on our server, the IP address of the request. The private key for gym entry never leaves your device.
No system is perfectly secure. If a data breach affects you, we notify you and the supervisory authority as the law requires.
12. Children
Gymskra is not intended for children under 16. We do not knowingly process the data of anyone under 16. If you believe we do, contact us and we will delete it.
13. No automated decisions
Levels, XP, challenges, and other progression are game mechanics computed from your own training. They have no legal or similarly significant effect on you. We do no profiling for advertising.
14. Changes to this policy
Each version carries a date, and previous versions remain available at gymskra.hr/privacy/versions. Small changes such as contact details or wording are simply published here. A change that processes existing data in a new way is announced in the app or by email before it takes effect. Features you opt into later explain their data use at the moment you opt in.
15. Contact
CODESKRA, vl. Danijel Katarić, Ulica Frana Folnegovića 6A, 10000 Zagreb, Croatia
Email: info@gymskra.com