Privacy policy
[DRAFT PENDING PROFESSIONAL REVIEW]
What we collect: identifying data (name, email, date of birth, club, and your phone number and profile photo if there are any), the service plan agreed with your physical trainer (which one and between which dates, to manage the service), sports-monitoring data and the health data recorded by you or your physical trainer (weight, height and body fat percentage, injuries with type, severity and status, the injuries you had had before the monitoring started (what it was, the year, the recovery time and whether there was surgery), your own 1 to 10 rating of nine physical capacities with where you are and where you want to get to, of which several dated sheets are kept (you write it; your physical trainer can also open a new one for you), RPE, discomfort — including issues you report from the app outside the questionnaire —, wellness questionnaire, groupings of your discomfort made by your physical trainer (area, dates and note), physical test results with the derived asymmetry and the percentage change from the previous test, Whoop values if you wear one, free-text calendar comments, tasks you write on your calendar lines, messages you exchange with your physical trainer, written or as voice notes, and videos of you doing an exercise, which you record or pick from your phone, with your notes and the corrections they send back, written or on video), the meal plan your club or its nutritionist sends you (see below), and the time zone your device reports (see below). You must be 16 or older to have a player account.
Your device's time zone: the player app tells us which time zone the phone is in each time you open it and each time you return to it after leaving it in the background, and we store it along with the moment it said so. This is so that your "today" — the questionnaire, the reminder and the work count — follows your clock and not your physical trainer's, who can correct it from your record. When a change of zone cuts a day short for you, that day is stored with the zone before and after, so that the work pending on that day is not recorded as undone. No location or coordinates are stored: a time zone is a whole country or region.
The meal plan: it is not made by your physical trainer. It comes from outside — from your club or its nutritionist, and sometimes you bring it yourself — and they put it on your day, sometimes importing it straight from the nutritionist's sheet; the application shows it to you, and it is not their prescription. For each plan we store where it came from and the day it arrived. If the original sheet arrives as a document, we keep it as it comes, with every version: removing it from your day does not delete any of them, and only your physical trainer can open it, and you can ask them for a copy. All of this appears in the file with all your data, and you keep seeing the meal plan even if you withdraw your health-data consent.
Why: for your sports monitoring with your physical trainer. Health data is only processed with your explicit, versioned consent; you can withdraw it yourself at any time from "Privacy and account" inside the app — the app stops storing new health data and does not delete what is already there — or by talking to your physical trainer or to X-Datik.
Who sees it: you and your physical trainer. A contracting party (club or agent paying for the service) NEVER sees your health data. Whenever the content of your health data is read — questionnaire answers, values, injuries, comments, tasks, messages and voice notes, your exercise videos and the sheet of your meal plan — who read it, what and when is logged, whether the read is your physical trainer's or your own. It is also logged when you correct or delete discomfort you had reported. Screens that only say whether something exists or is already done, without showing its content, leave no log; neither does your own calendar, where you see what you wrote yourself. Your physical trainer can review this log. Your physical trainer can also open your app exactly as you see it, to help you with what is on your screen; while doing so they cannot write or change anything, and the health data they look at is logged; within a single visit, looking at the same thing again does not add a new entry.
Your rights: you can download all your data from the app and request account deletion; the request is recorded and executed following the processing-agreement procedure. For any access, rectification or erasure right, talk to your physical trainer or to X-Datik. And if you believe your data is not being handled properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es: that right is always yours and you do not have to come to us first.
Phone notifications: if you turn them on, we store your browser's push subscription (a delivery address and its keys) — or, in the app installed on an iPhone, the identifier Apple gives your device to receive them — and a description of the device, so you can revoke them from the app. The notification text never carries your name or any health data. Delivery goes through the browser's or phone's push service (Google, Mozilla or Apple, depending on the device). In the browser, that service sees that a message reaches you and when, but not its content, which travels encrypted. In the iPhone app, Apple also sees the notification text — which is only the category — and which screen of the app it opens.
Email notifications: every notification that is created is also sent by email, as a backup to the phone notification. It has no switch of its own: it always accompanies whichever notification you have turned on. The subject and the text state only the category of the event, never your name or any health data. The email service that delivers it sees the recipient's address, the time it was sent and that category, never the content of any comment or message.
Public-website contact form: if you use it, we store your name, your email, the text of the message and the IP address you send it from. The IP is only used to limit submissions and prevent spam, never for anything else, and is discarded after 24 hours. Your name, your email and the message are kept until the trainer deletes them from his panel, and you can ask him to do so at any time. The notification for this message is sent by email and, unlike the app's notifications, it does carry the full content: the email service that delivers it sees your name, your email and the text you wrote.
Signing in, signing up and password recovery: every time someone tries to sign in, sign up, ask for a password or open an invitation link, we count the attempt in order to limit how many there can be and to stop automated attacks. We store neither the IP address nor the email: only a code derived from them with a secret key, from which they cannot be read back. This counter serves no other purpose and is deleted after two hours.
How long we keep it: for as long as the monitoring with the physical trainer lasts, and 5 more years from when it ends — when the physical trainer archives you — because the whole point of this data is being comparable with what came before, also if you come back within those years. After those 5 years, the controller deletes it: it is not automatic, the application tells them it is due. There is one shorter exception: the notes about days that a time-zone change cut short for you are deleted automatically after sixty days, because past that point they serve no purpose. Videos, voice notes and meal-plan sheets follow the general rule. If you request account deletion before that, the request is recorded and the deletion is carried out by the controller following the processing-agreement procedure. Once deleted, the data is only kept blocked — nobody can look at it or use it — for the time the law requires to deal with possible claims, and it may still remain for up to about ten days in the server's encrypted backups, which renew themselves. The log of who has read your health data is kept for as long as the account exists, because it is what lets you know who accessed it. The three exceptions with a term of their own are the contact-form IP address (24 hours), the sign-in attempt counter (two hours) and the discomfort report left on your device while offline (one month).
Automated decisions: the readiness indicator and the alerts are computed automatically from what each player records, and they exist so the physical trainer knows who to look at first. They do have one automatic effect, and this is it: he gets a notification to look at your case before the others, and that notification disappears from his list if he has not read it yet and the value returns to normal. No decision in your monitoring is taken by the application: what you train, when you stop and when you come back is always decided by him, and you can ask him to explain any alert and where it comes from.
Where the data lives: the server and the database are in Germany (Hetzner). The domain is managed by Cloudflare, which only resolves its address (DNS): traffic goes straight from your device to the server in Germany, without passing through Cloudflare. Email is delivered by Brevo, in France. Videos, photos, voice notes and meal-plan sheets are stored on that same server in Germany, on a disk belonging to the application, and are not passed to any other service: when you watch them, that server delivers them to you directly and always after checking that you have access.