Privacy policy

This English translation is provided for convenience. Only the German version is legally binding.

This page explains which data Kreidebuch processes, for what purpose, where it is stored and how you can delete it or take it with you.

1. Controller

The Goodie Company GmbH
Siedlerstraße 4b, 97230 Estenfeld, Germany
Represented by its Managing Director Thomas Kalina
Email: info@thegoodiecompany.de · Phone: 0160 / 947 18 976

For any questions about data protection and for exercising your rights, an email to this address is sufficient. Our company is not legally required to appoint a data protection officer.

2. Server, encryption and logs

Kreidebuch runs on a server operated by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in its data center in Helsinki, Finland, i.e. within the EU. Hetzner processes the data solely on our behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR.

All connections are encrypted via TLS (HTTPS). Fonts and all parts of the program are loaded from our own server; there are no connections to Google Fonts or other third-party servers unless you start a video (see YouTube).

With every request, the server stores technical logs: IP address, date and time, requested address, status code, amount of data transferred, browser and operating system (user agent) and the previously visited page. Login data and passwords are not included. The purpose is secure operation: detecting attacks and finding errors. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR.

• Web server logs are deleted automatically after 30 days.
• App database logs are deleted automatically after 5 days.

Website kreidebuch.de: The website with information about Kreidebuch runs on the same server. It does not set cookies, does not use analytics services and does not load anything from third-party servers. The server logs described above apply to visits. What you enter in the form “Cancel contracts here” is described in Section 11.

For backup purposes, we create a daily copy of the database and the photos on the same server. Each backup is deleted after 30 days.

3. Account

An account can only be created through a personal invitation; there is no open registration. We store your email address, your name and your password, which is only stored in encrypted (hashed) form. For the invitation, we store the invitation code, who sent the invitation, the name the inviting person noted for it, and when the invitation was redeemed. The person who invited you sees your name and the date on which you created your account in their invitation list, but not your email address or any of your data. We use this data to log you in and to assign your entries to your account. We do not send advertising emails.

Refer friends: If someone invited you and you take out a paid Premium subscription, the server records the start of the subscription on the invitation. After the 14-day withdrawal period has expired, it checks whether your subscription is still active; if so, the person who invited you receives one month of Premium. In their invitation list, they see that you have taken out a subscription and from when the reward applies (“Subscription, reward from …”, later “Month gifted”); they do not see which subscription, your payment data or your entries. If they have an active subscription themselves, we credit the monthly fee to them as a balance via Stripe (Section 10). To prevent a reward from being triggered more than once or by referring yourself, the server queries Stripe before granting it for the identifiers of the payment methods with which you and the inviting person paid (for cards and direct debit, a code assigned by Stripe, not a card or account number). We store these identifiers on the invitation; the inviting person does not see them. If it is the same payment method as that of the inviting person, there is no reward. If the same payment method has already triggered a reward before, for example in a family sharing one card, the reward is still granted; we note this on the invitation and review the case. If one of your payments was refunded or charged back, there is no reward; the server also checks this with Stripe before granting it. The legal basis is the performance of the user agreement with the inviting person (Art. 6(1)(b) GDPR) and our legitimate interest in granting rewards only for members who actually pay (Art. 6(1)(f) GDPR).

The legal basis is the use of the app pursuant to Art. 6(1)(b) GDPR. Kreidebuch is intended for persons aged 16 and over.

4. Training and body data

We store what you enter: workouts, results, weights, sets, notes, your rating after training, planned workouts, templates and settings. In your profile, you can voluntarily state your gender and year of birth; the app uses these to calculate Rx weights and standards. You can also enter your body weight, body measurements (circumferences in centimeters, body fat in percent), the equipment in your home gym and daily goals (for example 50 push-ups a day); for daily goals, each set is stored with date and time.

From your entries, the app calculates insights on your device such as strength score, muscle groups, weekly report and year in review. No additional data is collected for this.

Body weight, body measurements, progress photos and training information may allow conclusions to be drawn about your health and are then considered health data. We only process such data with your explicit consent pursuant to Art. 9(2)(a) GDPR, which you give when you first start the app. You can withdraw your consent at any time with effect for the future by deleting your account or writing to us.

Your entries are visible only to you. With every request, the server checks that only you access your data. The levels shown in the app (for example “Advanced”) are for guidance only; there is no automated decision-making with legal effect.

5. Photos, images and profile picture

You can attach photos to workouts, save progress photos with your body measurements, attach images to planned sessions (for example a screenshot from your box's app) and upload a profile picture. All of this is voluntary. Progress photos show your body and therefore count as health data within the meaning of Section 4.

• Photos are already resized and re-saved on your device. In the process, embedded metadata such as the location where the photo was taken (GPS) and the camera model are removed.
• The files are protected: they can only be retrieved with a short-lived access authorization from your own account. Other accounts cannot see them.
• If you delete a photo, an entry or your account, the file is removed from the server (from the backups no later than after 30 days).

Please do not upload images of other people without their consent.

Share as image: Images for personal bests, workouts, weight history, weekly report or year in review are created on your device and are not uploaded. They contain neither your name nor your body weight; if you share your weight history, it only shows the change in the selected period (for example “−3.5 kg in 90 days”). You decide where you pass them on (for example Instagram or WhatsApp); the terms of the respective service apply there.

6. Workout from image (text recognition)

When you import a workout from a screenshot or photo, the text is recognized directly on your device. The program for this comes from our server; the image is not uploaded for this purpose. It only reaches the server if you explicitly attach it to a planned session.

7. Shared templates and shared plans

If you share a workout template, all persons with a Kreidebuch account see the workout and the name from your profile as its creator. They can use and copy the template but not change it. You can turn sharing off again at any time; your results always remain private. The legal basis is your consent given by sharing (Art. 6(1)(a) GDPR).

If you share your training plan as a program (for example as a coach for your box), all persons with a Kreidebuch account see the name of the program, your name from your profile and your planned sessions (date, workout, note on the session and images attached to the session). Anyone who follows the program sees the sessions in their own plan but cannot change them. Your results, your history and your weight remain private. We store whom you follow only in your profile; the owner of the program does not see who follows it. You can turn sharing off at any time; the sessions are then immediately no longer visible. The legal basis is your consent given by sharing (Art. 6(1)(a) GDPR).

8. Reminders via push notification

Reminders (“No training yet today?”, “Time to step on the scale”) are turned off until you turn them on in your profile and your device has asked for permission. We then store a delivery address of your device with keys as well as the selected times and days of the week.

If you turn on the weekly report, the server counts your training days of the current and the previous week on Sundays at the selected time and sends you a notification with these numbers. The full report is calculated by the app on your device.

If you have set up daily goals with reminder times, the server checks at these times whether the day's goal has already been reached and only sends a notification if something is still missing. It names the exercise and your progress, for example “20 of 50 push-ups”.

Users who are allowed to invite friends also receive a notification as soon as someone has registered via one of their invitation links, and again when they receive a month of Premium for it. It contains the first name of the new person and can be turned off in your profile under “Invite friends”. This notification is also only sent if you have allowed notifications on your device.

Notifications are delivered via the push service of the manufacturer of your browser or operating system: Apple (Apple Push Notification Service), Google (Firebase Cloud Messaging) or Mozilla. This service receives the delivery address and the encrypted notification and may process technical data such as your device's IP address in the process; processing in the USA is possible. Apple and Google are certified under the EU-U.S. Data Privacy Framework.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can turn off the reminders at any time in your profile or in your device settings.

9. Feedback

If you send us a message via “Send feedback”, we store your text, the selected type (bug, idea, question), your name from your profile, the page of the app you were on, the app version and your browser's identifier (device type and version). Training data is not sent along. The feedback can only be read by the persons who maintain Kreidebuch. We use it to fix bugs and improve the app. The legal basis is your request that we take care of it (Art. 6(1)(b) GDPR) and our legitimate interest in a functioning app (Art. 6(1)(f) GDPR). Feedback is deleted together with your account.

10. Premium subscription and payment (Stripe)

If you take out Premium, payment is processed by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). You enter your payment data (for example card number or bank details) directly on Stripe's payment page; we neither see nor store it. Stripe receives from us your email address, your name and an internal identifier of your account and also processes the payment data, your billing address, information about your device and your IP address, including for fraud prevention. Stripe may process data in the USA and is certified under the EU-U.S. Data Privacy Framework. For more information, see Stripe's privacy policy.

We only store: which plan (monthly or annual), since when and until when Premium runs, whether it has been cancelled, the customer and subscription identifiers at Stripe, and the time at which you confirmed at checkout that you are at least 18 years old (Premium is available from age 18). Invoices and payments are held by Stripe; you can get there via “Payment and invoices” in your profile.

The legal basis is the performance of the subscription contract (Art. 6(1)(b) GDPR) and our legal obligation to retain invoices and accounting records (Art. 6(1)(c) GDPR, Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)). If you delete your account, any active subscription ends immediately; due to this obligation, the invoice and payment data at Stripe remains stored for up to ten years.

11. Cancellation without logging in

On the website under “Cancel contracts here”, you can cancel Premium without logging in (Section 312k of the German Civil Code (BGB)). In doing so, we store what you enter: name, email address, contract, type of cancellation, in the case of an extraordinary termination the reason and the requested date, as well as the time of receipt and an irreversible hash value of your IP address, which we use to slow down mass requests. If there is an account for the email address, we link the declaration to it and end any active subscription via Stripe at the end of its term. We send the confirmation to the account's email address, otherwise to the address entered.

The purpose is to carry out the cancellation, confirm it to you and be able to prove it later. The legal basis is our legal obligation under Section 312k BGB (Art. 6(1)(c) GDPR) and the handling of your contract (Art. 6(1)(b) GDPR). We retain the declaration until the end of the regular limitation period, i.e. three years from the end of the year in which it was received, and then delete it.

12. Exercise videos (YouTube)

Videos from YouTube may be linked to exercises, including ones you add yourself. They are only loaded when you tap “Play video”; before that, the app does not connect to YouTube.

After you tap, the video is loaded via youtube-nocookie.com from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). In the process, Google receives at least your IP address and information about your device and may process data in the USA; Google is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent given by tapping (Art. 6(1)(a) GDPR). For more information, see Google's privacy policy.

13. Storage on your device

So that the app starts quickly and also works without a network connection, it stores the following on your device:

• your login (an access token so that you stay logged in),
• a copy of your data and entries not yet transmitted (offline mode),
• settings such as the timer view,
• the app's program files.

This is strictly necessary for the function you requested (Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG)). There are no advertising or analytics cookies. When you log out, your data is removed from this device.

14. Retention period, deletion and export

Your data remains stored as long as your account exists. You can delete individual entries, photos, planned sessions and templates yourself at any time.

• Delete account: In your profile under “Delete account”. All your data is removed immediately: workouts, photos, body weight, body measurements including progress photos, plans, templates (including shared ones), feedback and push delivery addresses. Any active subscription ends; invoice data at Stripe remains due to the retention obligation (Section 10). It disappears from the backups no later than after 30 days.
• Export data: In your profile under “Export my data”, you receive all your entries as a file (JSON) or as a spreadsheet (CSV) for workouts, lift sets and body values, for example for Excel or another app (Art. 20 GDPR).

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)).

You also have the right to lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

16. Changes

If the app or the technology changes, we will update this policy. We will inform you about material changes in the app.

Last updated: October 21, 2026