Trainingszettel

Privacy Policy

This English translation is provided for your convenience; in case of any discrepancy, the German version is the legally binding one.

Last updated: 23 September 2026

1. The most important part first

Trainingszettel is deliberately built so that your training data never leaves your device. Everything you enter — your profile name, your training plans, your logged sets with weight and reps — is stored exclusively locally in your browser (localStorage / IndexedDB). This data is never transmitted to any server, neither to me nor to third parties. There are no user accounts, no login, no mandatory email. No cookies are set. For basic reach measurement I only use the self-hosted, cookieless analytics tool Matomo, which records anonymous page views only (see section 5) — it never sees your training data.

Because your training data never reaches my servers, I do not process any health data about you within the meaning of Art. 9 GDPR. You retain full control: you can export your data as a file (backup) at any time and delete it completely from your browser with one click.

2. Controller

Christian Götze
Rathenaustr. 3, 16761 Hennigsdorf, Germany
Email: gym@trainingszettel.de
Phone: +49 33022015238

3. Local storage of your training data

The application stores your profiles, plans and workout logs in your browser's local storage (localStorage / IndexedDB) as strictly necessary for the app to work and to let you find your data again on your next visit. This storage happens locally on your device; the data is not visible to me and is not transmitted.

Offline capability (service worker): So the app also loads without an internet connection — say, in a gym basement with no reception — your browser sets up a so-called service worker when you use the app and keeps the app's interface in a local cache (Cache Storage). This cache contains only the app's own technical files, never your training data, and sends nothing to me or to third parties. It is only set up once you open the actual app — merely reading these information pages stores nothing on your device. You can remove the service worker and cache at any time by clearing this site's data in your browser.

The legal basis for this exclusively local, strictly necessary storage (localStorage / IndexedDB and the service-worker cache) is § 25 (2) no. 2 TDDDG (strictly necessary for the service you explicitly requested) and Art. 6 (1) (f) GDPR.

4. Hosting and server log files

The site is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, on servers in Germany. The domain’s DNS zones are operated there as well; the authoritative name servers are located in Germany. A data-processing agreement under Art. 28 GDPR is in place with the host.

Every request passes through a front-end web server (Traefik) that writes an access log on the same machine. It contains: the full IP address of your connection — it is neither truncated nor anonymised at this point — date and time, the requested address including its parameters, the HTTP method, the status code, the amount of data transferred, the processing time, and the headers your browser sends, in particular the user agent and the referring page. Credentials and cookie headers are not written.

The purpose is to deliver the site and to ensure secure, reliable operation, including troubleshooting (Art. 6 (1) (f) GDPR). The log stays on the same server in Germany and is not passed to any external service provider; the only exception is the reporting of attacker addresses described below.

Storage period: the log is rotated daily and at most 30 older generations are kept, so an entry is deleted after 31 days at the latest. Further application log output is deleted after 30 days. If a specific security incident is being investigated, the entries concerned may be kept until it is resolved.

Defence against attacks (CrowdSec): the same access log is evaluated automatically by the open-source security software CrowdSec on the same server. It recognises patterns such as mass login attempts or probing for known vulnerabilities, and it decides on the basis of the IP address: a conspicuous address is blocked for 96 hours, a conspicuous address range for 24 hours. IP addresses that attacks originate from are additionally reported, together with the type and time of the attack, to CrowdSec SAS (Paris, France) and feed a shared block list there. Only addresses that stood out as attackers are reported; ordinary use of this site is not reported. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in IT security). A block expires by itself; if you consider one unjustified, write to me at the address above.

5. Web analytics with Matomo

For basic reach measurement — to understand how many people visit and which pages are viewed — I use Matomo, an open-source analytics tool that I self-host on servers in Germany (matomo.trainingszettel.de). It sets no cookies, your IP address is anonymised, and there is no cross-device tracking and no profiling. Only anonymous page-access data is recorded (e.g. the page visited, approximate region, browser type, referring page). Inside the app itself (dashboard, workouts, history, …) no page views are recorded — Matomo only runs on the public pages. Matomo never sees your training data — that stays in your browser. If your browser sends the "Do Not Track" signal, Matomo is not loaded. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in data-minimal reach measurement).

6. Anonymous usage counts

In addition, you can voluntarily enable in the settings the counting of a few purely anonymous aggregate events — for example how often the app is opened, or how many workouts have been completed in total (across all users). This feature is off by default and only becomes active with your consent. Only the event type is then transmitted (e.g. "app_open" or "workout_completed"), without cookies, without storing your IP address, without any identifier and with no reference to you, your profile or your training content. These plain sum counters cannot be traced back to individuals. The legal basis is your consent under Art. 6 (1) (a) GDPR, which you can withdraw at any time in the settings.

7. Encryption

Transmission is exclusively encrypted via HTTPS (TLS).

8. Contact via the contact form

On the “Contact” page you can use a form to send me a message. The following personal data is collected:

You must also activate a checkbox. By doing so you give your explicit consent that your data (name and email address) may be processed and stored for the purpose of handling your enquiry.

To protect against spam we use the self-hosted Altcha system (a privacy-friendly proof-of-work alternative to traditional CAPTCHAs). Your browser solves a short computational challenge; no data is sent to third parties such as Google.

The submitted data is validated on the server and the Altcha solution is verified. A valid message is forwarded to me by email: it is delivered via rapidmail GmbH (see section 9) and arrives in my mailbox at Proton AG in Geneva, Switzerland. For Switzerland an adequacy decision of the EU Commission is in place (Art. 45 GDPR). Contact messages are not stored long-term on this website’s server. The data is deleted once your enquiry has been handled and there are no legal retention obligations.

The legal basis is your consent under Art. 6 (1) (a) GDPR (by ticking the checkbox). You can withdraw this consent at any time (e.g. by email).

You can of course also contact me directly by email; those messages also arrive in the mailbox at Proton AG. In that case I process your details solely to handle your enquiry on the basis of Art. 6 (1) (f) GDPR (legitimate interest).

9. Disclosure to third parties

Your data is not disclosed to third parties, except to the following recipients:

Hosting and email delivery take place in Germany, the report to CrowdSec in France — that is, within the European Union. The mailbox is located in Switzerland; for Switzerland an adequacy decision of the EU Commission pursuant to Art. 45 GDPR is in place. There is no further transfer to third countries.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and the right to object (Art. 21 GDPR). As your training data lives exclusively on your device, you can exercise these rights over that data yourself at any time (view, export, delete).

11. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for the controller is the State Commissioner for Data Protection and the Right to Access Information of Brandenburg.

12. Changes to this policy

I update this privacy policy whenever changes to the app make it necessary. The version published here applies.