Trainingszettel

Privacy Policy

This English translation is provided for your convenience; in case of any discrepancy, the German version is the legally binding one.

Last updated: 2 September 2026

1. The most important part first

Trainingszettel is deliberately built so that your training data never leaves your device. Everything you enter — your profile name, your training plans, your logged sets with weight and reps — is stored exclusively locally in your browser (localStorage / IndexedDB). This data is never transmitted to any server, neither to me nor to third parties. There are no user accounts, no login, no mandatory email. No cookies are set. For basic reach measurement I only use the self-hosted, cookieless analytics tool Matomo, which records anonymous page views only (see section 5) — it never sees your training data.

Because your training data never reaches my servers, I do not process any health data about you within the meaning of Art. 9 GDPR. You retain full control: you can export your data as a file (backup) at any time and delete it completely from your browser with one click.

2. Controller

Christian Götze
Rathenaustr. 3, 16761 Hennigsdorf, Germany
Email: gym@trainingszettel.de
Phone: +49 33022015238

3. Local storage of your training data

The application stores your profiles, plans and workout logs in your browser's local storage (localStorage / IndexedDB) as strictly necessary for the app to work and to let you find your data again on your next visit. This storage happens locally on your device; the data is not visible to me and is not transmitted.

Offline capability (service worker): So the app also loads without an internet connection — say, in a gym basement with no reception — your browser sets up a so-called service worker when you use the app and keeps the app's interface in a local cache (Cache Storage). This cache contains only the app's own technical files, never your training data, and sends nothing to me or to third parties. It is only set up once you open the actual app — merely reading these information pages stores nothing on your device. You can remove the service worker and cache at any time by clearing this site's data in your browser.

The legal basis for this exclusively local, strictly necessary storage (localStorage / IndexedDB and the service-worker cache) is § 25 (2) no. 2 TDDDG (strictly necessary for the service you explicitly requested) and Art. 6 (1) (f) GDPR.

4. Hosting and server log files

The site is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, on servers in Germany. The domain’s DNS zones are operated there as well; the authoritative name servers are located in Germany. When the site is accessed, the server automatically processes technically necessary data sent by your browser: IP address, date and time of access, the requested URL, the amount of data transferred, the success message, and your browser type/version and operating system (user agent). The purpose is to deliver the site and ensure secure, functional operation (Art. 6 (1) (f) GDPR). Log data is stored only briefly and then deleted or anonymised. A data-processing agreement under Art. 28 GDPR is in place with the host.

5. Web analytics with Matomo

For basic reach measurement — to understand how many people visit and which pages are viewed — I use Matomo, an open-source analytics tool that I self-host on servers in Germany (matomo.trainingszettel.de). It sets no cookies, your IP address is anonymised, and there is no cross-device tracking and no profiling. Only anonymous page-access data is recorded (e.g. the page visited, approximate region, browser type, referring page). Inside the app itself (dashboard, workouts, history, …) no page views are recorded — Matomo only runs on the public pages. Matomo never sees your training data — that stays in your browser. If your browser sends the "Do Not Track" signal, Matomo is not loaded. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in data-minimal reach measurement).

6. Anonymous usage counts

In addition, you can voluntarily enable in the settings the counting of a few purely anonymous aggregate events — for example how often the app is opened, or how many workouts have been completed in total (across all users). This feature is off by default and only becomes active with your consent. Only the event type is then transmitted (e.g. "app_open" or "workout_completed"), without cookies, without storing your IP address, without any identifier and with no reference to you, your profile or your training content. These plain sum counters cannot be traced back to individuals. The legal basis is your consent under Art. 6 (1) (a) GDPR, which you can withdraw at any time in the settings.

7. Encryption

Transmission is exclusively encrypted via HTTPS (TLS).

8. Contact via the contact form

On the “Contact” page you can use a form to send me a message. The following personal data is collected:

You must also activate a checkbox. By doing so you give your explicit consent that your data (name and email address) may be processed and stored for the purpose of handling your enquiry.

To protect against spam we use the self-hosted Altcha system (a privacy-friendly proof-of-work alternative to traditional CAPTCHAs). Your browser solves a short computational challenge; no data is sent to third parties such as Google.

The submitted data is validated on the server and the Altcha solution is verified. A valid message is forwarded to me by email. Contact messages are not stored long-term on the server. The data is deleted once your enquiry has been handled and there are no legal retention obligations.

The legal basis is your consent under Art. 6 (1) (a) GDPR (by ticking the checkbox). You can withdraw this consent at any time (e.g. by email).

You can of course also contact me directly by email. In that case I process your details solely to handle your enquiry on the basis of Art. 6 (1) (f) GDPR (legitimate interest).

9. Disclosure to third parties

Your data is not disclosed to third parties, except to the following processors: the hosting provider named above and — for delivering the contact-form notification emails — rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg im Breisgau, Germany. This processing takes place within the European Union.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and the right to object (Art. 21 GDPR). As your training data lives exclusively on your device, you can exercise these rights over that data yourself at any time (view, export, delete).

11. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for the controller is the State Commissioner for Data Protection and the Right to Access Information of Brandenburg.

12. Changes to this policy

I update this privacy policy whenever changes to the app make it necessary. The version published here applies.