WorkoutBro — Privacy Policy

The data controller responsible for processing your personal data is:

3D Print Corner · Anastasiia Miroshnichenko
Ehrenbergstraße 8, 10245 Berlin, Germany
Email: coffeeonchainsol@gmail.com

We collect:

• Solana wallet address (used as your identity)
• Workout data: exercises, sets, reps, weights, timestamps
• Workout templates you create and publish
• Community interactions: likes, saves, purchases
• X (Twitter) username and avatar (only if you connect your account)
• JWT authentication tokens (24-hour expiry)

We do NOT collect:

• Email addresses, passwords, or phone numbers
• Real names (unless you voluntarily set a username)
• IP addresses or device fingerprints
• Location data
• Private keys or seed phrases

• Art. 6(1)(b) — Contract performance: Processing workout data and marketplace transactions to provide the Service.
• Art. 6(1)(f) — Legitimate interest: Improving the Service, preventing abuse, ensuring security.
• Art. 6(1)(a) — Consent: Optional features such as X account connection and on-chain proof saving.

When you save a workout proof on-chain, a SHA-256 hash of your workout summary is permanently stored on the Solana blockchain. This hash cannot be reversed to reveal your workout details. Your wallet address is publicly visible in the transaction. On-chain data cannot be deleted due to the immutable nature of blockchain technology.

Marketplace purchases are also recorded on-chain, including buyer wallet address, creator wallet address, and payment amount.

• Workout data: Retained for the lifetime of your account. You may request deletion at any time.
• JWT tokens: 24-hour expiry, stored in device memory only.
• Community data (likes, saves): Retained while your account is active.
• Purchase records: Retained permanently for transaction verification.
• On-chain proofs: Permanent (blockchain is immutable).

Data is stored on servers provided by Neon (PostgreSQL database, US) and Netlify (serverless functions, US).

You have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erase your data ("right to be forgotten") (Art. 17) — except on-chain data
• Restrict processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)

To exercise any of these rights, contact us at coffeeonchainsol@gmail.com.

Your data may be transferred to and processed in the United States (Neon database, Netlify hosting). We ensure appropriate safeguards through Standard Contractual Clauses (SCCs) as required by GDPR Chapter V.

• Solana blockchain: On-chain workout proofs and marketplace transactions
• Neon (PostgreSQL): Workout data storage
• Netlify: Backend hosting and serverless functions
• X (Twitter): Optional account linking (OAuth 2.0 PKCE)
• wger.de: Exercise images (CC-licensed, no user data shared)

WorkoutBro does not use automated decision-making or profiling that produces legal effects concerning you (Art. 22 GDPR). Streak calculations and statistics are purely informational.

We implement appropriate technical and organizational measures including: JWT-based authentication with signature verification, parameterized database queries (SQL injection prevention), CORS restrictions, HMAC-signed OAuth state, and on-chain purchase verification.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219, 10969 Berlin, Germany
Email: mailbox@datenschutz-berlin.de

We may update this Privacy Policy from time to time. Material changes will be communicated through the App.