Privacy Policy

Data Controller

Lukas Kitzberger Email: datenschutz@train-smarter.at

Data Categories Collected

We process the following categories of personal data:

• Master data: Name, email address, date of birth, gender, address (street and number, postal code, town, country — optional, purpose: invoicing by your coach), height, sport, role (Coach/Athlete)
• Access data: Email address, encrypted password
• Body and wellness data (only with explicit consent): Weight, body measurements, sleep quality, wellness score
• Nutrition data (only with explicit consent): Nutrition diary, macronutrients
• Usage data: IP address (upon consent), session data, timestamps
• Training data: Training plans, programs, sessions
• Athlete record and coach entries: the master data your coach keeps about you, plus their entries about you — notes, competitions, health and training plans. This is your coach documentation; you cannot view these entries in the app.

Legal Basis

The processing of your data is based on:

• Art. 6(1)(a) GDPR (Consent) — for body, wellness, and nutrition data you enter yourself
• Art. 6(1)(b) GDPR (Contract performance) — for master and training data
• Art. 9(2)(a) GDPR (Explicit consent) — body data you enter yourself is treated as health data
• Art. 6(1)(b) GDPR (Contract performance) and Art. 9(2)(a) GDPR — for the athlete record your coach keeps and the entries they write about you, including those on health. The basis is the written coach-athlete agreement, signed by the legal guardians in the case of minors; the app does not ask for a separate consent. It is withdrawn in writing towards your coach or at datenschutz@train-smarter.at.

Purpose of Processing

Your data is processed exclusively for providing the Train Smarter platform: training planning, athlete management, progress tracking, and communication between coach and athlete.

Storage Duration

Personal data is stored as long as your account is active. After a deletion request your account is suspended and a 30-day grace period applies, during which you can take the deletion back yourself. After that, your account and the content you created yourself are deleted. What is not deleted is the record your coach keeps about you: first and last name, date of birth, gender, address, height and sport, along with their entries about you, stay with them — that is their documentation under the written coach-athlete agreement. The link to your account is removed in the process. If no coach is responsible for you any more, the record is deleted in the same step. Audit log entries are retained for 12 months; the daily backup keeps a full copy for another 30 days. Invitations are valid for 7 days; expired invitations are automatically deleted after a grace period.

Data Processors

We use the following data processors. A data processing agreement under Art. 28 GDPR is in place with each of them. Where a third-country transfer to the USA takes place (Sentry), this is explained at the respective data processor:

• Supabase Inc. — Database, authentication, storage (Region: eu-central-1, Frankfurt)
• Vercel Inc. — Hosting, Edge Functions (EU region fra1, Frankfurt)
• Functional Software, Inc. (Sentry) — Error tracking and performance monitoring (Region: de.sentry.io, Frankfurt). Third-country transfer to the USA via EU-US Data Privacy Framework and EU Standard Contractual Clauses. Processed data: anonymized error logs with user IDs (UUID), stack traces and web vitals — no personal cleartext data such as email or names. Privacy policy: https://sentry.io/privacy/
• webgo GmbH — Email delivery and mailboxes for the train-smarter.at domain (registered office: Wendenstraße 8–12, 20097 Hamburg, Germany; data centre in Hamburg). Data processed: recipient address, sender name and the full message content of every email we send, plus every message received at a train-smarter.at address. Processing is contractually restricted to the EU/EEA. Privacy policy: https://www.webgo.de/datenschutz/

Cookies and Local Storage

Our website uses only technically necessary cookies that are essential for operating the platform. A cookie consent banner is therefore not required.

Authentication Cookie

For login and session maintenance, we set an authentication cookie (HttpOnly, Secure, SameSite=Lax). This cookie contains an encrypted token to identify your session — no personal data in plain text.

Session Duration

The duration of your session depends on your choice at login:

• Default (without 'Remember me'): Your session ends when you close the browser.
• With 'Remember me': Your session remains active for up to 30 days or until you manually sign out.

Local Storage

We use your browser's local storage solely for your display preferences (e.g., sidebar state, preferred view). This data does not leave your device and is not transmitted to our servers.

Legal basis: Art. 6(1)(b) GDPR (performance of contract). These cookies are technically necessary and exempt from the consent requirement under the ePrivacy Directive.

Your Rights

You have the following rights under GDPR:

• Right of access (Art. 15) — Overview of your stored data in Privacy Settings. The entries your coach keeps about you are listed there as a category only and cannot be read in full; you can request their content at datenschutz@train-smarter.at.
• Right to rectification (Art. 16) — you can change your name, your date of birth and your profile picture yourself under My Account. If a coach keeps a record about you, gender and address are there too; your coach sees and edits the same master data, and the version saved last applies. For anything else, reach us at datenschutz@train-smarter.at.
• Right to erasure (Art. 17) — Account deletion under Privacy Settings; revocable by you for 30 days via the link in the confirmation email
• Right to data portability (Art. 20) — Data export under Privacy Settings
• Right to object (Art. 21) — you can object to processing we base on a legitimate interest. Write to us at datenschutz@train-smarter.at.
• Right to withdraw consent (Art. 7(3)) — you can withdraw any consent you gave at any time under Privacy Settings, just as easily as you gave it. Withdrawal takes effect immediately and does not affect processing before that point.

Contact

For privacy requests beyond self-service, contact us at: datenschutz@train-smarter.at

Right to Complaint

You have the right to file a complaint with the Austrian Data Protection Authority: Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at