Privacy Policy
Last updated: 2026-08-31
This policy explains how IRONPEAK ("we") collects, uses, and protects your personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018.
1. Data we collect
1.1 Account and authentication
- Name, email address, password (bcrypt-encrypted), authentication method.
- Active sessions: IP address, user agent, creation/expiry timestamps.
- Audit log: security actions (login, data export, account deletion).
1.2 Fitness profile
- Sex, age, height, weight, goal, activity level — used for TDEE calculations.
1.3 Health data (special category, Art. 9 GDPR)
Processed solely based on your explicit consent (Art. 9(2)(a)). You may withdraw consent at any time from Settings → Privacy.
- Body weight and measurements (waist, hips, chest, arms, thighs).
- Workout log: sessions, exercises, sets, weights, RPE, personal records.
- Food diary: foods, quantities, macronutrients, water intake.
- Generated meal plans (based on nutritional profile).
- Supplement intake (type, dose, frequency).
- Progress photos (stored encrypted with AES-256-GCM; never shared with anyone else).
- Data imported from wearable devices — see section 7.
- Movement metrics from Form Check AI (joint angle, symmetry, score — video is never stored).
1.4 Community
- Feed posts (text, images), comments, reactions.
- Direct messages (DMs) between users.
- Follow relationships (who you follow).
- Group membership.
1.5 Coaching 1-on-1
- Coach matching questionnaire (goals, experience, availability, budget).
- Chat messages with your coach (text and media up to 30 seconds, stored in MinIO).
- Videos submitted for technique review (stored encrypted in MinIO; visible only to you and your assigned coach).
- Coach annotations on video frames (metadata + PNG images).
- Training plans assigned by your coach.
1.6 Online shop
- Delivery addresses (name, phone, full address).
- Orders (product snapshot, quantity, value, delivery status).
- Invoice data (snapshotted at order time).
- Product reviews and wishlist.
- Return requests (under Romanian Consumer Protection Law OUG 34/2014 — 30 days).
1.7 Gamification
- XP points earned per activity, current level, badges earned.
- Challenge participation.
- Leaderboard: your name and level appear in public rankings. You can disable this from Settings → Privacy.
1.8 Video on-demand and Audio
- Viewing progress (video title, position, completion, last viewed date).
- Audio workout progress (title, position, completion).
- Live class registrations (title, date, duration).
1.9 Web Push
- Device endpoint (unique browser/device URL) — stored for notification delivery.
- Notification preferences (enabled categories, quiet hours).
1.10 B2B Corporate (if you are an employee of a corporate client)
- Your employer's HR dashboard sees anonymized statistics only (k-anonymity k≥5). No individual health or activity data is shared with your employer.
- Organization members: email address (for invitation) and role within the organization.
1.11 Payments
- Subscriptions, shop orders, and 1-on-1 coaching payments may be processed, depending on the method chosen at checkout, by Stripe Inc. (USA), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg, with underlying processing in the USA), or Mollie B.V. (Netherlands). We never store your card details on our servers — each processor stores payment data under PCI-DSS standards.
- Recurring subscriptions can be activated via Stripe or Mollie (direct debit mandate). PayPal is available for shop orders (one-time payment) only, not for recurring subscriptions.
- Coaching payments use Stripe Connect; coaches receive payments directly in their Stripe account (platform fee: 25%).
2. Legal bases
| Processing activity | Legal basis |
|---|---|
| Service provision, account, authentication | Art. 6(1)(b) — contract performance |
| Health data (weight, workouts, photos, wearables) | Art. 9(2)(a) — explicit consent |
| Marketing newsletter | Art. 6(1)(a) — consent (double opt-in) |
| Non-essential cookies (analytics) | Art. 6(1)(a) — consent (cookie banner) |
| Security, fraud prevention, community moderation | Art. 6(1)(f) — legitimate interest |
| Gamification leaderboard (public level/XP display) | Art. 6(1)(f) — legitimate interest (with right to object) |
| Invoices, fiscal records | Art. 6(1)(c) — legal obligation (Romanian Accounting Law 82/1991, Fiscal Code) |
| B2B — HR dashboard (anonymized data only) | Art. 6(1)(f) — legitimate interest of the employer |
3. Retention
- Account and fitness data: while your account is active; 30-day grace period after deletion, then permanent erasure.
- Audit logs: 12 months (then anonymized — userId set to null).
- Tax records (invoices, payment confirmations): 10 years (legal obligation under Romanian Accounting Law 82/1991 and the Fiscal Code, Art. 25). Invoice data is snapshotted and retained even if your account is deleted.
- Newsletter: 2 years from last interaction; unsubscribe proof retained permanently.
- Cookie preferences: 12 months (re-consent on version change or expiry).
- Imported wearable data: while connection is active; optionally deleted on disconnect.
- Push endpoints: until you unsubscribe or the endpoint expires.
4. Who we share data with
4.1 Data processors
| Processor | Purpose | Location | International transfer |
|---|---|---|---|
| Stripe Inc. | Payment processing (subscription, shop, coaching) | USA | Standard Contractual Clauses (SCC) |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Shop payment processing (alternative checkout method) | Luxembourg / USA | Standard Contractual Clauses (SCC) |
| Mollie B.V. | Shop and subscription payment processing (alternative checkout method) | Netherlands (EU) | No (intra-EU transfer) |
| Resend | Transactional email and newsletter | EU (EMEA) | No |
| MinIO (self-hosted) | Media storage (photos, coaching video, community) | Own infrastructure | No |
| LiveKit (self-hosted) | Live video classes (real-time streaming) | Own infrastructure | No |
| Gotenberg (self-hosted) | PDF invoice generation | Own infrastructure | No |
| Umami (self-hosted) | Behavioral analytics (anonymized) | Own infrastructure | No |
| Cloudflare, Inc. (Turnstile) | Anti-bot protection on registration, password reset, newsletter, and support form (no visual CAPTCHA) | USA | Data Privacy Framework (DPF) |
We never sell your data. We never share individual health data with employers or third parties.
5. Wearable device integrations
If you choose to connect a wearable device, we import health data via OAuth 2.0 from third-party providers. Connecting requires your explicit consent (Art. 9(2)(a)) — you must have an active HealthConsent in the application.
| Provider | Data imported | Location | Transfer mechanism |
|---|---|---|---|
| Strava Inc. | Physical activities (running, cycling, swimming, etc.) | USA | Standard Contractual Clauses (SCC) |
| Fitbit LLC (Google LLC) | Physical activities, heart rate, sleep data | USA | Standard Contractual Clauses (SCC) |
| Garmin International Inc. | Physical activities, GPS, heart rate | USA | Standard Contractual Clauses (SCC) |
| Withings SA | Body weight, body composition | France / USA | Standard Contractual Clauses (SCC) |
- OAuth tokens are stored encrypted (AES-256-GCM) and are not included in GDPR exports.
- You can disconnect any provider at any time from Settings → Wearables.
- Disconnecting stops future sync but does not automatically delete previously imported activities. You can delete them manually or by deleting your account.
6. Your rights (DSAR)
- Access — full export of all your data (Settings → Privacy → Export data).
- Rectification — edit your profile directly in the app.
- Erasure — account deletion with a 30-day grace period (Settings → Privacy → Delete account).
- Portability — structured export in JSON format (machine-readable).
- Withdraw consent — at any time from Settings → Privacy.
- Object — to processing based on legitimate interest (e.g., leaderboard).
- Restriction — processing of your data can be restricted upon request.
- Lodge a complaint with the Romanian DPA (ANSPDCP): www.dataprotection.ro.
Data export is available directly in the app: Settings → Privacy. Legal response time: 30 days (our automated system usually delivers within 24h).
7. Cookies
See our Cookie Policy for details on individual cookies, their purpose, duration, and legal basis.
8. Security
- HTTPS enforced (HSTS) on all endpoints.
- Passwords stored with bcrypt (cost 12). Photos and OAuth tokens encrypted with AES-256-GCM.
- Two-factor authentication (2FA TOTP) available in Settings → Security.
- Audit trail for sensitive actions. Active sessions visible and revocable from your account.
- In the event of a security breach affecting you, we will notify you within 72 hours of detection, as required by Art. 33-34 GDPR.
9. Contact / DPO
For any request regarding your data, contact our Data Protection Officer: dpo@fitness.dbg.ro.