IRONCODEX APP
Privacy Information
This information applies to the IronCodex beta for adult residents of the EU/EEA, United Kingdom and Switzerland. The applicable rights depend on your residence.
1. Controller
Dennis ZimmermannLenbachstraße 94
65428 Rüsselsheim am Main
Email: d.zimmermann92@gmx.de
2. Beta purpose and principles
IronCodex is a pre-release app for planning and recording strength training, analysing progress and, when deliberately enabled, athlete-coach collaboration. We process data only to provide, secure and improve these functions. We do not sell private training, body, health or coaching data to gyms, manufacturers or other users.
3. Account and technical provision
We process your email address, internal user ID, authentication and security information and optional profile details to provide and protect your account. For EU/EEA users this is generally based on Article 6(1)(b) GDPR and, for security logs, Article 6(1)(f). Comparable contractual and legitimate business grounds apply under UK GDPR and the Swiss FADP where relevant.
Supabase provides authentication, database, private file storage and server functions. The configured project is hosted in West Europe (London). Settings and training data required for offline operation are also stored locally on your device.
4. Training and progress data
Depending on your use, we process plans, sessions, exercises, equipment, sets, repetitions, weights, rest periods, notes, performance values, personal records, equipment setups, history and derived progress or load indicators. This provides the documentation, synchronisation and analysis you request.
5. Body, nutrition and health data
You may optionally record body measurements, sleep, recovery, stress, mood, soreness, pain, illness, injury, limitations, nutrition, supplements or competition preparation. These may be health data or otherwise sensitive personal data. These features are voluntary and require a separate explicit consent. We store the purpose, exact notice version, timestamp and any later withdrawal. Withdrawal applies for the future and disables related coach permissions.
6. Photos and videos
When you choose these features, we process selected body and training media, file metadata, previews, check-in assignments and coach releases. Files are held in private storage. Supported check-in and progress photos may additionally use end-to-end encryption for authorised devices and recipients. We do not use these recordings for facial recognition or identification.
7. Coach collaboration
A coaching link requires a deliberate connection. The athlete controls separate permissions for training, progress, body metrics, wellness, nutrition, check-ins and media. Server-side access rules limit a coach to released areas of an active link. Coaches must use accessible data confidentially and only for agreed coaching; a paid coaching relationship may give the coach separate legal responsibilities.
8. Equipment photos and optional AI
Voluntary equipment photos may be checked locally for faces and detected faces blurred. If you start optional nameplate recognition, the prepared image is sent through a protected Supabase function to Google Gemini for text recognition. Do not use this feature for images containing people or private information.
9. Notifications, diagnostics and usage statistics
If enabled, a device push token and platform are processed through Apple Push Notification Service or Google Firebase Cloud Messaging. Test builds may send errors, warnings, affected areas, technical context, timestamps and an internal user reference; emails, access tokens, signed file links and detected secrets are removed automatically. Cloud diagnostics are normally deleted after 30 days. Separately configurable usage statistics contain aggregated event counts without personal training content.
10. Recipients and international transfers
Recipients are limited to necessary providers and people you authorise: Supabase for backend and storage, Cloudflare for beta pages, Apple and Google for distribution or notifications, Google for deliberately started AI recognition, and an authorised coach for the areas you release. No payment provider is used during the free beta.
The Supabase project is hosted in the United Kingdom. Transfers from the EU/EEA rely where applicable on adequacy decisions, standard contractual clauses and supplementary measures. UK restricted transfers use UK adequacy regulations, the UK IDTA/Addendum or another permitted safeguard where required. For Swiss users, destination states and safeguards are disclosed here; transfers use recognised adequate protection or contractual safeguards under the Swiss FADP. Providers may use subprocessors in additional countries.
11. Retention
Accounts and associated profile and training data are generally retained until account deletion or the end of the beta. Individual content can be deleted earlier where the feature permits it. Temporary media follows the period displayed in the feature. Backups may remain until scheduled overwrite while protected from ordinary access.
12. Your rights
EU/EEA: subject to legal conditions, rights include information, access, rectification, erasure, restriction, portability, objection, withdrawal of consent and complaint to a data protection authority.
United Kingdom: UK GDPR rights include being informed, access, rectification, erasure, restriction, portability, objection and rights relating to automated decisions. You may complain to the Information Commissioner's Office.
Switzerland: under the FADP you may request information about processing and, where applicable, correction, deletion, restriction or release/transfer of your data. You may contact the Federal Data Protection and Information Commissioner.
The in-app export currently covers the categories identified in the export. For a complete request, contact d.zimmermann92@gmx.de. Consent may be withdrawn at any time for the future.
13. Complaints and changes
EU/EEA users may contact their competent supervisory authority, UK users the ICO, and Swiss users the FDPIC. Material changes will be communicated before taking effect; new purposes or required consent will not be based silently on an earlier confirmation.