Liftavi Privacy Policy
Last updated
This Privacy Policy explains how Liftavi handles your personal data when you use the Liftavi web app (app.liftavi.com), the Liftavi apps for Android and iOS, and the Liftavi API (api.liftavi.com) — together, "Liftavi" or "the service". We have tried to write it in plain language. If anything is unclear, write to us at privacy@liftavi.com.
1. Who is responsible for your data
The controller under the EU General Data Protection Regulation (GDPR) is:
[Legal name]
[Address]
OIB / company registration number: [OIB/company ID]
Email: privacy@liftavi.com
("we", "us", "our"). [We have not appointed a data protection officer.]
2. Liftavi in short
- Liftavi creates a personalised training plan and nutrition targets from the answers you give us, and lets you log workouts and body weight and follow your progress.
- Some of these answers are health data (for example your weight, body fat and injuries). We only process them with your explicit consent, and you can withdraw that consent at any time in your Profile.
- You can try a plan without an account. Those answers are used only to calculate the preview and are not stored on our servers.
- We do not sell your data, show ads, use analytics or tracking tools, or load third-party scripts, fonts or trackers in the web app.
- Our servers are in the EU (Hetzner, Germany/Finland).
- You can download all your data and delete your account yourself, in the app, at any time.
3. What data we process, why, and on what legal basis
3.1 Account data
| Data | Why we use it | Legal basis |
|---|---|---|
| Email address, name, password (stored only as a bcrypt hash — we never see or store your password itself), account creation date, whether your email is verified, your role (user/admin) | To create and run your account, let you log in, recover your password and keep your account secure | Performance of our contract with you — Art. 6(1)(b) GDPR |
| Session data: a random session ID inside your login token or cookie, a session counter used to log you out everywhere, and a list of logged-out sessions until they would have expired | To keep you logged in and to make "Log out" and "Log out of all devices" work | Art. 6(1)(b) GDPR |
| One-time links for email verification and password reset (we store only a cryptographic hash of the link's token) | To verify your email address and reset your password | Art. 6(1)(b) GDPR |
3.2 Health and fitness data
When you set up your profile and use the app, you give us information about your body, health and training:
- sex, date of birth (we use your age), height, weight, target weight, body fat percentage, body type;
- your goal, training experience, daily activity level, training days and session length, preferred days, focus areas and available equipment;
- injuries or physical limitations you enter, and a free-text description of your current routine;
- your diet preference (for example vegetarian, vegan, halal or gluten-free — some of these can reveal religious or philosophical beliefs or a health condition);
- your generated plans (calorie and macronutrient targets, training plan, exercise substitutions because of injuries, warnings) — these are derived from the data above and are themselves health-related;
- your workout logs (date, exercises, sets, repetitions, weights, duration, notes) and body-weight entries, and the progress statistics calculated from them.
Why: to calculate your personalised training plan and nutrition targets, to adapt exercises to your injuries and experience, to let you log workouts and weight, and to show your progress.
Legal basis: your explicit consent — Art. 9(2)(a) GDPR (together with Art. 6(1)(a) GDPR). We ask for this consent separately from accepting the Terms, with an unticked checkbox when you sign up. Without it we cannot build or store a personalised plan for you, so this consent is needed to use the main features; you can still keep your account, download your data and delete your account without it.
Withdrawing consent: you can withdraw your consent at any time in your Profile. When you do, we immediately delete your profile, plans, workout logs and weight entries. Your account (email, name, login) stays, and you can give consent again later and start fresh. Withdrawal does not make the processing before it unlawful. If you also want your account deleted, use "Delete account" (see section 11).
3.3 Trying a plan without an account (plan preview)
On the landing page you can answer the questions and see a preview plan without signing up. We show you a short notice before you submit.
- Your answers (the same kind of data as in 3.2, which can include health data) are sent to our server only to calculate the preview. The server returns the result and does not store your answers or the preview, and does not write them to any log. (Like every request, the request itself appears in our web server log — see 3.6 — but without its content.)
- In the web app, your browser keeps your answers and the preview on your device (local storage, see section 13) so you can continue where you left off and, if you decide to sign up, save the plan to your new account. You can remove them by clearing your browser's site data for app.liftavi.com.
- Legal basis: you send the data yourself to get the result you asked for, and we use it only for that, in memory, for the duration of the request. Because health data may be involved, the preview is provided on the basis of your explicit request and consent expressed by submitting the form after the notice — Art. 9(2)(a) GDPR. [Owner/lawyer to confirm this legal basis for the stateless preview.]
3.4 Records of your consents
| Data | Why | Legal basis |
|---|---|---|
| Which document or consent you accepted or withdrew (Terms, Privacy Policy, health-data consent), its version, date and time, where you did it (web, Android, iOS, API) and a one-way hash of your browser/app identification string (user agent). No IP address is stored. | To prove that we obtained your consent and that you accepted the current Terms, as the GDPR requires (Art. 7(1)), and to ask you again when a document changes | Legal obligation — Art. 6(1)(c) in conjunction with Art. 7(1) GDPR; and our legitimate interest in being able to demonstrate compliance and defend legal claims — Art. 6(1)(f) GDPR |
You can see your consent history in the app.
3.5 Emails we send you
We send only service emails: a link to verify your email address after sign-up and password-reset links when you ask for one. We do not send newsletters or marketing. The emails do not repeat your name. To send them we keep a short queue entry (your account ID, the type of email, the link token in encrypted form until sent, delivery status). Legal basis: Art. 6(1)(b) GDPR.
3.6 Security and technical data (server logs, rate limiting)
| Data | Why | Legal basis |
|---|---|---|
Web server access log (our reverse proxy): your IP address, date and time, requested address (with one-time tokens replaced by "REDACTED"), HTTP method, status code, response size and time, and request headers such as user agent and referrer. Cookies and the Authorization header are redacted and never logged. | To operate the service, find and fix errors, detect and investigate attacks and abuse | Legitimate interest — Art. 6(1)(f) GDPR |
| Application log: method, path (without query strings) and status code of each request, error messages, and for emails the internal account ID and delivery result. No IP address, no request bodies, no passwords or tokens. | Operating and debugging the service | Art. 6(1)(f) GDPR |
| Rate limiting: counters keyed by IP address, by email address or by account (for example "5 login attempts per minute"), kept only in the server's memory for at most one hour and lost on every restart | To protect accounts from password guessing and the service from abuse | Art. 6(1)(f) GDPR |
| Administrative audit log: when an account is deleted or an administrator role changes, we record the random account ID, the action and the time — no email address or name | Security and accountability of administrative actions | Art. 6(1)(f) GDPR |
Balancing of interests: we have a legitimate interest in keeping Liftavi secure and available and in protecting your account from takeover. Logging IP addresses and counting attempts is a common, expected and minimal measure for this. We limit it: rate-limit counters exist only in memory for up to an hour, logs contain no request content, passwords, tokens or cookies, logs are rotated and deleted after a short period (section 8), and only we can access them. They are not used for profiling, marketing or tracking you across sites. You can object to this processing (section 11); we will then check whether your interests outweigh ours, but some logging is necessary to run a secure online service.
3.7 When you contact us
If you write to us (for example to privacy@liftavi.com), we use your email address, your message and anything you send us to answer you and handle your request. Legal basis: Art. 6(1)(b) GDPR where it concerns your account, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f)); for requests to exercise your GDPR rights, our legal obligation (Art. 6(1)(c)).
3.8 What we do not do
- No advertising, no selling or renting of personal data, no data brokers.
- No analytics, tracking pixels, social-media plugins, or third-party scripts or fonts in the web app (fonts are served from our own server). The mobile apps contain no analytics or crash-reporting SDKs.
- No processing of your location, contacts, camera, microphone or device health apps (e.g. Apple Health or Google Fit).
4. Is providing data required?
Account data is required to create an account. Health data is required to get a personalised plan and to log workouts and weight, and we process it only with your explicit consent. Nothing is required by law; you are free not to use Liftavi.
5. Who receives your data
We do not share your data with anyone for their own purposes. Only the following service providers (processors) process data on our behalf and under our instructions, bound by a data processing agreement under Art. 28 GDPR:
| Recipient | Role | What they process | Location |
|---|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Hosting: the server that runs Liftavi, its database and logs, and [optional] off-site storage for encrypted backups | All data described above (backups are encrypted with a key Hetzner does not have) | Data centres in Germany or Finland (EU) |
| Sendinblue SAS (Brevo), 106 boulevard Haussmann, 75008 Paris, France [owner to verify current address in Brevo's DPA] | Sending service emails (email verification, password reset). Links in our emails point directly to app.liftavi.com (no click-tracking redirects); Brevo records delivery and open statistics for these emails; we use them only to check that our emails arrive, never for marketing or profiling. | Your email address, the email content (verification or password-reset link), delivery metadata | EU (France); sub-processors per Brevo's DPA |
| Cloudflare, Inc. (Email Routing) and Google (Gmail) | Receiving emails you send to privacy@liftavi.com or support@liftavi.com: Cloudflare forwards them, Google stores them in our mailbox | Your email address and message | Cloudflare: global network; Google: EU/US — see section 6 |
Other parties involved in running Liftavi that do not receive your personal data:
- Cloudflare, Inc. is our domain registrar and DNS provider for liftavi.com. DNS tells your device the address of our server; after that your device connects directly to our server in the EU. None of your app traffic, account data or health data passes through Cloudflare (we do not use Cloudflare's proxy or CDN for the app). The only personal data Cloudflare handles is emails you send to our @liftavi.com addresses (see the table above).
- GitHub, Inc. hosts our source code and builds the software images we deploy (GitHub Container Registry). No user data is stored there.
- Let's Encrypt issues the HTTPS certificates for our domains; it receives only our domain names.
- Uptime monitoring services may check that our public health-check page responds; they receive no user data.
- Apple and Google distribute the mobile apps through the App Store and Google Play. When you download an app, they process data under their own privacy policies as independent controllers. The apps do not send them your Liftavi data.
Within Liftavi, access to personal data is limited to the people who operate the service [owner to list: e.g. the founder/administrators]. Administrators can see account email, name, role and the number of plans and workouts in the admin area; direct access to the database is limited to the server operator and used only where necessary (for example to fix a problem or handle your request).
We may disclose data to public authorities only where we are legally obliged to (for example a court order).
6. Transfers outside the EU/EEA
Liftavi is hosted in the EU and we do not intend to transfer your personal data outside the EU/EEA. Our email sender (Brevo) is based in the EU. Emails you send to us (privacy@ / support@liftavi.com) are forwarded by Cloudflare and stored by Google, which may process them in the United States. Both are certified under the EU–US Data Privacy Framework (Art. 45 GDPR adequacy decision) and additionally offer the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR); you can ask us for a copy of the relevant safeguards at privacy@liftavi.com. [Owner to confirm: DPF certification status of Cloudflare and Google at the time of publication; consider a business mailbox with a signed DPA (e.g. Google Workspace) instead of a personal Gmail account.]
7. Health data — how we protect it in particular
In addition to the general security measures in section 9:
- health data is processed only after explicit, separate, unticked-by-default consent, and the app blocks all health-data features (profile, plans, workouts, weight, progress) whenever that consent is missing or outdated;
- withdrawing consent deletes that data immediately;
- health data is never used for advertising, never sold and never shared with third parties for their own purposes;
- the plan preview without an account does not store or log the answers on our servers.
8. How long we keep your data
| Data | How long |
|---|---|
| Account data | Until you delete your account. |
| Health and fitness data (profile, plans incl. older plans, workout logs, weight entries) | Until you withdraw your health-data consent or delete your account — whichever comes first. Then deleted immediately. |
| Login session (cookie / app token) | Expires after 30 days; ends earlier when you log out. Logged-out session IDs are kept until the session would have expired (max. 31 days). |
| Email-verification and password-reset tokens (hashed) | Valid 24 hours (verification) or 1 hour (reset); deleted at the latest one day after they expire or are used. |
| Email queue entries | Deleted 7 days after the email was sent or finally failed. |
| Rate-limit counters | In memory only, for at most one hour; lost on restart. |
| Plan preview answers (on our server) | Not stored — kept in memory only while the preview is calculated. |
| Consent records | For the life of your account and then for [3 years — owner to confirm] after account deletion, to be able to prove consent; after that deleted. After account deletion they are linked only to a random account ID. |
| Web server access logs, application logs and system security logs (which may contain IP addresses) | Rotated daily and deleted after at most 14 days. |
| Administrative audit entries (random account ID only) | [Kept for the life of the service — owner to confirm a period, e.g. 3 years.] |
| Encrypted backups | Daily backups are kept for 7 days and weekly backups for 4 weeks, so deleted data disappears from regular backups within about 35 days. Occasional extra copies (taken manually before maintenance or stored off-site) are deleted at the latest after 90 days. Backups are encrypted, and the decryption key is kept offline. If we ever have to restore a backup, we will delete again any accounts and data that were deleted after that backup was made (normally automatically as part of the restore; in a full disaster-recovery situation as a manual step before the service is reopened). |
| Emails you send us | As long as needed to handle your request, then [up to 3 years — owner to confirm] to document how it was handled. |
When you delete your account, your account and all associated data (profile, plans, workouts, weight entries, tokens, email queue entries, sessions) are deleted from the live database immediately.
9. How we protect your data
- EU hosting on a dedicated server we administer, with only the necessary network ports open; the database is not reachable from the internet.
- Encryption in transit: all connections use HTTPS (TLS) with HSTS.
- Passwords are stored only as bcrypt hashes. One-time email links are stored only as hashes and expire quickly.
- Sessions: the web app uses secure, httpOnly cookies (not readable by scripts) with protection against cross-site request forgery; the mobile apps keep the login token in the iOS Keychain or Android Keystore, which is excluded from device backups.
- Least privilege: the application runs with a restricted database account; containers run without root rights.
- Encrypted backups: backups are encrypted before they are stored; the private key needed to read them is kept offline, not on the server.
- Minimal logs: tokens, cookies and passwords are never written to logs; the database never logs query values.
- Abuse protection: rate limits on login, sign-up and password reset.
- Account controls: "Log out of all devices", change password (which signs out other devices).
No system is perfectly secure. If a personal data breach is likely to result in a risk to you, we will notify the supervisory authority within 72 hours and, where the risk is high, inform you without undue delay, as required by Art. 33 and 34 GDPR.
10. Data stored on your device
See section 13 (cookies and local storage). Data you export ("Download my data") is saved where you choose; on mobile, the temporary export file is deleted from the app's private storage shortly after you share it (at the latest about one hour later).
11. Your rights
Under the GDPR you have the right to:
- Access your data and receive a copy (Art. 15) — use Profile → Download my data (a JSON file with your account, profile, plans, workouts and weight entries). Your consent history is shown in the app; for anything else, write to us.
- Rectification (Art. 16) — edit your profile, workouts and weight entries in the app; write to us to change anything else.
- Erasure (Art. 17) — Profile → Delete account deletes your account and all its data immediately (you confirm with your password).
- Withdraw consent at any time (Art. 7(3)) — withdraw your health-data consent in your Profile. This deletes your health data immediately but keeps your account.
- Data portability (Art. 20) — the export is a structured, machine-readable JSON file.
- Restriction of processing (Art. 18) — write to us.
- Object to processing based on our legitimate interests (Art. 21) — write to us (see 3.6).
- Not to be subject to a decision based solely on automated processing that has legal or similarly significant effects (Art. 22) — see section 15.
To exercise any right that is not available in the app, email privacy@liftavi.com from the email address of your account (so we can verify it is you). We will answer within one month (extendable by two months for complex requests, in which case we will tell you why). This is free of charge unless requests are manifestly unfounded or excessive.
12. Right to lodge a complaint
You can complain to a data protection supervisory authority, in particular in the EU country where you live, work or where you think the infringement happened. In Croatia this is:
Agencija za zaštitu osobnih podataka (AZOP) — Croatian Personal Data Protection Agency Selska cesta 136, 10000 Zagreb, Croatia — azop.hr [Owner to verify the current address.]
A list of all EU authorities is available from the European Data Protection Board (edpb.europa.eu). We would appreciate the chance to address your concern first at privacy@liftavi.com.
13. Cookies and local storage
Liftavi uses only strictly necessary cookies and device storage — no analytics, advertising or tracking cookies and no third-party cookies. Because these are necessary to provide the service you request (or store settings you chose yourself), no cookie consent banner is needed under the EU ePrivacy rules and the Croatian Electronic Communications Act.
Cookies (web app, set by api.liftavi.com):
| Name | Purpose | Type | Duration |
|---|---|---|---|
__Host-gb_session | Keeps you logged in (secure session token) | Strictly necessary, httpOnly, Secure, SameSite=Lax | 30 days, or until you log out |
__Host-gb_csrf | Protects your account against cross-site request forgery | Strictly necessary, httpOnly, Secure, SameSite=Lax | 30 days, or until you log out |
Browser storage (web app, app.liftavi.com) — stays on your device, never sent to tracking services:
| Key | Purpose | Duration |
|---|---|---|
gb.theme, gb.units, gb.restSound | Your display settings (light/dark theme, metric/imperial units, rest-timer sound) | Until you change them or clear site data |
gb.onboardingDraft.v1 | Your unfinished answers in the plan questionnaire, so you can continue later (may include health data) | Until you finish, log out, or clear site data |
gb.previewPlan.v1 | The preview plan from "try it without an account", so you can save it when you sign up | Until you sign up, log out, or clear site data |
gb.workoutDraft.v1 | An unfinished workout you are logging | Until you save it, log out, or clear site data |
gb.pendingProfile.v1 | Profile changes not yet applied to your plan | Until applied, log out, or clear site data |
gb.dataOwner | Remembers which account the above drafts belong to, so they are wiped when another account signs in | Until log out or clear site data |
gb.verifyBannerDismissed (session storage) | Hides the "confirm your email" banner for this browser tab | Until you close the tab |
When you log out, your session ends or your account is deleted, the web app deletes the drafts and preview from your browser; display settings remain.
Mobile apps: the login token is stored in the iOS Keychain / Android Keystore (encrypted, device-only, excluded from backups). Display settings and unfinished questionnaire/workout drafts are stored in the app's private storage on your device. Uninstalling the app removes this data.
14. Children
Liftavi is intended for people aged 16 and over. Under Croatian law (Art. 19 of the Act on the Implementation of the GDPR), a person must be at least 16 to give valid consent to information society services themselves. If you are under 16, please do not use Liftavi. If we learn that we hold data of a person under 16 without the consent of a parent or guardian, we will delete it. Parents or guardians who believe their child has given us data can contact privacy@liftavi.com.
[OWNER DECISION — see docs/legal/README.md: the app currently accepts a date of birth that makes the user 13 or older and does not check age at sign-up. Either raise the minimum to 16 in the app (recommended) or implement verifiable parental consent for users under 16 and update this section.]
15. Automated decision-making
Your training plan and nutrition targets are generated automatically by a rule-based algorithm from your answers (for example: estimated energy needs from your age, sex, height, weight and activity level; exercise selection from your equipment, experience and injuries). No human reviews each plan.
This is not a decision that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR: it is a suggestion you asked for, you are free to follow it or not, it does not decide on access to any service, contract, price or benefit, and you can change your answers and regenerate it at any time. We do not use your data for profiling for advertising or any other purpose.
16. Changes to this policy
We may update this policy when Liftavi or the law changes. The version date at the top always shows the current version. If we make material changes, we will tell you in the app (and, where appropriate, by email) before they take effect; where the change affects what you consented to, we will ask for your consent again in the app before you can continue to use health-data features. Previous versions are available on request.
17. Contact
Questions about privacy or this policy: privacy@liftavi.com
[Legal name], [Address]