Privacy Policy

Who processes your data

Controller: [obchodné meno, adresa, IČO]. Contact for privacy questions: info@vorgym.com.

What we process

  • Account: e-mail and password. The password is stored only as a one-way hash that nobody can read.
  • Profile: name (if you give one), sex, age, height, weight, goal, level, where you train, dietary preferences and language.
  • Health data: weight in relation to your goal, and any health limits and allergies you enter. This is a special category of data.
  • Activity: completed exercises, weights and reps you log, meals, extra food, water, your shopping list and reminder settings.
  • Progress photos: photos you upload yourself, stored only on our server and visible only to you. We reduce them in size and remove location data before upload.
  • Meal photos: if you use calories from a photo, the photo is sent for the estimate (see below). We don't store it; we keep only the time of the attempt for the daily limit.
  • Body photos: if you use the body analysis, with your explicit consent 1–3 photos are sent together with your age, sex and goal for one analysis (see below). We don't store the photos; we keep only the time of the analysis for the limit (one analysis every 2 weeks) and the areas you choose. Only for people over 18.
  • Coach chat: if you use the AI coach, your questions, the latest messages of the conversation and a short summary of your plan (goal, profile details, calories, today's workout and meals) are sent to create the answer. The conversation is saved with your VorGym data; on the server we only keep the time of each message for the daily limit.
  • Payments: subscription status, plan, amount and invoices. Card numbers are handled only by Stripe.
  • Referrals and sign-up source: who invited you (if you came through a friend's link), who received a reward, and which campaign or site you came from.
  • Communication: messages you send us from the app and a log of e-mails we sent.
  • Technical data: device type, error logs and anonymous visit statistics (no cookies, only a fingerprint that changes daily and can't identify you).

Why, and on what legal basis

  • Providing the service, your plan, reminders and referral rewards: performance of a contract (Art. 6(1)(b) GDPR).
  • Health data: your explicit consent (Art. 9(2)(a) GDPR). You can withdraw it at any time in Profile or by e-mail. Without it we can't create your plan.
  • Accounting and tax: legal obligation (Art. 6(1)(c) GDPR).
  • Security, fixing errors, visit statistics and sign-up sources: legitimate interest (Art. 6(1)(f) GDPR).
  • Tips, news and offers by e-mail: your consent, which you can withdraw in Profile or with the link in every such e-mail.

Notifications on your phone

If you turn on notifications, our server sends reminders through your browser maker's push service (e.g. Google, Apple, Mozilla). The content is encrypted and that service can't read it. You can turn notifications off in Profile or your phone settings.

Food search

When you search for a food or scan a barcode, our server looks it up in the open Open Food Facts database (France). Only the search words or the barcode number are sent, never your name, e-mail or other personal data.

Who receives your data

  • Server: the app and your data are stored on our server at [server provider and country, e.g. Slovakia].
  • E-mails are sent through the mail server of WebHouse (webhouse.sk), Slovensko.
  • Stripe (Stripe Payments Europe, Ltd., Ireland) processes payments and receives your e-mail and payment details. Stripe may transfer data to the US under the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
  • Anthropic PBC (USA) receives a meal photo when you use calories from a photo, body photos when you use the body analysis, and the conversation with a plan summary when you ask the AI coach, to create the estimate or answer. It doesn't use this data to train its models. The transfer to the US relies on the Standard Contractual Clauses.
  • Public authorities, only when the law requires it.

We don't sell your data or use it for advertising. How we use cookies and browser storage is described in the cookie policy.

How long

We keep your profile and activity while you have an account and delete them within 30 days after you close it. Accounting records are kept for 10 years as required by law. Database backups are overwritten within 30 days at the latest.

Your rights

You have the right to access, correct and delete your data, restrict processing, data portability, to object, and to withdraw consent. Write to info@vorgym.com; we reply within 30 days. You can download all your data with "Download my data" in Profile and delete your account there too. You can complain to the Slovak Data Protection Office (www.dataprotection.gov.sk).

Security and children

We protect data with encrypted connections, restricted access and backups. The service is not intended for people under 18.

Effective from [date]. Version 1.1.