Privacy Policy

1. Who is responsible

The controller within the meaning of Art. 4(7) GDPR is:

Sergio Sanchez Torres
Seidenweberhof 5
79618 Rheinfelden
Deutschland
sanchez@sergio-sanchez.com

We have not appointed a data protection officer. The thresholds in Art. 37 GDPR and §38 BDSG are not met — this is a one-person operation and the processing described below is minimal. Write to the address above for anything concerning your data.

The same details appear in the Impressum.

2. The Vorbild app

Data you create

Everything you enter — workouts, exercises, logged sets, planner rules, challenges and settings — is stored as files in the app's private container on your device. It is not transmitted to us or to anyone else. The single exception is a workout you choose to share by link, described below — your sessions are never part of that.

This data is included in your device backup if you use iCloud Backup or an encrypted local backup. That backup is between you and Apple; it is governed by Apple's privacy policy, not this one. Deleting the app deletes its data from your device.

What the app does not do

• No user accounts, no sign-in, no email address required.
• No analytics or telemetry SDK of any kind.
• No advertising, no advertising identifier, no tracking across apps or websites.
• No third-party SDKs that transmit data.
• No location, contacts, photos, camera, microphone or health data access.

The app's App Store privacy label lists exactly what the next section describes, and nothing else.

Sharing a workout by link

If you tap Share Workout, the app uploads that one workout — its exercises, rules and starting numbers, and for each exercise its weight step and the weights you have used on it (a list of numbers, without dates or sessions) — and the name you set in the app's settings, to our server, and gives you a link. Your sessions are never uploaded. Anyone with the link can open it for 24 hours; the page and the preview a messaging app draws show the workout's name, its exercises and your name. Nothing is uploaded unless you tap Share.

We keep what was shared for two years after the link expired, then delete it. That is so we can see how sharing is used from one season to the next, and look into a link that was misused. During those two years nobody can open the link; the record is ours alone. The first time you share, Apple checks that your copy of Vorbild is genuine (App Attest); we receive a key that stands for your installation of the app — not for you, and a reinstall gets a new one — which limits each installation to ten live links and lets us count shares per installation. Apple learns only that this app on this device asked for a key. Opening a link someone sent you tells us nothing about you beyond the server log in section 3; it is counted, not attributed, and the sender is not told who opened it.

Legal basis: Art. 6(1)(b) GDPR for the upload, the link and the page — you asked for the link; Art. 6(1)(f) GDPR for keeping the record for two years and for the installation key — our legitimate interest in understanding the feature and in a service that cannot be abused. The data lives on the server described in section 3 and does not leave the European Union.

Notifications and Live Activities

If you allow notifications, the app schedules them locally on your device — for example a rest timer finishing. These are not push notifications; nothing is sent through Apple's push servers or ours, and no device token is collected. The same applies to the Live Activity shown on your Lock Screen during a rest period. You can revoke the permission at any time in iOS Settings.

Purchases

Vorbild is distributed through the App Store. Any purchase, payment and refund is handled entirely by Apple — we never see your name, your payment details or your Apple Account. Apple provides us only with aggregated, anonymous sales and download figures that cannot be traced back to an individual.

If you have opted in to sharing analytics and diagnostics with developers in iOS Settings, Apple may make aggregated crash and usage reports available to us. This is Apple's collection, under Apple's terms, and you control it under Settings → Privacy & Security → Analytics & Improvements.

3. This website

Server logs

The web server records each request in a log file — requests for this site's pages, for invitation pages, and the ones the app makes when it shares or opens a workout. This log contains your IP address, the time of the request, the address requested, the referring page if your browser sends one, and your browser's user-agent string.

Purpose

Operating the site securely and diagnosing faults and abuse.

Legal basis

Art. 6(1)(f) GDPR — our legitimate interest in a functioning, secure website.

Retention

Deleted after 7 days, unless a specific security incident requires a particular entry to be kept while it is investigated.

Cookies, analytics and fonts

This website sets no cookies and uses no local storage. There is no analytics service, no tag manager, no advertising and no tracking pixel — which is also why you are not being asked to consent to anything.

The two typefaces are served from this server. They are not loaded from Google Fonts or any other content delivery network, so no request carrying your IP address is made to a third party when you open a page here. No external resource of any kind is embedded.

Hosting

This site runs on a server rented from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner acts as our processor under Art. 28 GDPR: a data processing agreement is in place, and Hetzner may not use the data for its own purposes.

The server is managed with Coolify, self-hosted on that same machine. Its reverse proxy terminates the TLS connection and writes its own access log, subject to the same retention as above. The link service's database runs on the same machine. No other party has access to any of it, and no log data leaves the European Union.

4. Contacting us

If you email us, we process your address and the content of your message in order to answer it — Art. 6(1)(b) or (f) GDPR. We keep the correspondence as long as the matter is open and delete it once it is no longer needed and no retention obligation applies.

5. Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have data erased (Art. 17);
• restrict processing (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interest, on grounds relating to your particular situation (Art. 21).

In practice there is very little for us to act on: we hold no account and no profile, and the only content of yours that reaches us is a workout you shared, filed under the id in its link for two years. Write to sanchez@sergio-sanchez.com and we will answer.

You also have the right to complain to a supervisory authority (Art. 77 GDPR), in particular in the member state where you live or work.

6. Children

Vorbild is not directed at children. It collects nothing in the background from anyone, regardless of age; the only data it ever sends is a workout its user chooses to share.

7. Changes to this policy

If the app or the site changes in a way that affects this policy, we will update this page and change the date above. The version in force is always the one published here.