Legal

Privacy.

1. Responsible party

Pascal Brüesch · Email: rolipos@gmail.com

2. What data is processed

  • Account data: Email, name, password (encrypted with bcrypt)
  • Athlete profile: Gender, year of birth, height, weight, training preferences — all optional
  • Garmin Connect access: Username and password, Fernet-encrypted with a master key, used exclusively for activity synchronisation
  • Training data: Activities, sleep, HRV, Body Battery, stress (synced from Garmin)
  • Nutrition data: Photo uploads, AI-estimated macros, weight history
  • Session cookie: essential login cookie only, no tracking cookies

3. Where data is stored

Hosted by <strong class="text-ink">Hetzner Online GmbH</strong>, Falkenstein, Germany. All data is stored in a SQLite database on a dedicated server in the EU. At-rest encryption via Linux filesystem permissions; sensitive fields (Garmin credentials) are additionally encrypted at the application layer.

4. Third-party providers

Anthropic (USA) — Use of the Claude API for AI-assisted training plan generation and food photo analysis. With each request, anonymised training/nutrition data and, where applicable, the food photo are transmitted to Anthropic. Anthropic retains API inputs for up to 30 days for abuse prevention, per its own Privacy Policy. Data transfer to the USA is based on the EU Commission's Standard Contractual Clauses (SCC). Anthropic Privacy: anthropic.com/privacy
Garmin Connect (USA, optional) — If you connect Garmin, your Garmin Connect credentials are stored encrypted and used periodically to fetch activities and daily metrics. You can disconnect at any time in Settings.
Google / Apple OAuth (optional) — If you log in via Google or Apple, we only receive your email address and name. No access to any other account data.
Telegram-Bot (optional) — When enabled, training reminders are sent via the Telegram Bot API. Telegram receives your chat ID and message content.

5. How long data is retained

For as long as your account exists. On account deletion (requested by email), all associated data will be removed within 7 days — including photo uploads, training history, and encrypted credentials.

6. Your rights (GDPR Art. 15–21)

  • Access: which data is stored
  • Rectification: correct inaccurate data
  • Erasure: delete account and all data
  • Data portability: export your data as JSON
  • Objection: object to processing
  • Complaint: with the competent supervisory authority (e.g. FDPIC Switzerland or BfDI Germany)

Requests to rolipos@gmail.com.

7. Cookies

legplan uses only one <strong class="text-ink">session cookie</strong> (HttpOnly, Secure, SameSite=Lax) for authentication after login. No tracking or analytics cookies. Under GDPR/TTDSG, strictly necessary cookies do not require a cookie banner.

8. Legal basis

Processing is based on <strong class="text-ink">performance of the usage contract</strong> (GDPR Art. 6(1)(b)) and on your <strong class="text-ink">consent</strong> (Art. 6(1)(a)) given at account creation.

Last updated: May 2026