Privacy Information — Harry's Gym
Harry's Gym (web app at harrysgym.de and the Android app "Harry's Gym", developer: Virtual Services) is a fitness diary for a closed group of users (staff of the studio). Use is voluntary. This page describes which data the app processes, where it is stored and which rights you have.
Harry's Gym is not a medical device and does not diagnose, treat, cure or prevent any medical condition. Calculated values (basal metabolic rate, calorie budget, balance) are estimates for orientation only.
1. Controller
Virtual Services
Holger Kühn
Frühlingstr. 30
83052 Bruckmühl, Germany
Contact for privacy questions: by post to this address or in person at the studio. User accounts are created by the administrator only.
2. Data the app processes
- Account data: user name, e-mail address, password (bcrypt hash only).
- Body data (health data, Art. 9 GDPR): weight, body measurements, body-fat and muscle percentage, sex, date of birth — only what you enter yourself.
- Training data: exercises, sets, weights, session duration, plans, goals.
- Nutrition data: meals, nutrients, water, supplements.
- Progress photos: optional, only if you upload them.
- Wearable activity data: optional — active energy (kcal) per hour if you set up the transfer from Apple Health yourself; endurance activities if you upload TCX/GPX files.
- Technical: session cookie (sign-in only), language and setup cookies, server-side error logs. No tracking, no analytics services, no advertising.
3. Purpose
Personal training and nutrition documentation and its evaluation for you. Supervisors have no access to your individual data; the administrator manages accounts and backups, not your entries.
4. Where the data is stored
On a server of Hetzner Online GmbH in Nuremberg, Germany, transmitted
encrypted (HTTPS). Encrypted backups are kept at Hetzner in Falkenstein, Germany
(retention: 14 daily, 8 weekly, 6 monthly snapshots). The app in your browser or on your phone
communicates exclusively with harrysgym.de.
5. External services
- Open Food Facts (food database): when you search or scan a barcode, the server queries the database — your device does not contact Open Food Facts directly. Only the search term or barcode is transmitted.
- Push notifications (training reminders): only if you enable them in the settings. Your browser's push service (Apple, Google or Mozilla) then receives the message ("time to train") — no health data.
- Apple Health: you set up the transfer yourself via an app on your iPhone; Harry's Gym only receives the values you release there.
- AI photo analysis of meals: off by default. If the administrator enables it, only the photos you deliberately upload for analysis are sent to the selected provider — you will be informed separately and asked for consent.
6. Retention and deletion
Your data is kept as long as your account exists. You can delete progress photos yourself at any time. You delete the entire account yourself under Settings → Account → "Delete account" (password + confirmation) — immediately and permanently, including all entries and photos. Without access to the app: ask the administrator, see Delete account. Backups expire after six months at the latest.
7. Your rights
Access, rectification, erasure, restriction, data portability and withdrawal of consent — at any time, without disadvantage. In the settings you can export your workouts and weight history as CSV; the administrator provides an export of the remaining data (nutrition, measurements, photos) on request. Complaints can be lodged with the competent data protection supervisory authority.
8. Security
- Passwords stored as bcrypt hashes only; sign-in attempts limited per client.
- Encrypted transport (HTTPS), session cookie
HttpOnly/Secure. - Every user sees only their own data.
- Server access by key only; firewall; automatic security updates.