Privacy Policy

As of: July 12, 2025

This privacy policy informs you about the nature, scope, and purpose of the processing of personal data within our website and the mobile application "Athlory".

1. Data Controller

The data controller within the meaning of the GDPR is:
Helge Busemann
Athlory
Saarlandstraße 1
25421 Pinneberg
Germany
Email: info@athlory.de

A. Data Processing on the Website (athlory.de and connected domains)

Website Provision and Creation of Log Files

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected (server log files): browser type and version, operating system used, referrer URL (the previously visited page), hostname of the accessing computer, time of the server request, and IP address.

The storage in log files is done to ensure the functionality of the website. Additionally, the data serves us to optimize the website and ensure the security of our information technology systems. The legal basis for the temporary storage of data and log files is Art. 6(1)(f) GDPR.

Use of Cookies

Our website uses cookies. These are small text files that are stored in the internet browser or by the internet browser on your computer system. We use technically necessary cookies to make our website more user-friendly. The legal basis is our legitimate interest according to Art. 6(1)(f) GDPR. In addition, we use cookies for analysis and marketing purposes only with your express consent (Art. 6(1)(a) GDPR), which you can grant and manage via our cookie banner.

Newsletter via Mailchimp

On our website, you can sign up for our newsletter. For this purpose, we use the Mailchimp service provided by The Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA. Registration is done via a double opt-in procedure. The email address you enter is transmitted to Mailchimp in the USA for the purpose of newsletter delivery. This is done on the basis of your consent (Art. 6(1)(a) GDPR). Data security is ensured through EU standard contractual clauses. You can revoke your consent at any time by clicking on the unsubscribe link in each newsletter.

Web Analytics with Google Analytics

If you have consented via our cookie banner, this website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies that enable an analysis of your use of the website. The data is usually transferred to a Google server in the USA. We have activated IP anonymization on this website, so that your IP address is truncated by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area beforehand. The legal basis is your consent (Art. 6(1)(a) GDPR).

B. Data Processing in the Mobile App "Athlory"

1. Personal Data Collected in the App

Within the App, we process the following data categories:

Master data: Name, email, user account identifiers (Supabase)
Health and fitness data: Training plans, workouts, weight, age, nutrition data, supplements
Communication data: Chat histories with gym buddies and coaches, uploaded check-in photos
Usage data: App usage behavior (features, timestamps)
Device and log data: Device ID, operating system version, IP address (temporary)
AI data (Gemini): Data processing for generating personalized recommendations by the AI "Gemini", pseudonymized/anonymized, if you have consented.

2. Purpose and Legal Basis of Processing in the App

Purpose	Legal Basis
Registration and authentication	Art. 6(1)(b) GDPR
Provision of app features	Art. 6(1)(b) GDPR
Personalized training and nutrition advice (AI)	Art. 6(1)(a) and Art. 9(2)(a) GDPR (consent)
Communication (chat)	Art. 6(1)(b) GDPR
Sharing with coaches	Art. 6(1)(b) GDPR
Analysis and improvement of the App	Art. 6(1)(f) GDPR

3. Disclosure to Third Parties (App Data)

Coaches and gym buddies: Upon explicit request and release by the user.
Service providers: Supabase (hosting, authentication), app store providers (billing), DIS (arbitration).

C. General Provisions for Website and App

1. Data Transfer to Third Countries

If data is transferred to service providers outside the EU/EEA (e.g., USA), we ensure an adequate level of data protection by concluding EU standard contractual clauses.

2. Storage Period

We store your personal data only as long as necessary to achieve the respective purposes or as required by legal retention periods.

App master data: until account deletion + 6 months.
Health and usage data in the App: until account deletion.
Website server log files: typically a maximum of 7 days.

3. Rights of Data Subjects

You have the right to information (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and the right to withdraw consent at any time (Art. 7).

4. Withdrawal and Deletion

The user can delete their App account at any time within the App. All personal data will then be irrevocably deleted, unless legal retention periods apply. Consent (e.g., for cookies or newsletter) can be revoked at any time for the future.

5. Changes to this Privacy Policy

We reserve the right to adapt this policy. The current version can always be found on our website. Significant changes will be announced via email.

6. Contact for Privacy Questions

For questions about data protection, please contact us at info@athlory.de.

7. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.