GUIDEFIT ("we", "us") operates the website guidefit.nl and the GUIDEFIT mobile applications for Android and iOS — fitness guides and workout platforms. This policy explains what personal data we collect, why, and what your rights are under the General Data Protection Regulation (GDPR).
For privacy enquiries: info@guidefit.nl
2. What data we collect
Data you provide directly
<b>Account:</b> email address and a bcrypt-hashed password (we never store passwords in plain text).
<b>Workout data:</b> muscle groups trained, exercise sets, duration, calories, and notes you add.
<b>Body metrics:</b> body weight, resting heart rate, and maximum heart rate.
<b>Preferences:</b> favourite exercises and program progress.
Data collected automatically
<b>IP address:</b> used once to detect your preferred language based on your country/region (via the ip-api.com service, website only), then cached in your browser session. We do not store your IP address in our database.
<b>Session token (website):</b> a 256-bit random token stored in your browser's localStorage and sent via the Authorization header. It expires after 30 days and is revoked on logout.
<b>Session token (mobile app):</b> a 256-bit random token stored in your device's secure storage (Android Keystore or iOS Keychain) and sent via the Authorization header. It expires after 30 days and is revoked on logout.
<b>Offline cache (mobile app):</b> the app caches your workout history, body metrics, and favourites in your device's app-private storage so the app works offline. This data is cleared when you uninstall the app or delete your account.
3. Lawful basis for processing
We process your personal data on the following lawful bases under Article 6 of the GDPR:
<b>Consent (Art. 6(1)(a))</b> — when you create an account and voluntarily provide your data.
<b>Contract (Art. 6(1)(b))</b> — to provide the fitness tracking service you requested.
<b>Legitimate interest (Art. 6(1)(f))</b> — language detection and security (rate limiting).
<b>Consent (Art. 6(1)(a))</b> — for advertising cookies from Google AdSense, which keep GUIDEFIT free to use. You can withdraw this consent at any time in our cookie banner or in the app's Account panel ("Advertising" toggle).
4. How we use your data
To create and manage your account
To store your workout logs, body metrics, and program progress
To display your dashboard statistics and history
To detect your preferred language based on your location
To protect the service from abuse (rate limiting)
5. Data sharing
We do <b>not</b> sell, rent, or trade your personal data. We share data with the following third-party processors:
ip-api.com
Used once per visitor to detect country/region for language selection. Your IP address is sent to ip-api.com in a single HTTP request. The result (country code + region) is cached in your PHP session. ip-api.com has its own privacy policy at ip-api.com.
Google LLC (Google AdSense)
We use Google AdSense to display advertising, which keeps GUIDEFIT free to use. AdSense is operated by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). When you consent to advertising cookies, Google may set cookies and collect data including your IP address, browser type, device information, and the pages you visit, for the purpose of selecting and delivering relevant ads and measuring their performance.
Google transfers data to the United States under its Standard Contractual Clauses. You can manage your ad personalization settings and opt out of personalized ads at <a href="https://www.google.com/settings/ads" target="_blank" rel="noopener">google.com/settings/ads</a>. See <a href="https://policies.google.com/privacy" target="_blank" rel="noopener">Google's Privacy Policy</a> and <a href="https://policies.google.com/technologies/ads" target="_blank" rel="noopener">How Google uses information from sites that use its ads services</a>.
6. Mobile app third-party components
The GUIDEFIT mobile app (Android and iOS) includes the following third-party components that may contact external servers:
<b>Google Fonts</b> — the app loads the Poppins font from Google's servers (fonts.googleapis.com). Your IP address is sent to Google when the font is first loaded; no other personal data is transmitted. See <a href="https://policies.google.com/privacy" target="_blank" rel="noopener">Google's Privacy Policy</a>.
All other app components (HTTP networking, charts, SVG rendering, audio playback, state management, local storage) run entirely on your device and do not transmit data to third parties.
7. Data retention
<b>Account data:</b> retained until you request deletion.
<b>Session tokens:</b> expire automatically after 30 days; revoked immediately on logout.
<b>Workout/metric data:</b> retained as long as your account exists.
8. Your rights
Under the GDPR, you have the following rights regarding your personal data:
<b>Access</b> — request a copy of your data.
<b>Rectification</b> — correct inaccurate or incomplete data.
<b>Erasure</b> — request deletion of your account and all associated data.
<b>Restriction</b> — limit how we process your data.
<b>Data portability</b> — receive your data in a machine-readable format.
<b>Objection</b> — object to processing based on legitimate interest.
<b>Withdraw consent</b> — at any time, without affecting prior processing.
You can exercise these rights directly in the app:
<b>Export your data</b> — Account → Export my data (downloads a JSON file with all your records).
<b>Delete your account</b> — In the app: Account → Delete account (permanently removes all your data). Or request deletion at <a href="https://guidefit.nl/delete-account.php">guidefit.nl/delete-account</a>.
For access, rectification, or other requests, email info@guidefit.nl. We will respond within 30 days.
9. Data security
Passwords are hashed with bcrypt (never stored in plain text)
Session tokens are 256-bit cryptographically random
All traffic is encrypted via HTTPS (TLS)
Database credentials are stored separately from the codebase
Auth endpoints are rate-limited to prevent brute-force attacks
10. Cookies and local storage
GUIDEFIT uses essential cookies/local storage for the service to function. With your consent (given via our cookie banner), we also use advertising cookies from Google AdSense to keep GUIDEFIT free to use. If you decline, only essential storage is used and no advertising cookies are set.
Essential (always on)
<b>PHPSESSID</b> — a session cookie (essential) that remembers your language preference. Deleted when you close your browser.
<b>localStorage</b> — stores your user ID, session token, and email so you stay logged in. Cleared on logout. You can also clear it via your browser settings.
Advertising (with your consent — Google AdSense)
When you accept advertising cookies, the following cookies may be set by Google:
<b>__gads</b> — ad delivery and measurement. ~13 months. Set by Google on its ad-serving domains.
<b>__gpi</b> — ad personalization. ~13 months. Set by Google on its ad-serving domains.
<b>IDE</b> — ad targeting and measurement. ~2 years. Domain: .doubleclick.net (Google).
<b>NID</b> — ad preferences. ~6 months. Domain: .google.com.
Google may use additional cookies from time to time; the full and current list is available in <a href="https://policies.google.com/technologies/types" target="_blank" rel="noopener">Google's cookie documentation</a>. You can withdraw your consent at any time via the cookie banner or the in-app Account panel toggle.
11. Your right to complain
If you believe we have mishandled your data, you have the right to lodge a complaint with your local data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
12. Changes to this policy
We may update this policy as the service evolves. The "last updated" date at the top will always reflect the most recent version.